Hacker News Reader

Comment by meowface | Hacker News Reader

The post is kind of confusing. Are they suggesting someone called in a bomb threat to clear out their building, giving intruders some time to get in and grab an admin's phpBB database backup without worrying about incident responders?

If so, sounds like some pretty dedicated attackers.

View on HN

Yeah, it sounds like someone was aware of an old copy (2010-03-03) of a database backup sitting on some "personal" server?

Was it the https://forum.linode.com forum? It looks like it does run on PHPBB...

In theory, it sounds like the goal of the SWAT was to clear the building of employees, and break into the target server, while no one would be sitting at an office workstation, and thus rendered incapable of disrupting the attack. It sounds like all that effort actually worked.

So then, after everyone returned to the office, staff discovered the intrusion, and they performed a password reset for anyone who hasn't changed their forum password since 2010.

But! Were the forum credentials valuable? Do people do things like mine bitcoins with their hosting? Is the PHPBB MySQL database isolated from all other user credentials, or is there overlap?

"SWATing" is a common "prank" skids pull. Good money says the attacker did it for the same reason they stole the db (they can), you guys are hugely over-thinking this.

Yeah, I think Brian Krebs was also SWAT'd.

The only credentials that were accessible were hashed forum passwords from the time of the restore (all of which have been revoked), and forum accounts are not linked to any other Linode systems.

Indeed, it was a clever trick.

But in no way was the attack "serious", just for the lols, I know the attacker and swatting is just another way to get lols.

It was RyanC again, no?

Hello RyanC,

It's Scott Thomas.

I'm gay.

gaygaygay

Reply on news.ycombinator.com