So we're still trying to get things sorted out. Here's what we know so far:

• The attacker gained administrative privileges through an unused account that had administrative rights
  
• The attacker had administrative access to the forums and executed control panel actions from 5:25am EST - 5:51am EST
  
• The attacker created an email list of board members. It is safe to assume he retrieved it and stored the list on his local machine
  
• Passwords were not compromised as there is no way to receive password hashes from the forum itself. The attacker never had access outside of the vbulletin admin panel. (Yes password are hashed and salted)
  
• Other actions included altering forum permissions then deleting forums, leaving only the recruitment and general forum behind
  
• There is no "quick" or "easy" way to receive IP addresses from users as an administrator must go from profile to profile and manually copy and paste last login IP addresses.

We are still investigating, however it appears that the only damage done was a leak of email addresses as well as loss of forum data. If anyone has any information that they would like to share, add me on steam and leave something on my profile so I know to accept it (too many spam bots add me so I generally ignore friend invites).

Side note, atf2.org is getting a face lift, I'm gonna try to get the stats thing back in place, I'm taking feature requests for the bots, and I should have the @atf2.org host fixed. So there may be a few site/bot restarts tonight. Other than that, if you want anything added in the bot just let me know!

Thanks,
blindsight

Hey guys,

blindsight here looking to get my foot in the door with ESEA. Looking for a scout spot on a low-mid open team. I have some exposure from 6s in UGC as well as doing pugs. I'm constantly working on improving dm wise, game sense wise, and of course as a team member. I'm free almost every night and can be flexible with my schedule as well. Feel free to add me for try outs http://steamcommunity.com/id/BlindSightSniper

Just want to add in,

Pretty much the project I'm working on will bring the pug and mix channels together (i.e. #tf2.mix.nahl, #tf2.pug.nahl, #tf2.mix.euhl, maybe #tf2.pug.na if they want) and have it so it can be easily used by a website with a nice GUI and IRC interpreter for people who can't figure out how to use IRC. As always, this will let players still use the traditional IRC method of just installing a client, connecting to the network, and adding up that way. I've been running some stats programs for the past week or so collecting data on all the servers to help get the in game stats system going as well as the traditional stats (really, what does that really do at this point?). This project will definitely be a challenge to get it just right but hopefully with enough support I can make this happen. Anyone interested in helping, feel free to message me either on IRC, ugc, or steam.

If anyone is having any issues, here is what I suggest and here is what worked for me:

If you get an error message like this:

http://nsrt.me/bin/1390526103.png

1) Validate your TF2 cache ( Steam -> TF2 -> Properties -> Local Files -> Verify Integrity of Game Cache (there will probably be a lot of errors)

2) Move your download and cfg folders to your desktop (you will most likely loose either in the update, I did it as a precaution)

3) Exit and relaunch steam

4) Update TF2 (it should work now)

5) Move your folders back, but keep a copy on your desktop or back up location of choice just in case

6) Start the game, it should work.

Let me know if this helps anyone!

If you already use GeeksIRC for mixes, pugs, etc you can just /join #tf2scrim.hl to have everything in one window :)

The old bot is beyond borked. The database runs slow as hell (takes about 4 seconds on a good day to add), sometimes it decides not to add at all, it randomly locks up sometimes, it's not being supported any longer (seriously, what happened to dad?), gamesurge for some reason has a weird system where if it detects the same response (ping/pong) in a consecutive pattern it just times out the connection. (why, I have no idea) Considering that 70% of the people in PuG also plays mix, them "moving" should not have much bearing on the channel. In fact, it may even give it a good kick to get it started. For a while pug.na took forever to get going, and now there are literally 7 - 10 games a day. I realize 6s is way easier to start than a HL PuG, but with the interest of the new bot, new channel, new network ( which, as stated will be familiar territory to mixers that play in pug) it may give the boost pug needs to get back to its old self.

I have added you in order to discuss a solution.

No, every time you connect your actual IP gets parsed. The problem is OP's network is on that particular spam black list website (which the link to why is right in the client)
http://www.sorbs.net/lookup.shtml?199.16.223.2

http://puu.sh/5zPY8.png

This system is shared by hundreds of other networks, except gamesurge (hence why you see the spam all the time) HiveMind will need to go through and follow the process of having the IP delisted from that site.

HiveMind: Are you on a school network, or public network, or something along those lines?

We don't use the bot anymore on GeeksIRC. I know I should have told him to create an account, but I was in the middle of a project and half way out the door so I was not thinking straight. He has been on our network with no problems at all. As for 4) and 9) I am going to have +P set so that does not happen. As for 5) we put our staff through a long trial period and see how they do, giving them power in increments while being monitored. The current opers have been known users across the networks I have been on as well as personal friends, so I am fully confident that they will not turn. As for 6) I still don't see what you're trying to push if they are the ones that want to move in the first place. (they were looking at networks anyways so I suggested GeeksIRC). There has been no problems with the current anti-spam system in place (which is on many other networks, so its not just us that uses it). Also, why do you keep calling me blindtalent?

I see what you are saying, but either way about it's Cinq that want's to move. It is his decision, not mine. The other channels wanted to move as well so they chose us. Cinq tried to talk them in to QuakeNet, but they saw the incompatibilities and decided to go to GeeksIRC. The point is, it is not me splitting the network it's the channel owners. All I am doing is just running another network, which appeals to them. And since the majority of channels are moving to GeeksIRC, I really can't say that I'm the one causing the fragmentations.

GameSurge has those channels at the top of the list as well. The widget that shows "Top Channels - By Most People" is just a compiled /list of the top 5 public channels with the most people in it. Also, its going on 11PM on the West Coast, and 2AM on the east coast. Also the channel /list stats get updated every 4 minutes or so.

Also

http://puu.sh/5sFLl.png

What's your whole point in all this anyways?

1) Fog is incorrect, channel founders (or any channel ops for that matter) can not see IP addresses. Only IRC Operators can see IPs.
2) The channels have decided that they want to move themselves, and they selected GeeksIRC so don't point your finger at me.
3) "What will that process entail when the proxy bot is also an IRC admin and the users get banned from the entire network?" I have no idea what you mean by this sentence, the bot does not exist on our network as it does not need it.
4) I plan on removing the redirect bot from #tf2.mix.nahl by the end of the week and just reset the topic.
5) I am already staff on GameSurge, so I really am not loosing much...
6) The network has been tested and proven, it just received a new name a few months ago.
7) If 80% of the channel want to move to GeeksIRC and #tf2mix and #tf2scrim want to go to quakenet, then that is their own prerogative.
8) The bot technically has no false positives as it checks through known dnsbl (black list) databases, and as soon as it detects it, it automatically kicks in. (I realize, some users don't know they are there but as you said I'd rather have them sign up for an account then remove the bot and have another botnet/spam attack)
9) When old players return they will just read the topic and move on, not a big deal and for most pug players it's simply just adding a new favorite in their browser.
10) tf2mix is moving because their system (atf2) does not work with GameSurge, so you don't need to blame me for that one.

The point is the network has been around for a while, it just received a new name and new servers. Believe it or not, but the TF2 community is not the only community on it so it's not like I created a glorified network for TF2.

From the SpamMaster8000 Bot Developer:

Spammaster8000 A.K.A AntiTOR-Bot - The bot was designed to remove spam users from the channel that were not registered with AuthServ. The bot could detect the users IP addresses because the GameSurge IRC network did not cloak non-registered users. Sometimes false positives can happen. The GeeksIRC network uses an IRC server daemon that has this functionality built in and will not allow the users to connect to the network to begin with. Basically this bot was designed specifically for GameSurge because of the lack of protection from spammers.

On another note, people that have connected to our network have NOT had an issue with our spam protection yet.

#tf2.mix.nahl, #tf2.pug.nahl, #tf2.pug.na, #tf2.mix.eu, #tf2.mix.euhl, #tf2ringer, are going to GeeksIRC while #tf2mix and possibly #tf2scrim are going to quakenet. We could always start an NA 6s channel on GeeksIRC but I'd rather find a way to come to terms with Cinq before doing something like that. For reasons beyond my knowledge Cinq has a desire to move to quakenet, when in reality the back end of their network is, well... not the best to say the least. The IRC Daemon is ancient, they have 0 services, the opers are not the friendliest, and the network was originally created for non-bot use (there used to be a rule about not having bots). It's pretty much impossible to move all the channels to QuakeNet as the bot are already programmed for universal services, such as what GeeksIRC and GameSurge(to an extent) provide. And since a good chunk of the channels have already settled in (EU will start this week) we can't relocate them and cause havoc (let alone reprogram all the bots to somehow work on quakenet without getting g-lined for excessive flood). The point is, I've tried to reason with cinq, I've told him the problem with ATF2L (which quiet frankly could be solved by gamesurge) yet I have no way to prove our services otherwise. Yes, GeeksIRC is new but the staff is not to IRC. The network is pretty much a mosh of users that have been on the net for years, and know all the back ends and tricks of IRC and the services. Are we the largest network? No, not by a long shot. But we are growing and with our user satisfaction and the perks of trusted unthrottled bots, I can safely say that the network will continue to grow and branch out to other communities.

GeeksIRC provides a webchat with 3 different clients to choose from. GeeksIRC also has servers from America to Europe as well as some new European pug channels coming soon.

***If your authserv account name does not match your regular nickname:
You can simple sign in to the network using the account name and password that you just created, then once you are in the network type /nick whatevernickyouwanttobeknownby then /msg nickserv group accountname

When you do this, you will be able to login to your account with the new nickname while still maintaining your original account name as your "logged in as" so the bot will see the stats.

Example: Let's just say my authserv account name was meettheflinstones but my regular nickname was elmo, what you would do is fill out that form with meettheflinstones and whatever password you want. Then, when you go to the webclient, http://webchat.geeksirc.net/tf2.pug.na , click something that says "I have a password" or "Password" or "Login to Services". You would then fill in the username/nickname with meettheflinstones and your password to password. Once you have done that, you go and type directly in the channel /nick elmo and then do /msg NickServ group meettheflinstones

After doing this, you will be able to login with elmo and your password.

*Note, the webchat that is most similar to GameSurge is qwebirc which is the blue block all the way on the right.