Spammed from BarginsAU - Page 2

Fairlane 500 · 08-01-2018, 08:04 PM

I got spammed as well.
I deleted & blocked the sender.

Plenty of other vbulletin forum members got exactly the same
& there are threads on other forums.

Sounds like there is a hole in the security.

wodahs · 08-01-2018, 09:41 PM

unfortunately even apps on your phone or pc write EVERYTHING that you've had going on back to daddy n mommy
as seems basically facebash gazzoogle n others the like own most apps and scour ALL your info for what ever bolderdash excise they need it for and they have the rights to onforward the info at their needs too
talk bout an invasion of privacy and we invite them in

WindsorXR · 08-01-2018, 11:13 PM

Pretty much.
That's why it's just a case of

- Unsubscribe
- Mark as Spam or Report
- Delete

My yahoo account is packed with spam.

Feathers · 09-01-2018, 12:14 AM

Another forum I'm on, had bitcoin mining code inserted into it recently, as they were running an unsupported version of Vbulletin, could something similar have happened here if there is a security flaw in the version being used?

Fed · 09-01-2018, 09:18 AM

Quote:

Originally Posted by Blue Shadow

Does the email have the option to unsuscribe ?

There is an unsubscribe on the Bargains AU spam but I don't unsubscribe from a site I never subscribed to in the first place.

They do say that unsubscribing from a dodgy site can be used as confirmation of a valid live email address which is then placed on more lists & passed around like a hooker at a bucks party.

Quote:

Not sure what you mean by they got me? Well they have now that its leaked out!

What I meant PF was that your Ford Forums email address is now on a mailing list that is out in the wild.

Mercury Bullet · 09-01-2018, 04:28 PM

Quote:

Originally Posted by wodahs

unfortunately even apps on your phone or pc write EVERYTHING that you've had going on back to daddy n mommy
as seems basically facebash gazzoogle n others the like own most apps and scour ALL your info for what ever bolderdash excise they need it for and they have the rights to onforward the info at their needs too
talk bout an invasion of privacy and we invite them in

Absolutely and we let the government get away with this lack of legislation.
America is worse though, they know when you visit the dunny. One day the Glen 20 can will go off automatically on cue.

TheLandOfSmeg · 13-01-2018, 11:29 PM

Hi guys, I also use a unique email address for each website I sign up to

i.e. fordforums_com_au@<mydomainname>.com

I also got the BargainsAU spam.

I signed up so long ago that I didn't even keep a record of signing up or this email address on my end, in fact according to the forum index "You last visited: 12-01-2007 at 02:42 PM"... Almost 11 Year exactly!

And yes, fordforums_com_au@<mydomainname>.com is my actual registered email address on the forum, I was able to complete the password reset using this email address.

So yes, I can say that with 100% certainty that your database has been compromised.

TheLandOfSmeg · 13-01-2018, 11:48 PM

**aussiblue** · 14-01-2018, 09:11 AM

So did the others spammed have a similar easily guessed email address starting with something like "ford_forums_au@" ?

TheLandOfSmeg · 14-01-2018, 09:31 AM

I doubt that convention is easily guessable

I think that you need to move to supported forum software receiving security updates and notify of the breach.

overclockers.com.au just moved from old VBulletin to XenForo because it's similar, although I'm more a fan of Discourse.

**aussiblue** · 14-01-2018, 09:53 AM

Quote:

I doubt that convention is easily guessable

I think that is one a spammers expert system would easily guess especially if the same convention was used on another forum or site that had been hacked.

TheLandOfSmeg · 14-01-2018, 10:13 AM

Quote:

Originally Posted by aussiblue

I think that is one a spammers expert system would easily guess especially if the same convention was used on another forum or site that had been hacked.

And even though it is a catch-all address (meaning anything@mydomain.com comes through to me and no other BargainsAU spam hit me except this one), and out of all the possible combinations, they chose fordforums_com_au.

This even though it has been 11 years since I last visited and had kept absolutely no record of it.

On top of this, other users on the same forum are reporting that they have received the same spam to other email addresses of a different convention which also has only ever been given out to fordforums.com.au (i.e. a work email address).

This spammer must have a magic crystal ball or something to be able to target users of this specific forum according to the email address on file, unless you guys actually sold your members email addresses to the spammer yourselves?

**aussiblue** · 14-01-2018, 10:20 AM

Its seems though less than a dozen members have got the spam and you would think many more would have if the site had been hacked. You'd think there must be something else in common of those who got the spam.

TheLandOfSmeg · 14-01-2018, 10:29 AM

It went into the spam folder. Most people just delete and move on - it's very hard to attribute where it came from if you use your primary email address. I on the other hand have this system set up so that I check for leaks before blocking that particular address, so I can tell if a particular website has been compromised.

**aussiblue** · 14-01-2018, 10:48 AM

Perhaps your mail provider was hacked ala Yahoo mail.

Fed · 14-01-2018, 10:49 AM

https://www.sau.com.au/forums/topic/...-my-sau-email/

Harvesting & using email addresses is against the law in Australia.
https://www.acma.gov.au/theACMA/spam...ng-prohibition
Maybe someone should let BargainsAU know?

**aussiblue** · 14-01-2018, 10:57 AM

The header suggests a spam bot was sending it all addresses starting with "fordforums_com." .

TheLandOfSmeg · 14-01-2018, 11:00 AM

Quote:

Originally Posted by aussiblue

Perhaps your mail provider was hacked ala Yahoo mail.

At the time I signed up for fordforums I was using my own mailserver and I immediately deleted the signup confirmation after, leaving no trace of that email address ever being used except in your database. I had totally forgot about this site.

Given that other members on here have been affected who signed up many years after I did, it is impossible that the email address was harvested at the time of sign up or at my end.

This only possible source for this breach in my case is your database.

I have never signed up to SAU, who appear to also have been breached. If I did sign up to them I would have received 2x spam, one to fordforums_com_au@ and one to sau_com_au@ (or similar convention depending on the time that I signed up to them, which I never did)

TheLandOfSmeg · 14-01-2018, 11:03 AM

Quote:

Originally Posted by aussiblue

The header suggests a spam bot was sending it all addresses starting with "fordforums_com." .

Well that's easy to check. Did anyone else who received this message use an email address starting with fordforums_com or fordforums_com_au?

It sounds like you are burying your head in the sand because you don't want it to be true. It's not that hard to believe, it happens often even from big companies. The fact that you are using an outdated version of vBulletin without security updates just makes it inevitable that something like this would happen.

**aussiblue** · 14-01-2018, 11:03 AM

Quote:

This only possible source for this breach in my case is your database.

Not my database; I am just and ordinary member who like most it seems didn't get this spam. Which is what intriguing me.

TheLandOfSmeg · 14-01-2018, 11:14 AM

Quote:

Originally Posted by aussiblue

Not my database; I am just and ordinary member who like most it seems didn't get this spam. Which is what intriguing me.

Mine arrived into the spam folder on the 4th Jan 2018 at 8:16AM

Could have you already deleted it?

**aussiblue** · 14-01-2018, 11:16 AM

Quote:

ell that's easy to check. Did anyone else who received this message use an email address starting with fordforums_com or fordforums_com_au?

or fordforums@com.
or fordforums*com. etc or similar addresses that a spambot would generate.

**aussiblue** · 14-01-2018, 11:17 AM

Quote:

ine arrived into the spam folder on the 4th Jan 2018 at 8:16AM

Could have you already deleted it?

Yes; I would have but a) I would have rembered and b) my mailwasher keeps a record and it's not there. Unless of course my ISP and mail provider recognised it as spam and deleted it before it got to me (but I think that rarely happens).

TheLandOfSmeg · 14-01-2018, 11:21 AM

why/how would a spam bot generate such a specific address which just to happens to align perfectly with an entry in your database? Shouldn't the Bot be generating OzLotto winning combinations instead?

TheLandOfSmeg · 14-01-2018, 11:25 AM

Seems like SAU/BOOSTCRUSING/FORDFORUMS and PERFORMANCEFORUMS have been hit by the same thing. Other people report using exclusive email addresses for those forums too.

https://www.google.com.au/search?biw....0.Q_lISWyeyy0

4x Australian+Motoring related forums.

Hmmm.

Inside job maybe unless they are also vBulletin (edit: 2x Invision + 2x vBulletin)

**aussiblue** · 14-01-2018, 11:29 AM

I did get a lot of spam after the Sept 2017 Yahoo hack although I rarely used Yahoo mail; it came to the alternate address I had provided to Yahoo. But not a lot since.

**aussiblue** · 14-01-2018, 11:31 AM

Quote:

why/how would a spam bot generate such a specific address which just to happens to align perfectly with an entry in your database?

As I said, not my database; like you I am just a regular forum member intrigued by how you and a few others got spammed.

Fed · 14-01-2018, 11:33 AM

04-01-18 must have been mail out day.
http://www.performanceforums.com/for...-67314333.html

**aussiblue** · 14-01-2018, 11:36 AM

Were those spammed tapatalk users? https://www.hometheaterforum.com/com...g-away.351617/ and https://www.tapatalk.com/groups/tapa...se-t31803.html etc Does this forum allow tapatalk access?

TheLandOfSmeg · 14-01-2018, 11:37 AM

Quote:

Originally Posted by aussiblue

I did get a lot of spam after the Sept 2017 Yahoo hack although I rarely used Yahoo mail; it came to the alternate address I had provided to Yahoo. But not a lot since.

So just to confirm, you DID receive the BargainsAU spam in your yahoo? And this aligns with the email address supplied in here: https://fordforums.com.au/profile.php?do=editpassword ?