Hi, we were recently social engineered to give admin to a compromised user. As far as the logs say, he enabled “ Data Explorer ”, and didn’t do anything else except Impersonate a few users. What is the impact of this incident to our forum and is there anything serious?

have you seen this yet? [Bild] What to do if your Discourse is compromised Self-Hosting We’ve recently had two reports of Discourse sites that were compromised, likely due to weak admin account passwords. So we’d like to document: what to do when compromise …

yes but what about preventing a similar social engineering penetration and securing admin?

that’s 100% fault on my end. I have decided just to no longer give admin to anyone, especially not people I haven’t met and trust in real life.

For some more detail: The person that did the data breach got a permanent suspension from the forum because they were never trusted again. [image] The problem is that they could create alternative accounts on that forum and use it to evade their suspension and cause more chaos. Perhaps Blacklist…

Having CSGO in your username could be grounds alone for suspension…

That’s mandatory for every single secure space on internet (because of that some of us likes real private messages -encrypted-).

Social engineering attacks are based on the all-too-human trait of trusting people. And there are some really smooth talkers out there!

They did make alt accounts and once we saw it we perm suspended those accounts as well

why not block his IP too? i’d at least delete an alt account and block the IP.

Because changing IP, if it has been static in the first place, happends faster than banning?

it actually works better than you think. i’ve stopped a number of problem users with it. i find suspension easier to circumvent. also why would you not use all available methods to stop further action from this person?

Kompromittierter Foren-Administrator

Unterstützung

Lilly 4. Juni 2023 um 13:45 45

Hast du das schon gesehen?

Thema		Antworten	Aufrufe
Discourse hacked via sophisticated social engineering Site feedback	9	7350	21. Mai 2018
What to do if your Discourse is compromised Self-Hosting reference	0	10349	24. Februar 2016
Is there a way to manually locate user's passwords? Support	23	5170	19. Oktober 2021
The Impersonated user should be notified that they are being Impersonated Feature impersonate	21	2335	7. Mai 2019
How do other admins deal with compromised accounts? Community Building	9	327	16. September 2025

Kompromittierter Foren-Administrator

Verwandte Themen