Hack/break-in: New login from

[richb-hanover (Rich Brown)]

Hi folks, I’m an admin on another Discourse system, and this morning I awoke to four email messages, which indicated an unauthorized login (see sample below).

I live in NH, US, so it is correct for Discourse to have flagged this log-in from Germany. I have always used a good password (15 letter, random, which I have now changed). I am in possession of the two computers which I ever used to log in.

A few questions:

1. Any idea how this might have happened?
2. My profile page showed another login (also “from Germany…”) in the 24 hours prior to the message below. But I did not receive a notification for that login - either in my inbox or my spam folder. How might that have happened?
3. It appears that the attacker may have exported the user list. Is it possible to tell if it was ever downloaded?
4. Do you have a standard playbook/procedure for notifying users?
5. What other information could I provide to diagnose or investigate this?

Many thanks.

[Sorry if this isn’t the right category. @moderators - please move to the right place. Thanks.]

====== Note received overnight =======

Begin forwarded message:
From: XXX Forum <mail@xxx-forum>
Subject: [xxx Forum] New Login from Germany
Date: January 15, 2021 at 11:04:14 PM EST
To: my-email
Reply-To: xxx Forum <mail@xxx-forum>

Hello,

We noticed a login from a device or location you don’t usually use. Was this you?

• Location: Germany (2a0b:f4c2:2::1)
• Browser: Firefox
• Device: Windows Computer – Microsoft Windows

If this was you, great! There’s nothing else you need to do.

If this was not you, please review your existing sessions and consider changing your password.

[merefield (Robert)]

Do you have 2FA activated? If not get that added ASAP

[richb-hanover (Rich Brown)]

I don’t, but will activate 2FA. Any thoughts on the other questions? Thanks.

[Falco (Rafael dos Santos Silva)]

@richb-hanover

Any idea how this might have happened?

Password reuse, weak passwords, keyloggers, shared wifi networks, etc

@richb-hanover

It appears that the attacker may have exported the user list. Is it possible to tell if it was ever downloaded?

Nginx logs.

@richb-hanover

Do you have a standard playbook/procedure for notifying users?

If the attacked may have obtained a backup, which needs email access too, there is What to do if your Discourse is compromised

If not, a banner topic or a topic in a category everyone is notified may suffice.

[pfaffman (Jay Pfaffman)]

And that was while you were asleep? It’s not possible that you got a new Ipv6 address that maxmind just had the wrong location for?

[richb-hanover (Rich Brown)]

Thanks for the note.

• Yes, I was asleep

• That IPv6 address is not from my range (I take from Hurricane Electric, in the 2001:470:… range)

• We have evidence that the intruder attempted to add their email to an admin account, download the user list, and get the database backup. No access was granted to the new email address; we assume they retrieved the user list; but that they could not get the latter (the database) because they had not yet got email address.

So we assume emails and handles have been compromised, but that the database has not been downloaded (nginx logs).

Are there other things we should look for? Many thanks.

[Falco (Rafael dos Santos Silva)]

Great to hear 3 of our protections were useful:

• Invader couldn’t get backups because of the needed email flow

• Invader couldn’t get admin on a email that he controls because there is emails to confirm to both addresses

• Warning emails when login happens from far away

One thing that you should check is if Discourse is running the most recent version so it’s patched against any know vulnerabilities.

[codinghorror (Jeff Atwood)]

Yes, and each of those protections was individually added after a hard-earned lesson, so it’s especially satisfying to see them all working together in tandem!