Urstinkenface...taking it to a new level.

[DáinIronfoot]

Got this PM from Kralik today:

Someone has tried to reset my password, anyway of dealing with it?

The following IP was sent with the email IP: XX.XXX.XXX.XX

It looks like it was urstinkenface. I'm BCC'ing this to Dain to see if he wants to extend the ban or take other appropriate measures.

Looking back through some of the forum logs, it looks like it was indeed urstinkenface trying to crack into TheJord's account. It also appears he attempted the same with josiah_of_rohan, Fingolfinfinwe, Zharak, SoP, BtO, FM, me, and possibly others (hard to tell with some other folks whether they were legitimate forgetfulness with passwords or not, since I can't pinpoint ALL the IP addresses USF has used so far). Especially since several of those are moderator or administrator accounts, this is obviously a big deal.

But I'm in a bit of a bind as to what to do about it. I can't DIFINITIVELY prove it was him, but I'm 99% sure. To me, that would be something that would earn a lifetime ban, but since I didn't expect something like this (at least this early in TLHH's life), I haven't really gotten around to writing down my thoughts on ban-able offenses and how LONG those bans should last.

So, what do you all think, my fellow moderators (and fellow administrator)? What should we do about this?

Also, SoP: do you share an IP with USF? It looks like the two of you might share similiar IPs (at least sometimes), and if so, that might make some things a little problematic in this....

[Kralik]

Poor SoP, banned... hmm. Better look into that.

For now, I've gone ahead and changed USF's ban to a Full ban. That should keep him off the forums period (no read access). It is still set to expire in 4 days. Thoughts?

[DáinIronfoot]

My concern is that sickofpalantirs is inadvertantly affected. However, SoP has been on and posting since USF got banned, so I guess you have a way around that, SoP?

I think making it a full ban, though, is a good idea, at least until the original deadline is up. I'm just trying to figure out what to do after that...?

[Kralik]

Well, I just sent SoP an email just in case... it shows in Admin that he is banned. However, it looks like all of his posts were made by a different IP address. I wonder if perhaps USF didn't get lucky and get in somehow via SoP's account...

Dain, did you notice that that specific IP address was attempting to login almost every minute?

[DáinIronfoot]

Yes, I was just noticing that as I inventigate this further. That sounds more like SoP to me than USF.

I KNOW there were other IPs USF had tried to use with his short-lived "ihateu" and "yourstinkinface" accounts...did you delete the latter of those?

Anyway, I also sent SoP an e-mail. If it turns out he is, indeed, banned, then I suggest removing the ban on just that one IP address (and leave the ban on the other we have on record). If USF tries to get in with any other IP, we'll add a ban on that one and slowly draw the noose. If, as I suspect, he does indeed have access to the same IP as SoP (I don't think he successfully hacked in, personally, or we would have seen some other evidence of it by now), then that will leave him one little hole he could try to exploit, I suppose. But believe me, I'll rail on him any time he goes and make sure nothing comes easy. If it comes down to battle of wills, I WILL win out and wear him down, not the other way around.

Again, let's wait and see what poor SoP says, then go from there.

[Kralik]

I consolidated all of the info we had on USF into a single ban... that way it will be easier to manage multiple usernames, IPs, etc.

[DáinIronfoot]

No problem, it's just that I could have sworn that he had at least three different IPs with the "yourstinkenface" account. Maybe I'm just nuts.

[SomeRandomDude]

Banning is not the option I think. If he does have the expertise to hack, as he has hinted at, banning him could cause some big problem.

I would just say that moderating him heavily would be the solution. He's insulting, but I mean, deal with it.

Let his ban expire, see what he does, and wield a big stick. If necessary, I suppose a temporary ban to show you mean business, but mainly, if its small, let it slide until he gets bored here like he did at the old CC and leaves.

[menace64]

I agree with NBarden. I'm no expert on IP addresses or hacking or anything related to what's going on here, but it doesn't sound as if he ever actually crossed any 'illegal' lines. Perhaps we should post some public thread saying that an 'anonymous' poster tried hacking other accounts but was caught in the act, and that all other posters should beware and report any happenings immediately.

[SomeRandomDude]

And since the average forum user thinks 2 + 2 = 5...

Everyone's gonna know who the "anonymous" user is. So I don't think an announcement of that sort, although maybe note that CC was being hacked and ask for suspicious reports, just as a precaution, you know, can't be too careful . Nope. Nothing's up. At all. *gulp*

[sickofpalantirs]

ok yeah he obviously hacked into my account...I changed my password and I am back on.

yesterday PP told me he was looking up stuff on a legal hacking website. He means no harm, he just wants to have his fun. I would recommend unbanning him immediately, then he will lose his fire...after that he will post some stuff he found (none of it vulgar, unless FM's GF, himself and his class schedule as well as his ambitions in life are vulgar ) he is just having his fun...and he knows I will kill him if he tries to do anything bad. 


and I didn't get banned, my password just got changed. Also we have different IPS, unless he found a way to change his 

[Kralik]

Here's what probably happened, SoP:

USF (or PP?) somehow got into your account and it set your most recent IP as his. So in the admin panel, it showed that you were affected by the same ban. However, since you can apparently log in, it must not affect the real you because you are not using said banned IP. I think that makes sense.

EDIT: The admin panel no longer shows you as sharing the same IP with USF.

[DáinIronfoot]

Guys, I don't think we can just let bygones be bygones, blow this off as someone "just having some fun", and call it a day. I've gotten a couple PMs recently on this, and it looks like others than just the ones I listed yesterday have been hit. An example:

I'm writing to you because I've received 15 e-mails from TLHH, all of which read the same:

"Dear _______,

This mail was sent because the 'forgot password' function has been applied to your account. To set a new password click the following link:

http://lotrtcgwiki.com/forums/index.php?action=reminder;sa=setpassword;u=3;code=8ba26ecbbb

IP: XXX.XXX.XXX.XXX

Username: _______

Regards,
The The Last Homely House Team."

I have not forgotten my password, nor have I tried to retrieve it, never ever tried to retrieve it. Could someone be playing silly buggers with my account? I wonder if someone was trying to break in and perhaps mess things up for me. If so, then I have a good idea who it is (and you probably do too). If this is the case, then I'm glad that I think up good passwords!

It may just be a system glitch.  If it is, then I apologise for thinking the worst of another person.

This is just a "regular" member's account, yes. But he's already gotten into SoP's account (a moderator account). Imagine if he got into a global moderator account. Or an ADMIN account. That doesn't scare you a little bit? He could delete entire boards, or the entire forum!

Guys, are you seriously suggesting that this is someone you want in our community? Someone that we KNOW has been trying to break into other peoples' accounts? Do you really want users who already KNOW this is happening (to THEIR accounts!) and KNOW who's causing it to see us just blow it off and welcome USF back with a little week-long ban and a slap on the wrist? Is that REALLY the message we want to send?

I, for one, do not. I recommend we let the ban expire, yes, but that I send a message to USF making it very clear that if he even THINKS about trying to crack into someone's account again, he's history. And if he comes back and acts like a jerk again, he's also going to be put right back on the ban list (though not for all eternity, I don't think).

EDIT by Kralik: IP details removed.

[SomeRandomDude]

He will only try to break into an account if he's banned. He's a bigger threat if you ban him than if yoiu don't.

It'll die off soon enough.

[Kralik]

I think using other people's accounts for any reason is a serious matter. However, I don't know if USF has any serious hacking skills per se... SoP's account had a simple security question and it may have been that he simply guessed the answer and got in.

If someone with IM would be willing to test this, I'm under the impression that a full ban would restrict a user from the forums in their entirety. No indexes, no login screen, no __________________. It seems like that would prevent any further attempts to login under someone else's name, use the "forgot my password" dialog, etc. If you have a chance and want to be banned for 5 minutes or so, PM me your IM info and we can check.

EDIT: On second thought, it may have had nothing to do with the security question. The hundred or so login attempts from that IP may have all been attempts to guess SoP's password until it was successful. In any case, I think a Full ban (which he is on now) prevents all board access. Subject to testing, of course.