New password for Badmovies.org Forum

Allhallowsday · August 05, 2012, 11:42:40 PM

What is this? I received an email, the text of which is copied below. I've not forgotten or ever changed my password:

Dear Allhallowsday,

This mail was sent because the 'forgot password' function has been applied to your account. To set a new password click the following link:

http://www.badmovies.org/forum/index.php?action=reminder;sa=setpassword;u=1302;code=71c931c9b5

IP: 201.73.178.98

Username: Allhallowsday

Regards,
The Badmovies.org Forum Team.

bob · August 06, 2012, 12:46:09 AM

I got the samething.

dean · August 06, 2012, 01:09:37 AM

Same here. Looks like someone's trying to join the fun.

dean · August 06, 2012, 01:11:24 AM

Same I.P too. Incidentally some should move this to the trouble tickets so it gets attention

Psycho Circus · August 06, 2012, 04:05:17 AM

Me too, just found it in my spam inbox.

Trevor · August 06, 2012, 04:38:07 AM

I received nothing like this but it is a bit weird.

Andrew · August 06, 2012, 06:51:46 AM

This was someone trying to brute force guess some account passwords. When that didn't work (the system only allows a few before it temporarily locks out more attempts) it appears they, for some reason, used the forum's forgot password function.

Two possibilities exist. One is that they hoped the lost password function would allow them to guess a secret phrase and still gain access to the account. The other is that the attack was carried out by a piece of software, and either by nature or setting it resorts to the lost password function.

The attempts came from a ISP in Brazil. None of them gained access to any account. I've now put a permanent block in place, but that's just a temporary measure for anyone who really wants to get into an account. Please always use a strong password that will resist attempts to guess it.

Allhallowsday · August 06, 2012, 09:00:43 AM

Thank you Andrew.

In future, I will post any such problems in the Trouble Ticket section; I didn't even think of it.

Flangepart · August 06, 2012, 06:15:09 PM

Thanks for the heads up, guys.

BoyScoutKevin · August 16, 2012, 05:28:39 PM

Not to belabor the point, but I got the same message, but it is good to know I am not going mad, as I did wonder if I had asked for a new password, but when I was able to log one with the old password, I just ignored the message.