Welcome! Please take a few seconds to create your free account to post threads, make some friends, remove a few ads while surfing and much more. ClutchFans has been bringing fans together to talk Houston Sports since 1996. Join us!

Torrents post oink

Discussion in 'BBS Hangout' started by aznhobo1, Nov 6, 2007.

Tags:

Page 6 of 14

Invisible Fan Member

Joined:

Dec 5, 2001

Messages:

45,954

Likes Received:

28,046

I don't think what is registering upload credit...

thegary said:

didn't see this^ yesterday.
you don't happen to have an invite do ya?
Click to expand...

Just received one, check your mail.

#101 Invisible Fan, Nov 12, 2007

ROCKET RY Member

Joined:

Aug 2, 2000

Messages:

307

Likes Received:

2

Will trade STMusic invite for what.cd or waffles..

jagger421@yahoo.com

#102 ROCKET RY, Nov 12, 2007
Lynus302 Member

Joined:

Feb 14, 1999

Messages:

6,382

Likes Received:

199

Do you have any more Waffle invites, LonghornFan?

Lynus302 at yahoo dot com

#103 Lynus302, Nov 12, 2007
JPM0016 Member

Joined:

May 23, 2003

Messages:

4,470

Likes Received:

43

What.cd has been down all weekend for me. It worked for a hour or two but nothing had been seeded. If an extra Waffles invite appears, i'm dying for one.

JPM0016@aol.com

#104 JPM0016, Nov 12, 2007
Mr. Brightside Member

Joined:

Mar 27, 2005

Messages:

18,964

Likes Received:

2,147

I got this email from the RIAA two hours ago:

from piracy@riaa.org
date 12 Nov 2007 11:42:01 +0100
subject Music Piracy

4:42 AM (2 hours ago)

Dear registered user of the site What.cd,

We have recently been investigating the activities of the users of the
site http://www.what.cd/ and we have found that this site exists for the
sole purpose of music piracy.

Pirating music is a criminal offence and we believe it should be obvious
to you that the results outweigh the benefits - hard working artists
won't be rewarded for their work and will stop producing music,
ultimately leading to a severely reduced selection of music both in the
shops and for download.

The RIAA had hoped that the disabling by the police of the large illegal
music site, Oink.cd, would stop a lot of people from engaging in piracy,
as they don't want to be seen as criminals. However, this appears to
not be the case, as two large new sites have sprung up in its place.

This email is the final warning to all of you who were members of
Oink.cd and are current members of What.cd. If we find you to be
committing any more criminal acts of piracy then we will have to press
charges against you, as representatives of the major record companies of
America.

Yours Faithfully,

The RIAA

Anyone else get this?

#105 Mr. Brightside, Nov 12, 2007
Harrisment Member

Joined:

Jun 20, 2001

Messages:

15,392

Likes Received:

2,158

Mr. Brightside said:

I got this email from the RIAA two hours ago:

from piracy@riaa.org
date 12 Nov 2007 11:42:01 +0100
subject Music Piracy

4:42 AM (2 hours ago)

Dear registered user of the site What.cd,

We have recently been investigating the activities of the users of the
site http://www.what.cd/ and we have found that this site exists for the
sole purpose of music piracy.

Pirating music is a criminal offence and we believe it should be obvious
to you that the results outweigh the benefits - hard working artists
won't be rewarded for their work and will stop producing music,
ultimately leading to a severely reduced selection of music both in the
shops and for download.

The RIAA had hoped that the disabling by the police of the large illegal
music site, Oink.cd, would stop a lot of people from engaging in piracy,
as they don't want to be seen as criminals. However, this appears to
not be the case, as two large new sites have sprung up in its place.

This email is the final warning to all of you who were members of
Oink.cd and are current members of What.cd. If we find you to be
committing any more criminal acts of piracy then we will have to press
charges against you, as representatives of the major record companies of
America.

Yours Faithfully,

The RIAA

Anyone else get this?
Click to expand...

Yeah I got that too.

I just went to what.cd and saw this. But it doesn't really explain how they know it's fake.

===========================================
∼ Someone really doesn't like us! ∼ posted on Nov-12-07 by What

"Edit by DAQ: These fake RIAA Emails are just that. Fake. http://pastebin.ca/770503 Read that."

#106 Harrisment, Nov 12, 2007
Last edited: Nov 12, 2007
Mr. Brightside Member

Joined:

Mar 27, 2005

Messages:

18,964

Likes Received:

2,147

Harrisment said:

Yeah I got that too.

I just went to what.cd and saw this. But it doesn't really explain how they know it's fake.

∼ Someone really doesn't like us! ∼ posted on Nov-12-07 by What

"Edit by DAQ: These fake RIAA Emails are just that. Fake. http://pastebin.ca/770503 Read that."
Click to expand...

Actually just logged into What.cd and they said it was a fake. Some hacker group sent the email.

#107 Mr. Brightside, Nov 12, 2007

LonghornFan Member

Joined:

Sep 16, 2002

Messages:

15,718

Likes Received:

2,628

It's actually the work of a 14 year old kid in the UK.

Show/Hide ∼ The guys behind the attacks ∼ posted on Nov-13-07 by What

So, there's been a lot of speculation about who was behind the attacks on us. Waffles? RIAA? We've already come out and told you that it isn't the first. The waffles guys are cool, really. And the RIAA? Well, they don't redirect people to shock sites, as far as I know. So, who else would want to hack us? We've done our detective work, and located the two people. If you want to know who they are, skip to the end of the post. If you want to know who they are and why they hate us so much, read on in the ordinary up-down fashion.

When we first opened our public beta, we were temporarily hosted on the bitient.org server, which was owned by one of our admins (Noah). Noah also lent out hosting space to a few other people, and gave them shell access. When Noah granted us access to his server and IRC network, one of the owners to a site hosted on the server saw us as intruders, and felt a great deal of animosity towards us. This user's nick was 'P3T3R'. We left him alone, because it's never good to make enemies when you're running a site like this, but he seemed very intent on intimidating us. The following is from my IRC logs:

[Sat Nov 3 2007] [23:23:38] (P3T3R) btw, be prepared
[Sat Nov 3 2007] [23:23:42] (P3T3R) i'd watch it if I were you
[Sat Nov 3 2007] [23:24:02] (P3T3R) make the most of what you have while you have it
[Sat Nov 3 2007] [23:24:14] (P3T3R) cos you just might have it taken away from you...
[Sat Nov 3 2007] [23:24:37] (WhatMan) What the hell are you on about, P3T3R?
[Sat Nov 3 2007] [23:24:43] (P3T3R) i'm not quite sure
[Sat Nov 3 2007] [23:24:48] (P3T3R) or am I?

We suspect he was working with his brother 'biscuit', who has a reputation of being quite knowledgeable about linux, and 'hacking' in general.

Things were pretty normal for the next few days, but then we started seeing disturbing things appear in our database. Most of you guys know what these disturbing things were - redirects to shock sites, fake RIAA notices, etc. We initially thought that this was because of SQL injections - after all, TBSource comes with a load of exploits by default. So we went through the site, and patched up all the injection points (there were a lot of them). When we put the site back up, we immediately got hit by another attack. So we took it down again, and found and patched a couple more exploits. Then we put the site back up, and got hit by another attack.

After checking our database logs, it became painfully clear what had happened. The site and the database are hosted on separate servers. The attacker was connecting to the database server from the web server, but it didn't look at all like an SQL injection - none of our ordinary database calls accompanied the malicious queries. So, we decided that the attackers must have access to the web server, and since it was time to move from that temporary server anyways, we packed our bags and left.

This is when the SQL attacks stopped.

As we've already stated, the attackers then turned to brute force. The DDoS attack was well done, which made us think that the attackers were more than bored kids - but then, they sent out a ****load of fake RIAA emails, which looked like the work of a 14 year old. It was these emails that allowed us to track down the attackers.

The emails were well spoofed - the "originating IP" belonged to Dutch offices owned by the RIAA. However, they made a serious ****up - a load of them were sent from riaa@bitient.org. This is not the case of a hacked mail script, as we never had a mail script - this was the case of someone trying poorly to hide their identity. A couple hours after these emails were sent out, every user in #what.cd received a CTCP-Version request from a user called 'biscuit'.

This is where it gets cool.

Sending version requests to everyone in a channel is the sort of thing script kiddies looking for someone to hack would do. As a good sysadmin, I tracked down biscuit's IP address:

[22:17] [Whois] biscuit is biscuit@b.i.s.c.u.i.t.1.3.3.7.h.a.x.0.r.r.o.o.t.NET (Biscuit)
[22:17] [379] biscuit is using modes +wrxt
[22:17] [378] biscuit is connecting from *@5acf5b58.bb.sky.com 90.207.91.88

And searched for it on the site - I came up with this account: http://what.cd/userdetails.php?id=1106

So, p3t3r and biscuit are on the same IP address. They both hate us, and p3t3r has openly threatened to take our site down. P3T3R has an account on the site, that logs into frequently, but never uses to upload or download. They both have shell access to our original server, so they could get into the database. Biscuit, the "1337 hax0r", sends a version request to everyone on IRC, a couple hours after scam emails have been sent out from a server they have access to. A little more research shows that P3T3R is 14 years old, and biscuit is his brother. It all sounds pretty conclusive to me. I go on to the bitient.org IRC channel to see what I can find. What do I find?

[22:37] (Noah) BISCUIT!
[22:37] (Noah) You'd better not have been the one sending those fake RIAA emails!
[22:37] (P3T3R) :O
[22:37] (Noah) And you most certainly have better not have been the one behind the hack
[22:37] (Noah) the emails CAME FOMR MY IP!
[22:37] (P3T3R) hack?
[22:37] (Noah) FROM THIS ****ING SERVER

This pretty much convinced me that these two (especially P3T3R) were the ones behind the attacks. So, I'm sure you're all curious as to who these people are.

We only went so far as to find out info on P3T3R. His name is Peter Cole, and he lives in Yorkshire, in the UK. His email addreses are p3t3r@p3t3r.co.uk and peter.j.cole@gmail.com (the second one is also his MSN). His AIM is P3TP3T3R, and his Yahoo messenger username is pe3te3r. He has a personal web site (hosted on the bitient.org server) at p3t3r.co.uk - sadly, his home address and phone number are hidden from the whois. There's a ****load of information on him, easily accessible via google.

Neither I nor the rest of the staff is going to do anything to him - we just thought you'd like to know who the d******d with your email address is. You can do with this information what you please.

EDIT: I had a nice chat with Noah earlier - apparently, P3T3R isn't the *******, his brother is. His brother's name is Richard Cole, uses the email address b@iscuit.co.uk and owns the domain iheist.com - and the whois information for that isn't kept a secret. This is their address and phone number:

Administrative Contact:
Cole, Richard @googlemail.com
5 Tenterfield Rise
Halifax, Other HX3 7AN
UK
+.01422209759 Fax: +.01422209759

We also got a load more proof from Noah - he read their history file. It is available online here: http://pastebin.ca/770838 The cool **** starts at command 491 (a DOS attack). You can also see biscuit hacking our database, etc.

I've removed his email from the news post for the day, at Noah's request - he wants to flame him without his email getting lost in piles of spam. I'll re-post it when Noah's done.
Click to expand...

#108 LonghornFan, Nov 12, 2007
LonghornFan Member

Joined:

Sep 16, 2002

Messages:

15,718

Likes Received:

2,628

percicles said:

Couldn't find it.

percicles77@hotmail.com
Click to expand...

For some reason I lost the invite since waffles does not allow hotmail accounts.

Change over to Gmail or Yahoo and I'll send an invite when another becomes available. I have zero now.

Edit: I've sent What.cd invites to everyone who has posted their email addy's in this thread.

#109 LonghornFan, Nov 12, 2007
percicles Member

Joined:

Jun 11, 2002

Messages:

11,987

Likes Received:

4,438

LonghornFan said:

For some reason I lost the invite since waffles does not allow hotmail accounts.

Change over to Gmail or Yahoo and I'll send an invite when another becomes available. I have zero now.

Edit: I've sent What.cd invites to everyone who has posted their email addy's in this thread.
Click to expand...

Will do. Thanks Longhornfan.

#110 percicles, Nov 12, 2007
thegary Member

Joined:

Jul 22, 2002

Messages:

11,006

Likes Received:

3,128

Invisible Fan said:

Just received one, check your mail.
Click to expand...

thanks man. however, STMusic is not taking the invite-code you gave me. XCheckLength! is what it's stuck on when i try to enter the code.

edit: nevermind, i just had to type it by hand, it didn't like me copying and pasting. cheers.

#111 thegary, Nov 12, 2007
Last edited: Nov 12, 2007
RocketsPimp Member

Joined:

Feb 15, 1999

Messages:

13,812

Likes Received:

194

percicles said:

Will do. Thanks Longhornfan.
Click to expand...

I have two. Send me your email addy.

Longhornfan, do you have any more waffles to spare? I had over a 6:1 ratio on Oink and the same on Demonoid (over 250 gigs UL on both).

#112 RocketsPimp, Nov 12, 2007
thegary Member

Joined:

Jul 22, 2002

Messages:

11,006

Likes Received:

3,128

i'm also still interested in waffles when they become available.

#113 thegary, Nov 12, 2007

Blatz Member

Joined:

Oct 27, 2002

Messages:

7,222

Likes Received:

3,472

So is Waffles the new Oink?

Had a great ratio (60 something thanks to free leach week.) on oink and would love an invite to another.

b_swinly at yahoo.com

Thanks

#114 Blatz, Nov 13, 2007
Last edited: Nov 13, 2007
Invisible Fan Member

Joined:

Dec 5, 2001

Messages:

45,954

Likes Received:

28,046

LonghornFan said:

It's actually the work of a 14 year old kid in the UK.

The emails were well spoofed - the "originating IP" belonged to Dutch offices owned by the RIAA. However, they made a serious ****up - a load of them were sent from riaa@bitient.org. This is not the case of a hacked mail script, as we never had a mail script - this was the case of someone trying poorly to hide their identity. A couple hours after these emails were sent out, every user in #what.cd received a CTCP-Version request from a user called 'biscuit'.
Click to expand...

Click to expand...

I gotta admit that those emails had me spooked before I looked at the entire email header.

What's free leech contest sounds interesting. For former oink members, the targets should be easy.

#115 Invisible Fan, Nov 13, 2007
Ziggy QUEEN ANON

Joined:

Jun 11, 1999

Messages:

37,268

Likes Received:

13,731

what.cd 4 waffles
AIM:razcan

#116 Ziggy, Nov 13, 2007
Xenochimera Member

Joined:

Jan 14, 2005

Messages:

1,929

Likes Received:

25

if anyone got more invites: xenochimera@gmail.com

thanks

#117 Xenochimera, Nov 13, 2007
RocketsPimp Member

Joined:

Feb 15, 1999

Messages:

13,812

Likes Received:

194

The Chronological X-Men has been uploaded onto what.cd. For those that don't know, it's a great way to boost your ratio. Just don't download the whole thing.

#118 RocketsPimp, Nov 15, 2007

raw10628 Member

Joined:

Feb 17, 2004

Messages:

401

Likes Received:

5

RocketsPimp said:

The Chronological X-Men has been uploaded onto what.cd. For those that don't know, it's a great way to boost your ratio. Just don't download the whole thing.
Click to expand...

What's wrong with downloading the whole thing?

#119 raw10628, Nov 15, 2007
professorjay Member

Joined:

Oct 20, 2006

Messages:

9,676

Likes Received:

388

If anyone has any more invites, it would be appreciated:

professor.jay at gmail.com

#120 professorjay, Nov 15, 2007

(You must log in or sign up to post here.)

Page 6 of 14

Share This Page