Posted on 13 July 2017 - 02:52 PM
I'll start off by this was just a simple mistake that was overlooked by us, and no data was stolen nor was anything accounts compromised.—–
About 30 minutes ago, some of our internal security monitoring systems (including ArchyAI to the volunteer staff), notified us of a potential compromise of the Badlion systems. The full security team of Badlion and a few ESL/TEO employees immediately (within seconds) were dispatched and the problem was identified within a minute. Since the issue was able to be contained to a small breach due to our security systems, we did not have to shut down the whole network and just the NA UHC servers.
We recently upgraded our UHC boxes and during the setup, we mis-configured our firewall rules which would allow players to spoof as any account. This firewall mess up also allowed them to bypass our server sided two factor authentication, which allowed them to do nothing more but change ranks, chat, and issue bans/mute punishments (not even IP bans were doable).
They had no database access, no access to personal information, no website access, and no access to anything besides the above three things.
We literally have a button that can undo bans and other commands in the case of hacked staff accounts, but by the time we had locked down the UHC boxes the network staff had already cleaned up all the bans for us as they were also on top of the situation due to ArchyAI notifying them.
The issue has been fixed within minutes but sadly we had to cancel the UHCs that were running on the boxes to guarantee that all connections were killed. We also are going to be implementing more redundancy into the security systems to prevent even mess ups within the firewalls and other security flaws.
~Archy
Posted on 13 July 2017 - 03:20 PM
okPosted on 13 July 2017 - 03:25 PM
Automatically DeletedPosted on 13 July 2017 - 03:46 PM
Badlion on top of their shitPosted on 13 July 2017 - 04:06 PM
baritonesax wrote
Posted on 13 July 2017 - 04:19 PM
grEATPosted on 13 July 2017 - 04:28 PM
Glad to hear it's fixed.Posted on 13 July 2017 - 04:43 PM
thats why all the discord channels were updatedPosted on 13 July 2017 - 04:53 PM
niCEPosted on 13 July 2017 - 05:39 PM
they way you guys handled it makes MineHQ look like a bunch of rookiesPosted on 13 July 2017 - 06:51 PM
I know who breached youPosted on 13 July 2017 - 08:08 PM
Automatically DeletedLast edited on 13 July 2017 - 08:13 PM by Genocado
EhhThing wrote
Azl0 wrote...
Who?
Posted on 13 July 2017 - 08:17 PM
And found another oneLast edited on 13 July 2017 - 10:55 PM by GlueEater22
.Posted on 14 July 2017 - 03:24 AM
SporkHandles wrote
Posted on 14 July 2017 - 10:46 PM
Thanks Archy and Dev TeamPosted on 14 July 2017 - 11:11 PM
SporkHandles wrote
Posted on 15 July 2017 - 12:02 AM
Vykz wrote
SporkHandles wrote...
unprofessional
Posted on 15 July 2017 - 01:49 AM
Vykz wrote
SporkHandles wrote...
you're toxic :(