The great Boards.ie hack in 2010

it could be but...

did you use your boards.ie username anywhere else? a lot of users use a familiar nick as their username and may have used the same nick elsewhere (many boardsies use their Quake player name for example because boards grew from the quake community originally)

Do you have any emails that contain your boards.ie username?

Do you have any emails registered that had that username in the address?

Have you ever signed up to any online service or product with that username either as the account name or given instead of your real name in the customer/user info section?

Do you have any documents on your system with that username (that would be bad if that were the source!) or is it part of your account profile on the machine you are using (if so it could be included as part of a cookie or some other website datamining measure performed through your browser)

so, yes, it is entirely possible that, four years later, someone is using data taken from that incident - either the original perpetrator or someone else if the data was shared online but more likely, unless the username was uniquely used for boards.ie , it is from a more innocent source that you may have overlooked as part of your security measures.

Of course, it could be none of the above and just be an old dataset crawled from boards' publicly accessible pages from a time when you used that username or from a thread that you posted to under that name pre-2010 that is still visible now. [edit: wouldn't explain how the email address was matched though unless you included it in a post and it got scraped]

I got an e-mail today using the user name I've only used on ask about money! Nothing boards related.

LynnGrace wrote: »

Same here, got one relating to AAM.

Again my email used my AAM username

Edit:

This is on the AAM site:

Today, users of Askaboutmoney received spam emails to the email address with which they registered at askaboutmoney. These emails were personalised to their Askaboutmoney user names.
“Dear “askaobutmoney username”, BETA-TESTERS NEEDED (Beginners Preferred) - registration ends on July 07, 2014”

We believe that, when Askaboutmoney, was hacked on 20th June, the hackers downloaded the user names and email addresses.Askaboutmoney runs on vBulletin, and as such, the passwords are “hashed”, so we don’t believe that they have accessed passwords.

What you should do now…
As a precautionary measure, change your password on askaboutmoney when we put it back up
If you use the same password on any other site, change that password as well
If you wish to change your user name, when Askaboutmoney is put back up, send a Private Message to Brendan Burgess with your choice of new name and your email address.

Again, we apologise for the breach of security.

Brendan Burgess

Admin note

Please don't post content that contains your (or someone else's) email address. its just going to get crawled and your end up with even more spam!

Same as a few others I got the email message also using my AAM user name which is different from my Boards nick.

I am trying to get to the bottom of this.

Has anyone received this specific spam today to a user name which they do not use on askaboutmoney?



Brendan Burgess
Administrator
Askaboutmoney

BrendanBurgess wrote: »

I am trying to get to the bottom of this.

Has anyone received this specific spam today to a user name which they do not use on askaboutmoney?



Brendan Burgess
Administrator
Askaboutmoney

Signed up to your site for the first time the other day and i DIDNT get the spam if thats any good to you. More proof it happened before that.

Askaboutmoney runs on vBulletin, and as such, the passwords are “hashed”, so we don’t believe that they have accessed passwords.

Your use of quotation marks on that particular word may not fill people with much confidence.

I received the quoted spam message today, at an email address I used exclusively for my AAM account (I have my own domain, so tend to give each forum I register with a unique user at that domain, to make it easier to track spam).

(Of course, having AAM in the email ID made me think I was being spammed by the excellent Ask A Manager blog - I haven't been on AskAboutMoney for a while.)

the people reporting the spam to us used the same username and email address combination on askaboutmoney as they did here.

The above (taken from your notice) is not correct as stated previously in this thread.

I got the spam email but I used a different nick and email on AAM.

Fuzzy wrote: »

Hashed but not salted, eh?

It would be both by default on vbulletin 3.

Agent Smith wrote: »

Randomly enough, I got a sms yesterday from "NewMessage" saying "You received a photo message, and to click some link sn.im etc to see me"

Now, I remember back in the day when boards had a tweet, thing, and You could enter your mobile.

Is it possiable they have gotten access to mobile numbers?

Wibbs wrote: »

FWIW AS I got the exact same text yesterday and I never gave Boards my phone number.

If that's the same one I got, it looks to be a fraud claiming to be from Dunnes and offering vouchers. Unfortunately the link times out quickly (or possibly can't be opened a second time). I have reported it to management and security in my local Dunnes, both of whom have sent it to HQ.

If you open this, please try and get a screen grab to show to Dunnes.

Im getting a shed load of mail undeivered lately from my email i subscribed to boards. Is it related?