Spammers posting through existing accounts with no need to login?

[Dirk22]

This is such a typical spam post, now also here in the forum ...

[DohTheme] - Forum Design Services

Very great experience with @DohTheme and very professional. I would highly recommend going here first before anyone else.

xenforo.com

 

[johnny82]

They put the link in the From field too

 

[Mr Lucky]

I just did this one a test user and nothing happened. They were able to continue using the site, log out and log in again. No requirement to rest password.

My test account got the following and could do nothing.

I just found out that batch update is not working. Hence my issue. This is a known unresolved bug:

Fixed - Batch update users broken in 2.2.12

Since 2.2.12 .. batch update users feature is broken due to this weird change at XF\Job\UserAction $customTitle = $this->getActionValue('custom_title'); if ($customTitle !== '') { $user->custom_title = $customTitle; } where $customTitle will never be...

xenforo.com

Security lock works fine if done user by user but that is not much use in this case with thousands of users !!

 

[Mr Lucky]

I just found out that batch update is not working. Hence my issue. This is a known unresolved bug:

Fixed - Batch update users broken in 2.2.12

Since 2.2.12 .. batch update users feature is broken due to this weird change at XF\Job\UserAction $customTitle = $this->getActionValue('custom_title'); if ($customTitle !== '') { $user->custom_title = $customTitle; } where $customTitle will never be...

xenforo.com

Security lock works fine if done user by user but that is not much use in this case with thousands of users !!

I found a workaround to the non-functioning batch update. Warning! this seemed to work but I can't guarantee it won't mess anything up as I'm always wary of editing the database, however seems fairly straightforward.

Promote the users who you want to reset passwords for to a usergroup
Run the query UPDATE xf_user SET security_lock = reset' WHERE FIND_IN_SET(123, secondary_group_ids) (where the secondary group is 123)

 

[RyanC]

I have three very large forums and have had hundreds of these in the past week or so... Most from dormant accounts.

Is there any plugins available that force user accounts that haven't logged in in the past 6 months to change their passwords?

 

[Black Tiger]

maybe this will help

It might indeed. Thank you.
Is this officially release yet? As I can't seem to find this here on Xenforo neither on the TH website under the addons. Only in this post.

 

[Mr Lucky]

Seeing as this has been affecting so many boards, maybe this will help - will set users to either require email confirmation or force a password reset (or both) after a specified time.

Didn't work with my test user.

 

[mattrogowski]

It might indeed. Thank you.
Is this officially release yet? As I can't seem to find this here on Xenforo neither on the TH website under the addons. Only in this post.

It's not one we release like the others, just something we have that may be useful to others here.

Didn't work with my test user.

It runs on a cron, so you'd probably need to run it manually to see immediate changes.

 

[Black Tiger]

just something we have that may be useful to others here.

Ah oke because I was looking for a manual or screenshot with the options one can setup, like after which inactivity time the user is to confirm again.

 

[mattrogowski]

It just creates an option group "[TH] Reverify Inactive Users" where you can set the action to take (default is just email confirmation) and the cut off days.

 

[Ozzy47]

It's not one we release like the others, just something we have that may be useful to others here.

May I release it so people wishing to discuss it can do so in the addon support thread?

 

[Rhody]

One of my forums has over 11k members, and goes back 26 years.

So far, we haven't had any of these, but we're on alert! It sounds like this has been a large problem in the past 48 hours, for a lot of forums.

Thanks for making that, Matt!

 

[mattrogowski]

May I release it so people wishing to discuss it can do so in the addon support thread?

I'd rather it just stayed here for anyone that comes across the thread, not really looking to have it rebranded or turning into an actively maintained addon listed anywhere. It is what it is and is there if people come across it and find it useful to protect accounts against this spam attack.

 

[nocte]

You can use the addon "Dragonbyte Security" by @DragonByte Tech in 2 ways to avoid this issue:

[DBTech] DragonByte Security

DragonByte keeps a watchful eye over your forum even when you are not there, and has the capability to alert you of any suspicious activity. Uses DragonByte is the ideal product for forums that are concerned about security, or wish to be alerted...

xenforo.com

1. Turn on Captacha on Login. This will avoid any kind of brute-force login attacks.
2. Monitor failed logins. If there are a lot of failed logins, probably someone is trying to hack accounts.

Good luck!

 

[high1976]

we see the same posts here but something is odd. They all show up in User Change Log with this settings changed:


but "last login" is still from long ago. Server logs show a normal login.
Some have the Moldovian IP posted above but others show up as "No IP logs were found for the requested user."

 

[Rhody]

Maybe trying to hide their tracks, so the account owner isn't notified.

Really odd if the login date isn't being moved, though.

Added 109.107.166.230 to the ban list.

 

[mattrogowski]

we see the same posts here but something is odd. They all show up in User Change Log with this settings changed:
View attachment 280125

but "last login" is still from long ago. Server logs show a normal login.
Some have the Moldovian IP posted above but others show up as "No IP logs were found for the requested user."

The last activity column is updated on a delay in the hourly rebuild cron, which may explain the last login date there (depending on where the date is pulled from).

 

[Kirby]

we see the same posts here but something is odd. They all show up in User Change Log with this settings changed

I'd say this is not odd at all:

Let's assume those accounts are compromised because the attacker got an email address and a password that works to log into that email account (and other websites like forums where the same password was used) and that the user was not actively using those forum accounts (for a long time).

If that is the case, the attacker would not want the victim to become aware that the email account is compromised (due to forum notification emails) - so all email notifications are being turned off.

 

[high1976]

the last login issue is not a general one but seems to affect some these accounts. The hourly cron runs fine manually, I see other (active) accounts are updated with todays date. Same for IP.

Maybe a local issue, not sure.

I'd say this is not odd at all:

sure, I meant the last login and IP problem, sorry

 

[duderuud]

We had 13 compromised accounts too. All security locked and banned ip 109.107.166.230