Looks like our injection hackers found a small hole that allowed them to corrupt a single SQL table and insert their garbage.
I have plugged the hole, as well as tightening down my general monitoring for injection attacks. If anyone gets any warnings
from their Anti-Virus, please use the contact form and let me know immediately. I'm getting about 20-30 attacks on the server
per day from IP addresses around the world, so I'm guessing I got onto one of the big hacker/spammer gangs lists of servers
to test for vulnerabilities. I will continue to monitor the server, but so far it looks like my filtering is catching all
of their attempts now.
Damn hackers
6/20/08
Apparently someone thought it would be cute to try injecting some malicious code via a SQL injection. I was able to track
down the hole they were using to inject their code and plug it. I also tightened down some of my own security filters that
I have written to detect those attempts in the future and automatically 403 any IP addresses involved. I have also reported
those IP addresses involved in this episode to their respective owners, though most are in LACNIC space, so I doubt very
much that they will do anything.
On that note, if your ISP is brasiltelecom.net.br, you aren't reading this, because their entire range of IP addresses
has been permanently banned. If you manage to read this from a friend's computer, please let your ISP know that I will
unban their IP range when they have a working abuse address that I can use to report hacking attempts like this in the future.
Ashen Empires Servers Down
10/16/07
After being down for 4 days, AEAuction is finally back up and running. On a side-note, Comcast STILL has not restored
cable modem service at my house. They have missed 2 appointments in a row. Anyway, the server now lives at my data center
at the office, so it won't depend on residential cable modem service anymore. As an added bonus, it is now sitting on a
dedicated fiber line with its very own IP address, so access should be much faster.
Auctions that ended during the downtime between 12/15/07 and 12/20/07 will NOT be considered binding, since bidders would
not have had a chance to bid on these items. If both parties wish to honor the bid on an auction ending during that time
period, they are welcome to, however, any neutral or negative feedback left for auctions ending during that time period
will be reversed, and disciplinary action will be taken against the account leaving it.
Ashen Empires Servers Down
10/16/07
Got a call this morning at 9:20 CDT from IWG asking me to post some information in the hopes that it could get out to some
of the players wondering why they can't reach any of the Ashen Empires servers. Not a lot of details at this time, but
apparently there was some kind of power issue that brough all the servers down. They are working on getting them back up
and running, but do not currently have an ETA. If I get any more information, I will post it immediately.
Update 9:32 CDT - More details. Apparently one of the transformers failed, cutting power to about half of the server rack.
ETA to get things back up and running is at least 1 hour. I will keep everyone posted if any new information becomes
available.
While you are waiting, you could always try out my little web based game to keep
you entertained until the AE servers come back up.
Trading Security
7/9/07
There have been several cases recently where people in game have claimed to be the person winning an auction, and collected
the items, even though they were not the person that bid. To prevent this from happening, please DO NOT
trade with a character if that character's name is not listed in the buyers/sellers profile. Also, please be certain to keep
your profile updated with all your current character names.
Scavenger Hunt Heroes Prize
1/27/07
Choper has volunteered to put up a 1,000,000 gp prize on the Heroes server for the Scavenger Hunt. One prize will go to
the player on Heroes who earns the most points, and one will go to the player on Legends who earns the most points. Please
make sure you let me know which server you are competing on when you make your submissions. I will start a leader board
for each server as I start getting submissions in. Please make sure you are following the submission guidelines below,
or you may not get credit for your submissions.
An anonymous donor has agreed to donate an additional 1 million gold towards the legends prize, making it a total prize
of 2 million gold for the winner on Legends.
AEAuction Database Scavenger Hunt
1/26/07
AEAuction will be running a database scavenger hunt in order to fill in the missing items in the database. Participants
will be awarded points for information that they submit. At the end of February, the points will be totalled up, and the
person with the most points will win 1,000,000gp on the Legends server. Heroes players are welcome to participate, but
since I don't have 1,000,000 gp on Heroes, they will have to elect a Legends character to receive the prize if they win.
Points will be awarded as follows:
1 point - Submitting an item image that is not in the database.
1 point - Correction to existing stats (excluding crafting information).
2 points - Submitting stats for an item listed on the No Stats page.
3 points - Submitting stats for an item not listed in the database at all.
There are a few rules and guidelines that you will need to follow to participate:
All sumissions should be made by using the Submit feature available at AEAuction.com.
Stats and corrections must be submitted as a screenshot of the item stats window to insure that they are accurate
and complete. RETYPED STATS WILL NOT BE ACCEPTED as there is no way for me to verify their accuracy.
Only items that can be placed in an equipment slot on the paperdoll will count for points.
Screenshots can be cropped to a smaller size if you like, but do not alter the original image quality by converting
it to a jpg or other image type.
If two people submit stats for the same items, points will be awarded to the one that arrived in my mailbox
first ONLY.
No points will be awarded for images that are not usable. Please see image submission guidelines in previous
news items for details.
These rules are subject to change at any time without notice.
Submissions will be accepted until Midnight February 28, 2007, submissions received after that will not be counted.
Scores will be totalled and the Grand Prize awarded no later than March 10, 2007.
Character Planner
1/25/07
I see that several of you have already found the Character Planner that I have been working on a little bit over the
past few weeks. If you haven't found it yet, its under "My Account". Simply add your character, and then click on the
edit icon to enter the planner. Right now it doesn't do a whole lot. So far, this is what it does:
Lets you lay out what equipment you are going to want to use.
Helps you decide what orbs will be required to wear a particular set of equipment.
Shows you your total stat bonuses as well as current and future HP with the chosen equipment.
I would like to get some feedback on this to find out what kind of features you all might find useful, if any. Also
any suggestions on making it easy to navigate and use are also welcome.
Need YOUR help adding SoC items
1/15/07
I need Sands of Creation item and creature stats! If you have any SoC items that currently do not have stats listed
in the database, please take a screenshot of the stat window for that item, and email them to me at
telarin1@yahoo.com so that I can update the database with them. If you remember what
dropped the item, or are aware of any drop that are not listed for a particular creature or item in the database, please
let me know and I will add that information as well. If you are not positive what dropped, I would rather have no data
than incorrect data.
If you want to provide a screenshot of the actual item as well, it need to either be in an equipment slot on your character,
or in the BOTTOM ROW of slots in a shop window with transparent interface turned OFF in your client. These are the only
images I can use, as all others are the wrong size border and will look out of place with everything else on the site.
I have made some minor formatting changes to the item lists in the database that should make the information cleaner and
more readable.
Changes and New Premium Feature announcement
12/21/06
When creating an auction, there is now a Quantity field. If you are listing a lot of items rather than a single item,
please use this field. So instead of listing Item Name: "1000 Logs", you will list Item Name: "Log", Quantity: "1000".
This will help standardize how these batches of items are listed, and will also help the AEAuction Item Database more
accurately calculate the average price of items that are sold in various size lots. Remember, minimum bids and bid
amounts are still for the whole lot of items, not per individual item, so bidding has not changed, just the way
multiple quantities are listed.
I have been trying to come up with a good way to thank those of you that have donated to AEAuction.com over the past
few months. As a way of saying thank you for supporting the site, I have added a premium feature available to anyone
who has donated $5 or more to AEAuction. The new feature is a "Store Listing" option when creating auction listings.
A store listing will have only a Buy It Now option, and will not allow bidding on the item. The listings will also last
for up to a year, or until someone buys it or the lister cancels it. Be careful with this feature, as forgetting to
remove listings if you sell them in game or elsewhere can be hard on your Feedback score, so make sure to remove the
listing immediately if you make a deal somewhere else.
If anyone notices any problems or unexpected behavior from either of these new features, please let me know
so I can get it fixed quickly.
Site Outage/New Server
12/13/06
AEAuction suffered a total server meltdown sometime last night. I have moved the site over to a new server running
newer software, and everything seems to be working ok. If anyone experiences any problems, please email me at telarin1@yahoo.com
or use the contact form to let me know.
Email Problems
5/30/06
The site had some problems with emails going out over the last few days. The issue should now be corrected. If you have
tried to email using the Contact Us page on the website in the last week or so and have not received a response, please
resend your inquiry.
Also, I still need more item stats for the database. I'd like to get it close to complete before the expansion comes
out and I have to start over on a whole new set of items. Email screenshots of item stats to
telarin1@yahoo.com. If you want to contribute pics for the database, they need
to either be in an equipment slot, or in the bottom or left rows in a shop. They should come out to 33x35 pixels exactly
if you crop them down to the borders, and those are the only 2 places that they come out the right size.
Donations, Database, and Bestiary
2/6/06
Donations
Since several of you requested it, I have added a donation button to the site so you can donate towards the cost of the
server an bandwidth if you want. If you find the site useful, and would like to donate to it, feel free to. If you find
the site useful and don't want to donate towards it, thats cool to. If I don't receive any donations, it doesn't cost me
anything, and you won't see any remarks on here about how expensive it is to run the site, or hear me gripe that I'm not going to
keep the site operating if I don't get donations. The site is not about making money, it is about providing a useful tool
for the AE community, and I will continue to make it available as long as you all continue to use it and find it helpful.
There have been numerous minor changes to the site over the past couple months, but most have been merely cosmetic, however
there are a couple worth noting:
Users can now edit their profile from the My Account page by clicking on the Edit button under My Profile.
Users can pick a preferred server, which will then be used as their default when listing a new item. This should
help cut down on the problem of people forgetting to change the server and listing their items in the wrong place.
Added some options to control the appearance of the first page you see when you select a server. Check them
out on your profile page. If you have any problems with them, please message me and let me know.
Also, some stats for the curious:
In the last 90 days, 273 items have been sold on AEAuction.com totaling 88,532,933 gp.
There are also currently 918 items in the database and it continues to grow daily.
New Additions
12/29/05
I have been hard at work on the site this last week, and have completed a couple of new additions.
First off, Buy It Now should be working, if you have any problems with it please let me know.
To use it, simply enter a price in the "Buy It Now Price" field when listing your item. Then a buyer has the option to
either bid on the item, or buy it immediately for the price you set. Once someone has bid on the item, the buy it now
option will no longer be available on that item.
Secondly, I have added a new automated feedback system. You can leave feedback by going to your "My Account" page, or to
the detail page of the auction that you were involved in (If you were the seller or winning bidder). You then have the
option to leave positive, negative, or neutral feedback for the other party. Feedback scores range between 0 and 100
with 0 being the lowest possible score, and 100 being a trader with a perfect record.
You should leave positive feedback if there were not any major problems.
You should leave neutral feedback if you had some problems, but were able to work them out eventually.
You should only leave negative feedback if the other party refuses to honor the auction results.
If it becomes necessary, I will implement automatic limitations (maximum amount of outstanding bids and auctions) on
accounts that drop below a certain feedback level.
Crash!
12/27/05
Hopefully that will be the last we see of this problem. For those of you curious, here is what happened;
Earlier this month, the mirrored disk array had a problem, indicating that one of the drives was failing. Both
drives were tested, and found to be good, so it was rebuilt in place as is. A few days later, the same thing occured.
This time, I pulled the drive that the array management software said was bad, and replaced it. Yesterday, the original
drive failed completely. It turns out the array software was indicating the wrong drive was the problem. By that point,
I had unrecoverable corruption on the array and Windows Server was unable to boot, and it wouldn't repair because of
numerous registry errors. I put the first drive that I replaced back in as a single drive (essentially rolling everything
back about a week). I was then able to pull an up-to-the-minute copy of the database from the failing drive, so that I
did not have to restore from backup, which would have resulted in about 24 hours of data loss.
As it is, the site is
fully up and running, with no data loss. All auctions in progress have been extended 24 hours to compensate for the
down time. I lost a few of the image files for the item database that were created within the last couple days, since
they are stored in a seperate folder and not in the database itself. I will try recovering those on a different machine
later today. It took almost an entire day to get everything back up and running properly, so if you see any other
problems please let me know.
The server was using a Promise FastTrak2 IDE RAID Controller. I would strongly recommend anyone considering IDE RAID
avoid this controller as it actually ended up causing exactly the problem, data loss and down time due to a single
failed hard drive, that a RAID controller is designed to prevent.
Site Status Update
12/22/05
The site continues to grow daily. Current traffic stats are approximately 1500 page views per day to the main content
pages of the site, with about 50 regularly active users, and another 100 or so that pop by on occassion.
New Features:
Site FAQ containing answers to questions that I get in my email on a regular basis.
The My Accounts page now contains a box at the bottom with forum code that you can paste directly into the
Ashen Empires Traders forums to create direct links to your auctions, and to the item stats pages. You can see an
example of this here. I have done some
tracking on this particular item, and it has made a HUGE difference in the number of views that items (especially
higher end items) seem to get. I highly recommend using this to cross promote your auctions on the forums. Marketing
your items in this way will lead to more traffic, and in many cases significantly higher bids.
Added an icon on the item details page to indicate if it is a TR item.
Added 3 categories in the Item Database. These are No Stats which contains a
list of items that I know I am missing stats on, Recently Added which contains a
list of all items added in the last 10 days, and Recently Updated which contains
a list of all items that have been updated or corrected in the last 10 days.
The database now contains stats for well over 700 items, and I continue to receive more submissions almost every day.
If you own an item that you don't see in the database, please take a screenshot of the stats, and
send it to me.
More Additions and Changes
11/22/05
The whole site is getting a major overhaul. You can already see the new layout and color scheme going into place on many of
the pages, and those that it hasn't been applied to should be changed in the next week or two. I have also started adding
Google ads to many of the pages, these will help to pay for the bandwidth and equipment for the site to keep it up and
running, so feel free to click on them if you see anything of interest to you.
You may also have noticed that the Item DB link in the resources menu now works, and in fact links to a database of items (imagine that).
Currently, I have just over 200 items in the database, and am adding more daily. All of the item data is being added
to the database, however, the summary tables might not list every detail in the database. Soon I will add an item detail
page with all of the details from the in-game stat window, as well as the ability to sort, search, and filter the items
displayed. A drop list will also be added to the item details page in the second phase of this project.
The database needs your submissions to be successful! Just send me a screenshot of the item in an equipment slot, with
the right-click stat window open next to it. Its nice if you can crop it down, but if not, I'll happily accept the whole
screenshot. Also be sure to include a note with which monster you got this off of so that it can be added to my information
in phase 2. You can send these to me at: telarin1@yahoo.com.
Additions and Changes
4/21/05
Numerous small updates today.
User profile page is now accessible by clicking on a users name in auction listing.
Items on the user profile include: User AEAuction.com name, in game character names if provided, E-mail address
if user has chosen to make their email address visible, AEAuction.com rating, and a list of the users current and recently completed auctions.
The most significant of these is the rating. This represents the number of complaints that a user has received for
not honoring a completed auction (buying or selling) relative to the number they have honored. A 100% rating means the
user has never received a complaint.
If a user refuses to honor auction results with you, please send me a message using the Contact Us option to the left with
the users name, and auction details. I will follow up on any complaints as quickly as possible.
