Account locked?

[Digital Jedi]

Originally Posted by X-or

Does not mean nobody got hacked, just that nobody reported yet. I have looked in my user CP, there is a paypal email address field, maybe that's what the hackers are after. If they can get both a password and a paypal email address, it's potentially very dangerous. There is also the homepage field that can be potentially very dangerous. I recommend people to blank these fields if no measures are going to be taken.

As was mentioned multiple times, if your password is secure, you have nothing to worry about. You do realize that this happens on every account you have across the internet, right? Daily. It's just vBulletin has a built in notification process when it happens. Most places, you'd never know unless you have an awful password. Seriously, though. Knowing your PayPal email address is about as potentially dangerous as someone knowing your last name. Everyone we did business with already knows it.

We really have to stop this paranoia every time hacking bots randomly pick this site as a target. Everything that can be done on the administration end has been done. Now you have to secure your password, just like you would everywhere else on the web. I can't understand why this doesn't sink in.

[BirdOPrey5]

Originally Posted by whitetigergrowl

No biggie until they eventually hack into your account and get your password. Anyone that says this is no biggie is seriously underestimating what is going on and potentially willing to compromise their account and information here and elsewhere.

200.112.211.80
117.164.142.150

I had 2 attempts on my account at the same time today. (8:09am)

Do not underestimate or downplay this. One IP is from Columbia and another from China in my case.

If you have a secure password it would take hundreds of thousands or millions or more chances to brute force break your password. Even someone who got 50 emails only had 250 max unique passwords checked on their account. The chances of them getting it right are almost zero. If your password is even puppy1036 they are never going to get it with this attack.

They are looking for the extremely week passwords- such as-
password
123456
abcde
[your username]

etc...

Originally Posted by JetLee

What got me worrying is that someone also called my cell phone carrier trying to ascertain my home address. WTF? I've since put extra security measures in place with all utilities and banks as well as changing all forum passwords to something even more complicated than I was already using.

I can assure you they are not related. This happens every few months around here- they are only looking for valid, licensed, accounts.

[BirdOPrey5]

Originally Posted by X-or

Does not mean nobody got hacked, just that nobody reported yet. I have looked in my user CP, there is a paypal email address field, maybe that's what the hackers are after. If they can get both a password and a paypal email address, it's potentially very dangerous. There is also the homepage field that can be potentially very dangerous. I recommend people to blank these fields if no measures are going to be taken.

The paypal field is only of value to coders/designers who can receive donations from other members as thanks for their mods.

There is no risk so long as you don't have the same password for vbulletin.org and paypal.

My paypal email is: paypal@juot.net - I welcome any donations anyone wants to send - there is ZERO risk making this public.

[TNCclubman]

getting brute forced as well here getting notifications of wrong password.

[whitetigergrowl]

It may happen every few months, but it doesn't make it any less serious. Maybe there is something the site can do to help prevent or minimize further attacks? I'm sure there are a number of things that can be done.

Vbulletin.org is the only site I have had this happen at. While its possible or likely it may have happened at others and I never knew about it, its still not reassuring IMO.

Or is it gonna take something catastrophic to happen and the damage done before its taken more seriously. Simply put this I don't think should be happening as often as it is to the point its affecting members here. Let alone to the point its making them jittery.

We don't know what they are after or what the true intention is. Having a good password may still not stop them. Its obvious they are looking for something. The question is if they get what they are looking for, is VB.org prepared to deal with the fallout and who will take responsibility for not trying to do more about it ahead of time when the chance was there?

This caught my attention. Downplaying it is not something I know I would be doing.

[BirdOPrey5]

The only thing we will likely do at some point is stop having so many emails sent to the users since there is really nothing you can do about it.

We will monitor when these things happen but there isn't a whole lot anyone can do.

The fact these emails are generated frankly means the system is working.

vBulletin.org has no real sensitive data beyond forum holder email addresses- and as long as you use a unique password and a secure password there is no need to worry.

[HeloHi]

I just changed my password to something freakishly long and complex. I suggest others to do the same.

[owning_y0u]

Originally Posted by HeloHi

I just changed my password to something freakishly long and complex. I suggest others to do the same.

32 chars FTW ;-)

[Alan_SP]

Originally Posted by zackw

The only email I might want is perhaps something that says that a successful login took place, from a different IP that my last login.

I have dynamic IP address. It's normal in my country.

Every time I login, I'm using different IP. This would mean I'd receive emails every time when I login.

On the other hand, something like this would mean a difference to people who wants to be extra safe.

[RaiinbowEyes]

Good to know I'm not alone, someone has been trying to hack my account with a proxy as well. How annoying >_< Guess it's time to change the PW to something ridiculous