Lemon 64 and Lemon Amiga sites down after being attacked

[1024MAK]

Unfortunately another community has been subjected to an attack. Both Lemon 64 (for Commodore 64 machines) and Lemon Amiga are down.

On the Spectrum Computing forum, PROSM says:

According to lifeschool over on the English Amiga Board, both Lemon sites have been hacked:

SQL injection, LA and L64 sites compromised. The hackers want money to reveal how they did it.

It may take some time to secure the site, but Kim says it can be done given some time.

This is an increasing problem, so I hope eab is secure?

Mark

[rubber_jonnie]

Unfortunately pretty much any site that holds any user data is 'fair game' to these scumbags.

If they can extract PII (Personally Identifiable Information) then great, otherwise bring it down.

When I hosted my own site it was never ending, which is why I gave it up in the end.

Same reason I moved my email services to an online service, the attacks were never ending and the time to manage it was just too great.

[exxos]

Damn :(

Though gong by the amount of spam attacks after the wiki went live and me spending the past few weeks fighting tens of thousands of attacks on the server.. it's no small job anymore :( there's around 20,000. Banned IPs in the firewall currently. Tiny really. But those resulted in around 2 million requests which crashed the server a few weeks ago.

Like I've said and a guy on EAB, hobby servers and sites are becoming a thing of the past now. It's just turning into a full-time job fighting attacks :( I think the internet will just end up with the tech giants and media sites etc in the end.

[exxos]

Dear Lemon visitor,
We are deeply saddened to inform you that our beloved retro computing hobby project, which has been a labor of love for over 20 years, has been attacked. Unauthorized individuals have accessed our database.

What Happened:

Our website suffered a security breach, and our database was accessed without permission.
We are currently investigating the breach and working to secure our systems with the help of voluntary cybersecurity experts.
Our Response:

We are doing everything we can to understand how this happened and to prevent it from happening again.
The authorities have been notified, and we are working to strengthen our security measures.
The passwords in phpBB3.3 use an exceptionally strong and secure method of encryption. This means that your password cannot be decrypted. Regardless of this, we recommend that you change your password once the site is up and running.

We are truly sorry for any inconvenience or worry this may cause. This community means the world to us and we are totally committed to fixing this. Thank you for your understanding and patience as we work through this.

With a heavy heart,
The Lemoners Team

[exxos]

Looking through the EAB thread, it looks like there may have gained access via old accounts with weak passwords.

I don't remember the password length or complexity of this forum when it first went online. I doubt it was "bad". Though I may start doing cleanups on accounts at some point in the near future. In that anyone who has registered, never logged in or posted will have their accounts deleted as presumably they are just abandoned. I think having thousands less of dormant accounts can only be a good thing :shrug:

[BennehBoy]

Looking through the EAB thread, it looks like there may have gained access via old accounts with weak passwords.

I don't remember the password length or complexity of this forum when it first went online. I doubt it was "bad". Though I may start doing cleanups on accounts at some point in the near future. In that anyone who has registered, never logged in or posted will have their accounts deleted as presumably they are just abandoned. I think having thousands less of dormant accounts can only be a good thing :shrug:

It really is worth doing.

The key thing is to make sure that your important accounts have unique passwords and preferably 2 factor authentication (mobile text required etc)... e-mail being the absolute king of what needs to be kept protected, if you lose that then you've lost the keys to the kingdom as most sites use it for authentication and recovery.

[exxos]

The key thing is to make sure that your important accounts have unique passwords and preferably 2 factor authentication (mobile text required etc)... e-mail being the absolute king of what needs to be kept protected, if you lose that then you've lost the keys to the kingdom as most sites use it for authentication and recovery.

Yep True.

It's why I enabled 2FA on facebook a few weeks ago as someone tried to hack it. Though there are that many security holes in Facebook it is unbelievable anyway! Though Facebook is becoming total cesspool of fake accounts linking to virus ridden websites of late. It is bad enough with all the virus ridden adverts. I keep getting friend requests from famous celebrities who only have like 200 followers who are generally all old men... So you can pretty much guess how that is going to unfold...