Compromised Forum Admin

[Jagster (Jakke Lehtonen)]

And my Fail2ban agrees. Script kiddies and badly behaving adults are different story IF they are using static IP. That isn’t situation too often when used mobiles for example. And you know very well the most used system to hide IP

[Lilly]

i don’t disagree generally, but of course FailtoBan helps. but there’s certainly no reason not to block his IP and every reason to do so.

[Lilly]

have you seen this yet?

What to do if your Discourse is compromised

We’ve recently had two reports of Discourse sites that were compromised, likely due to weak admin account passwords. So we’d like to document: what to do when compromise happens what we can do to better prevent this in the future The Database Please note that Discourse, for several years now, has the following protections in place around the site database: Full database backup download links will only be sent via valid email of a site administrator, so you can’t just log in (via shoulder …

[ondrej]

Definitely best they are off the site. As you said they can always create new accounts etc. Although is that suspension reason something you want to ‘advertise’ to new users who wouldn’t know about this rogue admin? If you get what I’m saying?

@Stephen I agreee haha definitely for that username

[Jagster (Jakke Lehtonen)]

Most of ISPs recycles IP-addresses. When that bad apple changes his/hers IP next one gets it. Hopefully that customer doesn’t work with Discourse then

Most of the world doesn’t use unchange static IPs.

[Lilly]

did you review new accounts for suspicious activity? i would be looking closely at all new accounts created recently. if you haven’t already, review activity of any users associated with his account and the impersonated ones.

[codergautam (gautam)]

there has been an increase in spammers after the ban, and yes we have been looking at new users and especially their emails, we noticed that most of the spammers use weird custom email domains.

[MikeNolan]

@codergautam

we noticed that most of the spammers use weird custom email domains.

Well, THAT part doesn’t sound so unusual, I’ve noticed on other platforms (not Discourse yet) that spammers come in waves of similarity, sometimes the IP addresses are similar, sometimes the email addresses are similar, etc. I think it has to do with spammer dark web sites (wow, that sounds like a cliche) that offer suggestions if not cookbooks about what works on certain sites, or what bypasses the latest spam filters, etc.

[Canapin (Coin-coin le Canapin)]

@codergautam

I really don’t want to reset everyone’s password, as that will just cause confusion for them if they ever choose to re-log in.

Yes, it may cause confusion, and some even may not have access to their email if they registered a long time ago (especially in the case of a forum that was migrated from another platform).

But if their password isn’t changed, I think it’s fair to consider them as compromised (even if it’s potentially).