The forum, which runs on the popular phpBB3 software, was hit by a phishing attempt in the last few hours. Around 2000 private messages were sent by hundreds of newly registered users. It’s not clear how this automated attack got past our own spam hammer protection that bars new users from sending private messages. Apologies for the annoying messages and thanks to everyone for the reports.
Here is the SQL we used to clear out the scammers and their messages in case this post turns up search results.
SELECT * FROM `phpbb_privmsgs` left join phpbb_users on author_id=user_id WHERE `message_subject` LIKE '%We are deleting inactive accounts! Confirm your ac%'
First, backup your database!
Second, run this query to review what will get deleted. Replace “We are deleting inactive accounts! Confirm your ac” with the subject the phishers used. Could also be a line in the post or a URL.
DELETE `phpbb_users`, `phpbb_privmsgs` FROM phpbb_privmsgs left join phpbb_users on author_id=user_id WHERE `message_subject` LIKE '%We are deleting inactive accounts! Confirm your ac%' AND user_id NOT IN (x,x,x,x)
If users responded to the phisher (ours had some choice words…) they will also get deleted because of the reply subject. Replace x in the NOT IN () clause with the user_id of any legit users that should not be deleted (or omit it if there are none).
Run the query to delete the messages and the users. There is no going back (you did a backup right?).
Image of global phishing incident reports by Offnfopt.
The question is what exactly was the exploit they were trying to run? I have clicked on the link but had the presence of mind to log into the forum from another tab. They still may have stolen the session cookie, though.
The link was attempting to run some javascript from a free hosting, which likely failed for me because I have noscript on, and then redirected to a subdomain of ecoin.pw, with DP embedded in an iframe.
I think it was more an attempt to spread malware/ransomware and not phishing as such (there isn’t much to gain by phishing the credentials from a small forum).
You’re probably right. All the emails, PMs, WeChats, and forum posts referred to it as phishing so I ran with that. The cleanup is the same :)
It’s funny though. I’m one of those inactive users and only came here to see what that PM was all about. (email notification)
Did anything interesting happen in the last two years on the forums, or on the blog? Guess I have some reading to do.
A few kits, a few cables, 6 Hacker Camps, spinning up a foreign owned Chinese company, and DirtyPCBs.com :) This week I’m reorganizing the server setup and integrating the experimental site at dev.dangerousprototypes.com in this main site. From there we’re spinning off services as fast as we can find suppliers here in China.
It seems the “new message” count still includes the deleted message – at least I get the “1 new message” notification.
Thanks so much for the report. Does it go away when you click the messages, or is it stuck? I’ll look further.
Its stuck. Probably because there are no new messages (the newest one I can see is from 2015).
(Another question: I cannot see any names here on the comments – is this just me?)
Thanks for the heads up, I will try to fix it in the database. Yes, we’re fixing the comments the updated should be pushed tomorrow.
Can you please check the private messages? I took the rather drastic step of setting everyone to 0 again. That will probably cause other issues though. If I have to I will write some SQL to redo the counts, but I’m hoping we can move on and update the forum this week first.
Yes, its 0 now. Thanks! (Since everyone should get a message for new messages, nothing should get lost even with the counts not being correct for some time).
I think you have to ask yourself how many real users you get a month or a year.
Back in the old days, BBS users had to leave a phone number so start voice verifying them (call them on the phone).
Start making users fill out an application:
Name
Address
Country
Phone number
What microcontrollers do you use?
What software do you run?
What operating systems do they use?
What browsers do they use?
How many PCBs do you make a year?
How much do you spend on electronics?
What company do you work for?
Company’s name?
Your Title / Position
Company’s Address?
Company’s Country?
Company’s Phone number?
Boss’s name?
Title / Position?
Not only could you use this for your own marketing purposes but it also requires a spammer to spend more time filling out forms and then you can tell the mass mailed one from a unique one.
And if you had a program to put these questions in random order, it makes it harder for a spammer to answer correctly. Use visual verification to weed out the problem users and ban their ISPs.
Put in a lock on how many times an ip address can submit spam.
Jeeze, you are kidding, right? This is an excellent way to completely kill one’s forum/community. Having to register is annoying enough, now one has to fill what is essentially a marketing questionaire too? For a hobby forum access? Really? You can’t be serious. Also collecting such info could make the forum owner liable under various personal data collection/protection laws all over the world.
There are ways how to prevent spammers from abusing the forum, they just need to be used. Such as that new users are not allowed to post links or send PMs until they have several non-spam posts and are at least few days old. Moderation can be used, there are even automated filters to flag suspicious activity.
So someone has the time to press delete on 15,000 phishing attempts?
I don’t really think that normal people will be inconvenienced because normal people will want to be here.
A form creates more work for a spammer and makes it easier to spot. Therefore, instead of the spammer taking 5 minutes to register, he takes 15 minutes per phishing attempt which equals 3, 750 hours total (based on assumptions of how long it would take to register).
As far as legalities go, that is what lawyers are for. The website should be treated as private property and have an agreement for users to opt out of their rights to join for access. I do think there should be levels for new user access so that they only can mess up a New User Welcome forum instead of the whole board.
Would you rather the board owner turn around and say that either there is no more time for new user registrations limiting the amount of talent that would potentially participate here or would you like the board owner to say that the website doesn’t make him any money and doesn’t have any time to run it?
An alternative way to control phishing attempts is to post a hotmail email address and have users email the owner for access so the owner knows if they are for real or not because new users need to explain in essay style what kind of person they are so that the owner knows if they are legit or not.
The 15k phishing attempts wouldn’t have been there if basic anti-spam setup I have described was activated on the forum.
And no, you can’t “opt-out of rights”, there are laws mainly in Europe that require everyone who collects or processes personal information to register their systems with the government and submit to audits, for example. Yes, those laws apply if you start collecting info about EU citizens (e.g. me) or provide services to EU citizens, even though the website is being hosted overseas. The infamous “cookie law/directive” requiring consent before storing information on user’s computer is a good example of this.
And there are also legal protections that you can’t just have people opt out from or such “agreement” would be void. Such click-wrap agreement wouldn’t help anything in such situation – the law would still apply, regardless of whatever click-wrap nonsense you gave the subscribers to accept.
If you want to “limit talent”, then requiring onerous registration collecting a ton of personal information (juicy target for crackers!) is the best way to do so. Most people have actual lives and work to do, if someone requires me to go through this sort of nonsense only to post to a forum or to download SDK or datasheet, I walk away. Especially if it is only for personal, hobby stuff – my privacy is more important to me than a silly forum.
Look at the EEVBLOG forum for an example how one does not need such measures to run a good forum – there is no such BS necessary and phishing and spam are practically unheard of there, despite the forum being much bigger than this one. But there are some basic precautions in place and there are also moderators active on the forum. Pretty bog standard setup. And Dave doesn’t make any money from running the forum neither, so that argument also doesn’t apply.
“new users need to explain in essay style what kind of person they are”
I want some of what you are smoking, mate … *facepalm*