While I’m here, I’ll let you all know what I know about the recent AIM incident that resulted in large amounts of users being left unable to log in. (I’m trying to reference specific sources so that you all know what happened on this front)
Earlier this month, a mass spamming event happened across a few NINA platforms. It started with the registration of a user with the name “BasedRacist1488” that created a profile with racial slurs, which the users saw and was quickly followed by forum spam that implied the user was lurking in the Discord.
The forums closed and quickly came back up with “protections” - that didn’t work, as the forums were spammed by multiple old accounts that were likely compromised from information stealer logs (TLDR: someone runs a sketchy executable and everything in local password managers/etc. gets uploaded to a malicious actor, which then may get widely distributed.) This spam included an administrator’s dox as well as graphic shock images.
When the forum webhook was removed from the Discord, this spam transferred to Last Call, which had a Discord bridge - I don’t remember everything, but the spam involved more racial slurs, doxxing, and a mocking edit of an administrator’s dead cat.
Tony quickly began to take measures after these incidents:
Now, I don’t expect you to have knowledge of SQL for this post, but the summary of these screenshots is:
tb_umf_users_userandtb_umf_users_user_profileare related to the “Users Master File” (terminology stolen from AOL) which is basically the database where all Escargot/NINA user information is stored.- The screenshot shows that Tony removes the general access flag from all people who haven’t donated. The “general access flag” in this case is the basic indicator that gives users access to certain services (such as AIM) that are released as “free”.
- After this, he re-adds the general access flag to people who logged in after September 5, 2024 (a year before the date this happened) that weren’t already suspended. He also re-adds it to everyone who had enabled the profiles feature. (This will become notable later on.)
- The
COUNTqueries ran by tonyshowoff say, before the changes, 121,841 people had access to AIM and the forums. (This was basically all users, minus suspended users.) After the changes, only 42,775 users have access.
The thing is, this on its own wasn’t the worst thing that could’ve happened - while the numbers are large, most active members would’ve been fine - it was just if someone took a break for more than a year and decided to come back, they would find they no longer had access to AIM.
Unbeknownst to them, the spammer already had another session from a stolen account before these changes were made and spammed one last time. After that account was banned, he then states this:
Effectively, this is the same SQL code run before, but without the second part - and this is what made the incident significantly impactful. This had suddenly went from “okay, maybe a few people who hadn’t touched the service in a while can’t log in anymore”, to “99.9% of users are suddenly unable to log into the service, even active members who could just log in yesterday or a few hours ago”.
Of course, this caused an influx of support requests asking about why they suddenly weren’t able to log into AIM - with which Tony responded and usually just reactivated accounts with no explanation as to why they were deactivated in the first place. Furthermore, his statement in staff chat basically told everyone to keep quiet, and direct people to support to let Tony handle everything himself:
Eventually, this was properly clarified as a “limited account” system was implemented and a good 1,000+ accounts were found to be in information stealer logs and subsequently suspended while they waited to notify individuals they were hacked as they posted in the support channel. But the initial secrecy surrounding almost the entire userbase suddenly being unable to log into a service they promised was free, with no explicit announcement, never stating why it happened, and very vague responses when brought up is sketchy in its own way. I don’t defend the spammer’s actions, but at least notifying the public that an attack is underway and you’re working to implement security measures would’ve been the way I approached this publicly.
Signing out, again, for now - I’ll pop in to answer questions if needed, but this has been a whole situation and I’m just trying to get the information where it needs to go at this point.