1  2  |   Order by index

Mar 31, 2002, 10:49am

WARNING - Could anyone hosting any object path change its password!

67 Object Path Keys Compromised - Everything from AW to the Gor worlds,
change your OP passwords NOW!

The source of the codes has been destroyed - Anyone found using the PW's
without the owners permission will have the owner and AWC to answer to!

Once again - Change your PW's now - I cannot reviel who is on the list, the
safest bet is to completly change every object path. Andras has a tool
available - www.andras.net.

- Mark

Mar 31, 2002, 11:41am

Correction: 53 Passwords

Mar 31, 2002, 11:50am

What the hell are you talking about? The passwords are encrypted every step
of the way. The only way to get them is with brute for cracking (a program
to guess the password). Which, takes forever unless you have a
supercomputer. Needless to say, someone didn't get 53 of them by that
method. It takes an ungodly amount of time just to get one.

That only leaves a few other options. First, what you're saying is totally
false. Second, the password was intercepted between the world server and
client, or vice versa. The password must be sent from the world server to
the client, so the client can unzip the rwx files. This, however, is also
encrypted.... The only other way is if someone was actully good enough to
compromise a few servers and get an atdump. But I presume even *that* stores
the password encrypted...

Next time, make sure something is at least *reasonable* before you
post.......

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Jeremy Booker
JTech Web Systems
(www.JTechWebSystems.com -- Coming Soon)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[View Quote]

Mar 31, 2002, 11:57am

from this list, im asking the owners.. The PW's ive checked so far are
correct.

- Mark

[View Quote]

Mar 31, 2002, 12:15pm

I thin all hosters and world owners need some clear words here.

Are you saying activeworlds.corp. client is insecure?

Are you saying world servers have been compromised?

This is a very serious situation for all world owners and hosters

If my worlds and paths have been compromised I shall close all untill all
pwds have been changed.

I have requested from aw.corp a def statment on this issue to make sure your
facts are true.

Regards




[View Quote]

Mar 31, 2002, 12:57pm

On 30th March, 2002 - I saw though my MSN that the user Dark Mod had placed
a line of text after his username quating a URL and text saying crack this
zip to get __ OP passwords.

I downloaded the file and asked Mod what it was, he said it was 10 character
password that was a common phrase of his.

I contacted InSaNiTy when Mod told me WCOL was also included.

I set my computers to smart search overnight and in the morning I found that
the PW had still not been broken. This morning i was talking to a friend who
cracked the ZIP Password and gave it me a few seconds byfore my scan
reveieled it to me also.

I found inside a set of passwords, which i asked the owner of several of the
OP's if the password was correct. It was confirmed the PW I had told the
owner was correct.

I then posted on all NGs on both Andras's and AWC's server about the problem
and informed everyone in various GZ that their OP PW's had been compromised.

I do not at this time have any knowledge about how the PW's have been gotten
as all i see is *'s, even with CT.

---------------------------------------------------------
Now u know how i know, You must realise how important this is and change
your object path passwords. I will not disclose the worlds, thats upto AWC
to do. But it is a safest everyones OP Passwords are changed.

I hope that you make sure you change yours

- Mark

Mar 31, 2002, 1:46pm

DarkMod- looking for a new WebSpace says:

lol suck up

Mark says:

i recomend you go speak to whoever yu got the PW from

DarkMod- looking for a new WebSpace says:

duh i got those pws....here put this in your little newsgroup....I got the
pws nothing they can do bout it...hell i even got the objects dled...Have a
nice day

Mar 31, 2002, 1:56pm

Oh no...he is absolutely correct 100% I have a list of 53 op pws...and i
assume some people cracked the password on the zip file and have it
too...Yes these pws were the work at a time of the beloved AWST
browser...which the list was given to me. and for a long time it stayed that
way but since i left AW why not let some others have some fun with it

have a nice day
-Dark Mod
[View Quote]

Mar 31, 2002, 2:00pm

Mmm, the smell of script kiddies is in the air today ladies and gentlemen.

--Bowen--

[View Quote]

Mar 31, 2002, 2:04pm

You can smell em?

anyway folks, you have a admission.

I recomend everyone changes their OP Pw's

[View Quote]

Mar 31, 2002, 2:07pm

Most likely he'll get them again. What's the point? Rotate them every 2
days. This is why you close off access to your worlds ;).

--Bowen--

[View Quote]

Mar 31, 2002, 2:09pm

A lot of those AW ones everyone knew...

--Bowen--

Mar 31, 2002, 4:01pm

Quite frankly, Mod, I don't believe you. Until I personally see this list
of passwords, I'm not taking action in any of my worlds, nor would I suggest
that anyone else waste their time either.

Second, if you actually have, as some claim, downloaded and de-encrypted
files to your hard drive that do not belong to you, then you are in
violation of international copyright law. All it would take would be for
one owner of any of these 53 worlds to file a lawsuit, and you (or your
parents, depending on your age) could be out thousands of dollars, not to
mention spending some time in jail.

I seriously doubt the legitimacy of this claim. Until I see proof, I'm not
going to panic.

[View Quote]

Mar 31, 2002, 4:02pm

Why can't you reveal who's on the list? That, coupled with the capital
letters all over your message and subject lines, spells "HOAX" to me.

[View Quote]

Mar 31, 2002, 4:18pm

Ummmm a question? How does this pertain to most of the NG's you crossposted
to? It should have been put in WORLDBUILDERS and thats it!

[View Quote]

Mar 31, 2002, 4:21pm

Because its imporant everyone knows so if they own a OP, they change it
asap.


[View Quote]

Mar 31, 2002, 4:29pm

And they cannot find out about it from ONE NG?
[View Quote]

Mar 31, 2002, 4:34pm

No, it is essential everyone who could possably have OP knows. I have
posted in every NG on both main AW type servers. As you know by now (i hope)
the passwords are confirmed as compromised and it is essential that
everyones knows so they can change them. So unless u have AWLD #1 rights and
can tell everyone by using the universe welcome message. Id apreciate just
going with this and just changing the PW on a OP if you own 1. Thankyou :)

-Mark

Someone called Dotar wrote this:
--------------------------------------------------------
And they cannot find out about it from ONE NG?
[View Quote]

Mar 31, 2002, 4:58pm

I have spoken to Andras owner of Storage and this is not a hoax :(

[View Quote]

Mar 31, 2002, 5:00pm

I still think cross posting was not nessasary in the least.

[View Quote]

Mar 31, 2002, 5:22pm

Of course, i will not give you false info

[View Quote]

Mar 31, 2002, 6:02pm

For evidence.. please see the SDK NG... there is a full explenation... and
he has admitted and bragged about the PW and unforunatly listed them which i
hope AWC kills ASAP.. all the proof you need is there... Unfortunatly it di
not go to all NG's, just the SDK like my origional did

Mar 31, 2002, 6:33pm

emmm, from what strike just replied to u with. seems like u should make
sure ur correct, before correcting others...
[View Quote]

Mar 31, 2002, 7:47pm

For those of you who are questioning the Validity of this report let me add to
the warning that it is very true!

Thommas Mower of Lansford, PA using IP 64.0.99.168 citizen name Dark Mod
329466 Has indeed been offering the passwords.

We have evidence which has been handed over to the F.B.I. pertaining to this
criminal act.
It is a crime to be in possession of stolen property, to sell stolen property
and to have stolen the property. As you can tell, this child admits to his
actions.

If your password has been stolen and offered by this individual you may wish to
contact your local Police Department and request that they take a criminal
complaint. Show the evidence of this going across the state lines and they will
contact the F.B.I. for you.

The site which Thommas was offering the file on was shut down Saturday, March
30, 2002. As you can see from some of the messages here, the child is
attempting to find a new home for the file.

It is strongly suggest that you use a password at least 18 in length,
upper/lower case along with characters to help slow these people who think
hacking is fun.

Thanks to Attorney General John Ashcroft, the seizure of PC's as evidence is
moving along strongly and has held up already in the courts against users under
many various Federal and State criminal cases.

I strongly suggest that people refrain from even the thought of using the
passwords.

Filmkr & InSaNiTy
Heartfall Productions
www.heartfall.com






[View Quote] > WARNING - Could anyone hosting any object path change its password!
>
> 67 Object Path Keys Compromised - Everything from AW to the Gor worlds,
> change your OP passwords NOW!
>
> The source of the codes has been destroyed - Anyone found using the PW's
> without the owners permission will have the owner and AWC to answer to!
>
> Once again - Change your PW's now - I cannot reviel who is on the list, the
> safest bet is to completly change every object path. Andras has a tool
> available - www.andras.net.
>
> - Mark

Mar 31, 2002, 7:49pm

ahh there u are :) Hi InSaNiTy :)

[View Quote]

Mar 31, 2002, 8:55pm

[View Quote] > AlphaWorld: > AWDemo: > AWGames:
> AWGate: > AWMusic: > AWDisco:
> AWShow: >AW sci-fi > Mars:
> AWTeen > AWSpades: > Axis:
> Bugs: > CASTLES: > Chicago:
> COFmeta: > Colony: > Cubed:
> Elysium: > England: > FunPark: 911
> HamGlaze: > Hole: > Holidays
> Image: > JADE: > JunoDome:
> NetTaxi: > No-Where: > Nomad:
> Objectd': > Rick's: > Russian:
> Seashore: > Storage: > Storage2:
> Symbolic: > The13th: > TyriaX:
> TriMoons: > Wien2: > Yellow:
> Mayumi: > Skye: > Germ at n
> Serenity:
> ----------
> Gor Worlds
> ----------
>
> GorAr: > GorenA: > GorHith:
> GorMoons: > GorTyros: > GorVernA:
> TalGor:
>

Mar 31, 2002, 9:13pm

Yay my world isn't in the list, that means it's a-ok ?

I've never really had any security problems. Someone takes a texture I ask
them not to, and as soon as the option of taking it to awcom comes up they
always just do the right thing. Then later I just tell them if they want
something ask, and then they get it.

I guess I'm just living in happy peace bunny friendship land...

>
>
>
>

Apr 1, 2002, 1:17am

In the grand scheme of things here..... considering how many decent ppl
would be hurt by this, I do believe most would agree with me in saying that
what you..... ONE person believes, is irrelevant.....

I for one am glad he posted this info..... tho I think it was unwise to post
the list of ACTUAL passwords..... that wasn't necessary.... and could
potentially harm some who OWN those OP paths, and may have not seen this yet
:O(

And, Yes.... I can also confirm this is not a hoax...... as one of the
worlds listed belongs to a close friend and the PW was correct..... :O(
fortunately it was changed quite some time ago......

Thank you Strike...... Hope You contacted those world owners..
JB

Apr 1, 2002, 5:53am

In article <3ca79826 at server1.Activeworlds.com>, baronjutter at shaw.ca
says...
> Yay my world isn't in the list, that means it's a-ok ?
>
> I've never really had any security problems. Someone takes a texture I ask
> them not to, and as soon as the option of taking it to awcom comes up they
> always just do the right thing. Then later I just tell them if they want
> something ask, and then they get it.
>
> I guess I'm just living in happy peace bunny friendship land...


WOO WOO! Hi there, neighbor :-) I live in Happy Peace Bunny Friendship
Land too! I am on Loving Lane, where abouts is your place?

I'm sorry but I am not changing my password to make a couple of kids
happy that they freaked out a bunch of world owners by pretending to have
hacked their passwords. You have been found out kids, so why don't you
call a few of your neighbors and ask them if their refrigerator is
running and suggest that they catch it?

Bruce, I respect your opinion but I think this whole thread was the
genius of 2 kids who wanted 15 minutes of fame.


Wings0nite

Apr 1, 2002, 5:57am

Better double check with andras, first, Wings0nite. He is thought to have
confirmed this, since he is a co-owner of Storage world, one of the worlds
that was supposedly cracked.

SW Chris

[View Quote]

1  2  |   Order by index