Security breach at Mbam Forums?

[Anak]

I looked back 3pages (two weeks) and didn't see anything about it....

I received an email from Marcin:

Anak,

I'm writing to let you know that on November 10th a vulnerability in our
forum software allowed a hacker to gain access to the server hosting our
community. We have no evidence of any personal data being stolen (nor do
we store any on our forums!) but as a precautionary measure we are
forcing all users to reset their passwords. The next time you attempt to
log in, please select the "Forgot Your Password?" link below and follow the steps.

Deleted link for security............

We've also migrated our community away from our servers and onto a
service hosted by Invision Power Board. They know their software best
and as vulnerabilities are discovered, they can patch them more quickly.

I personally apologize for the inconvenience and if you have any
questions, do not hesitate to contact me directly at
Deleted link for security............

Marcin

I don't see any mention of it in a general web search, but found this on the mbam forum: https://forums.malwarebytes.org/MWB forum hacked? Phishing email?

It's not that I don't take the word of a 15post count member posting its ligit, but I'm going to wait awhile to see if more about this surfaces.

 

[Gator]

I would wait to hear a moderator confirm or deny before doing anything.

 

[maxie]

Malwarebytes Forum Hacked: Yes, It can happen to anyone - Ryan's Tech Tidbits

 

[Urthboundmisfit]

I got this e-mail too. It is legit as per Marcin "RubbeR DuckY" (Admin @MBAM Forums)

https://forums.malwarebytes.org/index.php?/topic/161236-malwarebytesorg-comprimised/?p=910678

Hi guys, Malwarebytes.org was not compromised, only the one server that is running this forum. Invision is known for having vulnerabilities and gets exploited all the time, unfortunately we fell victim to that. The e-mails are still going out, should be done in a few hours. Purging user passwords was precautionary and since we just moved away from our servers and went to hosting the board with Invision, we used it as an opportunity.

Let me know if you have any questions or you can e-mail me

.

 

[Anak]

Thanks to everyone that replied, yes it's legit and I'll be changing my PW.

There is one other link at Mbam on the topic: https://forums.malwarebytes.org/I am asking just to be sure this came from Malwarebytes

 

[Layback Bear]

I can not log into the Malwarebytes forum any longer.
I tried so I could change my password.

 

[scr]

I can not log into the Malwarebytes forum any longer.
I tried so I could change my password.

Neither can I the security check on the "I forgot my password" page doesn't show up so I'm at a dead end.

 

[COMPUTIAC]

Thanks to everyone that replied, yes it's legit and I'll be changing my PW.

There is one other link at Mbam on the topic: https://forums.malwarebytes.org/I am asking just to be sure this came from Malwarebytes

I received this email also.
I used the link above a few minutes ago to change my password and it worked fine.

 

[ThrashZone]

There's no real support there anyway no need to login just read the locked threads

 

[Jacee]

See this ... https://forums.malwarebytes.org/index.php?/topic/161264-mwb-forum-hacked-phishing-email/

 

[Anak]

I can not log into the Malwarebytes forum any longer.
I tried so I could change my password.

LBB, I've seen remarks in all three now four links (see below) to mbam about the sign-in problem and there are two ways to recover your sign-in.

1.) If you received an email like I showed in my original post, try clicking on the first link and in my case it took me to a: https://Lost Your Password? | forums.malwarebytes.org page.

   Note

If you haven't received an email or that link doesn't work go to 2.).

​

a.) Fill in either your account name or your email addy and type in what you see in the captcha challenge, click on the Proceed button.
In my case another tab opened and said:

Lost Password Recovery

An email containing further activation instructions has been sent. This email should be received within the next 10 minutes (usually instantly).

I received mine within 1minute.

b.) I clicked on the first link and it took me to a page where I was able to change my password, after I clicked on the Proceed button it took me to the sign-in page where I could use my old user name, but had to use the new password, after clicking on that proceed button I was back in the mbam forum.


2.) If you haven't received an email yet, go to the mbam forum and click on sign-in in the upper right hand corner. When the sign-in dialog box opens just click on the blue "I've forgotten my password" link below the password entry box.

That will take you to the page of the link I have in 1.), from there follow the a.), and b.) steps.


Related Threads:
https://forums.malwarebytes.org/index.php?/topic/161264-mwb-forum-hacked-phishing-email/
https://forums.malwarebytes.org/ind...-just-to-be-sure-this-came-from-malwarebytes/
https://forums.malwarebytes.org/index.php?/topic/161236-malwarebytesorg-comprimised/
https://forums.malwarebytes.org/index.php?/topic/161247-is-mbam-forum-requiring-new-passwords/

 

[Layback Bear]

Thank you for the information Steve.

 

[Anak]

You're welcome Jack, I'll be in-forum for awhile yet, let me know if you were successful or not.

 

[scr]

I managed to change my password. The security check captcha challenge didn't show in Palemoon v25.1. I had to drag IE out to complete the change

 

[Anak]

I managed to change my password. The security check captcha challenge didn't show in Palemoon v25.1. I had to drag IE out to complete the change

Yea it's a pain, I'm using FF and I had to get a new captcha because the first one was vertical and had the top of the number cut off, I couldn't tell if it was a 1 or a 7.

• The first blue button to the right of the pix gets you a new visual one.

• The second gives an audio challenge, but its not the same as the visual, and it will be repeated, in my case I'd want to have paper and pencil ready. If you can't understand it, click on it again and it will give you a new set of numbers.

• Once you're in the audio side you can't change back to visual unless you refresh the page. Clicking again on the top gives you a new audio captcha.

 

[scr]

This is what I see in Palemoon. Entering the proper information does not change the security check captcha challenge

 

[Layback Bear]

I used Firefox and and changed my password with the email and things are working again on the Malwarebytes Forum site.

 

[Anak]

This is what I see in Palemoon. Entering the proper information does not change the security check captcha challenge

Wow! It looks like it didn't even render that part of the page. You don't say what version you're running (latest looks like v25.1.0) but check v24.5.0 and 24.4.2 here for similar issues: Pale Moon - Known Issues

Searching for Palemoon (page) rendering problems brings up a lot of concerns, one cure seems to be clearing your cache and setting it to dump after each session.

I used Firefox and and changed my password with the email and things are working again on the Malwarebytes Forum site.

That's good to hear Jack!

 

[scr]

This is what I see in Palemoon. Entering the proper information does not change the security check captcha challenge

Wow! It looks like it didn't even render that part of the page. You don't say what version you're running (latest looks like v25.1.0) but check v24.5.0 and 24.4.2 here for similar issues: Pale Moon - Known Issues

Searching for Palemoon (page) rendering problems brings up a lot of concerns, one cure seems to be clearing your cache and setting it to dump after each session.

Thanks for the reply. I'm using the latest release v25.1.0. I've not run in to the problem else where. I haven't had a chance to pursue it, life got in the way. Maybe later this evening I'll have a chance to go over to the Palemoon forums and snoop around.

 

[lehnerus2000]

It seems that some sites don't recognise Pale Moon since they changed the user agent.

On my PC:

• Yahoo search gives an error message (no search) if I try to access it using PM
• Firefox in Linux Mint 17 has no problems though