a random operate banner

/operate/ - Endchan Operations

Let us know what's up


New Reply on thread #29851
X
Max 20 files0 B total
[New Reply]

Index | Catalog | Banners | Logs
Posting mode: Reply [Return]

thumbnail of endchan_knight.jpg
thumbnail of endchan_knight.jpg
endchan_knight jpg
(88.46 KB, 700x700)
No. 29851 [Preview] [Reply]
Actions 
Endchan Hacked

Yesterday (2026 February 11) users exploited a bug in the engine and escalated privileges on user accounts. They gained "root" access to the site, getting the highest privilege, which means they could see user's IPs of all the posts, change site settings, lifting range bans, delete threads and posts.
The real problem from the above is the IPs, which could help breaking anonymity of the users.
It seems they had no access to the database so for example they couldn't get to email addresses of registered users. Other than these two types of data, there is not much else to gain.
We found and patched the bug. We are still auditing the logs and the engine, if new information emerges, we'll share it.

Maybe this event means a hit for the site's reputation, but now we can tell that we are on the same level as 4chan. Though at least it is still not 4chan.

No role signo competence is showing.




No. 29856 [Preview] [Reply]
Actions 
 >>/29851/
Two notes:
1. "root" is not the server root. The site engine calls the top role - above the admin - as root. See the Moderation Manual of Endchan. The "root" role allows access to Endchan's moderation pages with Root privileges, which comes with what I wrote in OP.
2. passwords are stored hashed, and similarly to emails that would have needed access to the database itself.


No. 29858 [Preview] [Reply]
Actions 
 >>/29857/
ChatGPT.

I noticed new commits for lynxchan and saw that the fork for endchan was last updated in 2020. Gross negligence if I dare say so. If I didn't turn every global volunteer into a "root", they probably wouldn't have noticed it at all lul





No. 29863 [Preview] [Reply]
Actions 
 >>/29861/
> I did the hack to get the IP's so I can sell the data on the dark web. I
That's going to bring millions, if not billions! Did you get the public or the private IPs? I heard the private ones are hard to route.





No. 29868 [Preview] [Reply]
Actions 
Why are you still running this site you useless retards? 2 years ago you let people upload custom css that could be used to get lurkers ip addresses with ip grabbers and now your entire site got hacked. You're low iq and can't run a site properly and you don't give a shit about your users either. Take down this website if you have any dignity left. I recommend whoever reads this to stop using this website right now












No. 29880 [Preview] [Reply]
Actions
thumbnail of role-escalation-log-sample.png
thumbnail of role-escalation-log-sample.png
role-escalation-... png
(41.82 KB, 403x487) 
 >>/29879/
Several things to address and clarify in your question.
> period
The logs says first escalation was on 2026 February 11th at 12:44, which means we discovered it about 20 hours later. These logs are accessible from the home page, scroll down a lot.
> logs
There are more logs generated by the engine that aren't published to that page. These logs aren't accessible with global Root privileges, no option in the moderation view or elsewhere.
> views and downloads
The engine doesn't log views and downloads - it's stated in the FAQ too.
> IPs
As for the IPs. When a user is a board or global staff member he can see IP hashes (and ranges) at posts in thread moderation view. For Root, there's an IP instead. So if they wanted to get IPs they had to open each thread. In theory they could harvest with a scraper. I don't know if this was done or not.



No. 29883 [Preview] [Reply]
Actions
thumbnail of 1.webp
thumbnail of 1.webp
1 webp
(26.02 KB, 640x678) 
 >>/29880/
> superguy
This is hilarious. I imagine pic for some reason.

 >>/29882/
А он и не должен нести ответственность. Ты же не подписывал никакой договор, когда решил пользоваться этой бордой, по которому он бы нёс ответственность за сохранность твоих данных? Нет. Вот и всё. А что до морального аспекта, ему в Австралии / Новой Зеландии или где он там по большей части на это прохладно, я думаю. Лучшее что он может сделать в такой ситуации, это  >>/29875/ не допустить повторения чего-то подобного.

Также удвою  >>/29876/. Для polru-шизиков и люbbителей ПАВ это актуально как никогда, на любом ресурсе. Ответственность за человека в первую очередь несёт этот же самый человек, сам за себя, а не кто-то другой.

No. 29884 [Preview] [Reply]
Actions 
 >>/29880/
Thx for the clarifications.
Basically, root can see IPs of every post on Endchan, even the for the ones created many years ago.

> So if they wanted to get IPs they had to open each thread. In theory they could harvest with a scraper. I don't know if this was done or not.
Obviously this was the point.

No. 29885 [Preview] [Reply]
Actions 
I have no account and I always use a VPN. Checked my network and background OS processes and everything seems fine, nothing abnormal is running in the background or sniffing my traffic. I do use a very secure alternative web browser too (no telemetry, no webgl, no webrtc, no geo api, no camera or mic access because physically disconnected). Everything seems fine for me.






No. 29891 [Preview] [Reply]
Actions 
 >>/29876/
yeah basically. I don't understand the mouthbreathing variety of the imageboard user who's not behind tor plus 7 proxies at all times. I'm not even alluding to the possibility of a malicious admin. these hacks can and do happen. oh well. survival of the fittest I guess?


No. 29893 [Preview] [Reply]
Actions
thumbnail of image (18).png
thumbnail of image (18).png
image (18) png
(200.86 KB, 446x366) 
 >>/29851/
i already complained months ago, and to you personally i think, that powertripping BV's (such as "endmin" of endchan.org/ttg) are doing weird stuff such running scripts which track IP hashes to try to discern users or running scripts to delete hundreds of posts, going back months, which are not did not break any rules, just because they have a personal grudge. allowing this sort of stuff is just a testament to the carelessness which lead to what can be presumed complete leak of all IPs
i had trust in endchan's security, so for the past year i have been posting exclusively from my bare home IP. now all bad actors know i reside in lesotho. thank you shiban.


No. 29895 [Preview] [Reply]
Actions 
 >>/29891/
Not sure if you could easily do this but the best opsec would be to run a 'burner laptop' (laptop with no personal info/never used for anything personal) with Linux installed, connected to a VPN network, then run another OS on a virtual machine that you can route through the Tor network, isolating any internet traffic from the virtual machine from the host burner laptop. This way it's near impossible to trace anything.

Although to be fair I do believe this is a bit overkill unless you are actually engaging in some sort of high risk illegal activity. I prefer using an old burner laptop with a VPN and if it was ever hacked there is no personal data or online account information to steal from it.







No. 29903 [Preview] [Reply]
Actions 
 >>/29899/
> biggest news on the whole site
> believes everyone came here following him
god you are delusional
anyways, this is a nothingburger, any bad actor that could suffer consequences from their posts uses a vpn
















No. 29921 [Preview] [Reply]
Actions 
The sharty user who hacked 4chan was on the sides of the posters. I hope that Mr. Superguy is as well and doesn't use whatever he potentially scraped for anything that harms innocent people by infringing on their privacy. I have to imagine that the vast majority of users aren't using Tor or VPNs every single time they post. Some boards here involve pretty dire circumstances. Superguy, don't screw over everyone with whatever you're doing. If you have a few enemies, that's fine, but protect everyone else.






No. 29933 [Preview] [Reply]
Actions 
 >>/29891/
Maybe i am being stupid but i dont see what having ips that arent fresh is useful for
Like i switch my router off every day i go to bed and get a new ip every time it connets
This is only interesting if somebody somehow has same ip for long time and who has that anyway?


No. 29935 [Preview] [Reply]
Actions 
 >>/29893/
 >>/29901/
> Site gets hacked
> Retard schizo tries to use it to attack boards run by people he imagines are his mortal enemy by making up shit
Image is a piece of shit and really ought to be permabanned as he is on every other site.  When I saw the post about endchan being hacked I half thought this guy would be behind it.














No. 29949 [Preview] [Reply]
Actions 
This hack just proves why you should never hand over your personal info to social media sites. That's why I refuse to join 4chan, Spotify, Discord, Facebook/Instagram and sadly I just added Roku devices to my blacklist too because they are starting to mandate digital IDs to access their TVs and media players. We desperately need more alternative sites and decentralized p2p networks for anonymous communication in the future or the internet is going broke and will be deeply at the mercy of hackers stealing everyone's personal info and internet history.


No. 29952 [Preview] [Reply]
Actions 
 >>/29921/
В рашке сайт не открывается без впн или тора, поэтому да, мы сидим тут не с реальных айпи)) А ты как будто не знал этого, подзалупка?










No. 29962 [Preview] [Reply]
Actions 
 >>/29957/
LynxChan has a weird templating system but that does not allow for anything malicious. However, endchan's software is many years behind the latest LynxChan patch, and many vulnerabilities have been patched since, like the major hack recently, so there are undoubtedly more vulnerabilities like XSS present.



No. 29965 [Preview] [Reply]
Actions 
Goddamn. Those people here panicking, how petty and insignificant are your real life problems? Somebody might have my IP. Oh no. I couldn't give less of a shit. I've been handing out my own doxx to people on the internet who promised to come kick my ass since the 1990s. Newsflash. Nothing happened. Get some real problems. Trade me for my fucking life.

No. 29966 [Preview] [Reply]
Actions 
 >>/29890/
Could you delete IP addresses e.g 48 hours after the post has been created? That's plenty of time to react to the report.

Moreover, if the board supports TOR, there's no sense in banning anybody whatsoever, then why even storing IP addresses?

No. 29967 [Preview] [Reply]
Actions 
 >>/29965/
На вас пиндосов вообще похуй что ваши айпи адреса слили. Трясутся в страхе руснявые аноны которые политику обсуждали в /polru/ и /polrus/ , их реально могут в турьму посадить за гнилой базар против Пыни.








No. 30008 [Preview] [Reply]
Actions 
Please tell you didn't disclose the vuln without fixing it first.
 >>/29890/
Staff should never need to see IPs, not even the admin. IPs of hostile actors are worthless in the age of residential VPNs, "free" proxies and IPv6.
 >>/29917/
 >>/29966/
Not hard, you could even do it with a bash script. Crawl the post database table every X hours, check if a post is at least Y hours old, replace the ip field of the post row with NULL or a fake IP like 1.1.1.1 if the software can't handle null strings.



No. 30011 [Preview] [Reply]
Actions 
 >>/29965/
> since the 1990s
i wager you probably could get away with being an internet badass if someone got your IP back in those times but now it seems like you never know if a hacker is part of or has ties to some org and if that org is backed by a nation-state and if that org is sophisticated enough to do more than just delete your system32 folder. i would err on the side of caution with this site's security breach
















Post(s) action:


Moderation Help
Scope:
Duration: Days

Ban Type:

0 replies | 0 file
New Reply on thread #29851
Max 20 files0 B total
Index | Catalog | Banners | Logs