Thread: Dreamviews Hacked and Hijacked

This is the first authentic public announcement by me on this matter. All posts/PMs/emails that might have been sent using the name "Alex" on Dreamviews.com since Feb 20 2012 are fake. As of that date I have neither control of Dreamviews.com, nor of my account on that site.

To ensure authenticity, I will report all posts/PMs/emails I send on my FB wall (http://www.facebook.com/profile.php?id=100000852126960) until this case is fully resolved. If you encounter any post/PM/email by "Alex" not reported on my FB wall, it is 100% fake.

Please make sure to change your password on the real DV and everywhere else you have been using the same password as on the fake DV, especially your email address!

---

I. What happened?

Due to strategic reasons only a quick overview of the happenings can be published at this point. More details will be available once the case is resolved.

• On 22th Jan 2012 the thief got access to DV's server administration software, using it to create a new FTP-account downloading all webfiles from the server.
  
  
• On 24th Jan 2012 the thief used his access to DV's server administration software to get access to DV's email account. Using this, they got access to DV's account at Network Solutions (the original registrar of dreamviews.com) and initiated the transfer of the domain to Directi (the new registrar).
  
  
• On 27th Jan 2012 the thief uploaded an FTP-dumper to the server and started to create dumps of DV's database.
  
  
• On 30th Jan 2012 the transfer of dreamviews.com to the new registrar was completed, but the domain was still pointing to DV's original server so the theft would remain unnoticed until he would be finished stealing the data and removing his traces.
  
  
• On 10th Feb 2012 the dump of the current fake-DV was downloaded.
  
  
• On 19th Feb 2012 the thief tried to have Softlayer (DV's Server Provider) support team reset the root password, but failed.
  
  
• On 20th Feb 2012 the nameservers of dreamviews.com were changed to point to the new server hosting the stolen copy of DV based on the dump from 10th Feb 2012.

At no point the thief had root access to the server so they couldn't steal the chat system nor delete the logs.


II. What are you doing now?

Fortunately, due to the lack of root access, the thief couldn't remove their traces and so the server logs are full of evidences proving every single step of the server intrusion.

So collecting, analyzing and sorting all evidences was the biggest task over the last three days. Right now a lawyer is putting all the informations together, trying to convince the old and the new registrar that the transfer was illegitimate which is the most important part of this case. Once they are convinced, they will most likely at first suspend the domain completely until the case is resolved and then transfer it "back home".

Besides that, getting down the fake site is another priority, so all the evidences were also passed on t Leaseweb (the server provider where the stolen website is hosted).

The incident is also being reported to the local police but the chances to get any damages from the thief are close to zero of course, so unfortunately I have to cover the serious lawyer costs on my own without a real chance of compensation.


III. Are there other victims?

Yes, on the same server that hosts the stolen copy of DV there is also "www.the-rpf.com", another forum which has been stolen in January 2012, supposedly by the same thief (the original site has switched to Movie Props, Costumes and Scale Models | the RPF).


IV. How to help?

Any help is greatly appreciated! The best things you can do right now:

• Report your experience to this thread: http://208.43.40.120/f18/fake-dv-pos...please-128696/ This is very important as the bigger the public backup of the actual happenings is, the easier it will be to convince the registrars.
  
  
• Spread the word about the happenings with DV everywhere possible, reason is the same as above.
  
  
• Try to make posts/DJ entries/visitor messages about this incident on the fake DV, screenshot them (!) as they might be deleted quickly, and post the screenshots on the real DV. They will added to the evidence files.

However, please refrain from any illegal activity against Dreamviews.com or the thief's server, especially DDOSing or any server intrusion attempts. This is absolutely counterproductive.


V. Thank you

Thank you for supporting DV in these hard times. If there is any positive thing about this unfortunate situation, it's that it brings the core community closer together.