MFlenses - A new life in a digital age
MFLenses 2026

Manual Focus Lenses Forum

Explore the world of vintage lenses through repair notes, real test shots, and detailed archive threads packed with images.

Explore the world of vintage lenses through repair notes, real test shots, and detailed archive threads packed with images.
logovectorizer.com
Spotlight

Featured partner placement for the forum front page.

mflenses.com security breach: member info stolen
Post new topic Reply to topic
View previous topic :: View next topic  


Post
Posted: Sun Apr 18, 2021 7:52 am
Post subject: mflenses.com security breach: member info stolen
Reply
Post
Posted: Sun Apr 18, 2021 7:52 am
Post subject: mflenses.com security breach: member info stolen
Reply
mflenses.com has experienced a security breach. I registered for the mflenses.com forum in 2012 using a new and unique email address. I never used that address at any other website. My profile was always set to not show my email address. On April 1 I received a phishing message at that address. The mflenses.com site was likely hacked, with the attacker exfiltrating a list of member addresses.


Post
Posted: Sun Apr 18, 2021 9:31 am
Post subject:
Reply
Post
Posted: Sun Apr 18, 2021 9:31 am
Post subject:
Reply
The website software is likely the original installed back in 2007. At least this is suggestive from the copyright date at the bottom of the website.

Plenty of email addresses available in the database I guess.


Post
Posted: Sun Apr 18, 2021 10:32 am
Post subject:
Reply
Post
Posted: Sun Apr 18, 2021 10:32 am
Post subject:
Reply
The forum.mflenses.com Apache server is reporting itself as version 2.4.10. That version was released in 2014 and superseded in 2015. It has a fairly long list of known security vulnerabilities. If the site's other server software components are that old, it wouldn't be surprising for the site to have been hacked.


Post
Posted: Sun Apr 18, 2021 12:52 pm
Post subject:
Reply
Post
Posted: Sun Apr 18, 2021 12:52 pm
Post subject:
Reply
I am not surprised if the DB has been hacked with such old version of phpBB and Apache. Make sure don't share sensitive information via PM.


Post
Posted: Sun Apr 18, 2021 2:30 pm
Post subject:
Reply
Post
Posted: Sun Apr 18, 2021 2:30 pm
Post subject:
Reply
...

Last edited by Blazer0ne on Tue Feb 22, 2022 6:34 pm; edited 1 time in total


Post
Posted: Sun Apr 18, 2021 4:13 pm
Post subject:
Reply
Post
Posted: Sun Apr 18, 2021 4:13 pm
Post subject:
Reply
Perhaps your email provider security has been breached, not mflenses. Perhaps your mflenses password was guessed. To jump to the conclusion the entire mflenses website security has been breached requires more proof than you provide. As noted, if you ever used mflenses to send a PM, your email address has been exposed to the recipient and their email provider. To prove a breach at mflenses requires examination of server logs. Far more likely is your own computer has been hacked, imho.


Post
Posted: Mon Apr 19, 2021 1:26 am
Post subject:
Reply
Post
Posted: Mon Apr 19, 2021 1:26 am
Post subject:
Reply
visualopsins wrote:
Perhaps your email provider security has been breached, not mflenses. Perhaps your mflenses password was guessed. To jump to the conclusion the entire mflenses website security has been breached requires more proof than you provide. As noted, if you ever used mflenses to send a PM, your email address has been exposed to the recipient and their email provider. To prove a breach at mflenses requires examination of server logs. Far more likely is your own computer has been hacked, imho.

My email provider is a top-tier provider with an excellent security record and my account is protected with a hardware key. My mflenses.com password is unique to the site. I had never sent PMs on mflenses. My computers are not running obsolete software exposed to the internet. I hadn't logged into the site in almost a year.

For the past 15 years I've always registered on websites with unique email addresses and passwords. While I can't prove that mflenses leaked my address, it certainly fits the pattern. I've gotten spam at addresses leaked in all of the big-name hacks (LinkedIn, eBay, MySpace, and dozens more), as well as from a lot of small forum sites where other users who also use unique addresses reported the same spam. I don't get spam at 90+% of the email addresses you'd find in my mail account. If a hacker had breached my mail account or my computer, they'd be very strange to pick an address out of my inbox that last received mail 9 years ago, and not the others. Given that mflenses is running obsolete software exposed to the internet, it seems far more likely to me that the site was breached and the user database was stolen. A great many small forum sites around the world have had the same thing happen.


Post
Posted: Mon Apr 19, 2021 3:22 am
Post subject:
Reply
Post
Posted: Mon Apr 19, 2021 3:22 am
Post subject:
Reply
balazer wrote:
visualopsins wrote:
Perhaps your email provider security has been breached, not mflenses. Perhaps your mflenses password was guessed. To jump to the conclusion the entire mflenses website security has been breached requires more proof than you provide. As noted, if you ever used mflenses to send a PM, your email address has been exposed to the recipient and their email provider. To prove a breach at mflenses requires examination of server logs. Far more likely is your own computer has been hacked, imho.

My email provider is a top-tier provider with an excellent security record and my account is protected with a hardware key. My mflenses.com password is unique to the site. I had never sent PMs on mflenses. My computers are not running obsolete software exposed to the internet. I hadn't logged into the site in almost a year.

For the past 15 years I've always registered on websites with unique email addresses and passwords. While I can't prove that mflenses leaked my address, it certainly fits the pattern. I've gotten spam at addresses leaked in all of the big-name hacks (LinkedIn, eBay, MySpace, and dozens more), as well as from a lot of small forum sites where other users who also use unique addresses reported the same spam. I don't get spam at 90+% of the email addresses you'd find in my mail account. If a hacker had breached my mail account or my computer, they'd be very strange to pick an address out of my inbox that last received mail 9 years ago, and not the others. Given that mflenses is running obsolete software exposed to the internet, it seems far more likely to me that the site was breached and the user database was stolen. A great many small forum sites around the world have had the same thing happen.


The fact you received *any* messages at the email address given mflenses.com 9 years ago indicates the sender(s) have that email address too, yes? Perhaps they leaked it?

If you let us know how to identify the phish message we can certainly be on the lookout for it.


Post
Posted: Mon Apr 19, 2021 3:31 am
Post subject:
Reply
Post
Posted: Mon Apr 19, 2021 3:31 am
Post subject:
Reply
visualopsins wrote:
The fact you received *any* messages at the email address given mflenses.com 9 years ago indicates the sender(s) have that email address too, yes? Perhaps they leaked it?

I think you are misunderstanding him. He registered here 9 years ago. The last sender to have used his mflenses email address was mflenses.com


Post
Posted: Mon Apr 19, 2021 3:54 am
Post subject:
Reply
Post
Posted: Mon Apr 19, 2021 3:54 am
Post subject:
Reply
visualopsins wrote:

The fact you received *any* messages at the email address given mflenses.com 9 years ago indicates the sender(s) have that email address too, yes? Perhaps they leaked it?

If you let us know how to identify the phish message we can certainly be on the lookout for it.

The email I received 9 years ago at that address was the Manual Focus Lenses Forums welcome email. It was sent by mflenses.com.

The phishing message I received April 1 of this year was a fake parcel delivery notification from "UPS(GB)". But please note that receipt of such a message does not, by itself, indicate that your mflenses.com address was leaked. Spammers buy and trade lists of addresses, and most spam campaigns use addresses collected from multiple sources. In fact, I received a nearly identical message the next day at a different address.


Post
Posted: Mon Jan 10, 2022 8:27 am
Post subject:
Reply
Post
Posted: Mon Jan 10, 2022 8:27 am
Post subject:
Reply
I doubt you're going to find the source.


Post
Posted: Mon Jan 10, 2022 1:55 pm
Post subject:
Reply
Post
Posted: Mon Jan 10, 2022 1:55 pm
Post subject:
Reply
balazer wrote:
visualopsins wrote:

The fact you received *any* messages at the email address given mflenses.com 9 years ago indicates the sender(s) have that email address too, yes? Perhaps they leaked it?

If you let us know how to identify the phish message we can certainly be on the lookout for it.

The email I received 9 years ago at that address was the Manual Focus Lenses Forums welcome email. It was sent by mflenses.com.

The phishing message I received April 1 of this year was a fake parcel delivery notification from "UPS(GB)". But please note that receipt of such a message does not, by itself, indicate that your mflenses.com address was leaked. Spammers buy and trade lists of addresses, and most spam campaigns use addresses collected from multiple sources. In fact, I received a nearly identical message the next day at a different address.


I think You'll find many of these phishing attempts send messages to random addresses, trying every combination of likely characters. Being sent from infected computers the wasted bandwith is of no concern to the perpetrators.


Post
Posted: Mon Jan 10, 2022 4:27 pm
Post subject:
Reply
Post
Posted: Mon Jan 10, 2022 4:27 pm
Post subject:
Reply
I always err on the safe side and assume any email address is public and everyone can find it out, given enough incentive.

I also assume that any website can be hacked.

Security protocols & algorithms are one thing, they may well be very good; but software implementation of those are quite another Wink
Post new topic Reply to topic
Page 1 of 1