Has Dave been hacked again. - Page 1
Forum section: electronics / general

author: G7PSK
author_rank: Super Contributor
timestamp: May 24, 2013, 12:14:32 pm
content: I received an email today which may be legit. But I also wondered if this is the result of Dave having been hacked either time a few months ago or more recently.taz.burwaiss@i2ieventsgroup.com <dave@eevblog.com>I am very suspicious of any thing with an address like this, my apologies if this is legit.

author: GeoffS
author_rank: Unknown
timestamp: May 24, 2013, 12:15:34 pm
content: What was the contents of the email?

author: madires
author_rank: Super Contributor
timestamp: May 24, 2013, 12:19:06 pm
content: It's the most simple thing to fake email addresses. Please post the header section of the email, then we'll know where it came from.

author: G7PSK
author_rank: Super Contributor
timestamp: May 24, 2013, 01:12:32 pm
content: This all of the message.Delivered-To: [address removed]Received: by 10.224.176.69 with SMTP id bd5csp89594qab;Fri, 24 May 2013 03:32:21 -0700 (PDT)X-Received: by 10.67.2.33 with SMTP id bl1mr17640643pad.26.1369391541348;Fri, 24 May 2013 03:32:21 -0700 (PDT)Return-Path: <dave@eevblog.com>Received: from eev.eevblog.com ([198.1.64.143])by mx.google.com with ESMTPS id v10si12369380pav.213.2013.05.24.03.32.20for [address removed](version=TLSv1 cipher=RC4-SHA bits=128/128);Fri, 24 May 2013 03:32:21 -0700 (PDT)Received-SPF: neutral (google.com: 198.1.64.143 is neither permitted nor denied by best guess record for domain of dave@eevblog.com) client-ip=198.1.64.143;Authentication-Results: mx.google.com;spf=neutral (google.com: 198.1.64.143 is neither permitted nor denied by best guess record for domain of dave@eevblog.com) smtp.mail=dave@eevblog.comMessage-Id: <519f41b5.ea05420a.6542.65beSMTPIN_ADDED_MISSING@mx.google.com>Received: from localhost ([127.0.0.1]:39769)by eev.eevblog.com with esmtpa (Exim 4.80)(envelope-from <dave@eevblog.com>)id 1UfpIK-0000Xk-B8for [address removed]; Fri, 24 May 2013 20:32:20 +1000Subject: =?UTF-8?B?wqM1MDAgb3Bwb3J0dW5pdHkgZm9yIGJsb2dnZXJzISBGbHkgb3V0IHRvIEJlcmxpbiE=?=To: [address removed]From: "taz.burwaiss@i2ieventsgroup.com" <dave@eevblog.com>Reply-To: <taz.burwaiss@i2ieventsgroup.com>Date: Fri, 24 May 2013 10:32:20 -0000X-Mailer: SMFMime-Version: 1.0Content-Type: multipart/alternative; boundary="SMF-2f770271be4e36dd9273c481bb5cd0c0"Content-Transfer-Encoding: 7bitX-AntiAbuse: This header was added to track abuse, please include it with any abuse reportX-AntiAbuse: Primary Hostname - eev.eevblog.comX-AntiAbuse: Original Domain - gmail.comX-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]X-AntiAbuse: Sender Address Domain - eevblog.comX-Get-Message-Sender-Via: eev.eevblog.com: authenticated_id: forum@eevblog.comX-Source:X-Source-Args:X-Source-Dir:Hi there,I wanted to send you a quick alert to bring to your attention the upcoming CWIEMEBerlin2013 event is happening in less than 2 weeks! AND to offer you an exciting opportunity&#8230;www.coilwindingexpo.comMy name is Taz Burwaiss and I&#8217;m social media executive for the event. You can follow me on twitter @RazzmaTazz84It&#8217;s a fantastic event with over 12,000 people registered. If you&#8217;re interested in browsing the latest electro-magnetic, insulation, coil, electric motor, transformer, manufacturing or industrial repair solutions then this is THE event for you!We also have a ton of cutting edge seminar sessions from industry experts including discussions on smarter supply chain procurement, the German Energiewende, award winning engineering design, and power generating machines.I am looking for 2 bloggers who would be interested in flying out to Berlin, meeting up with me, and covering the event on their blog.If interested, or know anyone who may be interested, drop me a line asap, as the event is only 12 days away!Also, connect with us on social media!Twitter @CWIEMEexpo+ Join our LinkedIn Page networkhttp://linkd.in/12MWZF2Pinterest page:http://pinterest.com/cwiemeexpo/Please do get in touch and connect if you&#8217;re interested in the Berlin opportunity or not, thanks.Best wishesTaz Burwaiss--SMF-2f770271be4e36dd9273c481bb5cd0c0Content-Type: text/plain; charset=UTF-8Content-Transfer-Encoding: base64SGkgdGhlcmUsIA0KDQpJIHdhbnRlZCB0byBzZW5kIHlvdSBhIHF1aWNrIGFsZXJ0IHRvIGJyaW5nIHRvIHlvdXIgYXR0ZW50aW9uIHRoZSB1cGNvbWluZyBDV0lFTUVCZXJsaW4yMDEzIGV2ZW50IGlzIGhhcHBlbmluZyBpbiBsZXNzIHRoYW4gMiB3ZWVrcyEgQU5EIHRvIG9mZmVyIHlvdSBhbiBleGNpdGluZyBvcHBvcnR1bml0eeKApiB3d3cuY29pbHdpbmRpbmdleHBvLmNvbSANCg0KTXkgbmFtZSBpcyBUYXogQnVyd2Fpc3MgYW5kIEnigJltIHNvY2lhbCBtZWRpYSBleGVjdXRpdmUgZm9yIHRoZSBldmVudC4gWW91IGNhbiBmb2xsb3cgbWUgb24gdHdpdHRlciBAUmF6em1hVGF6ejg0DQoNCkl04oCZcyBhIGZhbnRhc3RpYyBldmVudCB3aXRoIG92ZXIgMTIsMDAwIHBlb3BsZSByZWdpc3RlcmVkLiBJZiB5b3XigJlyZSBpbnRlcmVzdGVkIGluIGJyb3dzaW5nIHRoZSBsYXRlc3QgZWxlY3Ryby1tYWduZXRpYywgaW5zdWxhdGlvbiwgY29pbCwgZWxlY3RyaWMgbW90b3IsIHRyYW5zZm9ybWVyLCBtYW51ZmFjdHVyaW5nIG9yIGluZHVzdHJpYWwgcmVwYWlyIHNvbHV0aW9ucyB0aGVuIHRoaXMgaXMgVEhFIGV2ZW50IGZvciB5b3UhDQoNCldlIGFsc28gaGF2ZSBhIHRvbiBvZiBjdXR0aW5nIGVkZ2Ugc2VtaW5hciBzZXNzaW9ucyBmcm9tIGluZHVzdHJ5IGV4cGVydHMgaW5jbHVkaW5nIGRpc2N1c3Npb25zIG9uIHNtYXJ0ZXIgc3VwcGx5IGNoYWluIHByb2N1cmVtZW50LCB0aGUgR2VybWFuIEVuZXJnaWV3ZW5kZSwgYXdhcmQgd2lubmluZyBlbmdpbmVlcmluZyBkZXNpZ24sIGFuZCBwb3dlciBnZW5lcmF0aW5nIG1hY2hpbmVzLiANCg0KSSBhbSBsb29raW5nIGZvciAyIGJsb2dnZXJzIHdobyB3b3VsZCBiZSBpbnRlcmVzdGVkIGluIGZseWluZyBvdXQgdG8gQmVybGluLCBtZWV0aW5nIHVwIHdpdGggbWUsIGFuZCBjb3ZlcmluZyB0aGUgZXZlbnQgb24gdGhlaXIgYmxvZy4gDQoNCklmIGludGVyZXN0ZWQsIG9yIGtub3cgYW55b25lIHdobyBtYXkgYmUgaW50ZXJlc3RlZCwgZHJvcCBtZSBhIGxpbmUgYXNhcCwgYXMgdGhlIGV2ZW50IGlzIG9ubHkgMTIgZGF5cyBhd2F5IQ0KDQpBbHNvLCBjb25uZWN0IHdpdGggdXMgb24gc29jaWFsIG1lZGlhISANCg0KVHdpdHRlciBAQ1dJRU1FZXhwbyANCisgSm9pbiBvdXIgTGlua2VkSW4gUGFnZSBuZXR3b3JrIGh0dHA6Ly9saW5rZC5pbi8xMk1XWkYyICANClBpbnRlcmVzdCBwYWdlOiBodHRwOi8vcGludGVyZXN0LmNvbS9jd2llbWVleHBvLyANCg0KUGxlYXNlIGRvIGdldCBpbiB0b3VjaCBhbmQgY29ubmVjdCBpZiB5b3XigJlyZSBpbnRlcmVzdGVkIGluIHRoZSBCZXJsaW4gb3Bwb3J0dW5pdHkgb3Igbm90LCB0aGFua3MuDQoNCkJlc3Qgd2lzaGVzDQpUYXogQnVyd2Fpc3MNCg==--SMF-2f770271be4e36dd9273c481bb5cd0c0--Moderator: I took the liberty of removing your email address from this post.

author: 8086
author_rank: Super Contributor
timestamp: May 24, 2013, 01:20:14 pm
content: Interesting, I had an email like this earlier, but no mention of eevblog on mineCode:Delivered-To: @gmail.comReceived: by 10.204.32.88 with SMTP id b24csp101951bkd;Fri, 24 May 2013 02:52:39 -0700 (PDT)X-Received: by 10.180.88.231 with SMTP id bj7mr50895003wib.5.1369389159114;Fri, 24 May 2013 02:52:39 -0700 (PDT)Return-Path: <nobody@oban.just4dns.com>Received: from oban.just4dns.com (oban.just4dns.com. [178.18.116.110])by mx.google.com with ESMTPS id cj3si11432179wib.39.2013.05.24.02.52.39for <@gmail.com>(version=TLSv1 cipher=RC4-SHA bits=128/128);Fri, 24 May 2013 02:52:39 -0700 (PDT)Received-SPF: pass (google.com: best guess record for domain of nobody@oban.just4dns.com designates 178.18.116.110 as permitted sender) client-ip=178.18.116.110;Authentication-Results: mx.google.com;spf=pass (google.com: best guess record for domain of nobody@oban.just4dns.com designates 178.18.116.110 as permitted sender) smtp.mail=nobody@oban.just4dns.comReceived: from nobody by oban.just4dns.com with local (Exim 4.80.1)(envelope-from <nobody@oban.just4dns.com>)id 1Ufofo-00081D-2Vfor [email address]; Fri, 24 May 2013 10:52:32 +0100To: [email address]Subject: Contact FormFrom: Taz Burwaiss <taz.burwaiss@i2ieventsgroup.com>Reply-To: Taz Burwaiss <taz.burwaiss@i2ieventsgroup.com>X-Mailer: PHP/5.3.21Message-Id: <E1Ufofo-00081D-2V@oban.just4dns.com>Date: Fri, 24 May 2013 10:52:32 +0100X-Fuzioned-MailScanner-Information: Please contact the ISP for more informationX-Fuzioned-MailScanner-ID: 1Ufofo-00081D-2VX-Fuzioned-MailScanner: Found to be cleanX-Fuzioned-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,score=-1.901, required 5, autolearn=not spam, BAYES_00 -1.90,NO_RELAYS -0.00)X-Fuzioned-MailScanner-From: nobody@oban.just4dns.comX-Spam-Status: NoX-AntiAbuse: This header was added to track abuse, please include it with any abuse reportX-AntiAbuse: Primary Hostname - oban.just4dns.comX-AntiAbuse: Original Domain - [my domain]X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]X-AntiAbuse: Sender Address Domain - oban.just4dns.comX-Get-Message-Sender-Via: oban.just4dns.com: uid via acl_c_vhost_owner from authenticated_id: nobody from /only user confirmed/virtual account not confirmedName: Taz BurwaissEmail: taz.burwaiss@i2ieventsgroup.comMessage: Hi,I wanted to send you a quick alert to bring to your attention the upcoming CWIEMEBerlin2013 event is happening in less than 2 weeks! AND to offer you an exciting opportunityâ€¦My name is Taz Burwaiss and Iâ€™m social media executive for the event. You can follow me on twitter @RazzmaTazz84Itâ€™s a fantastic event with over 12,000 people registered. If youâ€™re interested in browsing the latest electro-magnetic, insulation, coil, electric motor, transformer, manufacturing or industrial repair solutions then this is THE event for you!We also have a ton of cutting edge seminar sessions from industry experts including discussions on smarter supply chain procurement, the German Energiewende, award winning engineering design, and power generating machines.I am looking for 2 bloggers who would be interested in flying out to Berlin, meeting up with me, and covering the event on their blog.If interested drop me a line asap, as the event is only 12 days away!Alternatively, if you are interested in exhibiting at the event, it\'s still not too late ti get involved.So feel free to contact me in regards to that too.Also, connect with us on social media!Twitter @CWIEMEexpo+ Join our LinkedIn Page network http://linkd.in/12MWZF2Pinterest page: http://pinterest.com/cwiemeexpo/Please do get in touch and connect if youâ€™re interested in the Berlin opportunity or not, thanks.Best wishesTaz Burwaiss

author: GeoffS
author_rank: Unknown
timestamp: May 24, 2013, 01:21:14 pm
content: G7PSK: It is a legitimate mail from the EEVblog server but definitely spam.It was sent from a recently approved (now banned) user.8086: You may want to modify your post to remove your email address. Scraping forums is a common spammer method of gathering emails

author: 8086
author_rank: Super Contributor
timestamp: May 24, 2013, 01:48:43 pm
content: Quote from: GeoffS on May 24, 2013, 01:21:14 pmWhoops, thought I got them. Must have not saved. Cheers.

author: G7PSK
author_rank: Super Contributor
timestamp: May 24, 2013, 01:57:43 pm
content: Moderator: I took the liberty of removing your email address from this post.Thank you moderator, I realised what I had done went back to alter the post almost immediately and found that you had beaten me to it. But just to be safe I suppose I aught to change my email.

author: EEVblog
author_rank: Unknown
timestamp: May 24, 2013, 02:28:35 pm
content: Woah.I got this email in my regular inbox. How did other people get it? Mass emailed from where?The guy sending it is legit.

author: EEVblog
author_rank: Unknown
timestamp: May 24, 2013, 02:34:16 pm
content: I received this email into gmail via my usual dave AT eevblog.com address (all eevblog email gets forwarded to gmail, it's the only email client I use)I accidentally sent a reply back to myself (due to some sort of occasional bug somewhere that sets the return address as my own, but that should have only gone back to me.How it got mass emailed to everyone I have absolutely no idea. This is very concerning!I will send another identical reply now and see if anyone gets it!

author: madires
author_rank: Super Contributor
timestamp: May 24, 2013, 02:40:59 pm
content: Quote from: EEVblog on May 24, 2013, 02:28:35 pmI guess he simply used the forums "Send Email" function.

author: EEVblog
author_rank: Unknown
timestamp: May 24, 2013, 02:47:19 pm
content: Ah, I think I know what has happened.This guy must have been sending emails from within the forum.The forum unfortunately sets the return address as my email address. I must try and fix this, as I do get the occasional personal email come to me when someone hits "reply" to direct forum email from another user.I don't think anything has been hacked.

author: BravoV
author_rank: Super Contributor
timestamp: May 24, 2013, 02:51:05 pm
content: Go to account setting, un-tick "Allow users to email me", that will fix the problem. Its enabled by default.Any messaging should go thru forum's PM instead of email, its redundant.Disabled mine when I 1st joined this forum, learnt it from other prev forums experience.

author: EEVblog
author_rank: Unknown
timestamp: May 24, 2013, 02:56:08 pm
content: I just sent myself (eevblog) an email from a dummy forum account, and the return address field is correct, but the text in the "from" part if set to my forum email address.This seems to be why people often send me a reply instead of the intended recipient.

author: BravoV
author_rank: Super Contributor
timestamp: May 24, 2013, 02:58:14 pm
content: Dave, Is there any setting at SMF to disable that by default ? This will reduce this case for newly joined member.

author: EEVblog
author_rank: Unknown
timestamp: May 24, 2013, 02:58:25 pm
content: Quote from: BravoV on May 24, 2013, 02:51:05 pmThat won't fix the problem for me though I'm afraid, as my email address seems to be attached to every email sent from the forum by every user!

author: BravoV
author_rank: Super Contributor
timestamp: May 24, 2013, 03:03:46 pm
content: Yep, you are an exeption.But once disabled, the only email forum members will receive is the self activated Automated forum notification like new post at user's subscribed thread, no more direct email from other forum member like this case is well known to spammer, they exploit this using bot to send large quantity of spams with info gathered from forum member list until they get banned.

author: EEVblog
author_rank: Unknown
timestamp: May 24, 2013, 03:05:08 pm
content: Quote from: BravoV on May 24, 2013, 02:58:14 pmDoesn't look like it. It's a user only option.There is a mod that denies everyone the ability to have an email contact:http://custom.simplemachines.org/mods/index.php?mod=3598

author: mariush
author_rank: Super Contributor
timestamp: May 24, 2013, 07:08:36 pm
content: The email should be stored somewhere in the database.Just replace it with something like noreply@ eev ... and problem solved... partially.

author: GeoffS
author_rank: Unknown
timestamp: May 24, 2013, 11:44:58 pm
content: I should have stated the fact that the mail came from within the forum from a valid users in my earlier reply - sorry about that.As Dave has pointed out, all email is sent with his sender address, I'm guessing that this is the email address of the admin user on the forum and can (probably) be changed.Time to fire up a copy of SMF and have a play. The weather's miserable so I'm stuck inside anywayEDIT: A quick test shows that all email sent from the forum by a user to another user, has the sender address set to the webmasters email address, i.e. the one set in the forum configuration.Dave, you could consider changing the webmaster address or there is amod availablethat allows the administrator to set a specific address for this purpose while leaving the webmaster address untouched. Important forum emails, warnings etc. still get sent to the webmaster address.

author: xrunner
author_rank: Super Contributor
timestamp: May 25, 2013, 12:42:24 am
content: As am Admin of SMF forums for years - IMHO - the email capability between users is an anachronism these days (with regards to spammers). I would not use it at all and would not enable the ability. If anyone wants to email another person for some reason, they can simply ask for another user's email address via a PM.

author: nitro2k01
author_rank: Frequent Contributor
timestamp: May 26, 2013, 03:56:02 am
content: Quote from: mariush on May 24, 2013, 07:08:36 pmI wouldn't even call it a partial solution. Maybe a 1% solution. These e-mails are meant for user to user contact, and the reply-to header is set in the e-mail. This means replies will by default go to whatever address the sender has registered their account with. If you don't pay attention, chances are you won't even notice it says eevblog before you've trashed, or less likely replied to the, message.I run a forum myself, and I've disabled this function there. Disabling or heavily restricting it is really the only viable option.

author: EEVblog
author_rank: Unknown
timestamp: May 26, 2013, 05:13:35 am
content: Quote from: xrunner on May 25, 2013, 12:42:24 amHow can email be disabled on a global basis though? I can't find such an option. Seems to be up to each user.

author: GeoffS
author_rank: Unknown
timestamp: May 26, 2013, 05:51:52 am
content: There doesn't seem to be an option to disable or remove the ability for users toreceiveemail. It would be possible to disable all users email ability via an SQL script but this would not remove the users ability to turn it back on.There is a modification that disables the ability for any users below admin to send emails -http://custom.simplemachines.org/mods/index.php?mod=3598One thing to check is that it doesn't affect the ability for a user to use theReport Postbutton. These reports are sent via email and have the senders email address on them. Probably a separate mechanism but worth checking.Changed send to receive, thanks nitro2k01

author: nitro2k01
author_rank: Frequent Contributor
timestamp: May 26, 2013, 06:50:35 am
content: Quote from: GeoffS on May 26, 2013, 05:51:52 amYou mean users' preference toreceivee-mail, right? If you turn it off for everyone, individual users can still turn it on, but then that's their prerogative. The main issue is making sure a spammer can't easily send a million messages in one day.The primary issue is the inconvenience for users receiving the spam. A secondary issue is that forum users may report these e-mails as spam, which may affect the ability for the forum to send other e-mail in the long run. (Registration e-mail, thread notifications etc.)

author: GeoffS
author_rank: Unknown
timestamp: May 26, 2013, 07:24:12 am
content: Quote from: nitro2k01 on May 26, 2013, 06:50:35 amCorrect. It does need the mentioned modification to globally remove a users ability to receive email.QuoteOnce a users ability to receive email is gone, part of the spam problem is also gone. With the modification, a user can still send mail but only in a limited fashion i.e. to report posts, contact admin or moderators, etc.

author: xrunner
author_rank: Super Contributor
timestamp: May 26, 2013, 12:28:14 pm
content: Quote from: xrunner on May 25, 2013, 12:42:24 amQuote from: EEVblog on May 26, 2013, 05:13:35 amI didn't word the sentence well. I meant I wouldn't personally use it to email another member (if another member had it enabled) or enable the ability (in my profile, or speaking to anyone that is reading this, they should not enable it in their profile).If I see anyone that has it enabled I turn it off (in their profile) and send them a PM warning that their email address could be gathered by spammers. Then once they realize this they can do as they wish.I think they should have given the Admin an option inThemes and Layout Settings --> Member Options --> Configure guest and new user options for this themefor this ability to be unavailable on the registration screen for new members by default. As it is it's off but available to be turned on at registration, so many people think "Oh email is important I need to turn this on ..."