1. Nothing is lost permanently here. They deleted the news, but we temporarily restored all the ones from up to 2021 for now, and will bring back the rest shortly (from an off-site backup hopefully).
   
2. Except for a certain specific user I'll get to, your account is safe and not accessed from outside.
   
3. Nothing else is touched. The games and whatnot are intact and safe.
   
4. There's no real big security risk going on. There's no backdoor as far as we know, it's just someone guessing a staff account's password.
   
5. This is not connected to any other prior incident.
   
6. They didn't have access to the full backend of the site. Only a specific portion, which they seemingly only used to snoop on one member, then spam on the news section.
   

1. They first visited a user's profile. When you google their name, MFGG is one of the first results to pop up, so that's likely how they discovered the site. This user had never done anything on the site, at least since the late 2000s.
   
2. They tried to log in to it, but failed.
   
3. So, they tried to log into various staff accounts instead. They got the password wrong many times in the process.
   
4. But eventually one of them worked. Our guess is that the password was either super easy to guess, or it was included in a prior database leak from a different website. This is why you don't use the same password across multiple websites.
   
5. Using the staff account they immediately took control of the mystery user's account as well. From what I can tell, they proceeded to do nothing with it, and the account itself did not contain much information. We ended up locking this account.
   
6. They also banned me to prevent me from stopping them. I was asleep at the time, as this whole thing happened around at 6 AM for me, so I was not there to see my first MFGG ban, sadly.
   
7. They deleted pretty much all the main site news posts as well. Come on man...
   
8. They then started posting a bunch of news post of their own, flaunting their victory, and promoting their Twitter accounts. Those accounts are pretty barren though, and mostly have posts related to... Yep, you guessed it, Roblox.
   
9. Fun With Despair noticed all this and tried banning them. Before he could though, they just changed the password of his account and started using it to spam instead.
   
10. We quickly tried to sort things out, reverted back a quick backup we had from 2021 for emergencies, cleared session records to log them out of the staff accounts, reset the passwords of ALL staff accounts, and deleted the accounts they had made.
    
11. Turns out this was not enough and they were still somehow logged into Despair's account, so we additionally IP banned them as well, and temporarily banned Despair's account also just to be safe.
    

1. Do not reuse the same password in multiple places. Use a password manager if necessary.
   
2. If you have old, unused accounts on sites where the account getting compromised would be a problem, please make sure that they have strong passwords.
   
3. Make frequent backups.
   
4. Don't let your kids play Roblox.
   

(04-09-2024, 03:21 PM)Vert Wrote: Why do Roblox kids hate Mario fangames so much? It boggles the mind.

Anyway, seeing as they failed to break into the site through other ways, it really reinforces how the weakest link in computer security is the guy behind the screen. Maybe there should be an official procedure for dealing with old staff accounts to prevent this in the future?

(04-09-2024, 03:21 PM)Vert Wrote: Why do Roblox kids hate Mario fangames so much? It boggles the mind.