Old (poster involved) drama where several boards end up vanishing from a popular roleplaying forum

28  2015-06-21 by vryheid

Disclaimer- For the most part I instigated this drama, so it is only fair you take everything I post here with a grain of salt. That being said several people I have told this story to have found it amusing, so maybe a few people here will get a kick out it.

Background:

  • Warriors, a young adult book series about clans of warring feral cats, had built up a very populated roleplaying community around 2008-2009.
  • Most of these roleplayers congregated in loosely affiliated networks hosted and run using the incredibly popular and incredibly shitty free message board software ProBoards.
  • Warrior Cats RPG, the most populated of the bunch, was rapidly entering a time of transition due to the admins being progressively more preoccupoed with college work and unable to moderate the site
  • I was hopping around various message boards at the time offering to help with HTML and template issues both for experience and through requests. This was one forum where they badly needed it, so they quickly brought me on board.
  • Despite the book series clearly being targetted at way below my age group I found the quirky community there charming enough that I enjoyed hanging around, even if I didn't really participate in the roleplay aspects.

So what happened? With the admins wishing to hand off ownership of the site to someone who had a lot more time to invest, they ended up picking not a long time regular but a relative newcomer who was arguably also the most extreme of the bunch- a 40-something self-proclaimed cat lady who's claim to fame on the site was spending 10-12 hours on the site each day to manage her vast army of fictional cats. Her goals for the site included total monetization- think moving to privately hosted forum software and adding a new layer of ads- and adding paid membership tiers with special posting benefits. Finally, she believed that the 12-14 demographic should be the primary audience of the site, not the 16-18 year olds that were actively keeping things running- hence any sort of "mature" or "serious" discussion would have to be heavily moderated. This is basically what ended up happening, mind you, but some context is necessary to understand that at the time the forum was a powderkeg of frusterated and anxious members. It was the perfect setting for some serious drama.

I am skipping a LOT of details here for the sake of brevity. Suffice it to say, there was a lot of bad blood that grew between a lot of people, and I decided I wanted to fuck with the admins one more time before they let the entire community get demolished in the name of letting this new admin have her own personal playground. Nothing serious/threatening or really all that damaging, to be honest, just enough to shake things up a bit before I left. My forum position let me do nothing more than edit the HTML template on the front page, but I did know a thing or two about how incredibly vulnerable Proboards administration system was, so I managed to concoct a very primitive XSS attack.

For people not familiar with web design- POST variables are special values used by websites which can act like the initial gatekeepers of sensitive data, as they can only be transmitted by the user through a form on a website rather than through the URL. The problem with this is that Javascript can be embedded in a malicious website that automatically fills and sends a POST form in a way that tricks another site into accepting it as user input. Many message boards get around this vulnerability by requiring a long, randomly generated session variable which can only be read through the forum itself as a form of confirmation. Proboards did not, which meant that anyone who could trick an admin to open a specifically crafted link could cause them to inadvertently delete content from their own site. The conversation ended up looking something like this:

Me: hey [admin], would you mind checking out this guide I wrote? I posted it on obviouslysuspiciouswebsite.com.
[admin]: sure, hold on a sec.
[admin]: sorry, I'm not seeing anything. am I loading this correctly?
Me: I dunno, it might be lag. Try refreshing it a few times, that might help.
[admin]: okay, hold on... sorry, still not seeing anything.
[admin]: wait HOLY SHIT

The sad part is that even after several large boards poofed out of existence (mind you, Proboards does not allow backups of any kind) they still didn't realize I had caused this until I basically implicated myself by posting a comment about the incident in the HTML header, at which point they were convinced I was some sort of devious illuminati super-hacker that they needed the FBI to defeat. This is at least how they described it to the staff on the Proboards support forum, who calmly infomed them that their software could not be hacked. Obviously I was permabanned, but the aftermath got fairly juicy:

From the main thread about it:

This person is malicious, obsessed, completely without remorse for anything he does, and, thankfully, currently unable to do further damage.

Be still, my heart...

There was always something fishy about him… He seemed kinda suspicious to me, but he never did anything too bad, so I didn't mind.

If they only paid attention to the signs!

He's probably a guest right now and he's looking at our posts, IF YOU SEE THIS VRY, **** YOU!

You don't mess with me you small-minded, narrow-headed, slick-pelted slimy poop-sucking scum that should be washed down a garbage disposal and then incentagrated.

Ouch.

Comments about the incident several years later:

He makes me shiver, My mind always made me wonder. What would we do if he came back!?

Better have some garlic and blessed crosses then, you never know when an old forum poster might pop back up from the dead.

There are many other mentions elsewhere on the board (and even on another forum) but I think those two are the only ones worth mentioning. My only regret is that the thread they link of of an old alt of mine wasn't even me, but some pale imitation. I had my own style, you know? You'd think they'd recognise an artist...

7 comments