Approximately half an hour ago, I became aware that the version of Oracle distributed on the Chrome Web Store contained code that logged usernames and passwords on login, at the very least. (I’m not near a laptop and haven’t done a full code diff).
Oracle has been unpublished so it should be disappearing, but uninstall it NOW.
This code isn’t present on GitHub or v0.1.8, the last update I pushed out. The current compromised version is “v0.1.9” and Chrome Webstore says it was pushed on 10/3/17.
If you have used Oracle since then, you need to CHANGE YOUR PASSWORD NOW. If you have used this password on another site, you need to change it as well.
The extension is permissions wise scoped to Epicmafia.com, so any activity on any other site should not be affected.
At this moment I do not know how my account was breached and the compromised extension uploaded, nor do I know how access to Epicmafia.net was accessed (if at all). I will update in this thread as I further investigate.
deleteddeletedalmost 9 years agoedited
i wasn't implying whitepimp did it. im saying the explanation seems really far fetched. i really doubt you can just get access to someone's google account
Whitepimp has previously asked for access to the server that hosts analytics, and I did give him a cloned copy of it. That cloned copy had the same MySQL password as epicmafia.net
should not have access to my Google account and I will be in touch with G Suite support (as I pay for G Suite) to understand what happened with my Google account. I don’t see any other indicators of compromise in my Google account, so I’m not leaving out the possibility that an version was uploaded without direct compromise. (I find that extremely unlikely for an Epicmafia extension though).
i just sent a text to jordan, lets get this show POPPIN
2
deleteddeletedalmost 9 years ago
Leave him alone! LaiLai didn't do anything! He got the app that he put so much love and care for in order to better this site and he gets his app compromised and ruined and this is the thanks he gets for having been admin and having made suhc wonderful plugins for EM! You are all so ungrateful.
You should be pointinf ingers at corrupt moderator charley
deleteddeletedalmost 9 years ago
This topic is a monument to lailai's giant steel balls
deleteddeletedalmost 9 years ago
are you saying you gave whitepimp access to your google account and your server and he did it ?
So the hacker had all the info you have, and then happened to know you and charley were drunk fighting in a bar in Texas? LMFAOOOO sit down you sneaky little fu’cker.
