So I run this web forum for tinwhistle and flute players. For the most part, it's an uneventful sort of place (and I long ran out of interest in participating -- there's only so much that can be said about the whistle).
A little while ago, a user with the handle "piper7" started posting. His entrance was problematic -- a board regular had reposted a for-sale post of his found elsewhere in order to get it to more people. Unfortunately, that favor backfired, as others followed up that thread explaining why the flute he was selling was not a good deal.
He came on swinging in a peculiar, passive-aggressive sort of way, and never stopped. Within a week or so I was getting complaints, but the whistlefolk tend to complain a bit early about these things, so I decided to let it sit.
The very next day, I get this:
From: "rstaton" <rstaton@cinci.rr.com> To: <webmaster@mati.ca> Subject: Date: Thu, 20 Feb 2003 20:24:08 -0500 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 A posting was just placed on the chiff and fipple flute board by someone = other than the person identified as making the posting. The posting is = under the name of piper7. I was not aware that another person could hack = and make postings that way. I shall not be posting again and I think you = need to look into this.
Curiously devoid of detail, yes? I replied asking who he was, what post he was talking about, and what evidence he had. (Incidentally, he never replied to that message.)
I looked at the board and found he'd gone off there too:
See the chiffboard post in a new windowNote still devoid of details. I'd since checked logs and found that all of his posts came from the same IP address, which was also the one he'd sent me mail from. I then found the problem post itself. It's about halfway down the page, posted at 2003-02-20 14:38.
See the chiffboard post in a new window
Since the post came from his computer, I guess it's a ploy for to either (1) look like a victim and gather sympathy, or (2) try to attract attention, or at least to try to throw a monkey wrench in the works as he leaves the forum.
From here it's easiest to just share the mail, because that's the entertaining part. He always quotes everything in an Outlooky way, so I've trimmed off all the "---- Original message ----" bits that were redundant. You will notice that he is a net producer of email, and sends in little batches. I can almost picture him spitting on the keyboard as he types.
Date: Thu, 20 Feb 2003 21:39:31 -0500
From: rich <webmaster@mati.ca>
To: rstaton <rstaton@cinci.rr.com>
Subject: Re: your mail
On Thu, Feb 20, 2003 at 08:24:08PM -0500, rstaton <rstaton@cinci.rr.com> wrote:
>
> A posting was just placed on the chiff and fipple flute board by
> someone other than the person identified as making the posting. The
> posting is under the name of piper7. I was not aware that another
> person could hack and make postings that way. I shall not be posting
> again and I think you need to look into this.
Uh-huh. Evidence, please -- like, say, which post you're talking about?
I take it you're piper7 -- while that's not very clear from what you
wrote, I just read the post on the flute forum.
Anyhow, all of the posts from piper7 have been from the same IP address,
which is also the IP address from which you sent the email quoted
above, so if you're piper7 and you think someone was able to post
and impersonate you, then you may wish to check the security of your
Windows install or your door locks.
-Rich
From: rstaton <rstaton@cinci.rr.com>
To: "rich" <webmaster@mati.ca>
Subject: Re: your mail
Date: Fri, 21 Feb 2003 09:19:00 -0500
I am in the process of reporting this incident to the FCC and other
agencies. You should hear something soon on this.
From: "rstaton" <rstaton@cinci.rr.com>
To: "rich" <webmaster@mati.ca>
Subject: Re: your mail
Date: Fri, 21 Feb 2003 09:23:46 -0500
In any event, if there is a security breach in my computer, this is hacking
and a federal offense. So, it is serious enough to be investigated and I
shall be diligent in my efforts to thwart this activity. Hacking is illegal.
Note that he gets the domain wrong in the next one. The web forum is chiffboard.mati.ca, although there is a link to it from chiffandfipple.com. Dale, who he Cc'd, runs the chiffandfipple.com site.
From: "rstaton" <rstaton@cinci.rr.com> To: <rich+chiff@lafferty.ca> Cc: <dwisely@hiwaay.net> Subject: Fw: hacking of password on chat board Chiff and Fipple. com Date: Fri, 21 Feb 2003 09:17:24 -0500 ----- Original Message -----=20 From: rstaton=20 To: fccinfo@fcc.gov=20 Cc: dwisely@hiwaay.net=20 Sent: Friday, February 21, 2003 9:15 AM Subject: hacking of password on chat board Chiff and Fipple. com Dear Madam or Sir: I am contacting the FCC to report a situation I encountered while = visiting the website of Chiff and Fipple.com. This website is operated = by a Mr. Dale Wisely. I was told to obtain a password when I entered the = site and I did this. During my visits to the site, someone was permitted = to hack into my password and, according to the "webmaster" they were = also permitted to send a message to the board from my computer. I = consider this hacking and the owner of the board has done nothing to = investigate this. I am requesting an investigation of this intrusion and = invasion of privacy. If you cannot do the investigation, please inform = me of the agency who will handle this. Thank you. Roger Staton
In the next message, it appears he accidentally sent mail to himself first time 'round.
From: "rstaton" <rstaton@cinci.rr.com>
To: <rich+chiff@lafferty.ca>
Subject: Fw: your mail
Date: Fri, 21 Feb 2003 09:22:07 -0500
----- Original Message -----
From: "rstaton" <rstaton@cinci.rr.com>
To: "rstaton" <rstaton@cinci.rr.com>
Sent: Friday, February 21, 2003 9:20 AM
Subject: Re: your mail
you see, if all the posts are from the same computer, that means if I did
not send a post, someone got my password from you and according to you,
used
my computer. We'll get to the bottom of this after an investigation I
assure
you.
From: "rstaton" <rstaton@cinci.rr.com>
To: "rich" <webmaster@mati.ca>
Cc: <dwisely@hiwaay.net>
Subject: hacking on chiff and fipple
Date: Fri, 21 Feb 2003 18:56:31 -0500
I will let you know, as I have let Mr.Wisely know, that I have filed a =
formal complaint with my server, time warner roadrunner, and I am still =
attempting to get assistance from the FCC and the Ohio Atty. General. =
You may think this is a joke, but it is not and it is time you take this =
seriously. I recommend that you not tamper with any of your computer =
records for this website and we will get to the bottom of this and find =
out who gained illegal access to my computer. Have a good day sir.
Roger Staton
From: "rstaton" <rstaton@cinci.rr.com>
To: <dwisely@hiwaay.net>
Cc: "rich" <webmaster@mati.ca>
Subject: hacking
Date: Fri, 21 Feb 2003 19:03:37 -0500
GlacierOne thing further Mr. Wisely. If the confidential integrity of my =
computer is further compromised as a result of this intrusion and it can =
be shown that this results through your website, I shall hold you =
legally responsible.=20
Roger Staton
Date: Fri, 21 Feb 2003 19:23:19 -0500
From: rich <webmaster@mati.ca>
To: rstaton <rstaton@cinci.rr.com>
Subject: Re: hacking
On Fri, Feb 21, 2003 at 07:03:37PM -0500, rstaton <rstaton@cinci.rr.com> wrote:
>
> GlacierOne thing further Mr. Wisely. If the confidential integrity of
> my computer is further compromised as a result of this intrusion and
> it can be shown that this results through your website, I shall hold
> you legally responsible.
Stop bugging Dale; he's busy with his dying mother-in-law. The machine
'chiffboard.mati.ca' is mine, not Dale's. I run the forums on it as a
favor.
If you really have a need to send a half-dozen email messages a day to
someone, send them to me, not him -- but don't expect a response, and
don't expect me to keep the contents private.
-Rich
At this point he started forwarding me unmodified copies of my own messages. Beats me why, but they don't add much to the discussion, so I've omitted them. Not that he's stopped writing in batches or anything:
From: "rstaton" <rstaton@cinci.rr.com>
To: "Dale Wisely" <dwisely@hiwaay.net>
Subject: Re: hacking intrusion chiff and fipple
Date: [I lost the date header on this one, but it goes here]
Mr. Wisely:
I am taking it from your silence that you do not intend to =
investigate the incident of reported hacking on your website. I must =
conclude that someone in your organization was involved. I am in the =
process of reporting this to the FCC and I have filed a formal complaint =
with my server, RoadRunner. Once again, your silence on this issue is =
very suspicious. I do intend to have this investigated fully and would =
advise you not to destroy any of your computer records.
From: "rstaton" <rstaton@cinci.rr.com>
To: "Dale Wisely" <dwisely@hiwaay.net>
Cc: "rich" <webmaster@mati.ca>
Subject: Re: hacking intrusion chiff and fipple
Date: Fri, 21 Feb 2003 20:38:06 -0500
Mr. Wisely,=20
I too have experienced deaths in my family, but that has not given me a =
leave from responsibility. You have a legal responsibility for what =
happens on your server and your website. I have informed you that =
someone who is a member on your website had invaded the security of my =
computer. I know at the present that you take this as a prank and a =
joke, but I assure you I do not. Your reply is totally unacceptable.
Roger Staton
----- Original Message -----=20
From: Dale Wisely=20
To: rstaton@cinci.rr.com=20
Sent: Friday, February 21, 2003 7:04 PM
Subject: Re: hacking intrusion chiff and fipple
Roger,
You may take it from my silence that I've not checked my email because =
my mother-in-law died last night and I've been occupied with things =
which mean a lot to me and my family. =20
I have not had time to take your complaint seriously, or to dismiss =
it, or to read it. =20
With all due respect, we are talking about a hobbie-oriented forum =
with no products to sell and no need for secure transfers of =
information. We're not talking about national security.
Enjoy your dealings with the RoadRunner folks and the good people at =
the FCC.
From: "rstaton" <rstaton@cinci.rr.com>
To: "rich" <webmaster@mati.ca>
Subject: Re: hacking
Date: Fri, 21 Feb 2003 20:35:06 -0500
Oh, you will hear more about this. This response certainly indicates that
you and Mr. Wisely are knee deep in this. I certainly did not expect either
of you to take such a cavalier attitude toward a security breach. Good, now
we do what is necessary. I will bug neither of you, but I assure you that
this is not going away. You are both a couple of smart nicks and I am used
to handling these matters through legal channels. of course I would not
expect you to keep anything private. I believe you know who the hacker is
and that makes you and Mr. Wisely accomplices.
From: "rstaton" <rstaton@cinci.rr.com>
To: "rich" <webmaster@mati.ca>
Cc: "Dale Wisely" <dwisely@hiwaay.net>
Subject: Re: hacking
Date: Fri, 21 Feb 2003 20:41:25 -0500
By the way, I will continue to correspond to you and Mr. Wisely and anyone
one else I choose until I get a satisfactory resolution.