Hi, we were recently social engineered to give admin to a compromised user. As far as the logs say, he enabled “ Data Explorer ”, and didn’t do anything else except Impersonate a few users. What is the impact of this incident to our forum and is there anything serious?

have you seen this yet? [afbeelding] What to do if your Discourse is compromised Self-Hosting We’ve recently had two reports of Discourse sites that were compromised, likely due to weak admin account passwords. So we’d like to document: what to do when compr…

yes but what about preventing a similar social engineering penetration and securing admin?

that’s 100% fault on my end. I have decided just to no longer give admin to anyone, especially not people I haven’t met and trust in real life.

For some more detail: The person that did the data breach got a permanent suspension from the forum because they were never trusted again. [image] The problem is that they could create alternative accounts on that forum and use it to evade their suspension and cause more chaos. Perhaps Blacklist…

Having CSGO in your username could be grounds alone for suspension…

That’s mandatory for every single secure space on internet (because of that some of us likes real private messages -encrypted-).

Social engineering attacks are based on the all-too-human trait of trusting people. And there are some really smooth talkers out there!

They did make alt accounts and once we saw it we perm suspended those accounts as well

why not block his IP too? i’d at least delete an alt account and block the IP.

Because changing IP, if it has been static in the first place, happends faster than banning?

it actually works better than you think. i’ve stopped a number of problem users with it. i find suspension easier to circumvent. also why would you not use all available methods to stop further action from this person?

Gecompromitteerde Forum Beheerder

Ondersteuning

Lilly (Lillian ) 4 juni 2023 om 13:45 45

have you seen this yet?

Topic		Antwoorden	Weergaven
Discourse hacked via sophisticated social engineering Site feedback	9	7353	21 mei 2018
What to do if your Discourse is compromised Self-Hosting reference	0	10350	24 februari 2016
Is there a way to manually locate user's passwords? Support	23	5171	19 oktober 2021
The Impersonated user should be notified that they are being Impersonated Feature impersonate	21	2336	7 mei 2019
How do other admins deal with compromised accounts? Community Building	9	330	16 september 2025

Gecompromitteerde Forum Beheerder

Gerelateerde topics