The user(s) [singular person] that posted the offending content was
NIXDORF & Kevin Mitnick. These user(s) now have a flag banning them
from local and IBBS one-liners - I've sent Avon an email discussing an fsxNet ban if warranted.
A user @ 2oFB utilized weak settings (s20g2) on FSX_DAT. They were able to post and send out vulgar and racist IBBS one-liners. Not only did they post inappropriate one-liners, but they posted 'as' Avon, Smooth, jACK pHLASH and other leaders of the BBS community.
What do you mean when you say they utilized weak settings? What
settings can a BBS user configure that would be 'weak' in this instance? And what is s20g2?
What do you mean when you say they utilized weak settings? What
settings can a BBS user configure that would be 'weak' in this instance?
And what is s20g2?
s20g2 is a security setting for users. A new user would generally be set to s10. A "validated" user is typically bumped up to something higher. The sysop is typically s255. Btw, g2 is the "group" setting with the echo areas (fidonet, fsxNet, etc.) defined as their own group. These are defined by the sysop while setting up the bbs.
s20g2 is a security setting for users. A new user would generally be
to s10. A "validated" user is typically bumped up to something higher
The sysop is typically s255. Btw, g2 is the "group" setting with the
areas (fidonet, fsxNet, etc.) defined as their own group. These are defined by the sysop while setting up the bbs.
Is that something in Mystic? (I use Synchronet, so I'm not very
familiar with Mystic)
A user @ 2oFB utilized weak settings (s20g2) on FSX_DAT. They were ab post and send out vulgar and racist IBBS one-liners. Not only did the post inappropriate one-liners, but they posted 'as' Avon, Smooth, jAC pHLASH and other leaders of the BBS community.
What do you mean when you say they utilized weak settings? What
settings can a BBS user configure that would be 'weak' in this instance? And what is s20g2?
A user on any BBS could create an account with any username, so they
could potentially create an account with the same name as someone else.
I don't think that has anything to do with any settings on the user's
side that could be considered 'weak' or 'strong'..
The user(s) [singular person] that posted the offending content was NIXDORF & Kevin Mitnick. These user(s) now have a flag banning them from local and IBBS one-liners - I've sent Avon an email discussing an fsxNet ban if warranted.
Isn't Kevin Mitnick some famous OG hacker or something? I bet the user isn't actually him but someone cosplaying as him.
Is that something in Mystic? (I use Synchronet, so I'm not very
familiar with Mystic)
What do you mean when you say they utilized weak settings? What
settings can a BBS user configure that would be 'weak' in this
instance? And what is s20g2?
A user on any BBS could create an account with any username, so they
could potentially create an account with the same name as someone else.
The user(s) [singular person] that posted the offending content was NIXDORF Kevin Mitnick. These user(s) now have a flag banning them from local and IBB one-liners - I've sent Avon an email discussing an fsxNet ban if warranted.
The correct settings should have been:
list :s255
read :s255
post :
sysop :s255
Glad to hear you managed to track down the reason and the users causing the trouble!
Not sure if an empty ACS code will prevent posting, though, but % should definitely do so (it should always translate to "false"). I know I have used it for some areas which should never allow for "manual" posting.
Also, congrats on the 50,000 callers -- that's quite an achievement! :)+1 as well!
Never heard of them.
This does beg the question -- why would someone go to all that trouble? :(
Maybe the oneliners needs to be strengthened a bit to validate the from field with who the message is actually from? I don't know who wrote the original mystic mod (i think it might have been gryphon?), but I think it would be fairly easy to do and maintain backward compatability.
The user(s) [singular person] that posted the offending content was NIX Kevin Mitnick. These user(s) now have a flag banning them from local an one-liners - I've sent Avon an email discussing an fsxNet ban if warran
Never heard of them.
This does beg the question -- why would someone go to all that trouble?
Not sure if an empty ACS code will prevent posting, though, but % sho definitely do so (it should always translate to "false"). I know I ha used it for some areas which should never allow for "manual" posting.
I just put s255 in to only let me post. I won't but that definitely
stops anyone else.
IBBS one-liners could be better by not using clear text; but none of that matters if BBSes use proper security - that 2oFB was NOT doing - so I'd mentioned updating the fsxNet infopack [Unless it already discusses this an simply DIDN'T implement security correctly...] so that new sysOps made sure secure their BBSes so these instances never happened...
I just put s255 in to only let me post. I won't but that definitely stops anyone else.
If an s255 for post on FSX_DAT, will the IBBS oneliners .mps be able to post in that base???
pAULIE42oIs the .mps run as an event or by the sysop? If the sysop, then their
I don't know why this base is a base anyways. Doesn't Mystic have an option for it's mail to make still process mail without creating a base?
With GEcho, I can create the data I would need, and Renegade would NEVER knew it existed. The beauty of using Fido software as it was intended, and not how someone half assed it into a bbs software. :(
NOT Calling you out just asking if you can do that or not in mystic
This does beg the question -- why would someone go to all that trouble?
I don't know why this base is a base anyways. Doesn't Mystic have an option for it's mail to make still process mail without creating a ba
With GEcho, I can create the data I would need, and Renegade would NEV knew it existed. The beauty of using Fido software as it was intende and not how someone half assed it into a bbs software. :(
NOT Calling you out just asking if you can do that or not in mystic
Of course, RG is better than Mystic everyday of the week.... Sir Exodus. :P
The IBBS Last Callers mod, by xqtr, uses much better obfuscation - I
think base64, knowing xqtr... but not sure.
At any rate, I'm just some nerd trying - and with the traffic I've been gifted, some bad actors will always find the flaws. :/
This does beg the question -- why would someone go to all that trouble?
People are morons.
Hi guys. Mitnick here.
This does beg the question -- why would someone go to all that troubl
For fun! What else could it be?
You got a free security audit. How great. It's not my fault that this
flaw existed. And there was no racist message - not sure where that came from. I'm kind of worried that few people know about Mitnick here!
With GEcho, I can create the data I would need, and Renegade would NEVER knew it existed. The beauty of using Fido software as it was intended, and not how someone half assed it into a bbs software. :(
At any rate, I'm just some nerd trying - and with the traffic I've been gifted, some bad actors will always find the flaws. :/
:) I wasn't offended or anything, and glad you worked out a solution :) but yeah, people will always mess with things. In this case I think it
was just someone being silly, although I can see how some people might find the impersonation part a bit bad taste, but I don't think their intention was nasty - so in some ways, lucky it happened this way and not someone really trying to impersonate people.
With GEcho, I can create the data I would need, and Renegade would NEV knew it existed. The beauty of using Fido software as it was intende and not how someone half assed it into a bbs software. :(
dude you post stuff like this and then complain about MRO?
'Kevin Mitnick', and their IP 162.210.192.209, is now published as I told them
I would - so that other sysOps can act on it if they choose. Its now banned from 2oFB, but I'm sure they're intelligent enough to get around that... right??? LOL. Prolly not.
| Sysop: | Tetrazocine |
|---|---|
| Location: | Melbourne, VIC, Australia |
| Users: | 16 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 202:51:26 |
| Calls: | 178 |
| Files: | 21,502 |
| Messages: | 81,327 |