Important: We did not send an email asking for donations - scam alert

[Rob]

Earlier today an email was sent out to our members stating that we now accept donations via cryptocurrency in exchange for upgraded member perks. This email is a scam, do not send anything to the addresses listed in the email.

Someone was able to gain access to the administrator area of the forum using a weak password from one of our administrators, then used the built-in email tool to send out bulk emails requesting donations.

The site also wasn't rendering during this time. We've restored from a previous backup. If you have any questions, please respond below, send me a private message here or reach out via email ([email protected]).

Thank you,
Rob

 

[KGIII]

It's great to see it back online. Crap happens and any posts missing can be recreated by those seeking help. Without an extremely expensive backup process, restoring from backups is going to result in lost data.

 

[Rob]

Thanks! Yeah, I do daily backups currently - and mainly wanted to make sure i restored from a good position.

 

[KGIII]

LOL Me too! Well, anything public facing that changes. If it's a static site, I just keep backups every two weeks.

Remember folks, an untested backup is not a backup!

I've seen it go much, much worse... We lost a day's worth of posts. We'll manage.

 

[Deleted member 137406]

I checked my email today and didn't find any emails from Linux.org with today's Oct 20th 2022 date but had a few from yesterdays date.

I didn't bother to open any of them just dumped them figured it wasn't worth taking a risk.

Thanks @Rob

Cheers

 

[Condobloke]

Interesting.
Obviously the email entitled 'New Linux.org Role + Updates!' was not sent by @Rob ....it was sent by someone who gained access to ...." able to gain access to the administrator area of the forum using a weak password from one of our administrators, then used the built-in email tool to send out bulk emails requesting donations."

With this level of expertise in play, is it a valid consideration that member info was stolen?

Is there any sign that this happened...or could have happened?

I would prefer to know now ......rather than get a surprise later..... @Rob

 

[Brickwizard]

Shame we lost a days work, but its a small price to pay,
@Rob thanks for jumping on it so quickly

This email is a scam, do not send anything to the addresses listed in the email.

Hardly surprising with the growing ranking of the site over the last year or so, as we know no site is completely invulnerable to malicious attacks

I must admit I was cursing a Firefox update which I had run immediately before the site collapsed, it wasn't till I ran my Parrot installation [ different browser] I realised there was a problem

 

[bengan]

Thanks for the quick response to this scam. I wondered about the email and started looking into it this morning (UTC+1). Nothing donated so far to the addresses, as far as I can see.

 

[f33dm3bits]

@Rob I think it would be a good idea to have the admin accounts use two-factor authentication, I actually use it for my account here as well since it's an option. That way if they get your password if you have a weak one they won't be able to login since the second factor is still needed. And if possible it may be a good idea to limit admin access to white listed ip adresses.

 

[kc1di]

Thanks @Rob for all you do that many will never see. Hope the one who did this will be rewareded by being banished from all forums some day. In any event, it is good to have the forum back up and running. Again thank you!

 

[Terminal Velocity]

I received this message yesterday, It's for Rob

 

[Brickwizard]

I saw that last night just before the site went down, another "polite" message

 

[kc1di]

Yep, had that message here also. Also got the email.

 

[KGIII]

Now I feel left out. I didn't get an email or a notice.

I have done some sleuthing and (just to eliminate a few ideas) there aren't any current XenForo exploits out there. Well, if there are some nobody is offering to sell them.

 

[f33dm3bits]

I received this message yesterday, It's for Rob

I think it's someone who's doing it for the attention.

 

[Sunil1991]

I also received that email

 

[f33dm3bits]

@Rob has our e-mail addresses been compromised, do I need to change my e-mail address so that I don't get future spam? I know this message was sent through the board forums but not sure if this person who had admin access also made a database dump?

 

[Brickwizard]

Looks like it came from an American Hacker [or from another country that doesn't speak English]

 

[bob466]

I didn't get any of those emails...what a shame

I tried several times yesterday to logon but couldn't...hope everything is fixed for now.

 

[KGIII]

hope everything is fixed for now.

So far, everything looks okay. We did lose some data, but nothing too terribly important.