WT-Fakawi
2006-04-13 20:23:32
This whole situation began after the sudden death of Kaitnieks.com. I was in the midst of creating an include for SCAR, one that would unite visions of the most talented programmers around. I had already gained permission from some demigods, and decided that the only way to handle matters decently was to start a forum of my own. With only one goal: to save SCAR. I managed to gather Creative Minds, I set up a repository and collectively we began creating this dream. So, this forum I made was a very small PRIVATE, little silly phpbb2 thingy. It had only 25 members, and I modded the php-source to keep the general public out.i.e. I disabled registration: it was strictly private. It said so at the main page.
I published most of my private premium scripts at that forum illustrating the level of trust I had put in my members.
Then I made a mistake. I accidentely left registration enabled at the forum. My mistake really, but arrgghh, 20 minutes later (I was out) two users registrated. One of them…NeonKnight77.
As you might understand, this was not my purpose at all…I deleted his account and I contacted NeonKnight77 (for the very first! time…)
Below is the convo:
I think I have put it decently. He took all my work! and he bitches at me.
Next day I recieve this email from him. Appearently he had studied the scripts and decided to change strategy:
Hi
Can I rejoin the forums. Sorry about earlier. I had a bad day yesterday. Someone sent me a virus that deleted my whole C:/
Neonknight77
Hahaha, how could anybody fall for that? I decided to do what most of you should do in such a case…: Hold your breath, count to 10, turn around and continue with your life. I told him to lay of my back for 2 month, which eh didnt. I ignored him.
But things got worse, way worse.
The day we opened up the SRL-forum for the public NeonKnight77 immidiately signs in. He starts stalking me with PM's like, "Why are you so mad at me?", usually followed by "I am Sorry".
I am beginning to feel a little uncomfortable with this. Whats his game? What is he trying to achieve? Why is he veigning affection? I am beginning to believe this is a deeply disturbed person that needs help. So after "why wont you answer me" #5 I decided to write:
Hi Neon.
I'll answer. I will answer assuming you are a bright young man. This is what I would have done….
You where about to enter the SRL Developers forum. You were polled by the community. I accidentely left the register script armed, my mistake.
You immideately took your chances and registered. Now, this stupid PHPBB2 doesnt do a lot of logging, so havent logged your activities. But, if I were you, I would have grabbed it all!!! No offence, it is just what I would have done…..
If you didnt take any of my scripts, like you said you didnt, (which I find hard to believe, since I take it you are a bright young man…) then the more stupid of you to enter. You damn well knew it was Private, and that members are screened upon entering. You didnt know? I dont believe you, but nvm. It is beyond the point.
Point is: I contacted you after I threw you out. Now, I dont mind being fooled around with, but I dislike being yelled at, or being "WTF do you want!" ed. You knew exactly what I wanted, and to be honest, I wasnt even mad at you now, was I? I merely pointed out that you where lucky to obtain all my work from the past 6 months. And I asked was a little understanding. Thats all… And you cursed me!
End of story?
No. I put up our little MSN conversation @ SRL under the title "there goes the neighbourhood…."
Two days later I recieve a small email from you explaining what had happened, and that you had a bad day and someone sent you a virus and that your C: drive was deleted, etc.
hm.
You must admit, this has got to be one of the lousiest excuses ever. Even if your C: was deleted, what does that have to do with me? Sure, I admit, I can be a pain sometimes, but you cant accuse me of being rude or insultive, or using IMHO cheap excuses to straighten things out. It is beyond the point. You know, my wife has recently spent 3 weeks in hospital, and I dont throw that to you either, right?
Ever since that, you have tried to excuse yourself. This, in itself, is ok. I dont have anything against you, but I hope you will understand I will not allow you to enter the SRL private section. At least not for now. I know you have many friends amongst SRL-developers, so in the end you will get what you want anyway… (like you always do, no? - at least I always got what I wanted when I was your age… ) But, please, try to be a little more mature in your approach, please behave here. Proove yourself to be an ok kid, then we will see what will happen, k?
I hope I have answered satisfactory,
Cheers,
WT-Fakawi.
This seems to help. I don't get any PM's from NeonKnight77 anymore. But after three weeks it all starts again. He decides to approach me totally differently:
Originally Posted by Neonknight77
Dear WT-Fakawi,
I was wondering if I could re-apply. I know I did alot of bad things. I am sorry I flamed you, and some other members. I am also very sorry for the lame excuses I made. I do not know what I could make for you to show off my scripting skills. I know how to: Make Functions(Integer,Boolean,and Extended ones)Procedures, almost about anything. I know Arrays. I enjoy making short walking scripts like a smelter or a smither. Some things that I don't know are forms. I am currently in the process of learning them. I also know how to make auto color finding procedures. I like making DTM's and bitmaps. If I would be approved, I would help the community alot more. I will try to test all the functions and write bugs/ or try to improve them and send them to a experienced member like RsN or you to look at. I have learned my lesson on how to act now. I do not flame people anymore. About Whiteshadow. What he says is not true. I would post a reply if I could. It says the board is moderated. Well anyways, he is pissed off at me because he wanted to keylog with me, like send the keyloggers to other people, and I didn't want to. If you have any other questions, please ask me.
Sincerely,
Neonknight77
I answered:
Hey, good to see you are on the right track. As you might have (or have not) noticed, I have granted you the Status of SRL-member by manually giving you 30 Reputation points. This means you can acces all the scripts released for Members.
I am however currently not in the need of any developers. We are currently with 23, and I dont want it to become any bigger for now. You are, however in my mind, and yes I do monitor you and have noticed the change in your behaviour. Courageous, keep it up!
But, As you will see when I release Beta 2, there are a number of skill empty. If you'd be so kind to look into those, and see if you can come up with something usefull (which is hard, because we have covered already a lot!) this would speed up a appliance.
Thanks for your kind words!
Fawk
Once again, I think I was being nice. I repped him manually and granting him acces to the Members section. For some time things seem to be in order. I believed to have dealt with the matter wisely and I concentrate on more important things, like getting the Include of the ground, which was why I set this forum up in the first place. NeonKnight77 is at the forum daily and happily chats with everybody.
The Crash.
April 3 I got attacked. Apache down, SQL down, offline for 12 hours. I run standard checks and all seemed well, so I restart the server. After a some days I got suspicious because the system had twice nearly crashed (restarted) and behaved different. I decided to log all of my network activities outside the server for a short period of time. I found periodical small bursts of encrypted code piped through port 80. I suspected being keylogged, but McAfee lulled me to sleep.
I Grepped the access log of Apache and found Anomalies in the Dev section. I queried SQL for IP's and found out NeonKnight77 had used his home IP-adress once to access the devs section under Shockers id. This could mean two things: either they where sitting in the same room together, or NeonKnight77 had somehow accessed Shockers account. Now, Shocker hasnt been at all active lately, in fact I tried contacting him about some ideas for his plugs, but no luck and all of a sudden he is all over the place using different IP's. But he never posted.
Moreover, there had been several anomalies inside the SVN-Repository. I am still puzzled, but I haven't found anything odd. Fear not for Version 1, it will be totally clean. It is just text and help files, no executables.
I removed two suspicious files, hidden inside dllcache and registry: nntpadm.dll and nntpapi.dll. (Creation Date matches the Crash Date). They do not match the filesize and they do not match the Microsoft signature, so I send them to Symantec and we will see.
The server is clean again. It took me over 20 hours to find this and I am still trying to recover how the hell a keylogger could have nested itself inside my System without me doing nothing.
Grinch LVL-126!
Needless to say: I am furious! I am outraged. In comes someone respectlessly messing with my private life. You can take my scripts, you can crash my forum, I really dont give a shit, but YOU DONT MESS WITH MY CREDITCARD. That is a criminal offence young man. I have sent some mails.
This is supposed to be a fun place where talented people can learn and teach. We all contribute to the community and together we stand strong. We stand proud above our leeching community, we feed them with functions/procedures and fun scripts. We are supposed to keep SCAR alive, remember?
And you try to destroy it.
Thats utterly low.
If you dont stop you will be a criminal before you reach 16, Peter! I feel very sad for you and I am very tired. This business has costed me way more energy than I had anticipated. I will not reveal anymore compromising data unless demanded by legal authorities. I have done my utmost.
Leave me in peace.
I published most of my private premium scripts at that forum illustrating the level of trust I had put in my members.
Then I made a mistake. I accidentely left registration enabled at the forum. My mistake really, but arrgghh, 20 minutes later (I was out) two users registrated. One of them…NeonKnight77.
As you might understand, this was not my purpose at all…I deleted his account and I contacted NeonKnight77 (for the very first! time…)
Below is the convo:
Fawk:23:21:49: hi
Neon:23:21:57: hi
Neon:23:22:18: What do you need?
Fawk:23:22:51: ?
Fawk:23:23:09: I would really appreciate if you would please please keep private what you just downloaded from my Forums, please.
Neon:23:23:18: Srl?
Neon:23:23:32: I didn't give anyone any of it and I won't
Fawk:23:23:37: The SRL will be public available
Neon:23:23:42: Ok.
Neon:23:23:55: I didn't give anyone it..
Fawk:23:24:06: But my scripts have taken a long time to write
Neon:23:24:18: I didn't give anyone anything dude
Fawk:23:24:21: I am sorry to say, but they to valuable for the mass to have. Really really
Fawk:23:24:40: Are you a good scripter?
Neon:23:24:44: Yes.
Fawk:23:25:06: You have read about the Repository?
Neon:23:25:40: Look, just tell me what you want
Fawk:23:25:48: ?
Fawk:23:25:57: I just told you want I want
Neon:23:26:02: Why did you delete my account
Fawk:23:26:26: You want to join in?
Neon:23:26:34: What the fuck do you want?
Neon:23:26:38: ?
23:26:41: NeonKnight77 signed off (was Online)
I think I have put it decently. He took all my work! and he bitches at me.
Next day I recieve this email from him. Appearently he had studied the scripts and decided to change strategy:
Hi
Can I rejoin the forums. Sorry about earlier. I had a bad day yesterday. Someone sent me a virus that deleted my whole C:/
Neonknight77
Hahaha, how could anybody fall for that? I decided to do what most of you should do in such a case…: Hold your breath, count to 10, turn around and continue with your life. I told him to lay of my back for 2 month, which eh didnt. I ignored him.
But things got worse, way worse.
The day we opened up the SRL-forum for the public NeonKnight77 immidiately signs in. He starts stalking me with PM's like, "Why are you so mad at me?", usually followed by "I am Sorry".
I am beginning to feel a little uncomfortable with this. Whats his game? What is he trying to achieve? Why is he veigning affection? I am beginning to believe this is a deeply disturbed person that needs help. So after "why wont you answer me" #5 I decided to write:
Hi Neon.
I'll answer. I will answer assuming you are a bright young man. This is what I would have done….
You where about to enter the SRL Developers forum. You were polled by the community. I accidentely left the register script armed, my mistake.
You immideately took your chances and registered. Now, this stupid PHPBB2 doesnt do a lot of logging, so havent logged your activities. But, if I were you, I would have grabbed it all!!! No offence, it is just what I would have done…..
If you didnt take any of my scripts, like you said you didnt, (which I find hard to believe, since I take it you are a bright young man…) then the more stupid of you to enter. You damn well knew it was Private, and that members are screened upon entering. You didnt know? I dont believe you, but nvm. It is beyond the point.
Point is: I contacted you after I threw you out. Now, I dont mind being fooled around with, but I dislike being yelled at, or being "WTF do you want!" ed. You knew exactly what I wanted, and to be honest, I wasnt even mad at you now, was I? I merely pointed out that you where lucky to obtain all my work from the past 6 months. And I asked was a little understanding. Thats all… And you cursed me!
End of story?
No. I put up our little MSN conversation @ SRL under the title "there goes the neighbourhood…."
Two days later I recieve a small email from you explaining what had happened, and that you had a bad day and someone sent you a virus and that your C: drive was deleted, etc.
hm.
You must admit, this has got to be one of the lousiest excuses ever. Even if your C: was deleted, what does that have to do with me? Sure, I admit, I can be a pain sometimes, but you cant accuse me of being rude or insultive, or using IMHO cheap excuses to straighten things out. It is beyond the point. You know, my wife has recently spent 3 weeks in hospital, and I dont throw that to you either, right?
Ever since that, you have tried to excuse yourself. This, in itself, is ok. I dont have anything against you, but I hope you will understand I will not allow you to enter the SRL private section. At least not for now. I know you have many friends amongst SRL-developers, so in the end you will get what you want anyway… (like you always do, no? - at least I always got what I wanted when I was your age… ) But, please, try to be a little more mature in your approach, please behave here. Proove yourself to be an ok kid, then we will see what will happen, k?
I hope I have answered satisfactory,
Cheers,
WT-Fakawi.
This seems to help. I don't get any PM's from NeonKnight77 anymore. But after three weeks it all starts again. He decides to approach me totally differently:
Originally Posted by Neonknight77
Dear WT-Fakawi,
I was wondering if I could re-apply. I know I did alot of bad things. I am sorry I flamed you, and some other members. I am also very sorry for the lame excuses I made. I do not know what I could make for you to show off my scripting skills. I know how to: Make Functions(Integer,Boolean,and Extended ones)Procedures, almost about anything. I know Arrays. I enjoy making short walking scripts like a smelter or a smither. Some things that I don't know are forms. I am currently in the process of learning them. I also know how to make auto color finding procedures. I like making DTM's and bitmaps. If I would be approved, I would help the community alot more. I will try to test all the functions and write bugs/ or try to improve them and send them to a experienced member like RsN or you to look at. I have learned my lesson on how to act now. I do not flame people anymore. About Whiteshadow. What he says is not true. I would post a reply if I could. It says the board is moderated. Well anyways, he is pissed off at me because he wanted to keylog with me, like send the keyloggers to other people, and I didn't want to. If you have any other questions, please ask me.
Sincerely,
Neonknight77
I answered:
Hey, good to see you are on the right track. As you might have (or have not) noticed, I have granted you the Status of SRL-member by manually giving you 30 Reputation points. This means you can acces all the scripts released for Members.
I am however currently not in the need of any developers. We are currently with 23, and I dont want it to become any bigger for now. You are, however in my mind, and yes I do monitor you and have noticed the change in your behaviour. Courageous, keep it up!
But, As you will see when I release Beta 2, there are a number of skill empty. If you'd be so kind to look into those, and see if you can come up with something usefull (which is hard, because we have covered already a lot!) this would speed up a appliance.
Thanks for your kind words!
Fawk
Once again, I think I was being nice. I repped him manually and granting him acces to the Members section. For some time things seem to be in order. I believed to have dealt with the matter wisely and I concentrate on more important things, like getting the Include of the ground, which was why I set this forum up in the first place. NeonKnight77 is at the forum daily and happily chats with everybody.
The Crash.
April 3 I got attacked. Apache down, SQL down, offline for 12 hours. I run standard checks and all seemed well, so I restart the server. After a some days I got suspicious because the system had twice nearly crashed (restarted) and behaved different. I decided to log all of my network activities outside the server for a short period of time. I found periodical small bursts of encrypted code piped through port 80. I suspected being keylogged, but McAfee lulled me to sleep.
I Grepped the access log of Apache and found Anomalies in the Dev section. I queried SQL for IP's and found out NeonKnight77 had used his home IP-adress once to access the devs section under Shockers id. This could mean two things: either they where sitting in the same room together, or NeonKnight77 had somehow accessed Shockers account. Now, Shocker hasnt been at all active lately, in fact I tried contacting him about some ideas for his plugs, but no luck and all of a sudden he is all over the place using different IP's. But he never posted.
Moreover, there had been several anomalies inside the SVN-Repository. I am still puzzled, but I haven't found anything odd. Fear not for Version 1, it will be totally clean. It is just text and help files, no executables.
I removed two suspicious files, hidden inside dllcache and registry: nntpadm.dll and nntpapi.dll. (Creation Date matches the Crash Date). They do not match the filesize and they do not match the Microsoft signature, so I send them to Symantec and we will see.
The server is clean again. It took me over 20 hours to find this and I am still trying to recover how the hell a keylogger could have nested itself inside my System without me doing nothing.
Grinch LVL-126!
Needless to say: I am furious! I am outraged. In comes someone respectlessly messing with my private life. You can take my scripts, you can crash my forum, I really dont give a shit, but YOU DONT MESS WITH MY CREDITCARD. That is a criminal offence young man. I have sent some mails.
This is supposed to be a fun place where talented people can learn and teach. We all contribute to the community and together we stand strong. We stand proud above our leeching community, we feed them with functions/procedures and fun scripts. We are supposed to keep SCAR alive, remember?
And you try to destroy it.
Thats utterly low.
If you dont stop you will be a criminal before you reach 16, Peter! I feel very sad for you and I am very tired. This business has costed me way more energy than I had anticipated. I will not reveal anymore compromising data unless demanded by legal authorities. I have done my utmost.
Leave me in peace.
