HACKED HERE ???

[Growing Coastal]

Just to let people know.
Noticed something odd today when I checked my gmail spam folder.
There is one there from 'Ernest Bryant' regarding my hacked password. It is one I happened to have used for the two tomato sites I visit TJ being the one I go to most frequently.
When I googled I see that it is a common porn or revenge photo scam. ie) pay or they'll post pictures we don't want shared.

Well good luck finding anything like that anywhere in my stuff!
Truly, tomato or hummingbird porn is all they'd get from me!
Fortunately, I don't do online banking and have a limited card for online shopping.

That email arrived Oct 21. I must have filed it as spam before reading the mssg. I just don't open anything from anyone I don't know.

The online advice is to change password and to have different pwrds for different sites.
Beware people! Who would expect to be hacked on a gardening site?

I'll also post this at other place.

[Growing Coastal]

OK. Now I am having trouble seeing how to reset my pwrd.

Log out and go to forgot pwrd? Is that the only way?

[MissS]

I am going to look into this and talk to Rajun.

[mention]Growing Coastal[/mention] You can change your password by going into your Control Panel. Click on your name in the upper right hand corner. There is a drop down menu and choose the control panel. Then find the tab that says 'PROFILE' and open that. Then on the right hand side open 'Edit Account Settings'. Once that is opened you will see a place to edit your password.

[Rajun Gardener]

I wouldn't try to reset the password here. I think someone hacked your computer and that's the problem. Do you have an antivirus program? Try that. I say that because they're sending you emails and it doesn't have anything to do with Tomato Junction but I will contact the anti spam service we have for this site and have them check into it. I don't know how long that will take but I'll start the process now.

You might want to try to log in on a different device with a different IP address just to confirm it's not this site.

[Rajun Gardener]

I just completed the support ticket and waiting on a response. I'll update when I know something.

[Growing Coastal]

Thanks for the quick replies.
In reading more about this one online I am seeing that it may have been an old hack from email (gmail?) pwrd.
Can't be my boring web cam that is focused on a feeder.
So, I'm just changing passwords for now. Getting a new computer fairly soon.
The virus scanner is on my computer more than I am!!! Slows the W7 down at times.

[rossomendblot]

You can check here - https://haveibeenpwned.com/ - to see if your e-mail address has been included in any hacked databases. If you haven't already, I would recommend setting up 2-factor authentication on your e-mail account(s). I also use a browser password manager like Bitwarden/Lastpass/Keepass to generate and store my passwords and never use the same password on multiple websites. For anti-virus I just use Windows Security and the free verison of Malware Bytes.

[brownrexx]

I don't believe that this is actually hacking. I think it is more likely a scam pfishing email. I have had this email one time and so has my husband on his computer. We simply ignored and deleted the email and never heard another word. However they did not know my actual password. If they listed your actual password I would just change the password on the two sites you are referring to and forget about it.

[Growing Coastal]

Right Brown Rex.
I have read that many have been sent a message regarding old pwrds they haven't used for 10 yrs.
Some have been sent several mssgs and have had no issues.
Easy to see online what those emails say. I didn't open the one I got.
google Ernest Bryant for the full text from a tech site that comes up 1st.
Targetting people who go to porn sites? Or just scaring people with that idea?
Not places I go to except on a false re-direct once years ago.

[pondgardener]

[mention]Growing Coastal[/mention] You may want to check your Contacts list as well, as they may have wormed their way into there. Any time I get a suspicious email with a strange address, I delete it and check my contacts, where I often find that their address has been added. And as others have mentioned, it is best to delete the email and don't respond, as that is what they are wanting you to do.

[Shule]

[mention]Growing Coastal[/mention]
Did they actually mention what your password was in the email? Any other private information? If so, I'd change your password right away (and don't use the same one as the other site). If not, brownrexx is probably right about it being a scam phishing email that you can just ignore. However, it's very unlikely that they got your password from hacking TomatoJunction (and I don't just say that because I'm a moderator, but because we use https and the passwords are said to be hashed with bcrypt on phpbb software, which pretty much rules out brute force attacks on the hash, should they break the https encryption).

Malware on your computer might have keyloggers to get your password as you type it. Or, it's possible that there's a phishing site that looks like TomatoJunction that you accidentally used instead (thus giving them your password when you logged in).

Hackers have lots of tricky methods. I mean, if they hacked your web browser or something, that complicates matters.

A secure password is pretty important. The less secure it is, the faster they can figure out what password a hash corresponds to. An excellent password may be very helpful even if the hash algorithm is an easy one to crack.

As others have said, don't respond to the email. The less they know about you, the better.

I would suggest making your new password secure. Don't use actual words or names in it. Make it a reasonable length (the longer it is, the more secure it is). Mixed casing helps. Using both numbers and letters helps. Other kinds of characters besides alphanumeric characters help. Choose a password that no one would guess. Use a password that no one else in the world likely uses.

[Shule]

[mention]Growing Coastal[/mention]

I just checked, and it looks like you're one of the first members to have joined TomatoJunction (even before me). So, we didn't have https at that specific date (although I know we had it soon afterward). If you haven't changed your password since then, it might be a good idea, just in case they got it before we had https, and just took a *really* long time to contact you about it.

[Growing Coastal]

I did change pwrds. My techie says my choices are good.
Had a bit of trouble logging in this morning but here I am, now.

That scam is a phishing email scam.
I will check that the name didn't go to my contacts list in email. Good tip.

More about the scam here. It might be confusing if someone else lived here. We'd both be accusing each other of visiting porn sites! Not somewhere I go and my web cam is focused on a hummingbird feeder.
Once I read the details I knew it was nothing I did.
Delete and ignore.
https://krebsonsecurity.com/2018/07/sex ... t-page-18/