PAL Reports Affiliate Media Hack Attempt

[GPWA Teresa]

In case you had not heard, or were not a member at PAL, Jeremy has posted this :

http://www.pokeraffiliatelistings.co...-hack-pal.html

I am actually quite shocked as I type this right now. Most of you know I am not a big fan of all the industry drama. I have purposely stayed out of all the gossip, rumors, and even facts about anything and everything to do with CAP, AMI, and PAP. Even when my account at PAP was hacked and AMI executives posted on it pretending to be me, I kept my cool.

But what just transpired really pisses me off, and I feel I should share with the group. While I was not even at my computer I get the following email on my blackberry.



Of course after I see this I immediately went to PAL to do a little investigating. What I found made my jaw drop. I logged into the admincp and ran a query on the I.P. address 64.58.138.146 where the attempted login to my account came from. This was the result.



Who could this be you ask?




The Jarwl account is the account that Warren and Lou from Affiliate Media (CAP,PAP) had been using to read PAL since its inception while the forums were private. I knew this account was theirs the whole time, but allowed them to use it anyways up until about a week ago. Even when private, I had nothing to hide from them. In fact they are welcome members here at PAL if they would like to be.

But what I don't understand is why would they attempt to login to my account (Jeremy) here at PAL? Say what you want about "a staff member thought it would be funny" like Warren did when they jacked my PAP account. Fine, they own PAP. But trying to login to my PAL account here 5+ times with what I assume are my old passwords from PAP stuff when I worked there...........this is shady, and nothing short of a hacking attempt.

So Warren, Lou, and whoever else from AMI reading this; Why are you trying to login to my PAL account? What were your intentions? What would you have done after you got in?

Quite frankly guys, I am disgusted and would love a real explanation about what your intentions were. And save the bullshit lies and just be honest for one ******* time in your career. Your business ethics are a disgrace to this industry, and I am embarrassed to say I spent any time with AMI as an employee.

[universal4]

That IP address is an IP owned by Cox Communications(GA), and a geographic lookup shows it is in CA. (as per a dnsstuff lookup)

Currently there is a Windows Small Business Server 2003 on the IP, so this could mean that it is any small business in CA.

It could be that the server or a workstation behind it (since often SBA will run a proxy by default) could have been compromised and the hacker may have been going through the history and attempting the break-in.

Without further forensic details, there are so many scenarios possible that the above is just one possible one.

Rick
Universal4

[universal4]

Another possible scenario is that the attempt is a true hacker trying to get in and is using a proxy that forges the IP Header also.

Rick
Universal4

[Brandon]

Another possible scenario is that the attempt is a true hacker trying to get in and is using a proxy that forges the IP Header also.

Rick
Universal4

I have been watching this IP read all CAP/PAP related threads on PAL since the creation of the account.

I also so it last week having issues trying to login to an account, I can only speculate that this was not their first attempt to get into Jeremy's account.

[universal4]

My point is that had a user account on the small business server been compromised, and someone used that account, ANY and ALL outgoing traffic from that server would show that ip address.

Also, had that account been compromised been one of the accounts that was used previously by them to view/read/post whatever at your forum, (you yourself said this was happening and you sanctioned it) that the address and username to login to your forum would have been in the browser history in that account on that server.

I am not defending or denying what you said happened, I am just offering another possible scenario to the situation since there are many possibilities of what might have happened.

Rick
Universal4

[mojo]

I am not defending or denying what you said happened, I am just offering another possible scenario to the situation since there are many possibilities of what might have happened.

I personally don't think it is different scenario than what was presented above. This has happened to jeremy before and it was acknowledged by warren. Unfortunalty, history is a factor here. JMO

http://www.pokeraffiliatelistings.co...r-my-name.html

[alexpratt]

Posted but deleted - I need to keep my promise to myself that I will not get involved in these threads and help them get massive

[ck8795]

I also find it hard to believe they would try this as its plain stupid and they know the IP etc is tracked so why risk it! I also know that CAP had no access to the forum prior to it going public this week as they have been trying to find out what was being said in their about them since it launched to no success apart from the odd bit of hearsay -

I just find it hard to believe the guys at CAP who are tech savy etc etc would try this

Alex thats not true either. The forum was invite only. I invited a number of people I had on my IM's etc. The account Jarwl was listed to aj@affiliateprograms.com
That specific account would have had to accept the invite sent to aj@affiliateprograms.com in order to access the forums...which they were. I know who sent him the invite...not going to mention it here but yes someone did have access to the forums up until the beginning of Jan.

[Brandon]

Posted but deleted - I need to keep my promise to myself that I will not get involved in these threads and help them get massive

Alex,

You obviously are going to stick with CAP to the death, but I hope you realize that they are indeed not thinking straight.

The evidence is there, and if you have any doubts please contact me and I will send you screenshots that will verify that someone in the Irvine office was responsible for this.

Also, you say you know that CAP had no access to the forums? Thats funny because Warren himself told me he did and is reading everything that is said. I can show you that as well.

BTW, I am pretty sure PAL has been the most active forum since it was created, so I would be careful being proven wrong in that aspect as well.

[rknuppel]

I sure hate hearing this kind of stuff. Will be interesting to see what kind of response comes out of it from the other side.

[universal4]

I will send you screenshots that will verify that someone in the Irvine office was responsible for this.

The only way to prove this is with the ip address.

And the way Small Business Server setup this way works, is that anyone remotely can connect to a workstation (or virtual desktop on the server) and go anywhere on the internet in a browser and the IP reported to the destination will be the server IP (or proxy IP if the proxy is enabled, or the workstation IP if a 1to1 nat is enabled)

There are also other ways to mask and forge the originating ip address, but that becomes very complicated and is mostly only successful using a proxy set up on the block of ip's that is reported.

If I sit on a FL IP and use an account on a SBS in NY and go to whatismyip.com in a browser using that account, my ip will show the orginating ip as the one in NY although I am sitting on a workstation in FL.

The only point I am trying to make is that the person does NOT have to be sitting in CA.(thus the hacker could be in any country providing they hacked the SBS Server)

Rick
Universal4

[Brandon]

The only way to prove this is with the ip address.

And the way Small Business Server setup this way works, is that anyone remotely can connect to a workstation (or virtual desktop on the server) and go anywhere on the internet in a browser and the IP reported to the destination will be the server IP (or proxy IP if the proxy is enabled, or the workstation IP if a 1to1 nat is enabled)

There are also other ways to mask and forge the originating ip address, but that becomes very complicated and is mostly only successful using a proxy set up on the block of ip's that is reported.

If I sit on a FL IP and use an account on a SBS in NY and go to whatismyip.com in a browser using that account, my ip will show the orginating ip as the one in NY although I am sitting on a workstation in FL.

The only point I am trying to make is that the person does NOT have to be sitting in CA.(thus the hacker could be in any country providing they hacked the SBS Server)

Rick
Universal4

I understand what you are saying, there is always a chance that this is not true. But lets be honest, with their history of already logging into Jeremys account at PAP, having one of the PAP mods invite them to pal, signing up under that IP, and then having that same IP try and guess Jeremy's password?

I am no detective, but that shoe fits.

[Enke]

Hi guys, it is very unfortunate that this has transpired and I'm extremely disappointed. Part of me wanted to ignore the entire incident and not make it public. I sincerely have no interest in being a part of the industry drama or airing out any beefs with Warren or Lou. At the end of the day I just want to be a poker affiliate and provide a community for fellow poker affiliates and operators to do business. But there comes a point where enough is enough!

I'm sure there are some plausible ways in which it is just a "crazy coincidence" that the jarwl account registered and confirmed with an AMI email address has the same I.P. as the I.P. yesterday that tried to login to my account 5+ times.

With all due respect Rick, I'm sure we could make a 100 page thread on how it is "possible" that this is just a freak coincidence. I will do my dilligence and look at the server logs, passwords attemped, etc. But considering this happened to me once at PAP, and I know the jarwl account was used daily to read PAL for months.............well it's not hard to draw a conclusion that this is not a coincidence.

Also keep in mind I doubt anyone expected me to find out about this attempt, or even worse, for me to make it public. Sometimes people simply get caught when they least expect it.

[Caruso]

Lou explained the player database sale with the suggestion that someone had hacked into his account to make the famous post - see the GPWA database sale discussion.

Now, he appears to have done the exact same thing, hacking into an account.

The irony.

[universal4]

OK, the server logs etc, are only going to point at the IP, and that is it.

This is a crime that is being accused.

Do you go through your logs and post the IP's of every single failed password attempt?

Do you scan your user data looking to make sure that all other attempts are not current users trying to guess other account passwords?

Website hack attaempts are a part of having a website.

I brought up the whole scenario because I took a look at the server sitting on that ip and to me it looks as if it could use a little more security sitting in front of it.

You guys may just be right, but we have seen many times in recent past where there were things stated that turned out to not be true, now granted they led to other things that should have been known previously, but I just posed this as something that should be looked at maybe, but stating it as fact might not be prudent without further investigation.

Rick
Universal4

[Enke]

Thanks for the heads up Universal. I am not a database administrator nor do I care to be one. Likewise before I receive my 4th legal threat from CAP, I will state that I am just reporting the facts about the information I have and I am not alleging any criminal activity by any individuals. Quite frankly I can think of 10,000 better ways to spend a weekend than this.

I am simply just posting the information I readily have in front of me. I am working on extracting the attempted passwords. In the event they are passwords I used at PAP, then there is really no way to deny who attempted this. Likewise I suppose it is just ironic that this I.P. was also monitoring CAP/PAP/EMG threads at PAL closely.

Nonetheless, I appreciate your thoughts on the topic, and feel free to shoot me a PM or email if there is anything I can provide for you that would shed more light on things. I am assuming by your title here, you are much more savvy than I am in respect to this type of stuff.

[Integrity]

Totally discusting.

Totaly expected.