phpBB Discussion • Re: Increased spam activity for meettomy.site from compromised accounts

I've been working on an extension for 2 weeks. This is designed to combat the potential problem with old accounts. We are currently testing the extension within the team. In this context, I also try to collect further information in parallel.

If I understand your starting post correctly (with my terrible English ^^), then the phpBB logins were not hijacked using compromised email accounts, but in some other way. This would also correspond to our assumptions, since the PW reset would be the only way to hijack a phpBB account via email.

And my extension is also based on the assumption that the email account is not affected.

Sounds interesting, what type of extension are you creating?

My question now is: have you received any new information about how the phpBB login data was compromised?

edit:

In the meantime I found a XenForo topic about the problem. The article linked in post 4 is interesting:

https://xenforo.com/community/threads/i ... ts.219448/

Thanks for sharing that topic, interesting to read. The only common denominator I can find so far it that all email addresses from compromised accounts are listed in one or more dumps when I check them on https://haveibeenpwned.com/

I've been working on an extension for 2 weeks. This is designed to combat the potential problem with old accounts.

You can already do it with the autogroups extension.

Moving older accounts to a moderation queue group works, but it does require extra manual labor for handling those posts from either legit as spam users. The query I posted in the first post works really good for me, only two newer accounts (like created 3 weeks ago) have slipped through. It instantly stopped the majority of spam and didn't require any manual labor for our moderators.

Statistics: Posted by Derky — Thu Mar 21, 2024 9:10 pm

---