RMT Framing

[Kestrel]

We do see a password change (that did not trigger the normal email verification link) that was done with the IP of the same operator who first logged into your account. This PW change was done after they account was already logged into, which in our current system bypasses the need for email verification.

Whomever did this account takeover used your password on the website (at 08:16:10 on the day of the attack), then updated the password presumably to ensure you could not kick them off while they cleaned out the account. Then you discovered this and reset the password again at 12:57:02 essentially reclaiming control of the account.

During our initial setup of this project we had some issues with email services blocking for spam which necessitated using each accounts password as proof of ownership, however now that our email service appears to be in a more stable state we will be shifting that proof of ownership to the registrants email. This means that in the future password changes will all require an email verification.

We will start looking at enabling 2FA as well for those who wish to opt into it, although I don't think it prevents an issue like this as people sharing accounts would not likely want to exchange 2FA codes every time they swapped.

[Icantkite]

interesting....:pregnaros: