TBH email database hacked?

[Lucha Ben]

FYI, the theburninghammer.com email database might have been hacked or otherwise exposed. I just received a Paypal phishing email sent to the email address that I used to register for TBH. This is the only site for which that email address is used. (And, actually I haven't used that address since signing up in 2009.) The address is not a common one that spammers could produce by simply guessing. There are other possibilities regarding how the spammers got that email address, but the most likely one is that they were able to get it directly from the board database.

As far as I can determine, the forged Paypal email was sent from server.wahaweb.net, a domain name registered in Dubai, United Arab Emirates. (The system itself is in the United States.)

[KATA HAJIME]

I will check with the admins about this, has any one else received any such emails?

[enforcer]

I just checked and saw that I got one too.

[Volture]

I just checked and I did not get 1

[eugene187]

can you please forward the email with as much info intact as possible (headers etc) to admin @ tbh? hopefully there is some sort of an explanation other than a a database exploit

i am not seeing any open bugs on the phpbb tracker relating to this, hopefully it is not something at a host level

-e

[eugene187]

this could possibly be the issue but i am unsure why it would be appearing now as previous updates were supposed to take care of it. http://www.phpbb.com/community/viewtopi ... &t=2100748

i will take this fix a step further and remove email addresses from our templates altogether

-e

[enforcer]

can you please forward the email with as much info intact as possible (headers etc) to admin @ tbh? hopefully there is some sort of an explanation other than a a database exploit

Done.

[Lucha Ben]

I forwarded my email, too.

FYI, the fake Paypal URL in the body of the message pointed to 3arb.net, a domain name registered to someone in Egypt.

[eugene187]

thank you for sending those over, not that i doubted you but i was curious. supposedly this bug has been taken care of in one of the recent phpbb updates there is no way of knowing exactly when the address was snagged, although i am guessing recently.

we are giving the whole board an overhaul and streamlining in preparation to move to yet another more powerful machine. i will make sure that any sensitive user info is properly obscured by at least 1 more level of authorization if not removed completely

open source sometimes is a pain in the butt

-e