107
Someone from my university took down my website
(lemmy.world)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 03 May 2025
107 points (98.2% liked)
[Migrated, see pinned post] Casual Conversation
3380 readers
3 users here now
We moved to !casualconversation@piefed.social please look for https://lemm.ee/post/66060114 in your instance search bar
Share a story, ask a question, or start a conversation about (almost) anything you desire. Maybe you'll make some friends in the process.
RULES
- Be respectful: no harassment, hate speech, bigotry, and/or trolling.
- Encourage conversation in your OP. This means including heavily implicative subject matter when you can and also engaging in your thread when possible.
- Avoid controversial topics (e.g. politics or societal debates).
- Stay calm: Don’t post angry or to vent or complain. We are a place where everyone can forget about their everyday or not so everyday worries for a moment. Venting, complaining, or posting from a place of anger or resentment doesn't fit the atmosphere we try to foster at all. Feel free to post those on !goodoffmychest@lemmy.world
- Keep it clean and SFW
- No solicitation such as ads, promotional content, spam, surveys etc.
Casual conversation communities:
Related discussion-focused communities
- !actual_discussion@lemmy.ca
- !askmenover30@lemm.ee
- !dads@feddit.uk
- !letstalkaboutgames@feddit.uk
- !movies@lemm.ee
founded 2 years ago
MODERATORS
What do you mean? If their email is confirmed, then I assume only they have access to it. Is there something I'm missing?
Perhaps it's something that I'm missing. What do you mean when you say their email is confirmed?
Usually when this happens, it's a result of someone taking advantage of an application vulnerability, e.g. sql injection. Sometimes it's more serious, like a script uploaded and a privilege escalation to execute it. The email value written to your database could be anything.
Not to condescend, but this is a good learning experience. If they were able to write to your db, they could likely also read from it, dump the whole thing and harvest the data.
They did not gain access to the db. They just inserted some garbage data that due to a bug in my code caused a background worker to try to insert some invalid data to the db and fail on loop, hogging network resources until eventually the main server couldn't serve anymore.
When I say their email is confirmed, I mean the email they used to sign up is presumably one they have access to because they clicked on the confirmation link with a token sent to their email. The data they inserted is tied to that account with a foreign key.
No SQL injection or anything like that was done. It was more them triggering a bug more than anything. But it's still clearly intentional because the data they inserted is spam about forex trading with no spaces (which is what caused the error, long story). My code is open source so presumably they knew that would happen.
Gotcha. Then maybe it is time for them to have a conversation with the friendly network administrator. You might have lost your logs, but university network appliances usually log alot.