Hi, we were recently social engineered to give admin to a compromised user. As far as the logs say, he enabled “ Data Explorer ”, and didn’t do anything else except Impersonate a few users. What is the impact of this incident to our forum and is there anything serious?

have you seen this yet? [imagem] What to do if your Discourse is compromised Self-Hosting We’ve recently had two reports of Discourse sites that were compromised, likely due to weak admin account passwords. So we’d like to document: what to do when compromis…

yes but what about preventing a similar social engineering penetration and securing admin?

that’s 100% fault on my end. I have decided just to no longer give admin to anyone, especially not people I haven’t met and trust in real life.

For some more detail: The person that did the data breach got a permanent suspension from the forum because they were never trusted again. [image] The problem is that they could create alternative accounts on that forum and use it to evade their suspension and cause more chaos. Perhaps Blacklist…

Having CSGO in your username could be grounds alone for suspension…

That’s mandatory for every single secure space on internet (because of that some of us likes real private messages -encrypted-).

Social engineering attacks are based on the all-too-human trait of trusting people. And there are some really smooth talkers out there!

They did make alt accounts and once we saw it we perm suspended those accounts as well

why not block his IP too? i’d at least delete an alt account and block the IP.

Because changing IP, if it has been static in the first place, happends faster than banning?

it actually works better than you think. i’ve stopped a number of problem users with it. i find suspension easier to circumvent. also why would you not use all available methods to stop further action from this person?

Administrador do Fórum Comprometido

Suporte

Lilly Junho 4, 2023, 1:45pm 45

Você já viu isto?

Tópico		Respostas	Visualizações
Discourse hacked via sophisticated social engineering Site feedback	9	7352	21 de Maio de 2018
What to do if your Discourse is compromised Self-Hosting reference	0	10349	24 de Fevereiro de 2016
Is there a way to manually locate user's passwords? Support	23	5170	19 de Outubro de 2021
The Impersonated user should be notified that they are being Impersonated Feature impersonate	21	2336	7 de Maio de 2019
How do other admins deal with compromised accounts? Community Building	9	330	16 de Setembro de 2025

Administrador do Fórum Comprometido

Tópicos relacionados