Responsible Disclosure (Security, Administrative, and Legal Issues)

[Naelwyn]

Hello there, members of this community and organization. That you are seeing this thread means that a standard deadline has passed in the public disclosure process of demonstrating issues. This communication is intended for responsible parties to better be able to address the threats affecting them and for users of the service to respond accordingly to proper notification.

This individual attempted to contact the responsible person for this web service to privately disclose issues twice, once upon Dec 26, 2017, once upon Jan 6, 2018. As this individual did not receive a response on a service that creates a paper trail, detailed analysis was not performed, and private disclosure was not possible.

This disclosure pertains to the following:

--------------------------------------------------------------------------------------------------------

1) Administrative - Domain Expiry:

This notice intended to inform the webmaster and/or other responsible parties that the ownership of the domain hollowworld.co.uk (Currently registered to an individual the community knows as Cherbert) expires as of 2018-04-24.

Impact if unaccounted for: The noted domain sitter godaddy is currently acquiring other common 'hollowworld' domains on various TLDs in anticipation for the expiry of this domain - it's a known thing that, and other, web registrar organizations do when they see a longrunning/visited domain about to expire. If the domain registry is allowed to expire, based upon current observations, one or more of these organizations will immediately snap it up, and reserve it for potential resale (at markup) to the domain owner or others wishing to capitalize on the search engine rankings of the domain. If the deadline of 2018-04-24 passes without this issue being addressed, visitors heading to this domain are highly likely to end up diverted to a advertisement/malvertisement page designed to exploit SEO.

Recommendations:

Immediate need to contact current domain holder and arrange for transfer of ownership. If this is impossible, organization needs to prepare to acquire and transfer to a new domain name before 2018-04-24.

-------------------------------------------------------------------------------------------------------------

2) Legal - Violation of Xenforo licensing agreement:

This website is currently operating in terms that are against the licensing agreement with which forum software is provided by Xenforo.

As I could not arrange to speak to a managing individual privately, I am unable to disclose precisely what this issue is, as it would allow for any individual to immediately report as such to the Xenforo team.

Impact if unaccounted for: You may end up contacted by the Xenforo legal team, be issued a Cease & Desist, or have your license to use the forum software revoked.

Recommendations:

Review the Xenforo licensing agreement and correct the standing issue promptly. (It shouldn't be difficult.)

------------------------------------------------------------------------------------------------------------------

3) Security:

There is at least one pending security issue of note affecting this website. Again, to avoid the issue being exploited, the specific problems will not be publicly disclosed. My contact information remains available to the managing individuals of this operation and they can contact me at will if they want details.

As I was unable to speak privately with managing individuals, absolutely no testing of any sort was performed - only analysis of publicly available information was consulted in this briefing.

Users of this website are advised to consider it potentially unsafe.

-------------------------------------------------------------------------------------------------------------------

Hey folks - Naelwyn here. This is as proper and formal a disclosure that I can perform. I tried getting in touch with management multiple times and got no response, and weighed that it was better to broadly let management know of these issues so that they could properly address them.

I was originally trying to delicately let folks know about the domain expiry issue (As I mentioned before somewhere else, I was trying to get in touch) and while looking into that, I found others which prompted the need to eventually escalate the disclosure.

I hope this allows you to address these concerns before they become critical issues for you.

-Naelwyn

 

[Tiberione]

Thanks for taking interest.

Domain renewal will not be an issue (And is still 4 months away).
We will await hearing from the Xenforo legal team
Security issues - Not sure if they still persist because we've moved to a new web server but I suggest you contact me (You havent tried yet) to let me know what they are.

 

[Chados]

We will await hearing from the Xenforo legal team b

Hold this L

 

[Solus]

Hey folks - Naelwyn here. This is as proper and formal a disclosure that I can perform. I tried getting in touch with management multiple times and got no response, and weighed that it was better to broadly let management know of these issues so that they could properly address them.

I have to clarify that you haven't contacted me at all about any of the above.

 

[Baron]

Thanks for taking interest.

Domain renewal will not be an issue (And is still 4 months away).
We will await hearing from the Xenforo legal team b
Security issues - Not sure if they still persist because we've moved to a new web server but I suggest you contact me (You havent tried yet) to let me know what they are.

'bout 20 seconds of Googling yields known vulnerabilities relating to both SQL injection and remote code execution, fixed only in 2017. HW is out of support since 2013.

 

[Naelwyn]

I have to clarify that you haven't contacted me at all about any of the above.

There are two attempts to contact you via Skype to privately disclose this information, as this is the literal only private means of contact I possess with a paper trail. All web registrar information still points to Cherbert, whom, as best I am aware, is no longer involved in the day to day operation of this server - ergo, there was no private email to send information to.

I'm sorry you were unable or unwilling to receive this by whatever means, but I very clearly attempted to contact you privately first.

 

[Solus]

You are clearly aware of why I have you blocked. The forums were the best means of contacting me for a private forum issue.

 

[Chados]

Jesus Christ

 

[Naelwyn]

You are clearly aware of why I have you blocked. The forums were the best means of contacting me for a private forum issue.

If you do not understand the necessity to disclose such matters in a fashion that is not upon the service in question, it is neither my responsibility nor prerogative to explain it.

In attempting to disclose this issue, the only avenue I had available which provided me with a proper, citeable sourcing of my attempts to contact you was Skype, so Skype was what I used. That no other contact information whatsoever was available for me to use except information pointing to a webmaster that is no longer the webmaster is also not my responsibility to handle, especially when I have previously attempted to get in touch using the forums to no avail.

There's one other thing I've found that I'll make an attempt to inform you privately about, because there are consequences if it's spoken about publicly.

You will note the first attempt to contact you on skype follows on the same day as that statement. I had searched for a contact email prior to this and was not availed.

You have been provided the information, your users have been provided the information, you may all use the information as you see fit.

I encourage the webmaster to properly keep up to date the web registration information of the server as otherwise various web services will instead point me at the contact information of the service hosting the webpage, which, as far as I believe, the management would much prefer to hear said disclosures personally than have them sent to their web host.

 

[Solus]

You could have contacted another member of staff, but instead pretend you contacted management, me, and slander that.

We thank you for your provided information, regardless.

 

[I am Wake]

your users have been provided the information, you may all use the information as you see fit.

I do not quite understand, because the original post does not go into detail about any specifics. It is what a Policeman would do to a criminal: know the law and tell the criminal they have done wrong without actually contributing any explanation.

I am disappointed to say, Nael, that this, from a users provided information, looks like some form of blackmail or harmful attack whilst exploiting the shaky legal system. I am disappointed because I thought better of you, man =/
The way you go about saying these things on forums is harmful and unlogical, completely opposite of what I knew you as: wise and logical. The forums is a perfectly acceptable way to contact people, as all of my contact between other users and staff is made through forums and it works effectively. This "trail" makes no sense.

While the usefulness of the forum information will be used, no doubt, and the forum would be upgraded because of the current staff's effectiveness at their jobs-- the forums were also under your awareness back in 2014, 2015 and some of 2016. To put others in blame now is hypocritical and would also put you in harms way, let alone the whole communities.

There was no need for this drama, Nael. It harms the community. Next time, please go about this with some more politeness in your mannerism?
I do not wish to see someone I used to admire be put down to a simple troll.

 

[Charybdis]

You could have contacted another member of staff, but instead pretend you contacted management, me, and slander that.

We thank you for your provided information, regardless.

isnt it kind of ur own job to make urself contactable on perhaps more than 1 platform as a server owner
ppl cant really control or know that u blocked them considering how skype handles blocking so it seems reasonable to assume someone is ignoring you. i've done that before.

 

[Baron]

I do not quite understand, because the original post does not go into detail about any specifics. It is what a Policeman would do to a criminal: know the law and tell the criminal they have done wrong without actually contributing any explanation.

I am disappointed to say, Nael, that this, from a users provided information, looks like some form of blackmail or harmful attack whilst exploiting the shaky legal system. I am disappointed because I thought better of you, man =/
The way you go about saying these things on forums is harmful and unlogical, completely opposite of what I knew you as: wise and logical. The forums is a perfectly acceptable way to contact people, as all of my contact between other users and staff is made through forums and it works effectively. This "trail" makes no sense.

u wot

 

[Solus]

isnt it kind of ur own job to make urself contactable on perhaps more than 1 platform as a server owner
ppl cant really control or know that u blocked them considering how skype handles blocking so it seems reasonable to assume someone is ignoring you. i've done that before.

I've a limit to my own personal skype. I have made myself fully available on the forums to everyone. Naelwyn is aware of what's happened between our skype.

Edit: I'd like to derail the thread from this, too. And keep on topic. I'm still available for hearing complaints privately that need to be heard privately and if I am not available to contact, another staff member will always be. Please do take that option in the future.

 

[Chados]

I do not quite understand, because the original post does not go into detail about any specifics. It is what a Policeman would do to a criminal: know the law and tell the criminal they have done wrong without actually contributing any explanation.

I am disappointed to say, Nael, that this, from a users provided information, looks like some form of blackmail or harmful attack whilst exploiting the shaky legal system. I am disappointed because I thought better of you, man =/
The way you go about saying these things on forums is harmful and unlogical, completely opposite of what I knew you as: wise and logical. The forums is a perfectly acceptable way to contact people, as all of my contact between other users and staff is made through forums and it works effectively. This "trail" makes no sense.

While the usefulness of the forum information will be used, no doubt, and the forum would be upgraded because of the current staff's effectiveness at their jobs-- the forums were also under your awareness back in 2014, 2015 and some of 2016. To put others in blame now is hypocritical and would also put you in harms way, let alone the whole communities.

There was no need for this drama, Nael. It harms the community. Next time, please go about this with some more politeness in your mannerism?
I do not wish to see someone I used to admire be put down to a simple troll.

L

Edit: Image too big

 

[Naelwyn]

I've a limit to my own personal skype. I have made myself fully available on the forums to everyone. Naelwyn is aware of what's happened between our skype.

Edit: I'd like to derail the thread from this, too. And keep on topic. I'm still available for hearing complaints privately that need to be heard privately and if I am not available to contact, another staff member will always be. Please do take that option in the future.

Please update the contact information for the webpage - such that something points to an external email for whomever is the Webmaster/Owner responsible for the webpage in question. I tried following all the available info and it pointed me either at Cherbert or your webhost. I tried to contact you because, as best I can tell, you're the person who 'Owns' this page and that's who security notices go to.

I'd happily go through any other route than the one taken - the one taken was because there really wasn't any other option available.

That said, in light of this and the response to it, the likelihood that I go through the effort of making mitigation/risk analysis and disclosure again is... minimal.

 

[Tiberione]

Please update the contact information for the webpage - such that something points to an external email for whomever is the Webmaster/Owner responsible for the webpage in question. I tried following all the available info and it pointed me either at Cherbert or your webhost. I tried to contact you because, as best I can tell, you're the person who 'Owns' this page and that's who security notices go to.

I'd happily go through any other route than the one taken - the one taken was because there really wasn't any other option available.

You may contact myself, and include Solus, in a forum private message. I am currently the systems administrator.

 

[Naelwyn]

You may contact myself, and include Solus, in a forum private message. I am currently the systems administrator.

You of all people should understand precisely why people contacting you about issues facing your forum, including security details of their own information on the system, should not be expected to use the service itself to notify you. It goes double for bots and other organizations.

For bloody shame. It's forgivable from somebody that doesn't have domain knowledge but unconscionable from someone who does.

 

[Tiberione]

You of all people should understand precisely why people contacting you about issues facing your forum, including security details of their own information on the system, should not be expected to use the service itself to notify you. It goes double for bots and other organizations.

For bloody shame. It's forgivable from somebody that doesn't have domain knowledge but unconscionable from someone who does.

Surely if the people who have "exploits" that could read our private conversation they could not gain anything from the private conversation.

I don't trust you with any of my personal means of contact. If you want to send it to me, great, thank you, but I will not be giving you other means of contact. I have a forum account and inbox. You're free to message it. That's all I'm going to say.

 

[Solus]

Please update the contact information for the webpage - such that something points to an external email for whomever is the Webmaster/Owner responsible for the webpage in question. I tried following all the available info and it pointed me either at Cherbert or your webhost. I tried to contact you because, as best I can tell, you're the person who 'Owns' this page and that's who security notices go to.

I'd happily go through any other route than the one taken - the one taken was because there really wasn't any other option available.

That said, in light of this and the response to it, the likelihood that I go through the effort of making mitigation/risk analysis and disclosure again is... minimal.

You never asked till now.

Contact Us will require your own account, for us to be aware of who sent what. Use this form to send to our HW email acount and it'll be sorted.