An admin, richb-hanover, reported unauthorized logins from Germany despite using a strong password and only accessing the forum from known devices. The attacker attempted to add their email to an admin account, export the user list, and access the database backup — but failed to obtain the backup due to email confirmation requirements. Falco suggested possible causes like password reuse or keyloggers, advised checking nginx logs to confirm user list downloads, and recommended a notification playbook for users if data was compromised. merefield urged enabling 2FA, which richb-hanover agreed to do. pfaffman questioned if the IPv6 address might be misattributed, but richb-hanover confirmed it wasn’t from their known range. Falco praised the forum’s layered security — failed email takeover, backup protection, and geolocation alerts — and recommended ensuring the Discourse instance is up to date. codinghorror celebrated that these safeguards, each added after past incidents, worked together effectively.
Hi folks, I’m an admin on another Discourse system, and this morning I awoke to four email messages, which indicated an unauthorized login (see sample below).
I live in NH, US, so it is correct for Discourse to have flagged this log-in from Germany. I have always used a good password (15 letter, random, which I have now changed). I am in possession of the two computers which I ever used to log in.
A few questions:
Any idea how this might have happened?
My profile page showed another login (also “from Germany…”) in the 24 hours prior to the message below. But I did not receive a notification for that login - either in my inbox or my spam folder. How might that have happened?
It appears that the attacker may have exported the user list. Is it possible to tell if it was ever downloaded?
Do you have a standard playbook/procedure for notifying users?
What other information could I provide to diagnose or investigate this?
Many thanks.
[Sorry if this isn’t the right category. @moderators - please move to the right place. Thanks.]
That IPv6 address is not from my range (I take from Hurricane Electric, in the 2001:470:… range)
We have evidence that the intruder attempted to add their email to an admin account, download the user list, and get the database backup. No access was granted to the new email address; we assume they retrieved the user list; but that they could not get the latter (the database) because they had not yet got email address.
So we assume emails and handles have been compromised, but that the database has not been downloaded (nginx logs).
Are there other things we should look for? Many thanks.
Yes, and each of those protections was individually added after a hard-earned lesson, so it’s especially satisfying to see them all working together in tandem!
