Final countdown

[ArMaP]

In a thread during last October's disaster, there was a bit of revelation of the software running ATS.  It was disclosed that the code running the site was written in-house as opposed to buying commercial software or use an open source package.  The benefit of that is a hacker or script kiddie can't simply use known exploits (i.e., something like WordPress or bbs apps) to try and break in.

ATS's code is based on a known forum software, and although it was highly customised by SO, some parts are still largely based on that old code. It was on those parts that I found a few exploitable bugs. Those are not enough to allow someone to get direct access to the database (at least as far as I looked into them) but they are good enough to create some chaos.

Also, being mostly new code is only as good as the code is, bad code is easily exploited.

In fact, do we know what happened in October?  Was it a code bug that corrupted the database,  a malicious actor on the inside or an attack from the outside?

My initial opinion, reinforced by what I read about what happened, is that someone tried to use a code flaw to get access to the database. One way of trying things like that can, if not carefully done, change all records on a specific database table.
In this case, what I think happened, was that someone tried to use that flaw to change the administrator's password and recovery email address, but while doing so they really changed all passwords and recovery emails to the same new password and recovery email, so everyone's password was changed and nobody could log in unless they knew the new password, that was the same for everyone. Trying a recovery email would not work because the email would be sent to the new recovery email address.

As nobody is updating the code the flaw is still there (along with all the others we don't know about) for someone to exploit, so it's possible that this will happen again.