User Accounts Hacked

[londonmitch]

We’ve had an issue lately where multiple user accounts have been hacked. Scammers are using the opportunity to post fake for sale ads. What’s the best way to combat this issue?

[Gary]

Hi @londonmitch,

This subject has come up a few times especially with the increase of people getting hold of email accounts all around the world. I am going to piggyback on Marc's post from June last year as a first step to see whether it improves things on your community.

1. Ensure you are using hCaptcha, rather than any other CAPTCHA type. It is the most advanced and effective at the moment.
   AdminCP -> Members -> Content Moderation -> Spam Prevention -> CAPTCHA
2. Ensure you have increased the sensitivity when you set up a hCaptcha account.
3. Ensure you have set up a Question and Answer Challenge (or numerous ones).
   AdminCP -> Members -> Content Moderation -> Spam Prevention -> Question and Answer Challenge

There is also an entire guide written about Spam Prevention here at Invision Community.

Here are some other topics that discuss an increase in spam found on some communities. You can find more by searching 'spam'.

[londonmitch]

Thanks, I’ll take a look at the guides. We’ve dealt with spam for years but easily combat it with first x posts require mod approval. This is new as they’re using long time member accounts to post the threads and using pictures from previous ads in our buy/sell/trade

[Gary]

I know it seems basic but they're the best options built into Invision Community to assist you in mitigating spam on your community right now.

The biggest concern are breaches of data from companies that hackers seem to be targeting all the time. Once an email address is compromised, they use it for spam or whatever other motive they have. Nine times out of ten these are older or inactive email addresses (at least to the original creator, but a candy store for hackers).

[Marc]

There isnt really much I can add to what Gary has already said, other than to say its likely that the users accounts have come up in a user/pass combination list somewhere, and they are using the same details for your site. However a couple of observations I can make about your site specifically that you should address right away

1. You are not using the latest release, and there have been security releases since the version you are using.
2. You are allowing username logon. Changing this to email only as advised in the ACP, will certainly reduce instances of what you are seeing

[londonmitch]

13 hours ago, Marc said:

There isnt really much I can add to what Gary has already said, other than to say its likely that the users accounts have come up in a user/pass combination list somewhere, and they are using the same details for your site. However a couple of observations I can make about your site specifically that you should address right away

1. You are not using the latest release, and there have been security releases since the version you are using.
2. You are allowing username logon. Changing this to email only as advised in the ACP, will certainly reduce instances of what you are seeing

Thanks. Will try both