NCRS Members emails addresses being hacked

[Kevin G.]

Re: NCRS Members emails addresses being hacked

Thanks Don. Ticket has been submitted

[Kevin G.]

Re: NCRS Members emails addresses being hacked

My issue with logging on to the NCRS.org site has been resloved thankfully by Mr. Wagoneer. For future reference it was this email that I received that caused this problem. I had attempted to copy paste the entire page and post it here, which must have opened the message. These unwanted emails are a real nuisance, I hope to find a way to end them?

Thanks to Don and John for the assistance.

[Don H.]

Re: NCRS Members emails addresses being hacked

Wonderful Kevin. There is harmony again in the world, or at least in your world. If you can figure out a way to stop the hacked address book emails, I would love to know what it is. I get them a couple times a week it seems and I have not heard of any way to stop them. They are pretty easy to spot for what they are, and I always simple move them directly to the junk box. Carry on...

[John W.]

Re: NCRS Members emails addresses being hacked

As most of you know you can not access email addresses from the Technical Discussion Board. If you are not logged in you don't even see the full names of posters. You can send an email through the forum if you are logged in. It doesn't show you the email address it is being sent to but it does include the senders email address in case you wish a reply.

Private messages on the other hand don't even have the senders email address. You get an email telling you there is a private message. It asks that you not reply to the email but follow the link back to the forum and the message that is stored here. I only get ten replies to these emails a week. I have a canned response asking people to follow the link back to find their message.

There are a thousand tricks the spammers use to harvest email addresses and we have as many of those tricks blocked as possible. I can not guarantee that the addresses weren't hacked from here I seriously doubt it. I for one didn't get a slew of them.

As far as getting blocked from the website. If you get a 404 or 403 error and keep doing whatever caused it you will get blocked after 3 failed attempts. This is to protect our server from the countless hack attempts we get every day. If you are blocked you will not be able to get to any page of the NCRS site. Go to www.ncrs.org and you will get nothing. Assuming our server isn't down which is unlikely but not impossible your blocked. You will need to try your cellular access or a neighbor or friends computer to fill out a Helpdesk ticket. It is best if you first go to Google.com and do a search on "What is my IP?". This will return a series of numbers from one to three numbers in four groups separated by periods such as 192.168.1.128. Put that in the Helpdesk ticket for quicker action. If you don't have alternate access you can call me at 317-736-4263 EST. If I am not available I will get back to you as quickly as possible.

[Kevin G.]

Re: NCRS Members emails addresses being hacked

As most of you know you can not access email addresses from the Technical Discussion Board. If you are not logged in you don't even see the full names of posters. You can send an email through the forum if you are logged in. It doesn't show you the email address it is being sent to but it does include the senders email address in case you wish a reply.

Private messages on the other hand don't even have the senders email address. You get an email telling you there is a private message. It asks that you not reply to the email but follow the link back to the forum and the message that is stored here. I only get ten replies to these emails a week. I have a canned response asking people to follow the link back to find their message.

There are a thousand tricks the spammers use to harvest email addresses and we have as many of those tricks blocked as possible. I can not guarantee that the addresses weren't hacked from here I seriously doubt it. I for one didn't get a slew of them.

As far as getting blocked from the website. If you get a 404 or 403 error and keep doing whatever caused it you will get blocked after 3 failed attempts. This is to protect our server from the countless hack attempts we get every day. If you are blocked you will not be able to get to any page of the NCRS site. Go to www.ncrs.org and you will get nothing. Assuming our server isn't down which is unlikely but not impossible your blocked. You will need to try your cellular access or a neighbor or friends computer to fill out a Helpdesk ticket. It is best if you first go to Google.com and do a search on "What is my IP?". This will return a series of numbers from one to three numbers in four groups separated by periods such as 192.168.1.128. Put that in the Helpdesk ticket for quicker action. If you don't have alternate access you can call me at 317-736-4263 EST. If I am not available I will get back to you as quickly as possible.

Hi John,

The additional information you just added to my post, I hope will be helpful to future readers. There is no question to the fantastic abilities and security methods you fellows have spent tireless hours developing. No doubt, many problems have been diverted by the security you have put in place.

I am certain that these emails derive from a mailing list that consists of NCRS members. If helpful I would be happy to forward the next email like this I receive. Only, if it does not cause any issues! Please take note there have been a couple posters here that have been experiencing the same problem.

Again, thank you.

[John W.]

Re: NCRS Members emails addresses being hacked

Kevin,

If you could send me one of the emails it might help. There is information in the header of a message that can give some clue as to where the mail originated. Don't forward it. Open an email to me and then drag and drop the spam email into that email. That way the header will be intact. If you just forward it the header will only contain your sending information.

[Kevin G.]

Re: NCRS Members emails addresses being hacked

Hi John,

I understand your direction and will be happy to give assistance or accept yours which ever may be the case.

Thank you

[Michael W.]

Re: NCRS Members emails addresses being hacked

This is a very generous effort on the part of John, but may be somewhat ineffective in having any lasting effect.

It's probable that the source of the problem is some person somewhere, possibly not even an NCRS member or a visitor to this site, that has a computer that has been hacked. Viruses that steal a person's email address list for the purposes of generating spam or spreading more viruses are extremely common, with most owners being completely unaware as the machine seems to operate without visible fault.

Trying to determine who that person might be, contact them, convince them they have a problem, get them to fix it and install some anti-virus software to prevent a repeat occurrence is pretty difficult. More often that not, the person listed as the sender of the email is NOT the guilty party.

Good luck.

[Kevin G.]

Re: NCRS Members emails addresses being hacked

Mike,

Let's not jump to any conclusions before John has a chance to review the messages. Not saying your wrong, but at this point it is exactly that an assumption.

Any effect in a positive direction will be of assistance to me. The purpose of the original post was done here knowing the abilities of our IT team.

You're welcome.

[Gary C.]

Re: NCRS Members emails addresses being hacked

FWIW - TDB visitors and non logged on members do not have any access to; member's last name, member's profile or the TDB Community member's list, nor can they access the "who's on-line". Rob restricted visitors access to member information a couple of years ago.

Gary
....

[Rick A.]

Re: NCRS Members emails addresses being hacked

The email SOURCE information is what the HELP DESK will really need to be of any use to get to the bottom of where these hacks are coming from. So, what needs to happen, when you think you have received an email hack is to FORWARD the email just as sent.

[Kevin G.]

Re: NCRS Members emails addresses being hacked

Hi Rick,

Nice Camaro!

Thanks for the post, but your's in contradicting Mr. Waggoner's advice? I'd hate to cause any issues to another person! So, if and when I do receive another suspicious email I'll update here and ask who ever is to receive it how they want it sent. Including you if you'd like?

Thanks for helping Rick!

[Gary C.]

Re: NCRS Members emails addresses being hacked

Guys,

What John needs is the email Internet Header information.

Below are instructions on how to obtain that information just in case attaching and forwarding doesn't do the job.

Gary
....



Outlook 2010

• Double-click on the email message for which you want header information and select the File tab
• Click on Properties box on the bottom right
• Right-click in the Internet Headers box and pull down to Select All
• Right-click again and select Copy
• Click on the Close button to return to your message
• In your email message, click on Forward and a new window will appear
• Right-click in the message area and paste the headers into the message before forwarding it.

Outlook 2007

• Right-click on the email message (while in your list of messages) and select Message Options...
• Right-click in the Internet Headers box and pull down to Select All
• Right-click again and select Copy
• Click on the Close button to return to your message
• In your email message, click on Forward and a new window will appear
• Right-click in the message area and paste the headers into the message before forwarding it.

Outlook 2003

• Open the message by double-clicking on it.
• In the message window, choose Options under the View menu, where you will see the headers.
• Copy the headers and paste them in a new email message.

Mac Mail

• Open the e-mail message
• In Lion Mac Mail, go to the View menu and select Message --> All Headers.
• In Tiger Mac Mail, go to the View menu and select Show All Headers.
• In Leopard Mac Mail, select Raw Source under Message.
• Cut and paste full headers into a new email message.
• Remember to return to the simple headers, select Show Filtered Headers from the View menu.

Thunderbird

• Click on the email message to view it.
• Click on the View pull down menu and select Message Source.
• A new window will appear displaying the full unformatted message.
• Click and drag the cursor in the headers to select the text.
• Copy the selected text and then paste in a new email message.

• Select the text to copy with your mouse by clicking at the start of the header and dragging until the entire text is highlighted.
• Now press Ctrl-c to copy the selected/highlighted text to the clipboard.
• Next go to the NCRS Help Desk www.ncrs.org/helpdesk/ and open a new ticket.
• Then press Ctrl-v to paste the copied email header into the ticket text box.
• Complete the rest of the Help Desk ticket information.

[Rick A.]

Re: NCRS Members emails addresses being hacked

Gary - Which is the SOURCE email information I referenced - you just expanded, and gave all the "useful / helpful" information on how to do it

[John W.]

Re: NCRS Members emails addresses being hacked

I just got two of those emails today with a well known members name as the sender. I dissected the header information and found that is was sent from jbolanos@mdv1.com hosted by inmotionhosting.com not the members email address or hosting company.

The list of recipients included a lot of familiar email addresses and some that were probably personal and not connected to NCRS.

It also slipped through my loose spam checker and had valid DKIM and SPF records. That means it may have been sent from a legitimate persons machine without his/her knowledge.