Topic: My account got hacked

Posted under General

I've found evidence that someone else is in my account. I stripped almost all the upvotes and downvotes off of my account.

Someone else added these upvotes:
748743
270946
213024

I took all the upvotes off of my account, and haven't added any, so these are new.

As evidence of my sincerity, I will point to the last upvote I left on the account:
171484

That is a shrine to my dead favorite artist. That was the last state I intended to leave my e621 account in, with just exactly that one sacred upvote. However, I checked back, and that was not the last state my e621 account was in.

Updated by felix nermix

31h253 said:
I've found evidence that someone else is in my account. I stripped almost all the upvotes and downvotes off of my account.

Someone else added these upvotes:
748743
270946
213024

I took all the upvotes off of my account, and haven't added any, so these are new.

As evidence of my sincerity, I will point to the last upvote I left on the account:
171484

That is a shrine to my dead favorite artist. That was the last state I intended to leave my e621 account in, with just exactly that one sacred upvote. However, I checked back, and that was not the last state my e621 account was in.

171484 is the last upvote performed by your account, done a couple days ago. Post 213024 received your upvote 6 years ago, 270946 was 7 years ago.

I see no signs of any hacking going on on your account, all other votes that have been made through your account come from normal IPs for you.

Updated by anonymous

Given NMNY's response, my best guess...you don't happen to have a computer you share with others, do you? If so, it could be you forgot to log out, and somebody voted on some images without stopping to think about it.

Updated by anonymous

Jacob said:
Given NMNY's response, my best guess...you don't happen to have a computer you share with others, do you? If so, it could be you forgot to log out, and somebody voted on some images without stopping to think about it.

I highly doubt that, due to how he said these other votes were new, but have been done more than half a decade ago.

Updated by anonymous

NotMeNotYou said:
171484 is the last upvote performed by your account, done a couple days ago. Post 213024 received your upvote 6 years ago, 270946 was 7 years ago.

I see no signs of any hacking going on on your account, all other votes that have been made through your account come from normal IPs for you.

I first upvoted 171484 years ago. I removed the upvote on 171484 as part of the clearing pass, and reinstitute it when I was done, and had hit a count of zero upvotes.

Again, I went down to a sacred image. That was to be the final concluding state of my account.

If my account wasn't intruded on, there must have been a database error, but I'm inclined to think that the timestamps were forged.

Updated by anonymous

31h253 said:
I first upvoted 171484 years ago. I removed the upvote on 171484 as part of the clearing pass, and reinstitute it when I was done, and had hit a count of zero upvotes.

Again, I went down to a sacred image. That was to be the final concluding state of my account.

If my account wasn't intruded on, there must have been a database error, but I'm inclined to think that the timestamps were forged.

Isn't it more likely you just missed one or two changes while you did your cleaning run? Ockham's razor and all?

Updated by anonymous

Random said:
Shhh. The upvote conspiracy must live.

EDIT: wait, you've upvoted two pages. What you talkin' 'bout, willis?
https://e621.net/post/index/1/votedup:31h253

Gaslighting doesn't help. Whether it's a security breach or a database error, I have most certainly not upvoted two pages. I still only see four items. Despite your joyless attempt at psychological abuse, you've managed to be helpful. For if you see two pages where I see four images, that suggests database inconsistency rather than a security breach.

Supply evidence rather than abuse, you know? People can collaborate if they don't abuse each other for no reason. That requires honest endeavor.

I would still like to get my account down to only the one upvote to leave it in that state.

Updated by anonymous

Random said:
EDIT: wait, you've upvoted two pages. What you talkin' 'bout, willis?
https://e621.net/post/index/1/votedup:31h253

31h253 said:
Gaslighting doesn't help. Whether it's a security breach or a database error, I have most certainly not upvoted two pages.

Misunderstanding. The votedup:username metatag only returns images you have upvoted yourself unless you have permission to see others'. Tested and confirmed locally that I can only see my own upvotes at Contributor level.

Updated by anonymous

Songbird said:
Misunderstanding. The votedup:username metatag only returns images you have upvoted yourself unless you have permission to see others'. Tested and confirmed locally that I can only see my own upvotes at Contributor level.

Thank you for contributing further information.

I had thought that if multiple people saw different upvotes, it supported database inconsistency rather than an actual breach, but I guess the four I see should still be authoritative? I took a screenshot if it would help, though I might've overcropped it for the point. I could take another.

Updated by anonymous

I think it's just one of those random things that can happen sometimes, computers will be computers after all, especially on a site with many thousands of users to keep track of. A few times when I logged in a while back my tag history showed a blank edit or two that I clearly didn't make, because I was asleep at the time stated on the edit, but nothing like that ever happened again.

I don't think you have to worry about account security unless your votes go completely bat shit crazy.

Updated by anonymous

I'm an admin. Our database has not been breached whatsoever, timestamps are also only internally generated and can't be forged by a third party. All votes also have IPs attached to them (at least since 3 years ago), and not one of those IPs is out of place.

Now that I'm on my PC I can also finally check the timestamps.

post #213024 - created on Thu May 16 19:38:19 2013, has not been updated
post #270946 - created on Wed Nov 28 21:56:30 2012, has not been updated
post #748743 - created on Wed Oct 21 08:19:31 2015, has not been updated

post #171484 - created on Thu Dec 5 00:31:25 2019, has not been updated

However, I know what happened. Those 3 images in question have one thing in common: I restored them a few days ago on request of the character owner Valmir. These votes were never removed, they just weren't returned in your search prior because they were still deleted when you cleaned them out. Since they have been restored now, you can see those votes from years ago again.

In fact, if you use status:deleted votedup:31h253 you should see tons of other images that you have voted on in the past, that are currently deleted.

Updated by anonymous

NotMeNotYou said:
I'm an admin. Our database has not been breached whatsoever, timestamps are also only internally generated and can't be forged by a third party. All votes also have IPs attached to them (at least since 3 years ago), and not one of those IPs is out of place.

Now that I'm on my PC I can also finally check the timestamps.

post #213024 - created on Thu May 16 19:38:19 2013, has not been updated
post #270946 - created on Wed Nov 28 21:56:30 2012, has not been updated
post #748743 - created on Wed Oct 21 08:19:31 2015, has not been updated

post #171484 - created on Thu Dec 5 00:31:25 2019, has not been updated

However, I know what happened. Those 3 images in question have one thing in common: I restored them a few days ago on request of the character owner Valmir. These votes were never removed, they just weren't returned in your search prior because they were still deleted when you cleaned them out. Since they have been restored now, you can see those votes from years ago again.

In fact, if you use status:deleted votedup:31h253 you should see tons of other images that you have voted on in the past, that are currently deleted.

Thank you for resolving this issue for me! Now I know the next step in my endeavor.

EDIT: Wait, there's a problem. It's impossible to vote on deleted posts. Could I by any chance get a batch-clear on my votes?

Updated by anonymous

31h253 said:
Thank you for resolving this issue for me! Now I know the next step in my endeavor.

EDIT: Wait, there's a problem. It's impossible to vote on deleted posts. Could I by any chance get a batch-clear on my votes?

I've locked all other votes, meaning they're zeroed now. However, this also includes all downvotes, I'm definitely too lazy to sort some 3.6k votes by hand.

Updated by anonymous

DragonFox69 said:
I think it's just one of those random things that can happen sometimes, computers will be computers after all, especially on a site with many thousands of users to keep track of. A few times when I logged in a while back my tag history showed a blank edit or two that I clearly didn't make, because I was asleep at the time stated on the edit, but nothing like that ever happened again.

I don't think you have to worry about account security unless your votes go completely bat shit crazy.

Does the e621 server has ECC memory? Does it have a power backup? Is it shielded against radiation? Was someone playing with magnets near the server?

Updated by anonymous

  • 1