An old system and a SWAT team

"Not so coincidentally, an old personal server had a database accessed using old forum credentials obtained from the incident last year."

That either means that the attacker used the data on the compromised server to SWAT them, OR that the SWAT team used their physical access to access the server. Anything else would make the SWAT visit and the server compromise a coincidence, and they make it clear that it is not.

....I'm very confused.

Edit: Or the attacker used the SWAT visit to prevent Linode from stopping the server compromise? I guess that makes some sense, although it seems like an awfully large precaution to take for a phpbb forum. I know of attacks on financial networks and banks where one attack (ie, DDoS on public website) was used to distract from the "real" attack on the money wire system or whatever. But to SWAT someone to distract from compromising a FORUM? Doesn't add up to me; the forum hack is basically just a prank, but the SWAT team visit is hugely more serious.

Yeah, it sounds like someone was aware of an old copy (2010-03-03) of a database backup sitting on some "personal" server?

Was it the https://forum.linode.com forum? It looks like it does run on PHPBB...

In theory, it sounds like the goal of the SWAT was to clear the building of employees, and break into the target server, while no one would be sitting at an office workstation, and thus rendered incapable of disrupting the attack. It sounds like all that effort actually worked.

So then, after everyone returned to the office, staff discovered the intrusion, and they performed a password reset for anyone who hasn't changed their forum password since 2010.

But! Were the forum credentials valuable? Do people do things like mine bitcoins with their hosting? Is the PHPBB MySQL database isolated from all other user credentials, or is there overlap?

Indeed, it was a clever trick.

But in no way was the attack "serious", just for the lols, I know the attacker and swatting is just another way to get lols.

Me too. The picture looks like a publicity shot for a SWAT based sitcom. I mean, it doesn't 'arf bolster the fat american stereotype.

You've reminded me of a funny quote from Immediate Action or Brazo Two Zero by Andy McNab, autobiographies of a famous British special forces soldier.

"No one runs faster than Mr Heckler and Koch."

(Heckler and Koch are a German gun manufacturer. If you are heavily armed and armoured, you don't really need to run after or away from your enemies.)

Well there are two of three possibilities:

1) All Swat teams look like that, Hollywood lied to us

2) This is a bomb defusal unit, they don't need to move fast

3) It's a small town police unit

It turns out that out-of-shape cops are make fairly effective killing machines when you outfit them with automatic rifles and body armor.

And, since the US Defense Department can donate excess hardware to police forces, most of the gear comes at a very heavy discount (because it's already been paid for by tax dollars). http://www.theguardian.com/commentisfree/2013/oct/07/militar...

As a result, it's not at all uncommon to send a team of local policemen in assault gear to arrest a drug dealer or other minor criminal, or anyone accused anonymously of something horrid -- that's the basis of swatting. Hopefully they get the right house, and don't shoot anyone else or their pets, but it typically isn't a big deal even when the cops screw up.

So... Lots of funny, if misinformed comments. To lead off, I am no pig. I have lots and lots of experience with them, I am related to a couple, and I have been very intensely monitoring them for quite some time. I am confident in my assessments and assertions, but they remain only that. What's more, I consider the majority of pigs undertrained, weak minded sheep. I also use the term "pig", instead of the harsher terms they tend to deserve. All of this adds up to a massive bias on my part, so do not forget that when you are typing your pro-pig hell rant.

Most US police forces lack the discipline and capability to field a Special Weapons And Tactics team. Instead, they have Volunteers. These are regular beat cops who sat through a few training courses and maybe ran a few smash and grab walk troughs at some point. They keep a flack vest, helmet and carbine AR in their trunk. Most SWAT calls are just beat pigs dealing with something over there head, which can be anything from a person who knows their rights to an actuall increased threat scenario. Real SWAT teams are the picture of tactical efficiency and reserve. Most footage [i completely discount all cinematic SWAT silliness] you will see has yelling and gun pointing and one cute video of a fat, crazy drunk getting zipped up by a SWAT bro with an MP5 [never take a breech loader to an automatic fight]. This discounts all of the rigorous training, both physical and mental, that these operators go through in the short window they are allowed to be in an actual SWAT team. I cannot vouchsafe the conduct of all SWAT, but my anecdotal experience was awesome.

I will leave off most the detail, but here is my short story. This was the first time I interacted with SWAT. It will not be the last, I fear. I was in a place I probably should have avoided, when I decided to step out for a jack. I was laughing at a lame joke my friends girlfriend had made [i was/am that guy] as I opened the front door. When I swung my head forward, I was greeted by 6 or 7 homeboys in black tac gear. They were setting to take the door. The point man [guy in front] leveled his hellasweet HK USP .45 at my face and politely asked me to, "please hold the door". I remember being able to see down the barrel of his shooter. He had one in the chamber. I graciously swung the door wide and bowed fairly low, like some drug addled varlet. Point guys swept by as number 2 gently spun me and zip tied my wrists. He kind of whispered "don't be stupid". I do not know what he meant, but I had been a military sycophant for a long time so I knew the drill and sank to my knees. They were done in seconds. 2 of them helped me up gently and ushered me to the couch. They left quietly and broke nothing. I cannot say the same for the overweight, callous detectives that spent 4+ hours figuring out that they had taken a house with no evidence and only one of their targeted suspects [he was released because he had no ID on him]?

I have had many experiences with many levels of LEO and none has ever instilled the respect and admiration I have for a true SWAT team.

No constables. No kings. Self police is self rule.

I believe when they refer to "the incident", they don't mean the immediate one with the SWAT members, but the previous year's hacking incident, https://blog.linode.com/2013/04/16/security-incident-update/

There's no "deep" part of a 3-paragraph post that fits on less than one screen.

Do you seriously don't know what "swatting" means? Somebody called SWAT on them, while he hacked into that machine. Nowhere was said that a SWAT operative was the hacker.

According to this[0] they're hashed using the "Portable PHP Password Hashing Framework"[1].

[0] https://www.phpbb.com/community/viewtopic.php?f=46&t=1813965 [1] http://www.openwall.com/phpass/

Consider this scenario: Perpetrator calls in a bomb threat. People evacuate. Perp goes inside to do [something illegal].

At that point, a bomb sniffing dog is not going to be terribly useful, but firearms will be.