May be time to change your password/user name

[Ed]

We've had some unusual activity over the past couple of weeks, and I've just caught what looks like a brute force attempt to hack passwords from bots at twelve different IP addresses, and counting:

199.48.147.36
109.169.29.56
66.8.120.130
62.141.53.224
62.193.228.18
137.56.163.46
137.56.163.64
204.244.252.34
95.26.41.56
192.251.226.206
87.118.101.175
199.48.147.38

They are targeting the accounts of regular members and trying to guess your passwords. Now, part of the reason for me recently upgrading the forum was because a password/permissions related vulnerability was discovered in the forum software, so it might well be that this attack is an attempt to exploit this vulnerability that no longer exists.

What you might want to do, which will make life more difficult for these agents of despair, would be to change your 'Username', which can be different from your 'Displayed Name', so basically you can keep your display name unchanged, but change your login name. Go to your profile page, then in the left hand column click Account Related Settings, and you'll see an option right at the top of the list to change your Username. Only you (and I) can see this name, so when the bots come along and try to log into your account, they will have their work cut out to even find the right Username to start with. I urge everybody to make the change, because it's only a matter of time with dozens of attempts per day before they get lucky and hit on the right password for an account, especially if it's something silly like 'password'

Edit: Send me a PM or e-mail with the 'Username' you would like to use, and I'll change it for you. The forum will notify you of the change and reset your password at the same time -- you're free to change the password to whatever you want as soon as you've logged back in.

Here are some screen captures I took, showing the level of activity. There are pages upon pages of these attempts. I exclude the IP addies as they come up, but I get the impression there are lots of them.

[Rook]

What you might want to do, which will make life more difficult for these agents of despair, would be to change your 'Username', which can be different from your 'Displayed Name', so basically you can keep your display name unchanged, but change your login name. Go to your profile page, then in the left hand column click Account Related Settings, and you'll see an option right at the top of the list to change your Username. Only you can see this name, so when the bots come along and try to log into your account, they will have their work cut out to even find the right Username to start with. I urge everybody to make the change, because it's only a matter of time with dozens of attempts per day before they get lucky and hit on the right password for an account, especially if it's something silly like 'password'

Okay, call me a technological idiot (I freely admit it), but I can't find it.       I can find my username and displayed name, but can't find how to change it...  Will someone please help this fool? HELP!!!   

[Ed]

It should show up below the word 'Username:' as (change). But it is possible that I'm the only one who sees that, because I'm the administrator. If that's the case, PM me with the name you want put there and I'll change it for you. Make sure your e-mail address is up to date, though, so I can stay in communication with you if anything goes wrong, such as you forget your username

Sorry for the hassle.

[Ed]

BTW, we're up to 18 different ip addresses trying to hack us now. Here are the latest ones:

77.109.139.87
193.198.207.8
91.121.88.203
199.48.147.45
192.251.226.205
91.121.152.114

[Rook]

It should show up below the word 'Username:' as (change). But it is possible that I'm the only one who sees that, because I'm the administrator. If that's the case, PM me with the name you want put there and I'll change it for you. Make sure your e-mail address is up to date, though, so I can stay in communication with you if anything goes wrong, such as you forget your username

Sorry for the hassle.

1-- still can't find it.  (= could be me!)

2-- PM sent. 

3-- Not a hassle. 

4-- Thank you! 

[Ed]

Thanks for being the pathfinder, Rook -- I'll change the initial post to reflect what we've found out between us.

If anybody wants me to change their Username for them, send me a PM or an e-mail. Don't disclose your password to me or anybody else.

[Rook]

Thanks for being the pathfinder, Rook -- I'll change the initial post to reflect what we've found out between us.

More than welcome, Ed. 

Mission accomplished, BTW! Nasty bots will have problems now! Bahhahahahahaha!

[Ed]

I hope so

[Ed]

Now we're up to 26 bots. Latest IP addresses are:

94.23.215.184
91.121.249.246
91.121.170.32
83.142.228.14
80.73.242.130
173.193.221.28
199.48.147.4
87.106.138.84

I block them as they come up, but there could be hundreds of them. It seems they have at least one IP range of 255 addresses all to themselves. I'll just keep plugging away at it, though. Add it to my list of daily chores

[marc_chagall]

Done. That was painless. Thanks Ed!

[leatherdykeuk]

Thanks Ed

[Ed]

No problem Thanks for taking the time to get it sorted out

[carcharor6]

Thanks, Ed!

[Ed]

I hope I'm not speaking too soon, but it seems like bot activity has dropped off dramatically. Let's hope it stays that way

[Pharosian]

Thanks, Ed!

Even if bot activity has dropped off for now, they'll be b-a-a-a-a-ck!