Main > Forum/Website Discussion

Possible compromise of member list data: phishing attempt after buy/sell post

<< < (3/4) > >>

Robbbert:
Simple but obvious abuse of the system. Sometimes scammers can be more direct, simply creating an account then spamming everyone via PM. This guy just took it one step further.

Many forums have already woken up to this and prevent users from sending PMs until they've made 10 posts or whatever.

I'd strongly suggest that this option be enabled.

I don't know if the forum has the ability to moderate the first x posts as well, but I'd suggest doing that too. If anything, it will keep the moderators on their toes. :P

Rockstead:

--- Quote from: saint on April 23, 2021, 10:32:10 pm ---OK I'm leaving this up because it was a clever but annoying non-hack by a new and now banned forum member and people will want to know what he did and how.

When someone sends you a PM here on the forum, the forum will send you an email with the contents of the PM. It comes from the arcadecontrols.com server, sent to the email you have on file here on the server. The person who sent you the PM doesn't have your email info.

What this guy did was immediately after sending the PM, and then waiting for a moment, he deletes the PM. You log on to the forum, no PM. However, you did get an email to your private email address with the contents of the message he sent you.

He sent the same PM to 6 additional people, all telling them to email a specific email address to get an arcade part they mentioned they were looking for here on the forum.

Clever and annoying bit of marketing spam. 

If you got a PM or an email from the forum with the contents of a PM telling you to email "Regis" at "fredomwayxx@outlook...." it's SPAM from user bally00life, who is now banned.

A snippet of the raw database showing what he's done is attached:

Note, the forum database was not compromised. He's abusing the functionality of the forum software that sends email notifications.

--- End quote ---

One thing that was different from a normal PM notification, the email I received was from email “saint@arcadecontrols.com”, where as a PM notification has the sender name “ The NEW Build Your Own Arcade Controls”

How was he able to change that?

PL1:

--- Quote from: Robbbert on April 24, 2021, 06:20:04 am ---I don't know if the forum has the ability to moderate the first x posts as well, but I'd suggest doing that too. If anything, it will keep the moderators on their toes. :P

--- End quote ---
We've been doing that for over 6 1/2 years.   ;)

Before that, spam was a common sight around here.

Now, almost all spam accounts (~99.9%) are identified and eliminated before forum members see anything from them.

Without going into the methods and procedures that we mods use to do that, I think we've found a good balance between minimizing friction for legitimate new forum members and eliminating spammers.   :cheers:


Scott

Robbbert:
@PL1: no need to reveal your methods, the processes involved are most likely just an elementary application of logic. I thought you must have had some kind of control given the lack of spam, but because I joined a long time ago I never saw moderation.

@Rockstead: a real email has to come from a designated real email address. For some reason Saint nominated himself instead of having a dedicated account just for the forum. It's nothing unusual.

saint:
Yeah that’s why I want to see a copy of the email in addition to the header you sent me - I’d like to track that down.  Will dig through server outgoing email logs as well.


--- Quote from: Rockstead on April 24, 2021, 09:26:42 am ---
--- Quote from: saint on April 23, 2021, 10:32:10 pm ---OK I'm leaving this up because it was a clever but annoying non-hack by a new and now banned forum member and people will want to know what he did and how.

When someone sends you a PM here on the forum, the forum will send you an email with the contents of the PM. It comes from the arcadecontrols.com server, sent to the email you have on file here on the server. The person who sent you the PM doesn't have your email info.

What this guy did was immediately after sending the PM, and then waiting for a moment, he deletes the PM. You log on to the forum, no PM. However, you did get an email to your private email address with the contents of the message he sent you.

He sent the same PM to 6 additional people, all telling them to email a specific email address to get an arcade part they mentioned they were looking for here on the forum.

Clever and annoying bit of marketing spam. 

If you got a PM or an email from the forum with the contents of a PM telling you to email "Regis" at "fredomwayxx@outlook...." it's SPAM from user bally00life, who is now banned.

A snippet of the raw database showing what he's done is attached:

Note, the forum database was not compromised. He's abusing the functionality of the forum software that sends email notifications.

--- End quote ---

One thing that was different from a normal PM notification, the email I received was from email “saint@arcadecontrols.com”, where as a PM notification has the sender name “ The NEW Build Your Own Arcade Controls”

How was he able to change that?

--- End quote ---

Navigation

[0] Message Index

[#] Next page

[*] Previous page

Go to full version