GearHead-EFI.com Hacked and deleted!

[EagleMark]

Someone hacked the GearHead-EFI.com server early this morning and stole and delted it's entire contents. Server logs show the IP address and tracked it in Washington near Seattle. Police there are attempting to track down the location!

I don't have any enemies, just one person I can think of that would do this out of envy/jeaousy and rage! Because of what I know. He happens to live there. Is a known lier, cheat and has been involved with stealing 2 other data bases from websites to make the one he has now where people are banned if they link here! Kind of ironic ay?

I hope the IP can be tracked to him this time.

[88ragtop]

Mark,

Any indication on how they got in?

Feel free to PM/email me if you don't want to discuss in public. May be able to get you some assistance.

- Frank

[EagleMark]

Server people said hacked, IP adress logged, police notified, all security passwords have been changed. Server is GoDaddy so I would think everything that could be done is. They have gone out of there way to help, track, report this as well as go over all I can and need to do to prevent this from happeneing again. Since pentagon and CIA servers were hacj\ked this year I don't think it can be totally prevented by a good hacker.

If you have any specail skills we could use beyond what was mentioned please feel free to PM me! This website hsa always been a team effort. :thumbsup:

Strange how they only stole GearHead-EFI.com folder and deleted it when done? Could have easily deleted or stolen all other websites on my server?

[1project2many]

You also posted a link recently to a Chinese site which connected you with stolen or pirated documents. Maybe you got someone's attention?

We'll know if we start seeing pirated copies of the lookup program floating around.

[JeepsAndGuns]

Wow. If everything was deleted, how come we are still here? I am guessing there was a backup of the complete site stored somewhere seperately?

[EagleMark]

You also posted a link recently to a Chinese site which connected you with stolen or pirated documents. Maybe you got someone's attention?

We'll know if we start seeing pirated copies of the lookup program floating around.I doubt that was the cause, but I am going to delete that thread. It was only meant to show what tech the Chinese have stolen from us and then blatantly put up to prove? I don't know what they were trying to prove.

BCC Find is protected by Copyright of this site. It can not be stolen and used anywhere... except china...


Wow. If everything was deleted, how come we are still here? I am guessing there was a backup of the complete site stored somewhere separately?I learned a long time ago that the best Webmaster is Jesus! Why? Because Jesus saves!

It was 2 hours work but as far as I can tell we didn't loose a post. Also just found out they tried to get data base but were unsuccessful. So php database is where posts are...

[1project2many]

I learned a long time ago that the best Webmaster is Jesus! Why? Because Jesus saves!
LOL!!!!

Well, it's ironic that I kept it locked away for so long because I didn't want it taken, and now it's gone in a month or so. Oh, well. But the good side is that I have new and improved version in the works, plus I've been reading through bithoist code to understand how it works and maybe we can put an ID program up as well.


It was 2 hours work but as far as I can tell we didn't loose a post.
Mark, that's awesome. I'm sure this was more frustrating to you than anyone else. You've put in a helluva lot of work for this site and it shows. Keep up the good work.

[EagleMark]

Mark, that's awesome. I'm sure this was more frustrating to you than anyone else. You've put in a helluva lot of work for this site and it shows. Keep up the good work.Thank you and thank you for being part of it! :thumbsup:

Frustrating was a HUGE understatement to find this before I even had a cup of coffee!!! :mad1: And just barely got it done and partially tested before I had to leave for doctors appointment. It was not a good morning...

[93V8S10]

Thank You Mark!

[dave w]

Mark,
I greatly appreciate all your efforts to keep this site up!:thumbsup:

dave w

[EagleMark]

Thank You Mark!Your welcome and thank you for being part of it!


Mark,
I greatly appreciate all your efforts to keep this site up!:thumbsup:

dave wYour welcome and thank you for being part of it!

I'm just doing what I have always wanted to do. It would be worthless without all of you as part of the team! :thumbsup:

[historystamp]

Maybe someone infiltrated your personal computers to get there hands on a password. Suggest checking for malware like key-logging programs.

Thanks for all your work restoring the system.

Robert

[EagleMark]

Thanks for being here Robert! :thumbsup:

Doubt that though. Have all sorts of protection running full time on all three computors at home on wireless network. All scan each day to boot. One of the first things I did this morning was run full scans, no issues.

[JeepsAndGuns]

Sounds like you are a man thats well prepared! Good work!
I bet it just chaps the butt of whoever hacked this place to see it back up and running like new. If they dont get busted by the police, I bet they will try again. We might have to stay on our toes.

[woody80z28]

Mark,
I greatly appreciate all your efforts to keep this site up!:thumbsup:

dave w

Absolutely!

Glad it was saved.

[EagleMark]

GearHead-EFI.com must be a threat to someone? I don't know why? All we do is help people and provide information free! Spend a lot of time making sure it's all accurate. Team work is everywhere! All topics welcome. Debate, dicussion and theories along with testing new ideas are all wide open subjects. Nothing EFI is forbidden. Just register and you can have all files? We don't even have rules?

Totally protected and backed up daily at server and with cron jobs. With this setup even if a hacker could delete website again and get database next time, worst case scenario is we loose 12 hours of posts!

GearHead-EFI.com can not be destroyed! :rockon:

[EagleMark]

I guess Seattle is not a good place to be a hacker as they have special investigative unit thanks to Microsoft and GoDaddy is PISSED!

IP address was a WiFi network at starbucks in Oak Harbor near Whidbey Island Navel Air Station! They have the time and place, now looking at video survalence... I already know who it is, they just have to verify...

[jim_in_dorris]

Mark, while it is possible to hack a site like GoDaddy without account specific information, the most likely scenario is that a trojan or rootkit on your home systems is where the information came from. I do a lot of cleanup work for customers, and the use of malware specific cleaners is really necessary to catch some of the bugs the bad guys use. I don't know what you are using to scan your home system with, and don't recommend posting it here, but if you have any questions, email me or message me and I can recommend some tools to check for bugs.

[EagleMark]

Jim in the position I am in I would take any advice you have to check or further protect my home system if this is a vuneribilty point of maintaining this website. Please PM me.

[historystamp]

A quick way of hardening your home system would be to run Linux on one of your home machines. Do all your web site work from this machine. Linux will come with Firefox, so it will not be a big transition.

http://www.ubuntu.com/ (http://www.gearhead-efi.com/Fuel-Injection/showthread.php?520-Car-VIN-Demystified)

Do not run Ubuntu under windows. Running off of a separate harddrive would be OK.

Robert

[EagleMark]

Just not interested in buying, learning and running another machine right now.

Jim has PMd me some info that will shore up any issues I may have at home.

[droptopstng]

sorry I have been very busy at work so I have not really had time to look around on here so a little late but Im sorry you had to deal with this Mark but I will say from someone in the automotive field this is one of this best sites I have found and everything I see on here that I know is accurate and well maintained at that.Thank you Mark for providing this awesome site for those of us who want to learn.To anyone who doesnt like it - Karma sucks, even if someone has to make sure karma knows what someone did.I could not imagine how much work you put into this site but thank you for all of it and all the help you and everyone else on here has given me.I help people as much as I can sometimes im a little{lot} sarcastic but I mean well and let me say if i can ever help any of you please feel free to ask...

[EagleMark]

Thanks droptostng!:thumbsup:

If it weren't for the great people involved I would never have put the 1000 or so hours into it over the years! I'm really proud of you guys!

[JeepsAndGuns]

I really hope this person gets brought to justice. Any updates?
I cant believe that the person was smart enough to hack the site, but not smart enough to cover their tracks.

[Six_Shooter]

I was wondering why I couldn't get on the site the other morning.

Quick restoration of the site though, I've been on other sites where they were down from days to weeks, after being hacked!

So what's this guys beef that bans members for linking to this site?

[1project2many]

Here's his reply when asked why a member was banned:

Seems a previously banned member had logged in with another account.
Trolls are not welcome.
It seems they are also sending private messages to new members trying to send them to other sites.
Kind of unethical but i guess I should be flattered that guys come here and take all the information and then go to other sites to post it.

Nothing wrong imo with sending someone to another site with good info. Mebbe Mark would disagree, but the site you use should match your needs and maybe even your personality. The post above was written by someone who's used a lot of info from his days on the old gmecm list which, apparently, is not unethical. The quote is from a public forum so anything there is up for grabs by members and non-members alike. Posting it to another public forum is perfectly acceptable. The efi tuning hobby would be nothing today if this weren't true.

[EagleMark]

I really didn't want to bring that into the picture...

But that was my son. Kid-Neutron. Don't believe me check his email account and ebay account they all lead to his name his bank account. He is/was a great IH enthusiast. We had a 1228747 ECM for his truck but decided with 16197427 long ago. He said I thought you could tune 1228747, I said I can... he showed me the post and I gave him all the information and link to files. He helped the guy who only wanted in first post TunerPro $4F files and bins. Just a week earlier we helped 1leg and found $4F has 2 aldl file so BOTH were there. Bill said $4F had no support... Bill thought it was me, banned my son and deleted the links to files. He also edited JeppandGuns post and deleted the link to BCC Find. I was banned there a couple years or so ago for giving corrected information as well, before this website was formed.


I do not find it unethical to send someone to another site for information especially if we don't have it and somewhere else are specialists at it. I regularly send guys to TGO some have come here because of our involvement with TunerPro and tuning everything, not just one type vehicle. This site was to provide information, the ones who were involved since begining were tired of uploading files over and over again at sites around the internet so we had a place to put our stuff and could talk about any vehicle system! I still visit other sites and help and learn, I also link to files here when we have them or specilty places that do. Why would I find it unethical to give someone what they need or not tell them where to find it?

What I find unethical and in this case ironic is the IH injection section was my idea, Bill, I and others jumped in back in 1999 on my local clubs website I built while taking my 13 webmaster couses at North Idaho Collage, because Binder Bulletin did not want anything to do with it and we formed it. The site went virel and took away a lot of traffic from Binder Bulletin which was and always was the go to place for anything IH. Before the internet it had a monthly newsletter with tech writeup and Q and A, like a forum but monthly. Something changed and I guess they got intrested because bill then took all the work to Binder Bulleitn for years... Then it was sold. The admins and moderators (bill) stole the entire database and created Binder Planet. So the company who bought Binder Bulletin got only the name. Now that is unethical. He claims all work of others as his including DuraSpark distributor conversion which was in Custom EFIS handbook years before he had an IH, the work can also be traced back to DIY EFI, again unethical. And someone giving information is a troll? Not only unethical but mis informed at the meaning of word.

Now I don't ask much around here but I will ask that you just put this to rest, don't do anything, I have had PMs about this and appriciate the loyolty, but advised they do not get involved, there is nothing to prove or gain, and go back to our positive attitudes and enjoying what WE do and each others company! :thumbsup: