Is it not time to introduce a precaution to make it more difficult for people to do drive by spam of the forums and consequently forum members.
There is a thread where This forum spamming was discussed and I suggested that registration shouldn’t be a single operation, fill in the form to register with a legit email address and an email is sent to that address with either an activation link or a code for them to enter to complete the registration. Until registration is complete then they can’t post and they can’t send PMs. No PM, no notification email.
I know this isn’t an infallible system with throw away hotmail addresses, etc. but it inconveniences them if they have to get a new email once they are banned. In forming the registrant that the IP address will be noted on registration could also be a deterrent and nothing to worry about for genuine forum members.
These measures are becoming common on other forums, not sure if it is directly to combat this or for other reasons.
That was what I thought to bitemehardly. I just checked my pm’s and the message is in there also. When I checked my profile, I had the box ticked for notify me when I have new pm’s, that is why it came to my personal email account. Untick that box and you won’t get this sort of spam anymore. Hope it helps.
Look no e-mail addresses were compromised (as long as you have chosen to hide them) the spammer sent a Personal Message, after the message was sent and the user it was sent to recieved it, then you will recieve an e-mail notification from the avast! forums notifying you that you have recieved a personal message, the notice will also have the content of the PM in it.
I know I said I wouldn’t comment any more on this, but, I just got a SECOND PM probably identical to the first…
I think it’s safe to say this forum/server has been hacked…
I suggest IMMEDIATE EMERGENCY response here…
CHANGE ALL PASSWORDS IMMEDIATELY… Mysql, Root, SMF Admin, ALL of them… Activate in Registration “Member APPROVAL by Admin”… Restrict the Newbie (or whatever) member group to ZERO PMs…
Jedi Master, the forum has not been hacked. That user just created an account to send PMs thats all.
Kubecj does not want to install a beta or RC build, ALWIL has enough to do without reinstalling the forum software because of a bug and I don’t blame them!
Huh, I got this spam too. Funny how phpbb doesn’t send PM content to the email, this forum could learn something from phpbb. (Edit: Also visual confirmation…)
Okay… You get a little bit of spam and you start crying “OMG HAX”? Jumpy today, aren’t you?
I too received this just now (from EdwardN whose profile indicates “he” is still online and most likely is PMming as fast as he can before that account gets shut down) and was worried about a hack because the email said it was an urgent message from ADMIN…now I am realizing that was just the subject of the PM.
Just to reiterate if any of you haven’t caught on yet…no one’s email address has been compromised, it is a PM sent to your account HERE and the account HERE is set up to send you an email when you receive a PM. NO ONE HAS YOUR EMAIL ADDRESS.
Besides, I haven’t been saying it’s secure, I said it would do better against this spammer.
This forum was not hacked, although there is a possibility it could be down the road since it’s out of date. I know that at least with phpbb every ‘minor’ (third number) version is released to fix one or more security holes.
the spam all came from one user, right? i don’t see why the admins can go in to the database and delete all of the PM’s that user sent. on other forums i frequent, they do that all the time when there’s PM spam.