OFFICIAL FURILEAKS THREAD

[Vitae]

I'm so glad I was rejected when I tried to return as an administrator years ago. So glad I don't have to deal with this shit. So... so glad.
Now, if Dragoneer resigns and another is made to take the reigns, someone with not only experience in running a popular website but one with an actual sense of security and humor, I would love to come back. I've been wanting to help come up with a new design to replace the years old crap that they've been running, which was my original intention of joining the administration team when FA was getting started.

I'm hoping this is more of a rebirth of the website, of FurAffinity, into something actually usable and fun.

[a pigeon]

Now he says something:

By now we pretty much know what happened. There was a multi-stage attack on FA and an admin account got compromised. The entire story is fairly complex, and we'll be posting details about the entire event soon.

We regret that this happened, but are working to ensure that it doesn't happen again, and that we treat this responsibly and professionally.

Question: is FA secure?

Answer? Yes.

The accounts that got compromised was two admin accounts. **Our database WAS NOT hacked, no user passwords were given out**, and the worst issues involved notes from site staff being leaked out (mostly on the admin side) and other confidential information. So the only people primarily affected were site staff, along with a few other individuals were hit, but the damage was relatively minor overall.

We regret that this ever happened.

We've resolved the issues on our side that lead up to this, and are continuing to examine the logs and review what happened to ensure a safe cleanup. We're pulling people in for extra security, and will be reviewing the issues.

Again, we'll post up a full explanation of what happened once we are doing reviewing the logs, as this was a fairly elaborate attack. But I must stress what happened to FA was not specifically an "FA flaw", or something necessarily wrong with the site. What happened to us could happen to any site, anywhere, as it involved a bit of social engineering and some well played cards.

The staff are as committed to the site as we've ever been, and this is by no means going to lesson our commitment to the community.

NOTE: I had initially posted that I had felt this may have been related to the events at Gawker Media. While several accounts on FA were attacked because of the leaks on Gawker, it was NOT related in the end.

My apologies on that.

http://www.furaffinity.net/journal/1952132/

[Conan]

What happened to us could happen to any site, anywhere, as it involved a bit of social engineering and some well played cards.

Yeah okay then.

[Pi]

That's exactly the kind of inaccurate non-answer that he so loves.

They've been successfully exploited twice in the span of a week. I don't think that really qualifies as "secure".

They've  also experienced a massive data-loss incident. That REALLY disqualifies them from being secure.

[a pigeon]

A person who was targeted by Zaush states that Zaush tried the "exact same shit" on her:

http://i52.tinypic.com/250m1jp.jpg

[AshleyAshes]

If no user or passwords were stolen, how'd they get onto the forums?

[a pigeon]

Dragoneer deleted the previous journal and posted this new one:

Deleted the previous journal - I apparently did not have the full update on the back end.

The long and the short of it - yes, we we hacked. Yes, we have everything under control, and we are currently figuring out the extent of the damage. So far we know that 41 people (including admins) had their notes leaked, and some people had their galleries deleted; the latter we can restore. We will post more updated once we have more information and are able to further review the security logs.

My apologies if mis-spoke in the previous journal. I admit my error.

http://www.furaffinity.net/journal/1952230/
-

Zaush is now saying that we'd all be sorry if he died:

http://i51.tinypic.com/2niv478.png

It's merely people "targeting" him. Utterly oblivious. No one else's feelings exist except his.

[Pi]

Hmm, that sounds familiar

[a pigeon]

Dragoneer's opinion about Zaush:

What he did was not illegal, and I did not feel it was rape. Did he pressure? Yes, but the person said no and did the respectful thing and stood their ground. And I respect that.

But what Zaush did was NOT rape. Still, it's completely understandable for them not to feel comfortable by his actions, feel they were pushing the limit. And this has happened to a few people, but rape? I see no evidence of rape.

I told her if she felt comfortable in doing so to voice her opinion, but that she'd expect to be countered unless she had some people to back her up or had similar experiences.

http://www.furaffinity.net/journal/1952230/#cid:16202235

[Jim Demintia]

The Zaush thing seems to be what people care about more, i.e. anyone hoping that the fandom would finally turn on Dragoneer and FA is probably going to be disappointed (again). I don't honestly give a fuck what his opinion is, because he has no business having an opinion on this. He's only giving one because he thinks people care because he's popular. And sadly, people do care. The only reason he's involved in this at all is because that girl made an amazingly misguided decision to seek out the advice of a man who has no useful wisdom to share.

I am left to wonder if the fandom isn't already internalizing and rationalizing all of this, so that they can return to their state of willful ignorance regarding the malice, criminal behavior, and staggering incompetence of its most popular figures.

Zaush's myopia and ego are rather amazing for their utter obviousness. I wonder if he even expects anyone to believe he'd off himself.

[a pigeon]

The Zaush thing seems to be what people care about more, i.e. anyone hoping that the fandom would finally turn on Dragoneer and FA is probably going to be disappointed (again). I don't honestly give a fuck what his opinion is, because he has no business having an opinion on this.

I reckon many people are going to turn on Dragoneer because of his response to Ferality and the double standards revealed.

My thinking about it, is that Dragoneer gave Mobianfox and Java a heads up and protection, but to Ferality he offered nothing. He simply said the same sort of thing Zaush might have said: "you will have to risk reputation damage and backlash if you say anything" which is a very strong encouragement to keep her quiet. It was well within his power to let Ferality be able to repeat the facts of the matter, in a journal, so that people could be warned, and to prevent any drama (at least on FA) by keeping a very tight lid on all responses, but he did not offer this.

-
Edit:

Here is an example of this, these comments being posted in reply to Dragoneer's: http://www.furaffinity.net/journal/1952230/#cid:16202235

...I've tried for a long time to respect you, but I really no longer can.

If you don't see that as rape, I am highly suspect of your judgement. As well as being highly disgusted.

http://www.furaffinity.net/journal/1952230/#cid:16203445

^Agreed

http://www.furaffinity.net/journal/1952230/#cid:16203445

This is the most stupid, and retard statement I have ever heard. I guess with zaush  being one of your favorite artists, you just had to suck on a dick and say this.
Way to dig your grave a mile deep.

http://www.furaffinity.net/journal/1952230/#cid:16203730

[Jim Demintia]

The Zaush thing seems to be what people care about more, i.e. anyone hoping that the fandom would finally turn on Dragoneer and FA is probably going to be disappointed (again). I don't honestly give a fuck what his opinion is, because he has no business having an opinion on this.

I reckon many people are going to turn on Dragoneer because of his response to Ferality and the double standards revealed.

It'd be awesome; I hope they do. I hope I'm wrong. But you know what they say; the past is the best predictor of the future. Except when it isn't.

Let's hope this is one of those times.

[a pigeon]

It'd be awesome; I hope they do. I hope I'm wrong. But you know what they say; the past is the best predictor of the future. Except when it isn't.

Well, to clarify, I think that "many" people will turn on Dragoneer, but whether it will be enough to force any lasting changes I don't know. And as you said, I'm sure many people will try to rationalize this all away or simply ignore it.

Also, I note that Dragoneer said on furrydrama_2 that his own girlfriend, Sciggles, had told him that Zaush tried the same thing on her that he tried on Ferality:

I tried to clarify that, but I doubt it will matter at this point. When I told Sciggles of this, I left out names... and she mentioned that Zaush tried to do something like this to even her. But she mentioned when she said no, despite him keeping asking and insisting, he backed off.

So I can't verify it on every instance, but I didn't agree with Zaush and the accusations concerned me. I just didn't want her getting burned.

His own girlfriend is waving red-flags about Zaush (asking and insisting over and over, even if eventually backing off, is a pretty big red flag I think) and yet he still suggests that Ferality keep quiet and does nothing. Just like with FA's security and so many people waving red flags over that. Both the Zaush issue and the data loss come back to the same source it seems.

Edit:

Dragoneer has now posted another journal, about the Zaush issue:

Per my previous journal, I wanted to make a clarification:
I didn't support Zaush in the accusations. I supported Ferality, and wanted her to make an informed decision on the matter, and be aware of the issues that would go against both sides.

Nothing more.

I mis-spoke in the last journal regarding my comments on the situation (as you an imagine, I am under a bit of stress). Forcing yourself upon somebody who does not want it is not kosher. I mis-spoke on the issue, and was not trying to belittle the issue whatsoever. I wanted her to make the best decision she could on the matter, and as I recalled she had said no and backed down from the situation, removing herself from it (which was the smart thing to do). That's what I was referring to, not the scenario.

http://www.furaffinity.net/journal/1952576/

Note he says that "as I recalled she had said no and backed down", he wasn't even aware that Zaush did coerce her into sex(!). He didn't even (re?) check the leaked note before opening his mouth. Acts without thinking strikes again.

Dragoneer did you ever consider that maybe you acted badly in permitting a glaring security oversight to allow this information to become public and that defending what you actually said is missing the point entirely??

(i mean not that you didn't say some awful things)

http://www.furaffinity.net/journal/1952576/#cid:16205528

edit edit:

Ferality makes a comment on 'neers journal:

Hey guys, Dragoneer has stayed in contact with me through this. I wanted to post my thoughts.

First and foremost, I am going to seek counseling on this issue and learn about what steps to take from there. I've received a lot of information that suggests that I am not alone in my experiences.

I shouldn't have gone to Dragoneer (or anyone on the internet) about this, but rather I should have talked to someone with the legal knowledge and authority necessary to guide me. I know this sensitive information has affected others than myself, and for this mistake I apologize profusely.

I didn't feel like Dragoneer sided with anyone. I didn't feel like he was trying to tell me to keep quiet and protect Zaush. Dragoneer knew things could get ugly for me if I had simply posted a journal accusing Zaush, and wanted me to be mindful of my decision on this regard. I appreciate his input even though I do not agree with everything he said about the situation.

Seems to me that it's Dragoneer's fault that the sensitive information got out tho', 'cause he ignored the warnings and didn't fix things.

[bridgeportcat]

Dragoneer continues to backtrack re: the Zaush situation, and states that he missed the entire paragraph where the actual sex part happened. Either he's lying out of his ass to make himself look like less of a sleaze or he's a huge fucking idiot.

Either way, good GOD this guy :/

[Conan]

Sciggles, Witchiebunny, seux, and tsawolf.

http://filesmelt.com/dl/Sciggles.rar
http://filesmelt.com/dl/Witchiebunny.rar
http://filesmelt.com/dl/seux.7z
http://filesmelt.com/dl/tsawolf.rar

Yours is done, as I mentioned in my journal the other day I don't have a scanner with me so I have to wait to scan everyones right now till after I move on the 17th

This probably explains why Dragoneer has been MIA the last two days.

[rodox_video]

So apparently,  to find something even close to comparable to this whole shitpile you have to go all the way the fuck back to the 90s. The story I've heard says that FurryMUCK was rooted and the MASTER LOG leaked out. Everything that was happening everywhere in the game during a given period, be it admin commands or typefucking, got out.

I'd love to hear some more about this, if only to pass the time between bombshells here.

In other historical discussions, the only furry leader who probably has bigger skeletons in his closet is Uncle Kage. Only difference is that HIS skeletons are airgapped.

[rodox_video]

By the way, was it ever established that the Gawker hack had absolutely anything to do with what happened here or is that just speculation?

The initial breach came from the Gawker password database, yes. Then the entire house of cards fell.

The later attacks, the ones that resulted in all of the PMs leaking, used slightly less obvious methods.

Although this whole mess is tenuously connected with the Gawker break-in (the investigation of which recently went federal for some odd reason), there's pretty much no possibility of an actual criminal investigation here. Or at least, the possibility is so remote that the party involved in the FA breach pretty much considers it zero.

[Jim Demintia]

...

Please tell me that avatar is a Photoshop.

[a pigeon]

More people now speaking out about Zaush, a friend of Keovi here:

http://i52.tinypic.com/2pts048.jpg

http://bridgeportcat.livejournal.com/96818.html?thread=707122#t707122
-
FA admin Witchiebunny, mostly notable for her verbal aggression towards people, leaking news of cub-porn ban early, posting someones private notes on furrydrama_2 and general incompetency and unpleasantness,  breaks the rules for her friends:

http://i51.tinypic.com/15e7jt2.jpg
-
A post I saw on lulz:

>If they wanted any real change, this wouldn't have been leaked to us, please use some common sense.

Actually this is pretty much the single most damaging action they could have done, and they did it.

Anything technical attack--no matter the breadth--would have been fixed within a couple weeks with a restore, and everybody would have moved on and forgotten as FA history has already shown.

Releasing private notes is permanent damage to 1) the reputations of high-ranking artists, which are the most valued site asset by the administration and a lot of the userbase, 2) public trust, 3) the very core of Dragoneer's admin "abilities", and 4) probably tons more (I'm tired). Instead of exploiting all the technical flaws like common script kiddies, they've shown the disastrous consequences of these flaws and of the admin team's incredibly careless reactionary policy towards these flaws.

This is an event people are going to remember and associate with FA negatively on all fronts. This is the single most damaging event in FA history. Whether it happens or not, there couldn't possibly be a better catalyst for change.

-

Meanwhile, in Dragoneer land:

It's a serious issues, yes, but a top in the bucket. I regret that it was 41 users, and I'd regret if it were just 4. But with 80,000+ regulars... it's tragic and unfortunate, but not as bad as it could have been.

Edit, more:

I knew he was into the art, of which there is a LOT of that on FA. I had no evidence he had done anything in real life or anything else, but given how the communities react...

It wasn't Gawker so much. I was wrong on that. It wasn't any one admin being careless with their password, and it was far more complex than that. It was quite a few other details involved, of which we'll share when this shit storm is over.

Correct. We were trying to analyze and pinpoint point of entry, and were actively reviewing admin logs to find where it was. When we closed it the first time we did shut down a major exploit (XSS via trouble ticket) and proceeded to close up holes. Then some other issues happened, some of them not /on/ FA at all.

Yep, he's still giving out more information/updating first on a closed live-journal community than anywhere where the user-base of FA can easily see it.

edit:

A post on lulz.net alleged that Dragoneer has reported this incident to the FBI. Dunno of veracity.

[Jim Demintia]

I wouldn't be surprised if they don't have adequate logging in place such that there could be any useful formal investigation.