Looks like another BOT in Real World Military

Danielbnp on Saturday, July 27, 2024 - 07:28 am

By Mike West (Mjwest) on Wednesday, September 04, 2024 - 09:08 pm: Edit

Would you or Al check the FC Forum? The main listing shows a Last Post of Jan 1 1970 (basically a time value of 0) for the General topic. I think we've had so many spam and deleted posts that something got confused. It'd be great if either of you could get that fixed. Thanks!

By John M. Williams (Jay) on Saturday, October 12, 2024 - 09:48 am: Edit

Both Edge and Chrome now automatically redirect to https, even though I specifically enter http into the browser. Any ideas on how to turn this off? The instructions I find online don’t seem to apply to the current versions of these browsers.

By Ryan Opel (Ryan) on Saturday, October 12, 2024 - 11:46 am: Edit

It worked for me on my desk and laptops. Phone I use Firefox.

By John M. Williams (Jay) on Saturday, October 12, 2024 - 04:29 pm: Edit

If I tinker around with things long enough, I can get to the right-hand window with the message threads, but I can't bring up the left-hand window that includes the search tools. Which means I'm probably not really loading the page; I'm just accessing one of the sub-windows (or whatever they're called in developer speak). However, I'm a frequent researcher of prior posts and would really like to be able to do searches on something larger than my phone. Any suggestions would be welcome.

By Ken Kazinski (Kjkazinski) on Sunday, October 13, 2024 - 07:43 am: Edit

I use the full URL

http://www.starfleetgames.com/discus/

and it works from edge. I do have to tell it to continue.

By Terry O'Carroll (Terryoc) on Sunday, October 13, 2024 - 08:20 am: Edit

Firefox on desktop works for me to access the forums, but other browsers don't.

By John M. Williams (Jay) on Sunday, October 13, 2024 - 09:50 am: Edit

I use that URL as my bookmark, but a recent "upgrade" to Edge on my computer automatically redirects that URL to the https version. I then try to delete the "s" from the address bar, but it still sends me back to the https. I don't get a prompt asking me if I want to redirect or continue to the http; it just does it. According to the instructions I've found online, there used to be a security setting in Edge that allowed you to toggle the auto-direct on and off. However, it appears that the toggle was removed from the security settings in one of the Edge updates earlier this year.

After Edge changed, I started using Chrome for the BBS because it would accept the http version of the URL. However, within the last few weeks it also added a redirect to https. I haven't been able to find a security setting in Chrome that would override the redirect.

I could try Firefox, but I hate to add a third browser to my computer.

By Mike West (Mjwest) on Sunday, October 13, 2024 - 10:39 am: Edit

That Chrome and Edge operate similarly makes sense since they are using the same engine. Honestly, everyone should have Firefox, at least on Windows, as it has its own engine, so it provides an alternative when Chromium browsers (like Chrome and Edge) have an issue. And do know that sometimes Firefox just won't work, because not all website developers test for it.

As an aside, the removal of http is inevitable. It will happen. That it would happen with no warning is a little odd, however.

By John M. Williams (Jay) on Sunday, October 13, 2024 - 08:27 pm: Edit

Did someone change the web-coding behind the BBS? It's no longer redirecting and is loading just fine in Edge now. I didn't do anything on my end that would explain the change.

By Lawrence Bergen (Lar) on Friday, October 18, 2024 - 11:25 am: Edit

Good morning Jean, I could not get my login to work for the store so I sent an email.

By Stephen G. Parry (Mutant) on Thursday, December 12, 2024 - 06:52 pm: Edit

Hi Jean,
Firefox 133.0 fails to load the discus/BBS pages by default, due to some protected content being insecure (i.e. HTTP instead of HTTPS), at least that's what the developer console says. The only workaround I have found is to disable content protection for starfleetgames.com, but obviously that is a potentially dangerous option. Thought you ought to know.

By Ryan Opel (Ryan) on Thursday, December 12, 2024 - 07:35 pm: Edit

That has been going on for sometime now. It's a known fault with the Discuss software.

By Michael F Guntly (Ares) on Thursday, December 12, 2024 - 08:58 pm: Edit

Stephen Parry,
I am running Firefox 133.0.3 (aarch64).
Discuss/BBS works fine for me.

By A David Merritt (Adm) on Thursday, December 12, 2024 - 09:17 pm: Edit

Stephen Parry,
I am running Firefox 133.0.3 as well.
Discuss/BBS works fine for me.

By Stephen G. Parry (Mutant) on Friday, December 13, 2024 - 06:36 pm: Edit

After further testing, it seems to depend on how you dial up the address of the star fleet games site. If you use https://www.starfleetgames.com to contact the site, the rest of the site works, but the discus page does not load. if you stick to http://www.starfleetgames.com, discuss works as well.

By John Wyszynski (Starsabre) on Saturday, December 21, 2024 - 08:04 am: Edit

I have been having the problems with the Discuss/BBS also for a week or two. It is affecting Firefox, Edge, and Chrome. It appears to be because the main page with the frames is "https:" while the links within the page are "http:".

On Firefox 133.0.3 the problem is in Settings>Security & Privacy>HTTPS-Only Mode. Change "Try HTTPS first, but allow connections that are not secure" to "Only use HTTPS in all windows".

By Jessica Orsini (Jessica_Orsini) on Sunday, December 22, 2024 - 08:41 am: Edit

Known issue for the past several years. Long story short, the software used for the BBS won't support HTTPS, and browsers have for the past several years expected and defaulted to HTTPS.

The workaround is to edit the URL to "http:" whenever the problem crops up.

By John Barnes (Nitehawke) on Sunday, December 22, 2024 - 09:49 am: Edit

I suspect that ADB may have suffered a data breach.
I recently received an email from a blackmail scammer that included the username and password I use for this discussion board. I do not use that password anywhere else, so it could only have come from you folks.

I only use that password here because of the HTTP/HTTPS issue Jessica mentioned above.

By Mike West (Mjwest) on Sunday, December 22, 2024 - 03:49 pm: Edit

Everyone should treat starfleetgames.com as if it has no password. No password used here should be used anywhere else, nor should it be anything like what you use elsewhere, as you must assume that this password is immediately compromised.

No one is doing anything to startfleetgames.com because it appears it isn't worth the effort. If it ever is worth the effort, it can be compromised and/or eliminated with no difficulty.

Do note that starfleetstore is different, uses different authorization, and is purely https. It should be OK, but do NOT ever share passwords between starfleetstore and starfleetgames. Ever.

By Steve Cole (Stevecole) on Monday, December 23, 2024 - 11:22 am: Edit

This is something I have never heard before. It is both interesting and upsetting, but I cannot imagine anything we could do about it.

I suspect that unless others report the same thing (and it would seem they would have by now) the criminal involved probably got the password data by monitoring dataflow rather than by breaching our database. This makes it very important that anyone else getting something similar needs to contact ADB immediately.

By Garth L. Getgen (Sgt_G) on Monday, December 23, 2024 - 12:50 pm: Edit

Given how easy it is to capture data / passwords from HTTP with man-in-the-middle, I would not be too quick to say that ADB had a data breach without solid evidence of a intruder hack.


Garth L. Getgen

By Jeff Anderson (Jga) on Monday, December 23, 2024 - 03:06 pm: Edit

It's probably too late to say this, but I've never trusted internet security, and have long suggested to folks that they NEVER put anything on-line that they have any questions/concerns about becoming public information.

Passwords.

Credit card numbers.

Whatever.

Http or httpS, anything is vulnerable to folks with more sophisticated hacking softwares than the folks providing security to systems might have, and with State level players out there involved in data wars, it only takes a day, or perhaps even just a fraction of a day, with someone having an edge to hack any data base out there.

By Stephen G. Parry (Mutant) on Saturday, December 28, 2024 - 10:49 pm: Edit

I disagree to a degree. The weak link in any security system is what has been termed by some the "chair screen interface", i.e. the user. Most data breaches start with either a) a socially engineered deception such as a phishing email b) a disgruntled employee with privileged access c) weak password d) laptop-left-in-pub syndrome e) bored employee surfing dodgy websites via exploitable unpatched browser/PC f) poor physical security (unlocked doors or screens, post-it notes, lax reception etc.). All of these come from simple failings in humans, not clever hacking or cracking. HTTPS still remains strong - even the outdated ciphers suites are only hackable in theory for the most part.
I am not certain, but I think it is possible to access this site mostly via HTTPS and hence without sending your password in the clear. Regardless however, I follow one rule, which is never to use the same password twice. Apart from a few exceptions where I may need to type a critical password manually, I use different, randomly generated passwords for each site, service or product I use. I use different, long, hard to guess passwords for the manual ones. All these are stored in an online password wallet, using open source software and my own service. I don't trust the built-in wallets on any of the browsers.
For purchases, I try to rely on one payment provider (who sucks, but at least it uses a password, not easily guessed or snooped 3 digit CVVs). I only lodge my CC details with them and a handful of trusted sites.
MITM relies on compromises to network infrastructure like routers and DNS servers *and* the use of encrypted traffic like HTTP. Where large scale state-sponsored hacking comes in and is scary is phones, and foreign network equipment like routers. A *lot* of phones potentially come with built in spyware that has privileged or pre-encryption access, rendering HTTPS, WhatsApp encryption etc potentially useless. A lot of network equipment has questionable security, either by negligence or malicious intent. It is notable the U.S. federal government is in the process of banning all sales of TP-link equipment, because of such concerns.
It is difficult to know who to be more concerned by - hostile state actors looking to manipulate or eliminate key people, cyber-criminals looking to exploit the vulnerable, or greedy corporations looking to use yours and everybody else's data for profit, regardless of the consequences. Of course, the worst is a combination of all three: Russian sponsored cybercriminals using vulnerabilities in poorly protected Chinese hardware to extort money from your grandma. It is a pleasant world out there.
It is still possible though to avoid and mitigate most of this, but it requires education and vigilance. We do it every day out there in the real world. We close and lock our windows; turn on the alarm and lock our front door; pat the well-starved guard dog on the head; check under the car for C4 explosive devices. All before we go out to work for a regular day at the office.

By Steve Cole (Stevecole) on Sunday, December 29, 2024 - 07:00 am: Edit

So far, no one else has reported this symptom so I'm tending to think it happened to John, not to ADB. We will remain vigilant for any more hacking activity.