has eqtraders been hacked (email attached)

[Pootle]

I got it as well.
Didnt follow the link as it was an obvious spoof email.

[tnexus]

Outrider (and also my account) was hacked as well. Don't see any harm done to anyone at least. Whoever it was I think is an EQLive reader since I was hacked shortly after I posted I backed up our Database.

[Jhavon]

Got one as well. -- I'm noting that all those who got the MSG are Dec02-Jan03 join dates, so far...cooincidence seems statistically unlikely.

[Egat Bearskinner]

I also received the email, I didn't visit the link as I assumed it was not a friendly website.

My email also blamed the supposed tradeskill nerf on a vocal member of the EQ community, which made me laugh.

[Lloren]

Most likely board software compromise...

Got the same here as well.

#--------------------------------------------------------------------------------------------
From mboardse@h30001.racknine.com Thu Apr 10 21:55:05 2008
Received: from k2smtpout04-01.prod.mesa1.secureserver.net (k2smtpout04-01.prod.mesa1.secureserver.net [64.202.189.166])
by darktech.dyndns.org (8.13.7/8.12.10) with SMTP id m3B1t2Z2020695
for <** my email **>; Thu, 10 Apr 2008 21:55:02 -0400
Received: (qmail 6353 invoked from network); 11 Apr 2008 01:55:01 -0000
Received: from unknown (HELO h30001.racknine.com) (208.109.125.28)
by k2smtpout04-01.prod.mesa1.secureserver.net (64.202.189.166) with ESMTP; 11
+Apr 2008 01:55:01 -0000
Received: from mboardse by h30001.racknine.com with local (Exim 4.68)
(envelope-from <mboardse@h30001.racknine.com>)
id 1Jk8Ti-0008B6-UQ
for <** my email **>; Thu, 10 Apr 2008 18:54:58 -0700
To: <** my email **>
Subject: TRADESKILLS ARE BEING DISCONTINUED
From: "admin@mboards.eqtraders.com" <admin@mboards.eqtraders.com>
Message-ID: <200804110158.b95fd4287313@mboards.eqtraders.com >
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Sender: <mboardse@h30001.racknine.com>
Date: Thu, 10 Apr 2008 18:54:58 -0700


(Edited: We didn't need the body, the headers are the important part.)


#----------------------------------------------------------------------------------------------------

Particularly note the headers: This message was sent via your board software from racknine.com. I suspect you do indeed have a compromise. There have been several compromises in vBulletin in the last few months: http://search.securityfocus.com/swse...shlastmodified

You may want to make sure your board software is up-to-date.

[eepjr24]

Another

Just posting so you can correlate join date ranges. No other info to add.

- Ernie

[Teriwyn]

Welcome, Teriwyn.
You last visited: 10-19-2004 at 06:25 PM

Odd that this looks to have hit mostly inactive/very old members... most of whom were long gone from the forums.

Posting to correlate my "join" date with everyone else's. I mainly came to the boards to find out what everyone said the URL was. I couldn't decide if I thought it was a rickroll, or a keylogger... but was actually leaning toward the latter.

[Breathe]

Just posting so you can correlate join date ranges. No other info to add.

- Ernie

Same here. ::hugs DenMum and Ngreth::

[Driin Blindaje]

I am in the same boat as the rest of these folks.

Miss you Denmother!!! its been about 4 years since I played eq but your site has always been the best of the best!

[Villordsutch]

Spammed me to with a Rick Astley video (oddly enough he lived 2 miles from me).

However good to visit an old board that helped me through my EQ days.

Currently however a WoWer (after 6 years of EQ)

Earthen Ring (EU), Alliance username Velor (61)

Still love trade skills (Cooking, First Aid, Fishing) (Skinner and Miner too).

Say 'ello if you are passing.

[Ngreth Thergn]

It looks like someone found a vulnerability in vbulletin, and used it to send this joke mass mail. It has happened on multiple forums, not just us.

As soon as I can I will update the forums to 3.6.9 (not a huge diff from 3.6.8)

[Bobaten]

Hmm.. is it the same Rick Roll as was posted by Rytan (or at least his account) on EQlive last night?
http://forums.station.sony.com/eq/po...28413&#1871994
If so he might want to change some passwords.

[Ngreth Thergn]

Dunno. But he does not have admin rights to this boards, so it was not through that.

these Boards have been upgraded from 3.6.8 to 3.6.9

[Kyrros]

LOL, tried to post my header, but it seems you were just now upgrading...

Probably a little late, but here's my header as well...

* * * * * * * * * * * * * * *

X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0x

X-Message-Status: n:0

X-SID-PRA: mboardse*AT*h30001.racknine.com

X-Message-Info: JGTYoYF78jFaLRSvESU9U9sDmeGDOqTz2O+Lja3tSjlfoDMjSj PuKhmVJ7GKmKvreyAGx3uYdDznWARAqnwCD0qWaeNi9aLg

Received: from k2smtpout05-01.prod.mesa1.secureserver.net ([64.202.189.56]) by bay0-mc3-f23.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);

Thu, 10 Apr 2008 18:57:38 -0700

Received: (qmail 11620 invoked from network); 11 Apr 2008 01:57:38 -0000

Received: from unknown (HELO h30001.racknine.com) (208.109.125.28)

by k2smtpout05-01.prod.mesa1.secureserver.net (64.202.189.56) with ESMTP; 11 Apr 2008 01:57:38 -0000

Received: from mboardse by h30001.racknine.com with local (Exim 4.68)

(envelope-from <mboardse*AT*h30001.racknine.com>)

id 1Jk8WF-0001pa-FB

for **** MY EMAIL ****; Thu, 10 Apr 2008 18:57:35 -0700

To: **** MY EMAIL *****

Subject: TRADESKILLS ARE BEING DISCONTINUED

From: "admin*AT*mboards.eqtraders.com" <admin*AT*mboards.eqtraders.com>

Message-ID: <200804110135.020357148506*AT*mboards.eqtraders.co m>

MIME-Version: 1.0

Content-Type: text/plain; charset="ISO-8859-1"

Content-Transfer-Encoding: 8bit

X-Priority: 3

X-Mailer: vBulletin Mail via PHP

Sender: <mboardse*AT*h30001.racknine.com>

Date: Thu, 10 Apr 2008 18:57:35 -0700

Return-Path: mboardse*AT*h30001.racknine.com

X-OriginalArrivalTime: 11 Apr 2008 01:57:38.0497 (UTC) FILETIME=[6B60AB10:01C89B77]

* * * * * * * * * * * * * *

Sorry for all the *AT*'s, but it seems I haven't posted a whole lot since the changeover to the NEW forum a long while back... LOL

[twistle]

*hugs* - you guys work so hard for us - cranky that folks are dumb enough to target you!

Mary