WARNING: Compromised Accounts - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: February 20, 2024, 11:42:15 pm
content: There has been a recent spate of existing forum accounts being compromised by spam bots.Presumably they had their details stolen and reused passwords?So just a reminder to make your password unique and/or use the 2FA security feature.

author: xrunner
author_rank: Super Contributor
timestamp: February 21, 2024, 12:05:50 am
content: Yea I have seen a lot of them recently. Therefore I just set up 2FA here and the process was painless and worked.

author: KE5FX
author_rank: Super Contributor
timestamp: February 21, 2024, 12:43:14 am
content: How does one brute-force a password? Don't you lock the account out for X hours after Y unsuccessful attempts?Usually, "brute forcing" a password involves a stolen password database file, potentially from some other site where the user with the same name used the same password.

author: coppercone2
author_rank: Super Contributor
timestamp: February 21, 2024, 12:44:29 am
content: the meat of our dead crew members is being turned into spammer-advertiser cyborgscan the morgue be locked?

author: MLXXXp
author_rank: Frequent Contributor
timestamp: February 21, 2024, 01:39:07 am
content: Quote from: EEVblog on February 20, 2024, 11:42:15 pmAny chance support for FIDO hardware security keys for 2FA (Yubico,Google Titan, etc.) could be added?

author: EEVblog
author_rank: Unknown
timestamp: February 21, 2024, 02:31:36 am
content: Quote from: KE5FX on February 21, 2024, 12:43:14 amYes, probably more likely to be the owner had their account compromised and shared a password.

author: EEVblog
author_rank: Unknown
timestamp: February 21, 2024, 02:33:20 am
content: Quote from: MLXXXp on February 21, 2024, 01:39:07 amIf there is an SMF plugin that does that then I'm happy to install it, I use hardware keys myself. But last I looked there wasn't.

author: coppercone2
author_rank: Super Contributor
timestamp: February 21, 2024, 03:29:38 am
content: arent all these accounts long dormant?

author: EEVblog
author_rank: Unknown
timestamp: February 21, 2024, 04:11:41 am
content: Quote from: coppercone2 on February 21, 2024, 03:29:38 amHaven't checked them all, but from what I've seen, not recent posters. But they were still active accounts with legit posts.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: February 21, 2024, 06:18:40 am
content: Do you send notifications to those who have been compromised?

author: Zoli
author_rank: Frequent Contributor
timestamp: February 21, 2024, 06:54:07 am
content: I've checked(other forum, so is a widespread issue) some of the compromised e-mails: typically pawned in 10+ data breaches; add bad password hygiene in the mix, and you have the current situation.Edit: since I've seen the spam posts(similar to the other location), I recommend to Dave, to use the forum censorship to change the *.site advertisement to something else(spam would be an idea).

author: magic
author_rank: Super Contributor
timestamp: February 21, 2024, 08:25:21 am
content: Quote from: KE5FX on February 21, 2024, 12:43:14 am"Brute forcing" means repeatedly trying random passwords without any idea which one could be right.I tested this forum during the last wave of compromised account spam. A few failed login attempts lock the account for a few minutes and during this time even the correct password doesn't work. So true brute forcing is slow and unlikely to succeed.These compromises are caused by using "well known" login/pw combinations, usually obtained from other hacked websites. If you know that some login had a particular password on another site, it's a no brainer to check if the same password also works here.

author: jvmartins
author_rank: Newbie
timestamp: December 12, 2024, 04:13:28 am
content: Can someone explain how to set 2FA in this forum?My account was hacked, I managed to reset the password but now I want to include 2FA.

author: Kean
author_rank: Unknown
timestamp: December 12, 2024, 04:17:26 am
content: Quote from: jvmartins on December 12, 2024, 04:13:28 amVisithttps://www.eevblog.com/forum/profile/Then go to menu Modify Profile, then Two-Step AuthenticationI have it enabled already so I cannot tell you what you will see there, but it should be pretty straightforward to set up using an Authenticator app or email codes.

author: EEVblog
author_rank: Unknown
timestamp: December 12, 2024, 05:40:03 am
content: Quote from: Kean on December 12, 2024, 04:17:26 amI've been using 2FA for years since I installed it, and it works great. Slightly annoying to enter the code every 30 days, but well worth the extra security.

author: EEVblog
author_rank: Unknown
timestamp: December 12, 2024, 05:43:48 am
content: Quote from: CatalinaWOW on February 21, 2024, 06:18:40 amFYIgnif has written a custom script that tries to detect compromised accounts and automatically locks them with a notice to the user to email me direct to get their account back.I get a few emails a month from existing users that have had thier computer hacked or password compromised in some other way and it's been auto-detected.For those unsure how this happens, rest assured the passwords are NOT being stolen from this forum, but they have had their data stolen from some other site or hack on their own computer, and people often reuse passwords on different sites.They can often find out using:https://haveibeenpwned.com/

author: Halcyon
author_rank: Unknown
timestamp: December 17, 2024, 09:24:41 am
content: I banned two manually today as well. Seems like another wave coming through.

author: voltsandjolts
author_rank: Unknown
timestamp: December 17, 2024, 10:06:47 am
content: For anyone who isn't sure how this 2FA works, here is my understanding:When you sign-up for 2FA, a random seed code is generated by this forum and shared to your chosen authenticator app, via a QR code scan or manual entry. Thereafter, when you want to login, the authenticator app will generate a one-time-code based on that seed and the current time, using the math described inRFC 6238. The forum verifies the one-time-code using your seed and the current time.You can use any authenticator app that supports RFC 6238. I already used the microsoft authenticator app for work stuff and found it works fine with 2FA on this forum. There are other options, such as Google Authenticator or Authy.When you setup 2FA, you're given a 'backup code' that you can use to gain access if, say, you lose your phone. If that fails, contact the sys admins through email.I was unsure at first, but now recommend it, it's super easy!

author: EEVblog
author_rank: Unknown
timestamp: December 17, 2024, 01:57:58 pm
content: Quote from: voltsandjolts on December 17, 2024, 10:06:47 amIt should be noted that the forum can remember your login for 30 days before you have to use the authenticator app again.I use Google Authenticator for the forum.

author: MLXXXp
author_rank: Frequent Contributor
timestamp: December 17, 2024, 05:13:37 pm
content: Quote from: voltsandjolts on December 17, 2024, 10:06:47 amWhen on a PC, I useKeePassXC.I still wish that FIDO hardware security keys were supported.

author: Halcyon
author_rank: Unknown
timestamp: December 27, 2024, 12:34:51 am
content: Quote from: MLXXXp on December 17, 2024, 05:13:37 pmYou might want to consider Bitwarden. I was a Keepass user for many years, I now prefer Bitwarden as it's cross-platform and supports FIDO2 keys even on the free tier. (I pay for it, that's how much I like it.)

author: MLXXXp
author_rank: Frequent Contributor
timestamp: December 27, 2024, 05:30:07 pm
content: Quote from: Halcyon on December 27, 2024, 12:34:51 amKeePassXC is cross platform, as well.Quote from: Halcyon on December 27, 2024, 12:34:51 amI meant I wish that theEEVblog forumsupported FIDO keys, so I didn't even have to use KeePassXC, Google Authenticator, or any other TOTP generator for 2FA.