Incident Report for 6/7/2024

@Anonymous #690B
You’ll have to do a password reset as specified in the announcement header to log in again.

@Softy
My old password had less than 12 as well. It’s for convenience.

is Gmail not allowing PB’s emails through? because I’ve tried 4 times so far and haven’t received an Email to get Access back to my account.

Trying multiple times like this doesn’t work, if you don’t get the first or second ones hang it up for a while and try again in a bit, daily limits on emails are a thing. PB has quite a lot of users that use the site but never comment etc, I did not anticipate such a high volume for sure.

@ZizzyDizzyMC
you can ignore that, I had just gotten an email a few minutes after posting that, and it was 4 times over several hours between yesterday an just now.

using an icloud email here, it got sent to spam but i did receive the password reset email immediately

i sent a reply for a password, and it did fixed the issue on my end

For users submitting email change requests via our ops email, please email ops using your hotmail account, this should work. If you have done this, bug me here and I’ll see why I’m not getting it.

If inbound hotmail is also not working, I’ll set up a temporary mail I can be reached at for remediation purposes.

Sorry about that.

I have been waiting for hours for my email to drop a notification from this site. My login details are the same, but I still cannot log in.

@Anonymous #C421
This isn’t helpful to actually figuring out the problem.
Are you using hotmail? Did you email Ops? Did you re-try sending yourself a password reset link? “My login details are the same” What do you mean? Did you already do a password reset? Did you not read the instructions to do a password reset?
I’m very confused here, lots of questions and 0 answers to be had from that.

@ZizzyDizzyMC
Where do I find the ops address to email with?

On the Contact page.

@ZizzyDizzyMC
I’m waiting for a reset link. I checked the spam folder, I check the main folder, and I get nothing on the email I have assigned to the account. Worst off, it’s a yahoo email.

@Anonymous #C421
Try again? I haven’t seen anyone’s yahoo mail come back with a rejection (yet)

Oh wow. Finally got to reset my password.
Thanks for the warning, by the way.

Is there any evidence that malignant actor didn’t just download the whole DB and is about to reveal nicknames of all Anonymous posters?

Weird, I just reset my password (having an outlook email) and the email just went through fine. Note this was on Saturday though.

Go my password reset.

It was stated that there was no evidence of content taken from the servers.

Also, I feel like that would be pointless to do as it wouldn’t mean anything if anons suddenly have their name exposed. (mods can already see who you are in the first place so it doesn’t matter at all)

@Anonymous #07D9
It is highly likely from my investigation that it was an automated script that took control using the absurdly open hole left behind by cloud-init - such scripts usually only add a machine to a botnet to brute force other machines, send spam, and act as proxies, they can do other things but it’s unlikely. The amount of work and effort that’d need to be put in is absurd, and there’s no evidence I could find for abnormally high outbound traffic beyond PB’s baselines which would indicate exfiltration.

Intermittent ‘500’ errors when browsing posts/comments/faves in user profile.

@Anonymous #07D9
I noticed this too.

@Anonymous #07D9
I might need to re-index again at a later point, but I’m not sure why this error is happening.

These errors started cropping up before the incident, I suspect it’s the dying hardware having a bad day.

Also I got word from Microsoft that they’re implementing a workaround for the hotmail blocks, they said give it 24-48h to propagate, but I’m not going to hold my breath on it.

If this doesn’t work, I’ve got a backup gmail account I’ll post here to let users with hotmail addresses requests a change. Turns out hotmail isn’t able to send to our ops address either! I need to ensure the mail comes from the hotmail account itself. so I’ve not changed anyone’s emails who sent me an email with their new address. I MUST get an email from your old address to confirm it’s you.

Too lazy to reset. I think I will just stop using the site here.