Postmortem Site compromised 10-Sep-2019

Status
Not open for further replies.
Welp, Based Sam is probably bouncing around his shithole flat with a cock as hard as a tungsten carbide drill bit right now.

Pity that if he sticks my IP into geolocation it comes up as either Sheffield or Exeter. That's quite a distance with around 30 million people living between those points.

Still, gonna change the ol' password just to be sure. I already use a burner Gmail that has no other purpose, s'there.
 
  • Like
Reactions: Dork Of Ages, lightswitchdoll, Count groudon and 3 others
Here's my Kiwi Farms security guide. Actually, if you do this with each site, you're probably pretty safe.

1) Only access the site via a VPN. Pay for your VPN with crypto. Yes, it's a pain, yes it's necessary because you don't want your VPN provider having a credit card number that can link back to you. Actually, if you're in a place where you can get prepaid Visa cards, use one of them. Use a VPN provider that claims to be logless too, but making it hard or impossible to identify you from your payment method can't hurt.

2) Use a throwaway email account from a site not connected to Kiwi Farms. I like cock.li. Once again use a VPN to access it. Use a VPN for everything basically

3) Use a secure password. I use passwords generated something like this. You need a bash shell, though the password generator function should be pretty easy to get working in a Windows batch file.

Bash: 
function randpass_openssl
{
openssl rand 4096 | openssl dgst -binary -sha512 |  openssl base64 | tr -d /=+ | head -c ${1:-32}
}

randpass_openssl 32

xyrhOapDJZUvShsLNUHC2X3HCTxF4x3R

Breaking it down. This part generates 90 chars of in the base64 charset. You need openssl installed, but that's it

Code: 
$ openssl rand 4096 | openssl dgst -binary -sha512 |  openssl base64
9R5Al3JJVlDwxwsUcjKsMuGvf0ygr7rLTYYHF5huBu63RKz3b5X7acnVsBIUEtNN
SJ6qYuC3xx5fPX4TgPEWOA==

The next two parts use tr and head, which are both usually present on Unix like OSs and I believe are part of Cygwin

Code: 
tr -d /=+
removes any '/', '=' or '+' characters.

Code: 
head -c ${1:-32}
means 'take the first argument to the command and truncate to that number of characters or, if it is not specified, truncate to 32'. So if you do randpass_openssl 16 you get 16 chars and if you do randpass_openssl with no argument it will default to 32. 32 will work with most sites, if they say 'max 16 chars' then just to randpass_openssl 16. 32 characters out of the base64 set less '/', '+', '=' gives a set of 62 characters. 62^32 is a large number to make brute-forcing hard and even if it is brute-forced you've only had one site access compromised because you must

Use a different password for each site. Use a different username for each site. Use a different email address for each site.
 
Last edited:
  • Like
  • Informative
Reactions: Annoying Thick Bitch, Dork Of Ages, HIVidaBoheme and 9 others
Gustav Schuchardt said:
Here's my Kiwi Farms security guide. Actually, if you do this with each site, you're probably pretty safe.

1) Only access the site via a VPN. Pay for your VPN with crypto. Yes, it's a pain, yes it's necessary because you don't want your VPN provider having a credit card number that can link back to you. Actually, if you're in a place where you can get prepaid Visa cards, use one of them. Use a VPN provider which claims to be logless too, but making it hard or impossible to identify you from your payment method can't hurt.

2) Use a throwaway email account from a site not connected to Kiwi Farms. I like cock.li. Once again use a VPN to access it. Use a VPN for everything basically

3) Use a secure password. I use passwords generated something like this. You need a bash shell, though the password generator function should be pretty easy to get working in a Windows batch file.

Bash: 
function randpass_openssl
{
openssl rand 4096 | openssl dgst -binary -sha512 |  openssl base64 | tr -d /=+ | head -c ${1:-32}
}

randpass_openssl 32

xyrhOapDJZUvShsLNUHC2X3HCTxF4x3R

Use a different password for each site. Use a different username for each site. Use a different email address for each site.
Click to expand...
To be fair if you weren't doing this in the first place you kinda deserve to get doxxed.
 
  • Thunk-Provoking
  • Agree
  • Like
Reactions: Dork Of Ages, greengrilledcheese, Phosphophyllite and 2 others
Most interesting thing to me was how many IPv6 addresses there were on there. I'm assuming that it's phoneposters mainly, but maybe some VPNs have taken to assigning IPv6 addresses too? It would make sense if they wanted to spread their traffic out a bit without the expense of getting additional IPv4 addresses.
 
  • Like
Reactions: Dork Of Ages, Slick Willy and Colmerry
Eh, I used an old burner email address to sign up for this site but I changed my password just to be on the safe side.

Don't know who was behind this and frankly I don't care. Like Null said, it could've been anyone (personally I think it was someone connected to Zoe Quinn or maybe some Kick Vic hardliners) but either way, it doesn't matter because the site's back up and we've been through a lot worse over the years.
 
  • Like
  • Agree
Reactions: Dork Of Ages, The Pink Panther, Count groudon and 4 others
Status
Not open for further replies.
Back