Another Dreamworld FAIL !

[JackBenjaminBrissenden]

Statement from Dreamworld Australia: "Good evening everyone, there is an offer floating around Facebook at the moment. Some of you may have claimed this offer. We can confirm that this offer is NOT legit. We are not running any type of Facebook offer at the moment. We are sorry for any inconvenience caused and are investigating the origin of this offer" Well sorry Dreamworld but YES, this was from your facebook account... Either someone at dreamworld dreamed this up (who has access to the Dreamworld facebook page) or they were hacked ..or both. Probally just another way to lure customers into paying the ridiculous amount of $80 for an adult day pass to Dreamworld !!!

[xRazzBerryx]

Probally just another way to lure customers into paying the ridiculous amount of $80 for an adult day pass to Dreamworld !!!

I don't think they are luring customers into paying $80 for entry..Obviously a hack. Everyone gets hacked even dreamworld! (aparently)

[westical]

JackBenjaminBrissenden FAIL

Hi all, while it APPEARS this offer comes from our page, it does not. It is showing up on peoples news feeds and not on our timeline. It is very similar to the Target scam which happened a few weeks ago. Unfortunately, there is nothing we can do to stop the viral spread. We thank you all for your patience and understanding while we look into this further.

[JackBenjaminBrissenden]

Clearly you people know SFA about how facebook, the internet and security works!!! The offer was produced by someone that has access to the Dreamworld Australia facebook page. Heres proof: https://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-ash4/291524_261678940608450_611795934_o.jpg Secure HTTPS facebook connection and "dreamworld" facebook username !!!

[westical]

That's your secure HTTPS connection to Facebook you dope.

[JackBenjaminBrissenden]

Yep.... Anyway Dreamworld screwed up.... they can have fun with their PR nightmare now

[westical]

I look forward to this being a Facebook exploit and Dreamworld having nothing to do with it. But you're the internet security expert.

[kujotess]

52,000+ people have claimed already! What is the offer anyway? I haven't clicked on it so I don't know what it is...

[westical]

Because just clicking on it accepts the offer and also spams your feed if you don't tell it not to.

[BemaniAK]

Whether or not they posted it themselves or not, ACCC laws do not classify Facebook postings as advertising and as such are not subject to false advertising and/or bait and switch laws. Facebook account passwords are compromised all the time, settle down.

[JackBenjaminBrissenden]

Maybe Dreamworld should retrace their steps/actions over the last few weeks and they will find their answer.... That is all!!!

[CruiseSF]

Just because its HTTPS doesn't mean it can't be hacked. All they needed to do was run a program that runs through every possible combination of passwords until they got in. Obviously with a delay so that it doesn't lock the account.

[Gazza]

So what was the actual thing offered? Free ticket? 2 for 1?

[BemaniAK]

Just because its HTTPS doesn't mean it can't be hacked. All they needed to do was run a program that runs through every possible combination of passwords until they got in. Obviously with a delay so that it doesn't lock the account.

That's called a bruteforce attack. Protip: They take years to accomplish. You know how this sort of thing happens, right? Password written down on a piece of paper, accidentally left logged in on a PC that can be accessed by the wrong person, the list goes on.

[xRazzBerryx]

So what was the actual thing offered? Free ticket? 2 for 1?

Pretty sure (because I deleted the email) it said to come to dreamworld by 12/7/12 and show this email on your phone or printed out to redeem it. (whatever IT was)

[CruiseSF]

That's called a bruteforce attack. Protip: They take years to accomplish.

If people are desperate enough they could do it. I was just give one possible way it could happen because he sounded so sure that it was impossible to hack facebook.

[BemaniAK]

If people are desperate enough they could do it.

No, they couldn't, you don't understand, if Dreamworld had the minimum amount of characters on their password, with no numbers, and the hacker somehow knew to not take numbers into account, it would take more than 50 years, if they had numbers, which is obvious, or if the hacker did not (and he won't) know that there are no numbers in the password, it would take 4 lifetimes to get it. Edited July 11, 2012 by BemaniAK

[CruiseSF]

The password is not going to be something like dcbabhby8yhjhuiy98u98t78i;iu98u4Rih. It will be something simple that would have something to do with the park.

[BemaniAK]

It will be something simple that would have something to do with the park.

Businesses do not use business-related passwords for Facebook accounts, random word unrelated to the park>random numbers that may be related to a certain aspect of the park (height of a ride or something of that nature) is the standard. It does not matter how the characters are organized, the brute force attack is only based on the amount of characters and how many characters you can factor out of the search. There's one thing we, as IT professionals can't help, however, and that's random employees jogging their memories with post-it notes containing the password on their computer monitors for all the cleaners to see.

[westical]

We don't even know if there was a password breach.

[BemaniAK]

We don't even know if there was a password breach.

Exactly right, this is all theoretical banter. The fact is is that Dreamworld's FB page had a false post on it and they quickly rectified it, since Facebook posts have not got legal advertising status nothing will come of this and everyone will go back to their daily lives.

[Gazza]

^I don't even get why people are so mad? They acknowledged the problem very quickly. It's not like they are a bank or something where there is real risk. The line in the OP about this being a ploy to get people to buy full priced tickets is plain bullshit, and is just a desperate attempt to be negative about the park (The title of the thread seems to reflect that)

It will be something simple that would have something to do with the park

Right, but if the hacker were to "run a program that runs through every possible combination of passwords" (Your exact words Crusieshipfan) then how does a mindless, methodical brute force program determine what what word is to do with the park, and what is just gibberish? The word "cyclone" would be tested by the program, but so would "cyclona" or "cyclonb" or "cylonc" or "cyclond" etc etc on equal footing. A 6 Character password using only letters (of either case) has 19 770 609 664 possible options and as BemaniAK said since you cant just do them rapid fire due to FB not letting you make that many attempts. 56 800 235 584 is what it reaches when you add numbers to the mix,

[BemaniAK]

A 6 Character password using only letters (of either case) has 19 770 609 664 possible options and as BemaniAK said since you cant just do them rapid fire due to FB not letting you make that many attempts. 56 800 235 584 is what it reaches when you add numbers to the mix,

Out of curiosity, how did you calculate this?

[Gazza]

52^6 52 letters (26 each case) muliplied by itself 6 times for the 6 positions (in other words raised to the 6th power) Becomes 62 if you add numbers ( so do 62^6) If you use all numbers and letters, and had seven letters, you'd do 62^7...and things get really insane...3 521 614 606 208 combos.

[jjuttp]

LOGICAL EXPLANATION. Keylogger.