Thread Count

[SteveColes]

Ok, I need some help getting to the bottom of this. BUT, I don't want this to turn into a witch hunt. There has NOT been a hack of our system.

But I do need some info from you to help me. So besides providing the info I need, lease keep all specualtion about how it was done to yourself. Don't PM me with your suspiciaons or anyone else. This was a good intentioned joke with at worst a bit of a lapse of judgement.

However, I want to be able to reassure our memebership and ourselves that the issue is understood and we are secure.

If it turns out that it is one of us, there will be no repercussion, no removal from their position, and most important, I will keep the identity to myself.

I do hope that the person will contact me and save me a lot of work. :eusa_pray:eusa_pray:help::help:
Part of what I have to do is go through the server logs. In particular, the SQL access logs. even with control panel access, you guys can't to them. I have to get to them via ssh as the root user of the machine.

To help me limit my search, I need to narrow the timing.

What was the earliest that anyone saw the change?
Who and when did someone try to figure what happened?
Who and when did someone try to fix it?

We'll discuss the CORRECT way to have fixed it later:rotflm::rotflm:

 

[ChrisMathes]

It's funny (maybe not haha funny now that I see the end result ) but I was planning on doing something very similar on April 1.

Anyhow, I guess looking through the sql logs might only tell you what was done...not 'necessarily' who. I expect there are 'hints' that could lead you to the answer, but it's not necessarily specific. Perhaps, you should consider dividing up UIDs to the cpanel app? I'm happy that you are taking it well as a joke as I have no doubt it was intended that way. My only concern is if it came from outside the people whom you have given the permissions to. Then it was still a joke, but should have us fixing something in the software.

So, out of this, I am hoping that I learn two things. One, I would like to learn how it was done to make sure it is not something that could be used maliciously by a non-member. Two, what the 'fix' was...or, more importantly, how the 'fix' adjusted the post count.

Please let me know if you need help looking through the logs or whatever...my time is starting to free up again from work :eusa_danc:eusa_clap

Oh..also...I didn't notice anything until it was over...wish I could offer more...

Regards,
Chris

 

[SteveColes]

Anyhow, I guess looking through the sql logs might only tell you what was done...not 'necessarily' who. I expect there are 'hints' that could lead you to the answer, but it's not necessarily specific.

Actually, there are more than hints there. I will find out what happened. How? Well for now that's my secret:gar-La;:tongue2:

 

[sapwood]

Sorry, I can only wish you luck
It happened while I was offline. Malicious or not, clearly poor judgment was used. :wmad:

Roger

 

[NZAPP1]

Steve
I can lend no insight to this by the time I saw the post it had been corrected.

 

[McRabbet]

Ok, I need some help getting to the bottom of this. BUT, I don't want this to turn into a witch hunt. There has NOT been a hack of our system.
<snip>
To help me limit my search, I need to narrow the timing.

What was the earliest that anyone saw the change?
JimmyC posted his thread at 9:49 PM on 2/16
Who and when did someone try to figure what happened?
DaveO posted at 10:18 PM, noting the big number and his suspicion.
I posted at 8:47 AM the next morning and said I had lost post count (I knew because I had passed a memorable 3,333.)
Who and when did someone try to fix it?
DaveO said he fixed it here.

We'll discuss the CORRECT way to have fixed it later:rotflm::rotflm:

I think there are some strong clues in the first thread, but I won't speculate. :wconfused:

 

[Ray Martin]

Steve,

Wish I could be more help but I missed the whole thing. My access on weekends is limited since I build all day on Saturday and am in church Sunday mornings. If there is something I can do, please let me know

Ray

 

[DaveO]

All I can add to the time-line already posted by Rob, is that I did my "fix" fairly late that evening probably around 11:30 pm. In hindsight, I wish I had not done anything, or had done it differently. I feel bad that I affected everybody's post count...and you know how important that is :roll: (I lost around 400 posts and was cruising in on the big 10K mark in a few weeks :eusa_doh

Dave

 

[clowman]

Well. It wasn't me.

 

[cskipper]

I didn't see it until I saw the thread. Ya'll know that after my major oops long ago that i do not mess with any of those kind of areas of the site. I don't think I posted my annoyance post until the next day - but it may have been later on the day I saw the post. I think it had been fixed by then.

 

[Jon]

I didn't do anything

 

[Monty]

hmmm... this should be interesting... when you find out what happened, please let us know.

 

[MikeH]

I saw the thread shortly after it was started, but that's all I know.