I just saw some updates on GMT's Facebook page about some attacks on their website. Here are a couple of the messages.
QuoteMore on the website problem, copied from a response on Consimworld:
I wish I could tell you details, guys, but we're not getting info from our ISP yet. All I know at this point is that our ISP took a big hit on Friday - big enough to bring their site down, along with ours and others. I'm sure it was malicious, but don't want to say anything further in public on that, while they try to plug the hole/fix the problem.
At this point, our ISP is not answering our e-mails or calls or fix it tickets, so my assumption is that they are having troubles bigger than ours at the moment. I know this is frustrating, believe me we are frustrated. But I don't want to give you information that isn't accurate, and right now I just don't have any other than the above. Mitch is continuing to ask for information, and we'll let you guys know just as soon as we do.
All of our customer data is encrypted (twice), but I never say never when it comes to crazy hackers, so I think that Keith's precautions above [ Keith had said "I think folks have a right to know that so they can check their CC # that's on file with GMT and change any sites where they may have also used their GMT password"] are prudent. Once we have details on exactly what this was and whether any customer data was at risk, we'll pass that along right away.
I hope this is helpful. More as we know it.
Gene
Then their last update and it sounds pretty serious.
QuoteWe received some stunning news this morning when we finally heard from our ISP, and they made it clear to us that WE were the lone target of a massive DOS attack, large enough to bring all their servers down. The good news is that it was only a DOS, not something where they got into customer data. So thankfully we have no worries about the security of your data.
The bad news is that we have to find a new ISP and that the GMT site is going to be down for awhile. I spent part of my morning talking with the FBI, so please understand that we can't talk in detail about every aspect that we know while there is an ongoing investigation. The only really important news here is a) your data is fine, and b) the GMT website and e-mail servers are down for the near future.
Some details for you customers:
Contacts and E-Mail. First off, the online chat from the website is down until we have the site up again.
Lost e-mail: If you sent us e-mail since about 3 PM Friday afternoon, it is lost, probably forever. So please resend or call the office ladies.
We have set up a temporary e-mail address for the office ladies that you guys can use to contact them while our gmt mailserver is down. That address is gmtoffice5@yahoo.com. Please use this address for contacts with them until further notice. Thanks!
Orders. Obviously, web-ordering is down until the site is back up. Our office ladies are still ready to take your orders, though, as always! Just call 800-523-6111 or e-mail to gmtoffice5@yahoo.com and they'll fix you up.
E-Mail Updates: I use an off-site service for the mass customer e-mail updates, so I'll use that venue as well as CSW and Facebook to give you guys detailed updates as we move forward. Hopefully, we can get this fixed before too long.
Thanks for your patience with us as we work to get everything back up and functioning normally. If you have any suggestions - especially you guys who work in the realm of internet security, feel free to drop me a line at gmtgames@aol.com.
Enjoy the games!
Gene
So it looks like their website will be down for a while. This really sucks and it makes me pretty angry that it would happen to a company like GMT. >:(
Here is the link to see all their updates.
https://www.facebook.com/pages/GMT-Games/184579104920069?ref=stream
That sucks. GMT has always been a great company to deal with. I am a little concerned about the "credit cards on file" bit. I hope they weren't storing that info in their own database, no matter how much they may have had it encrypted.
that explains why I couldn't hit their site today
What game have they released that might piss off, say, some Norks? Chinese?
I get the feeling this isn't the work of some script kiddies.
PLA was my first thought as well.
That or the Macedonians got pissed that The Conquerors: Alexander the Great is getting marked down to bargain bin prices.
http://yhst-12000246778232.stores.yahoo.net/coalgr.html
I really doubt this is some sort of 'international web conspiracy'....frankly, blaming some foreign nation for taking down a board game company web site is getting a bit tin foil hat-ish.
And never chalk up to international politics what is much easier to chalk up to the usual ass hat denizens of the Internet.
Next War: Korea was released last year
GMT's site goes down then
the Norks test a nuke
coincidence?
Quote from: Arctic Blast on February 12, 2013, 01:33:29 AM
I really doubt this is some sort of 'international web conspiracy'....frankly, blaming some foreign nation for taking down a board game company web site is getting a bit tin foil hat-ish.
And never chalk up to international politics what is much easier to chalk up to the usual ass hat denizens of the Internet.
I like my tinfoil hat. It matches my underwear.
I'm with AB on this one
plus, I have no desire to know about LB tinfoil chainmail underwear
Chainmail tinfoil? No way! It takes too long to weave. I go with full plate!
Geez, why would anybody target a board game company? I just don't get it. ???
Quote from: gattopardo on February 12, 2013, 11:16:31 AM
Geez, why would anybody target a board game company? I just don't get it. ???
There's the excuse "because they can."
What strikes me as odd is the characterization of the DDOS attack. It was called "massive." Something about that suggests to me that this wasn't a run of the mill kid with nothing better to do.
It was probably an attempt to brute force through the security protocols of the ISP and get to financial data. That's almost always what it turns out to be.
<shrug> Could be.
Does anyone know where the guys running Victory Point Games were last night? ;)
Really odd, I got word of this via the email newsletter. I am not sure why GMT, other than just plain random chance. Or disgruntled BGG guys made at overly long P500?
Looks like they have the website back up and running.
QuoteWebsite Back Online!!!
This is just a quick update to let you know that the GMT website is back online now. As a security precaution again further attacks of this type, we've added Cloudware software to our site. This will mean that occasionally when you visit our website, you will get a "challenge page" (like the ones you get from an email server that is filtering spam, where you have to type in letters you see on the screen) before continuing to our site. We're sorry for any inconvenience this may cause you, but we want to make sure we don't get any more "bot" attacks on the site.
Our mail servers look to be working fine as well, so your e-mails to gmtoffice@gmtgames.com should work now. As we noted earlier, if you sent us e-mail between friday and today to any of the @gmtgames.com addresses, that mail was lost, so please resend it.
We're monitoring the site closely and double-checking all features over the next few days. If you see something that appears to not be working properly, please let me know at gmtgames@aol.com.
Thanks for your patience with us through this trying past few days, and for all the kind words, support, and advice you've given us. Believe me, we KNOW we have great customers! Thanks!
Thanks, as always, for your support of GMT!
Enjoy the games!
Gene
Great news. Thanks!
Did they ever figure out what really happened?
Appears to be down again. I recently picked up a copy of Blue vs Gray (http://boardgamegeek.com/boardgame/89/blue-vs-gray) which has gotten some very nice reviews on the Geek. GMT picked up this game from QED some time ago (I have the QED version). The updated rules are on their website but it's been down since at least last night.
I wonder if the Norks aren't hacking them for Next War: Korea
Quote from: bayonetbrant on March 27, 2013, 07:17:39 AM
I wonder if the Norks aren't hacking them for Next War: Korea
You mean
they know about our little wargaming hobby? ???
Quote from: GJK on March 27, 2013, 07:21:49 AM
Quote from: bayonetbrant on March 27, 2013, 07:17:39 AM
I wonder if the Norks aren't hacking them for Next War: Korea
You mean they know about our little wargaming hobby? ???
The GMT website counts as critical infrastructure in my book. But if they took down NWS...that would be a real tragedy.
Quote from: GJK on March 27, 2013, 07:21:49 AMQuote from: bayonetbrant on March 27, 2013, 07:17:39 AMI wonder if the Norks aren't hacking them for Next War: Korea
You mean they know about our little wargaming hobby? ???
Nah, just that anything with their name on it probably looks equal to them through their limited internet periscope. And if you're raised in a country where nothing happens without gov't approval, and you have no frame of reference for the possibility that someone could - of their own volition - create and sell a game about a war between the US and the Norks, then your default mode of thought is that a game like that must somehow be state-approved.
I'm not saying it's right, just saying that it's not an unrealistic possibility, and if you discard things out of hand that sound crazy
to us then you're not necessarily thinking about what might be rational to the other guy.
Quote from: bayonetbrant on March 27, 2013, 07:32:25 AM
Quote from: GJK on March 27, 2013, 07:21:49 AMQuote from: bayonetbrant on March 27, 2013, 07:17:39 AMI wonder if the Norks aren't hacking them for Next War: Korea
You mean they know about our little wargaming hobby? ???
Nah, just that anything with their name on it probably looks equal to them through their limited internet periscope. And if you're raised in a country where nothing happens without gov't approval, and you have no frame of reference for the possibility that someone could - of their own volition - create and sell a game about a war between the US and the Norks, then your default mode of thought is that a game like that must somehow be state-approved.
I'm not saying it's right, just saying that it's not an unrealistic possibility, and if you discard things out of hand that sound crazy to us then you're not necessarily thinking about what might be rational to the other guy.
Excellent point, Brant. I hadn't thought that far into it. I suspect you're right.