My disqualification from the ACWC

[castiel]

Hey guys,

Late Monday night/Tuesday morning Harrek contacted me asking if I could help with php as Lucas had left the ACWC project. I said yes and I was told they were trying to access the "unapproved" teams who had been submitted. I was finished by about 3am and went to bed, thinking all was well and good.

The next night(tuesday) at 8pm I got an angry email from Lucas which can be seen here:

echo "<!--Herro " . MYSQL_USER . " " . MYSQL_PASSWORD . " -->";

Remind you something ?
Yes, when you were stealing my db username / password, right.
First, you were not supposed to have enough access. Since you were going to play the tournament and you had nothing more to do, and to prevent this kind of shit from happening, i had removed your svn access;
Unfortunately, (fortunately for you), daylixx gave you his login and password. It was his fault ok. But how could he guess you would do such things ?

You have absolutely NO reason to steal this informations, you could have done without it and you know that.
Also you've made this critical data public while you were trying to get it.
And anyway you could have asked me if needed instead of doing that.

Of course daylix password has been removed.
And i'm seriously thinking about taking other actions against you.

PS : db password has been changed and i will not share my VPS any longer. Thanks to you.

I was confused by this, but as I was at work I thought I would attend to it then.

When I arrived home from work finding out my team captain(undead) had recieved the following message from daylixx(new acwc admin).

[23:09] <DaylixX> Hello Undead, we disqualified Castiel of the World Cup for hacking database site, so you will have found a new partner.

This all threw me off a bit, as all I thought I had done was help out my friend, Harrek.

I promptly emailed lucas back apologising, a sent him another email a few hours later but I have had no response. I also tried to contact him(Lucas) on teamspeak when he was online but I got no response(harrek told me he was talking to him moments before).

Now I'm confused and not really sure what to do, I have been excluded from a tournament I was rather looking forward to due to me trying to help out and have been accused of hacking.

Also when I now try to visit the ACWC website, I get a 403 error, which usually means my ip has been blocked(I have asked others and they can still access it fine).

The events on the night of the accused "hacking" go as follows:

Harrek/DaylixX contacted me asking if I knew php, I replied yes. They needed help finding the teams which had applied to ACWC, as the current admin interface that DaylixX had did not show the unapproved teams.

I was previously working on the site, but my svn access had been disabled as I am a player(of course), so daylixx gave me his access so that I could try and work out how to view the unapproved teams.

My first thoughts were that lucas possibly had a higher admin role on the acwc site so that I just needed to change daylixx's role to the same and it would all work.

I ran queries against the database to increase my role to same level as lucas, to test if that meant you could see the unapproved teams, unfortunately it seemed that lucas and daylixx had the same admin level on the acwc site and lucas was approving teams a different way.

I looked through the php of the site and I saw that when a user submitted a team the team details was inserted into the mysql database.

My next thought was that if I simply had the database username and password, I could login to phpmyadmin(an online database viewer) and look at the unapproved teams in the database.

To do this I used the following command:
echo "<!--Herro " . MYSQL_USER . " " . MYSQL_PASSWORD . " -->";
This would output the username and password to the site, but would put it in a comment, only viewable if the user clickes "view source" and then knows what the username/password combo is for. It was a slightly risky thing to do but I removed that line as soon as I had the username and password to ensure nobody else would see it.

I then used the username and password to login to phpmyadmin and to view the acwc database, I was able to inform harrek and daylixx of the extra teams that had been submitted, so they were now able to approve the newly entered teams.

This is all that I did, in defense of myself:

• I was ONLY trying to help, nothing else. All my actions were in an attempt to help Harrek and DaylixX
  
• I did not know it was lucas's personal server, I thought it was a w00p clan server
  
• I did not email lucas about this as I was informed/thought that he was unreachable(that's why I thought they contacted me not him)
  
• I attained the MySQL username and password so I could easily view the content of the database, not for ANY other reason
  
• As lucas said there are other ways to get the data(without the username/password) but it was late and I just wanted a simple solution + at the time I did not think it would be an issue
  

As I have said to lucas, i'm sorry that I did not email him and that I instead did not write some php code to retrieve the unapproved teams. But on the night it seemed like an easy way to get the information harrek/daylixx wanted. I'm sorry if it seemed like I was doing anything else other than try to help them.

I don't think I should be labeled a hacker for this, or excluded from the tournament, I have not heard from lucas in over 2 days so decided I would post and let people know what is going on, I have apologised and tried to talk to him but have had no response.

Thanks for hearing me out, Castiel