Somebody changed my password and password reset feature doesn't work properly

[Kevin Ouellet]

I am unsure if this is related to the recent hacking of Omnimaga and Revsoft (there were attempts on Ticalc.org, CodeWalrus, Cemetech and TI-Planet as well), but somebody changed my HP Museum forum password.

Also, the password reset on MoHPC doesn't work properly: It took me two tries before it finally sends me a password that actually works.

The hacker who attacked those sites used the following IP addresses: 90.11.159.131 and 80.119.166.103 . Could a MoHPC admin run some server/forum scans to see if they are in the logs and if any suspicious activity has occurred recently?

I would also recommend any member here who got an account on Omnimaga and Revsoft to change their passwords anywhere else where they use the same password as there.

[Massimo Gnerucci]

(12-08-2015 07:15 PM)Kevin Ouellet Wrote:  I am unsure if this is related to the recent hacking of Omnimaga and Revsoft (there were attempts on Ticalc.org, CodeWalrus, Cemetech and TI-Planet as well), but somebody changed my HP Museum forum password.

Also, the password reset on MoHPC doesn't work properly: It took me two tries before it finally sends me a password that actually works.

The hacker who attacked those sites used the following IP addresses: 90.11.159.131 and 80.119.166.103 . Could a MoHPC admin run some server/forum scans to see if they are in the logs and if any suspicious activity has occurred recently?

I would also recommend any member here who got an account on Omnimaga and Revsoft to change their passwords anywhere else where they use the same password as there.

Same passwords. Really?
;)

[Katie Wasserman]

(12-08-2015 07:15 PM)Kevin Ouellet Wrote:  The hacker who attacked those sites used the following IP addresses: 90.11.159.131 and 80.119.166.103 . Could a MoHPC admin run some server/forum scans to see if they are in the logs and if any suspicious activity has occurred recently?

I can only check for users that logged in and/or posted from those IP addresses, there are none. Perhaps Dave can check for attempted logins.

[Dave Hicks]

I don't see anything from those IP addresses. I'm guessing the password confusion falls under the "Lost Password Confusion" here.

It causes enough confusion that a thread about it showed up on the myBB support forum, but I think it ended with one of the developers saying something like: Unfortunately, there's not much we can do about people not reading the emails. Which is true I suppose but it seems like something they could improve and might someday. But for now I think if you read them and follow the instructions carefully, they seem to work.

[Kevin Ouellet]

Actually I entered the password from the e-mail sent after entering the activation code. Thankfully the last password I got worked as you could see, but I thought I would point it out in case.

That still doesn't answer why my MoHPC password was changed in the first place, though, and I know my e-mail address was not compromised.

[Dave Hicks]

When was the password changed?

[debrouxl]

If the account takeover was part of the recent attacks on multiple sites mainly targeting TI calculators, I'd say no earlier than December 3rd or 4th. On other sites, the issues started and were noticed around December 5th.

[Kevin Ouellet]

(12-09-2015 04:11 AM)Dave Hicks Wrote:  When was the password changed?

Is there any way to check on MyBB when users changed their profile settings or modified posts? I personally don't know when my password got changed, since it has been a few weeks since I last visited MoHPC, but the Omnimaga/Revsoft attacks occurred on December 3rd or 4th, like Lionel said, then two or three days of account or server hijacking attempts occurred on other prominent TI websites.

[Dave Hicks]

You had the original password on your account until May 2014. From May 2014 it had the same password until Dec 8th 2015 - but that would be the change we all know about.