Forum - View topic

How ANN Was Hacked

I'm not very well-informed about these things, so this may sound like a dumb question, but what would a hacker gain by stealing domains, especially for a relatively small and obscure operation like ANN? It seems particularly odd to me since they didn't steal user information, though I guess that could be because they were headed off quickly enough by ANN's recovery efforts.

Will you expose the hacker?

farix wrote:

This is one of the things that annoy me with 2-factor authentication.

People always get angry with me for pointing this out, but 2FA is pointless anyway. A strong password is just as effective at discouraging or stopping the same kind of random or scripted attacks that it does, but neither one can prevent a targeted attack from succeeding. Regardless of method, there's always a procedure to keep the rightful owner from getting permanently locked out of their account, which can always be exploited by someone else.

Over the last 12 or so years I've been visiting this site, since beginning High School basically. I can't understand why ANN is repeatedly hacked every few years.

Is it disgruntled fans not liking opinions on topics?

I hope the CSR person didn't lose their job, at the very least they can now be at the forefront of explaining what not to do. Social Engineering is now realer then it was even 5 years ago.

Well, I hope it's a quick recovery. Anime needs all the backup it can get in todays world of competing streaming services and the plight of animators and voice actors making it in the world.

On ANN's side, we're moving all our domain registrations to more secure domain registrars. Once we get AnimeNewsNetwork.com back, it will go to an extremely secure (and expensive) registrar that will not make domain changes without offline confirmation.

Quote:

Cell phones aren't perfect 2-Factor security.

This is one of the things that annoy me with 2-factor authentication. Many websites require a cellphone for 2-factor authentication to work. However, I live in an area were cellphone coverage is extremely spotty if not non-existent once you go outside of town (I live 4 miles outside the nearest town). Thus, 2-factor authentication that requires a cellphone is completely useless to me.

Tightening security at that level will lead to customers complaining about CSR being too difficult or uncooperative more than customers praising the extra security.

It's inconvenient for consumers but it does make this kind of social engineering much more difficult than in the US... I suspect that eventually the government will step in and add in some more safeguards to this kind of thing.

luffypirate85 wrote:

Will you expose the hacker?

I don't know who it is, but they left a lot of breadcrumbs. It'll be up to the police to decide if this is even worth investigating, and if any of the breadcrumbs that we've turned over actually lead to someone.

-t