Hello there, members of this community and organization. That you are seeing this thread means that a standard deadline has passed in the public disclosure process of demonstrating issues. This communication is intended for responsible parties to better be able to address the threats affecting them and for users of the service to respond accordingly to proper notification.
This individual attempted to contact the responsible person for this web service to privately disclose issues twice, once upon Dec 26, 2017, once upon Jan 6, 2018. As this individual did not receive a response on a service that creates a paper trail, detailed analysis was not performed, and private disclosure was not possible.
This disclosure pertains to the following:
--------------------------------------------------------------------------------------------------------
1) Administrative - Domain Expiry:
This notice intended to inform the webmaster and/or other responsible parties that the ownership of the domain hollowworld.co.uk (Currently registered to an individual the community knows as Cherbert) expires as of 2018-04-24.
Impact if unaccounted for: The noted domain sitter godaddy is currently acquiring other common 'hollowworld' domains on various TLDs in anticipation for the expiry of this domain - it's a known thing that, and other, web registrar organizations do when they see a longrunning/visited domain about to expire. If the domain registry is allowed to expire, based upon current observations, one or more of these organizations will immediately snap it up, and reserve it for potential resale (at markup) to the domain owner or others wishing to capitalize on the search engine rankings of the domain. If the deadline of 2018-04-24 passes without this issue being addressed, visitors heading to this domain are highly likely to end up diverted to a advertisement/malvertisement page designed to exploit SEO.
Recommendations:
Immediate need to contact current domain holder and arrange for transfer of ownership. If this is impossible, organization needs to prepare to acquire and transfer to a new domain name before 2018-04-24.
-------------------------------------------------------------------------------------------------------------
2) Legal - Violation of Xenforo licensing agreement:
This website is currently operating in terms that are against the licensing agreement with which forum software is provided by Xenforo.
As I could not arrange to speak to a managing individual privately, I am unable to disclose precisely what this issue is, as it would allow for any individual to immediately report as such to the Xenforo team.
Impact if unaccounted for: You may end up contacted by the Xenforo legal team, be issued a Cease & Desist, or have your license to use the forum software revoked.
Recommendations:
Review the Xenforo licensing agreement and correct the standing issue promptly. (It shouldn't be difficult.)
------------------------------------------------------------------------------------------------------------------
3) Security:
There is at least one pending security issue of note affecting this website. Again, to avoid the issue being exploited, the specific problems will not be publicly disclosed. My contact information remains available to the managing individuals of this operation and they can contact me at will if they want details.
As I was unable to speak privately with managing individuals, absolutely no testing of any sort was performed - only analysis of publicly available information was consulted in this briefing.
Users of this website are advised to consider it potentially unsafe.
-------------------------------------------------------------------------------------------------------------------
Hey folks - Naelwyn here. This is as proper and formal a disclosure that I can perform. I tried getting in touch with management multiple times and got no response, and weighed that it was better to broadly let management know of these issues so that they could properly address them.
I was originally trying to delicately let folks know about the domain expiry issue (As I mentioned before somewhere else, I was trying to get in touch) and while looking into that, I found others which prompted the need to eventually escalate the disclosure.
I hope this allows you to address these concerns before they become critical issues for you.
-Naelwyn
This individual attempted to contact the responsible person for this web service to privately disclose issues twice, once upon Dec 26, 2017, once upon Jan 6, 2018. As this individual did not receive a response on a service that creates a paper trail, detailed analysis was not performed, and private disclosure was not possible.
This disclosure pertains to the following:
--------------------------------------------------------------------------------------------------------
1) Administrative - Domain Expiry:
This notice intended to inform the webmaster and/or other responsible parties that the ownership of the domain hollowworld.co.uk (Currently registered to an individual the community knows as Cherbert) expires as of 2018-04-24.
Impact if unaccounted for: The noted domain sitter godaddy is currently acquiring other common 'hollowworld' domains on various TLDs in anticipation for the expiry of this domain - it's a known thing that, and other, web registrar organizations do when they see a longrunning/visited domain about to expire. If the domain registry is allowed to expire, based upon current observations, one or more of these organizations will immediately snap it up, and reserve it for potential resale (at markup) to the domain owner or others wishing to capitalize on the search engine rankings of the domain. If the deadline of 2018-04-24 passes without this issue being addressed, visitors heading to this domain are highly likely to end up diverted to a advertisement/malvertisement page designed to exploit SEO.
Recommendations:
Immediate need to contact current domain holder and arrange for transfer of ownership. If this is impossible, organization needs to prepare to acquire and transfer to a new domain name before 2018-04-24.
-------------------------------------------------------------------------------------------------------------
2) Legal - Violation of Xenforo licensing agreement:
This website is currently operating in terms that are against the licensing agreement with which forum software is provided by Xenforo.
As I could not arrange to speak to a managing individual privately, I am unable to disclose precisely what this issue is, as it would allow for any individual to immediately report as such to the Xenforo team.
Impact if unaccounted for: You may end up contacted by the Xenforo legal team, be issued a Cease & Desist, or have your license to use the forum software revoked.
Recommendations:
Review the Xenforo licensing agreement and correct the standing issue promptly. (It shouldn't be difficult.)
------------------------------------------------------------------------------------------------------------------
3) Security:
There is at least one pending security issue of note affecting this website. Again, to avoid the issue being exploited, the specific problems will not be publicly disclosed. My contact information remains available to the managing individuals of this operation and they can contact me at will if they want details.
As I was unable to speak privately with managing individuals, absolutely no testing of any sort was performed - only analysis of publicly available information was consulted in this briefing.
Users of this website are advised to consider it potentially unsafe.
-------------------------------------------------------------------------------------------------------------------
Hey folks - Naelwyn here. This is as proper and formal a disclosure that I can perform. I tried getting in touch with management multiple times and got no response, and weighed that it was better to broadly let management know of these issues so that they could properly address them.
I was originally trying to delicately let folks know about the domain expiry issue (As I mentioned before somewhere else, I was trying to get in touch) and while looking into that, I found others which prompted the need to eventually escalate the disclosure.
I hope this allows you to address these concerns before they become critical issues for you.
-Naelwyn