XF 2.2 Users are getting hacked

[dtrumbower]

Currently on v2.2.6 Patch 2. The site I help with has had people at time get their accounts hacked and and the hacked user tries to sell items in our For Sale forum.
The last case happened this last Wed. The item was put up for sale at 1:25pm PST, but the logs show the password was changed at 5:30pm PST.

Anyone else had this issue on accounts?

 

[Wildcat Media]

I have an unpublished plugin from ozzmodz that alerts the Admin (me) when users make User Profile Edits - ie: change of location, website, etc. I have had users register and sit dormant, and their IP and user-entered profile information match (ie: India, Russia, Romania, etc), then return months later and change their location to Seattle, Atlanta, Denver, etc and start posting in Classifieds with scam attempts.

Nice! That would catch problem users in two different ways.

 

[Ozzy47]

I have an unpublished plugin from ozzmodz that alerts the Admin (me) when users make User Profile Edits - ie: change of location, website, etc. I have had users register and sit dormant, and their IP and user-entered profile information match (ie: India, Russia, Romania, etc), then return months later and change their location to Seattle, Atlanta, Denver, etc and start posting in Classifieds with scam attempts.

We’ll get this released soon.

 

[Suzanne O]

If people are getting hacked, send them an email telling them that there is some suspicious activity going on with their account and if it wasn't them to contact you directly.
Then you can ban the account.

 

[donwon]

This is a HUGE problem for us. Crazy how many old accounts are getting "resurrected" and start scamming.

 

[Suzanne O]

This is a HUGE problem for us. Crazy how many old accounts are getting "resurrected" and start scamming.

Upgrade to the latest version of 2.3.13 mate.

 

[Xon]

My (free) password tools add-on has Pwned password integration with the option to trigger a password reset if they login with a known compromised password.

Resource icon X

Password Tools

Oct 1, 2018

Cause safer passwords are better passwords.

• Xon
• hibp limitations password zxcvbn
• Add-ons [2.x]

This sort of thing slows down the flood of compromised accounts, but doesn't resolve it. Part of the issue is session/password stealers are super-common, and harvest everything the browser knows about and unleashes a wave of spam for every account they have.

 

[jeb35]

Upgrade to the latest version of 2.3.13 mate.

Which will do nothing to solve the problem!!!

 

[DeltaHF]

I've had this problem as well. I have a very old forum (25 years) and hundreds of thousands of users.

I handled it with a monthly routine. On the first of every month, I batch update all users who have not been active in the past year and set their Security Lock to "must reset password". It's not perfect, but it has worked very well.

 

[AndyB]

You might like this add-on:

https://xenforo.com/community/resources/security-lock-manager.9311/