Home

Please support mflenses.com if you need any graphic related work order it from us, click on above banner to order!
SearchSearch MemberlistMemberlist RegisterRegister ProfileProfile Log in to check your private messagesLog in to check your private messages Log inLog in

mflenses.com security breach: member info stolen
Post new topic   Reply to topic
Home   Official News and Announcements
View previous topic :: View next topic  


PostPosted: Sun Apr 18, 2021 7:52 am    Post subject: mflenses.com security breach: member info stolen Reply with quote
mflenses.com has experienced a security breach. I registered for the mflenses.com forum in 2012 using a new and unique email address. I never used that address at any other website. My profile was always set to not show my email address. On April 1 I received a phishing message at that address. The mflenses.com site was likely hacked, with the attacker exfiltrating a list of member addresses.


PostPosted: Sun Apr 18, 2021 9:31 am    Post subject: Reply with quote
The website software is likely the original installed back in 2007. At least this is suggestive from the copyright date at the bottom of the website.

Plenty of email addresses available in the database I guess.


PostPosted: Sun Apr 18, 2021 10:32 am    Post subject: Reply with quote
The forum.mflenses.com Apache server is reporting itself as version 2.4.10. That version was released in 2014 and superseded in 2015. It has a fairly long list of known security vulnerabilities. If the site's other server software components are that old, it wouldn't be surprising for the site to have been hacked.


PostPosted: Sun Apr 18, 2021 12:52 pm    Post subject: Reply with quote
I am not surprised if the DB has been hacked with such old version of phpBB and Apache. Make sure don't share sensitive information via PM.


PostPosted: Sun Apr 18, 2021 2:30 pm    Post subject: Reply with quote
...

Last edited by Blazer0ne on Tue Feb 22, 2022 6:34 pm; edited 1 time in total


PostPosted: Sun Apr 18, 2021 4:13 pm    Post subject: Reply with quote
Perhaps your email provider security has been breached, not mflenses. Perhaps your mflenses password was guessed. To jump to the conclusion the entire mflenses website security has been breached requires more proof than you provide. As noted, if you ever used mflenses to send a PM, your email address has been exposed to the recipient and their email provider. To prove a breach at mflenses requires examination of server logs. Far more likely is your own computer has been hacked, imho.


PostPosted: Mon Apr 19, 2021 1:26 am    Post subject: Reply with quote
visualopsins wrote:
Perhaps your email provider security has been breached, not mflenses. Perhaps your mflenses password was guessed. To jump to the conclusion the entire mflenses website security has been breached requires more proof than you provide. As noted, if you ever used mflenses to send a PM, your email address has been exposed to the recipient and their email provider. To prove a breach at mflenses requires examination of server logs. Far more likely is your own computer has been hacked, imho.

My email provider is a top-tier provider with an excellent security record and my account is protected with a hardware key. My mflenses.com password is unique to the site. I had never sent PMs on mflenses. My computers are not running obsolete software exposed to the internet. I hadn't logged into the site in almost a year.

For the past 15 years I've always registered on websites with unique email addresses and passwords. While I can't prove that mflenses leaked my address, it certainly fits the pattern. I've gotten spam at addresses leaked in all of the big-name hacks (LinkedIn, eBay, MySpace, and dozens more), as well as from a lot of small forum sites where other users who also use unique addresses reported the same spam. I don't get spam at 90+% of the email addresses you'd find in my mail account. If a hacker had breached my mail account or my computer, they'd be very strange to pick an address out of my inbox that last received mail 9 years ago, and not the others. Given that mflenses is running obsolete software exposed to the internet, it seems far more likely to me that the site was breached and the user database was stolen. A great many small forum sites around the world have had the same thing happen.


PostPosted: Mon Apr 19, 2021 3:22 am    Post subject: Reply with quote
balazer wrote:
visualopsins wrote:
Perhaps your email provider security has been breached, not mflenses. Perhaps your mflenses password was guessed. To jump to the conclusion the entire mflenses website security has been breached requires more proof than you provide. As noted, if you ever used mflenses to send a PM, your email address has been exposed to the recipient and their email provider. To prove a breach at mflenses requires examination of server logs. Far more likely is your own computer has been hacked, imho.

My email provider is a top-tier provider with an excellent security record and my account is protected with a hardware key. My mflenses.com password is unique to the site. I had never sent PMs on mflenses. My computers are not running obsolete software exposed to the internet. I hadn't logged into the site in almost a year.

For the past 15 years I've always registered on websites with unique email addresses and passwords. While I can't prove that mflenses leaked my address, it certainly fits the pattern. I've gotten spam at addresses leaked in all of the big-name hacks (LinkedIn, eBay, MySpace, and dozens more), as well as from a lot of small forum sites where other users who also use unique addresses reported the same spam. I don't get spam at 90+% of the email addresses you'd find in my mail account. If a hacker had breached my mail account or my computer, they'd be very strange to pick an address out of my inbox that last received mail 9 years ago, and not the others. Given that mflenses is running obsolete software exposed to the internet, it seems far more likely to me that the site was breached and the user database was stolen. A great many small forum sites around the world have had the same thing happen.


The fact you received *any* messages at the email address given mflenses.com 9 years ago indicates the sender(s) have that email address too, yes? Perhaps they leaked it?

If you let us know how to identify the phish message we can certainly be on the lookout for it.


PostPosted: Mon Apr 19, 2021 3:31 am    Post subject: Reply with quote
visualopsins wrote:
The fact you received *any* messages at the email address given mflenses.com 9 years ago indicates the sender(s) have that email address too, yes? Perhaps they leaked it?

I think you are misunderstanding him. He registered here 9 years ago. The last sender to have used his mflenses email address was mflenses.com


PostPosted: Mon Apr 19, 2021 3:54 am    Post subject: Reply with quote
visualopsins wrote:

The fact you received *any* messages at the email address given mflenses.com 9 years ago indicates the sender(s) have that email address too, yes? Perhaps they leaked it?

If you let us know how to identify the phish message we can certainly be on the lookout for it.

The email I received 9 years ago at that address was the Manual Focus Lenses Forums welcome email. It was sent by mflenses.com.

The phishing message I received April 1 of this year was a fake parcel delivery notification from "UPS(GB)". But please note that receipt of such a message does not, by itself, indicate that your mflenses.com address was leaked. Spammers buy and trade lists of addresses, and most spam campaigns use addresses collected from multiple sources. In fact, I received a nearly identical message the next day at a different address.


PostPosted: Mon Jan 10, 2022 8:27 am    Post subject: Reply with quote
I doubt you're going to find the source.


PostPosted: Mon Jan 10, 2022 1:55 pm    Post subject: Reply with quote
balazer wrote:
visualopsins wrote:

The fact you received *any* messages at the email address given mflenses.com 9 years ago indicates the sender(s) have that email address too, yes? Perhaps they leaked it?

If you let us know how to identify the phish message we can certainly be on the lookout for it.

The email I received 9 years ago at that address was the Manual Focus Lenses Forums welcome email. It was sent by mflenses.com.

The phishing message I received April 1 of this year was a fake parcel delivery notification from "UPS(GB)". But please note that receipt of such a message does not, by itself, indicate that your mflenses.com address was leaked. Spammers buy and trade lists of addresses, and most spam campaigns use addresses collected from multiple sources. In fact, I received a nearly identical message the next day at a different address.


I think You'll find many of these phishing attempts send messages to random addresses, trying every combination of likely characters. Being sent from infected computers the wasted bandwith is of no concern to the perpetrators.


PostPosted: Mon Jan 10, 2022 4:27 pm    Post subject: Reply with quote
I always err on the safe side and assume any email address is public and everyone can find it out, given enough incentive.

I also assume that any website can be hacked.

Security protocols & algorithms are one thing, they may well be very good; but software implementation of those are quite another Wink
Post new topic   Reply to topic
Home   Official News and Announcements
Page 1 of 1