Forum - View topic

Update: What's Going On with Anime News Network?

CatSword wrote:

I'm curious as to how exactly a hacker completely stole control of the domain though, to the point of having his information replaced in the WHOIS. I didn't know you could just steal someone's URL like that.

It's sadly easier than one would think, if one isn't careful.

Let's say there's an admin or superuser of a company or website. Let's also say this person is also a user of one of the many other sites that recently suffered a data breach. (And, in fact, according to haveibeenpwned.com, there are indeed @AnimeNewsNetwork.com email address holders whose info has been compromised through no fault of their own.)

Let's also say that one of those admins may have the bad habit of re-using a single password at multiple sites, and has not changed it in a long time. All a hacker has to do (and it doesn't even need to be a GOOD hacker) is to snoop around for one of the publicly released breaches and see if any of the passwords are still any good -- and voila, he's in.

Once they got in, they apparently found enough information to be able to log into the domain registrar and initiate a transfer, and/or to intercept the registrar transfer emails. That's plausible because some companies share an "in-case-of-emergency" list that contains important passwords (such as twitter logins, site host logins, registrar logins, secondary email accounts, and other credentials), which is shared with important company individuals. Dunno if ANN does this, but I've previously worked with companies who do.

Anyway... again, not saying that what I described above is what actually happened, but that's one of many ways (and often the most common way) that things like this happen.

Moral of the story: Change your passwords often, use two-factor authentication, and don't use re-use the same password everywhere.

The forums (and much of the site) here are heavily modified and customized to meet ANN's needs, upgrading to a new version would be a rather large undertaking.

Emerje

I want to know, who is ANN Owner? I need to contact ANN Owner about software and server issue. I'm assistant of security server and software in vBulletin and XenForo security file.

I have a feeling that it is because of @Anime. Similar to what what happened with @n, I'm sure the @Anime handle is something that is a prized name.

Chris Macdonald mentioned on his Twitter before that someone tried to brute force @Anime in 2015.

Samet Chan wrote:

I want to know, who is ANN Owner? I need to contact ANN Owner about software and server issue. I'm assistant of security server and software in vBulletin and XenForo security file.

Tempest may be the guy you'd want to talk to...?

Did you get the 4nn.cx URL shortener/redirect back already?

Nothing was said about the integrity of the forum DB, something I'd like to know. Knowing the type of attack and the exploit used (unless it was a keylogger) would be useful too - and yes, for these things transparency is essential.

More interestingly, our avatars all have '4NN' watermarks now.

ximpalullaorg wrote:

Nothing was said about the integrity of the forum DB, something I'd like to know. Knowing the type of attack and the exploit used (unless it was a keylogger) would be useful too - and yes, for these things transparency is essential.

This is a good point and I just updated the main article with this:

Further, AnimeNewsNetwork's domain was breached, but not our servers - your personal information is safe, however we always recommend changing passwords just in case.

BTW, I just visited the main website and it seems to have changed with the only text Anime and a ticking clock. Also, there are clouds floating in the background. Is this done by the main team?