Topic: harizen - ban appeal (Read 890 times)

Although OP isn't technically permanently banned because his account is locked for security reasons, I wouldn't make a suggestion like creating a new forum account. I am not sure if it's against the rules. Owners of permanently banned accounts can't participate in forum discussions any longer. Not sure how admins look at locked accounts, and if the right recommendation shouldn't be to wait until you know where you stand.   

In the scenario you gave, it seems as though the OP has suffered twice.

Firstly, the (alleged) hack and second being him not being able to restore his account in the forum. If the forum admins cannot be sure, they will not allow him access to the account. As he will probably not be granted get access to his forum account, it is advisable for him to at least re-register in order to start building up his new account. Though it will some take time, he will eventually make it on to a signature campaign and can start looking forward rather than back at what he lost.  

For now he is probably very busy dealing with the other issue related to the hack about whether his personal documents and programs were compromised. Going through events such as these is a nightmare I would not wish on anybody.

It's unfortunately too late to do that in this scenario because the breech already happened, and unless OP already has such a signed message, it's not going to help him to prove he is the original owner by signing a message now. He can prove it by signing a message from any address he posted in an unedited Bitcointalk post prior to the hack, though.

An additional problem is that the admins are probably trying to figure out if the account was hacked or if it was the user who posted those infected files. It's unlikely it was the real harizen, but it's still an offence that warrants a permanent ban for the person who did it. That's why this case isn't a simple incident of someone having his account stolen and losing access to it. Content that is against the forum rules was posted from that account.

Harizen was a part of a campaign I managed. Seems unlikely that he would have done this and so I believe his story about being hacked. Hopefully his issue doesn't get ignored and he regains access.

I assume if he was hacked there's atleast some indications of unauthorized access.

That's what I also thought and I also believe that if harizen gets access to his account once again and comes makes a thread from his own account in reputation board or at least make a simple post here by confirming that he has got access to his account and he's the one handling the account then I believe that the ones who left those tags will have no hesitation in removing those from his profile.
Definitely if an hacker can get access to someone's system then they can do all sort of such things with that person, but the accounts of the forum can be logged in remotely if the hackers somehow gets knowledge about the e-mail and password of the account. But, yeah if the whole system of a user a compromised then surely the hacker can see the wallet information and in that case he will be able to steal the balances of the user easily. I thing a user who's well aware about wallet security will not save his/her wallet information on a internet connected device but surely most people don't care about hackers and that's one of the cause of them being hacked.
I doubt that he even needs to create a new account because a new account won't be helpful for him as ranking up a new account and making that many posts as the OP has made isn't an easy task. The @OP has more than 16k posts on his original account and it would take him at least 2-4 years to make that many posts or even get to a rank like that. However, I totally agree with you that one the user gets access to his account then those reputed members of the forum will surely remove their tags.

The best course of action as far as proving account ownership is concerned is for the member to at least stake a bitcoin address. That way, if the worst should happen and the forum account is compromised, it should be relatively easy to sign a message and have access to the account returned. If becomes a different scenario if the computer was attacked because there is a possibility the wallet information (as well as BTC balances) could have been compromised.

I also noted the OP has not been online for over a month using either of his two known accounts but that does not mean he has not created a new account. Maybe he is already back and would like to keep the new account private and not associate it with his past. I cannot recall interacting with the OP but if he does get access to his banned/stolen account granted, I hope the tags will be removed.
 

Perhaps it's not as easy as you think. He did add some other code that PowerGlove created relatively quickly. This time, though, that's not the case. Perhaps the code fixes one issue, but creates three new problems in a live environment.

No, OP was never banned. The notification banner on his account says that it got locked for security reasons.

Of course, they will. No one is punishing the user. The flags and negative tags only serve as a warning to other members not to trust or use anything the account posts until it's back in its rightful hands.

I have visited his profile and I found that DirewolfM14 has an active flag against harizen and he has also left a negative tag on the user's account. I hope that once OP comes back and makes us sure that his account is unbanned and is safely controlled by him not someone else then you people can remove those tags from his profile.

I know sometimes it would be hard for such users and they can face huge issues even if they get their account back because some members still might consider the account as hacked one, and they might not remove the negative tags that they have left.

So far the guy hasn't been active on forum for at least a month now and I hope that everything is going right on his side because sometimes people can have other issues then the forum's related issues and that can be a reason for their absence.

The OP created this harizenbanappeal account to appeal the ban and his last login was on 17th October 2023. It seems as though the OP might have given up because there is no effort on his part trying to claim/reclaim the harizen account. If that is the case it is a shame because members losing their accounts as a result of hacking should not be penalised is this manner.

Most probably their computer was hacked therefore wallets and many other things not even related to this forum could have been compromised. I hope the OP manages to get his forum account back and protect his computer from further attacks.

These things sometimes make me scared of losing everything... I'm freaking out rn!
It's advisable for everyone to please keep safe - these dudes ain't joking about it no more.. it's either they get you or the keep trying... For this reason, I don't click no links in here except it's a trusted one.

---

The 2FA patch could evade all this mishap. I can't tell how I'll feel if it were me.

Sandra 🧑‍🦰

I and BABY SHOES was the one that reported the Fake Ann with malware post/thread that was made from the Account " harizen "
Mostly they installed / or downloaded that Malware Links or got on a phishing site.
For sure in the background maybe there is still something going on.
From https://bpip.org/Profile?p=harizen it shows that he is not banned.

If he is already unbanned i will remove my Feedback but he has to write here before i am doing that.

It's really the time for theymos to patch this new update. I wonder what's keeping him to implement 2FA on bitcointalk. It's almost 2024 now. Adding a extra layer of security won't do any harm, will it? Every other forum/community/platform supports 2FA nowadays, but we are still living in stone age. Lol 

Everything points to OP being hacked and someone else using his login credentials to post that malware-infected software. The question is, how?
There are over 1000 results on Ninjastic Space if you enter R*****X (I don't want to enter the name and give importance to it) with the same or similar ANN that was posted by harizen' account. Most of them date back to March 2023. 

The OP has not been active practically since the beginning of this topic and has only written 3 posts, yet he is someone who should be most interested in getting his account back. However, maybe the case is not quite as simple as it seems to all of us, so regardless that the OP signed the message and did everything that was needed, I wonder if the IP addresses were checked and if they show real hacking or if the OP and the hacker maybe used a VPN/Tor, which then makes the check useless.

Based on the lack of Harizen's activity, seems like the latter. I really thought that it was a pretty clean case of hacking and that he will regain the access easily but it looks like I was too optimistic abouyt this and I can't wait for theymos to approve that 2FA that @PowerGlove is working on.


+1, it makes absolutely no sense to do that unless account was hacked.

How far with this case? There was never an update.

Was the member unbanned, or the mods just let it be and the person appealing the ban gave up?
Personally, I think OP was genuinely innocent and got hacked.

It has to be something worth it since some hackers are smart enough to be able to tell when someone keeps tabs on them; they will not bail out for a small sum; instead, they will wait for the big drop before walking away.

This is not the first hijacked account this year; I believe the hackers are becoming smarter, and only 2FA can completely shut them down.

There was a few Users that something similar happened to them and i helped to recover them or assisted them on the way.
But nobody can say how long it takes to recover them as it is a case by case thing for every Account.
Sometimes it takes only 1 or 2 Weeks , sometimes longer , he has just to wait now and follow the steps from the Account Recovery Team. 

Sometimes we make sure that all these security requirements are duly followed but we forget that firstly password needs to be strong enough and not easily guessable. I hope you have kept a stongest password for the account so it cannot be guessed by any hacker.

Also i can understand your situation as how you would be feeling with your account locked with none of your mistakes. I hope things are settled quickly and you get back access of your main account soon.

I'm confident that the account of Harizen will be recovered, he is a valuable member of the forum so I think he'll be considered. Judging on the case of LogitechMouse, the recovery period was only 8 days, or less than 2 weeks, so hopefully soon we wil see some good news coming from Harizen's account saying "hey I'm back" kind of deal.

Yes, there is one, My Account - LogitechMouse has been hacked and locked.

Similar in nature, hacker didn't change the password, but instead posted some malicious links and someone caught it, reported his account and the recovery team was able to get it back for him.

Just scary though, I mean I thought that this hacking of accounts here has been reduced since the introduction of merits as it's useless to hack someone and used or sell it. But the criminals have evolved as well, not to change the password as not to aroused suspicions and instead try to PM or create a thread that has some malware on it.

I remember there is, but in a different case, and luckily it wasn't banned even though the account posted a scam website until the account was recovered quickly.  It's also come from our country but I forgot the name.
This case seems worse because the hacker posted malware links which is a bannable offense.

I'm just curious how the hacker obtained the OP's details and logged into his account.
I've been here in the forum for many years and never changed my password from the start because I know I'm using a safe device.  So now, to prevent incidents like this, it's important to know what's the reason for getting hacked or getting your account compromised.

Mate @harizen, I hope for a fast recovery of your account.
I think you have a high chance of recovering it.

Damn that sucks OP. Imagine one day logging in and in the last few hours a lot has happened... Account got hacked, post some malware and got banned by the mods. I think I have seen some other user in kind of situation before. His appeal fell on deaf ears/ or blind eyes.
I hope you manage to recover your account, OP.

Just out of curiosity, is there any member in a similar situation who has ever managed to recover his account and get unbanned?

You are right, boss. Those hackers are very sensitive and experienced in the sense that they equally know that if they try to steal a forum member's account, they will not be able to prove themselves as the real owners of the account, because definitely the forum will ask for a signed Bitcoin message through the wallet that they have already used on the forum. Crazy things are happening these days, pioneered by these hackers, who always want to reap where they did not sow. I also saw the case of a member on this forum whose account was accessed and was used to collect a $1000 loan from Shasan. In that same case, there was no change of password on the victim account.

@Harizen, Things like these happen more often these days, and the way to prevent them is to always be cautious of activities, websites, apps, and programs that you run on your device. I wish you luck in getting your account back.

The Account got compromised or hacked without any doubts and its proven already with that ban appeal here.

You need no idea on how to recover your account when something happend to it like this.
Its clearly stated here how and what you have to do Recovering hacked/lost accounts
From there on nobody else needs to know whats going on between the Recovery Account Team and the User for security reasons.

I can vouch for Harizen as one of the reputable users in our local community, so I was surprised that his account was banned. I'm sure the account was compromised. Hopefully, @kabayan, you will be able to get some help to recover your account. I'm following this thread, so I can also get some insight into the current situation. If it's resolved, at least it will give us an idea on how to recover our accounts if they're compromised.

I will post the situation in our local community. Perhaps you'll also receive some advice from users there.

Yeah I was talking about him and I was secretly hoping he might pick up and speed up development of EpochTalk
Even if that scenario never happens, he did a great job of fixing bugs and improving current software, but he can't turn grandma into young girl again.  

It seems like your account was compromised by the hacker, it created a thread on the same day too base on your trust summary of your account, ideal if you have the fully security with your email so you can recover your account. I encounter someone to access my account I recommend making a daily check with the IP address where you login most of the time. this gives you a heads up immediately if someone takes your account and use the telegram bot notification so every message you will be aware. good luck in your account recovery. Hoping sooner or later there's a 2FA develop so there's another layer of security.

dkbit98 implied about PowerGlove who developed many SMF patches recent months and some of patches were approved by theymos.

He is in developing 2FA patch for the forum: A concise 2FA/TOTP implementation (SMF patch).

No information, sneak peek from PowerGlove about his plan and contribution for EpochTalk new forum software.

Yow . IIRC, they gave an email where I need to recover my account, then waited for a week until they responded with a link where I can reset my password there.
At least that's what I remembered. Don't panic though. @Lafu already said that your account will be back, and he helped me alongside other users here to recover mine, so you will recover yours - much faster than I am I guess.

OP, Maybe you should try contacting Cyrus directly via Discord. I got the impression that he is more up-to-date there on PM than here on the forum.
Here is ANN and the invite link.


Does this good developer also develop epochtalk forum software? I'm afraid it won't be so soon 

Did you receive any PM in forum recently, and did you click any links?
Most likely you gave hackers your login details with some phishing page that looks almost identical to original bitcointalk forum.
Maybe you accessed forum from different device/location, and all it takes in few seconds for something like this to happen.
If you are using wind0ws, consider switching to Linux OS (Debian, Fedora, Mint) to reduce chances of getting malware.

PS
One good developer is working on adding 2FA on bitcointalk forum, so I would also use that in future when it get's introduced, as additional protection.

After reading the whole thread and all replies of it I can say that @OP's account was compromised in a way that's not yet determined. The OP confirmed that he didn't install any plugins, extensions, and other software that can be downloaded from unknown sources, but sometimes we mistakenly download software from trusted sources or extensions from the Chrome web store and trust those extensions and software blindly but they may contain malware inside them without our knowledge. The other thing can happen when someone downloads an open-source software in exe format as that one is already compiled as we are not sure that how it was compiled that's why we can still be at risk. Most of us don't really compile open-source software ourselves and we just download those software by thinking that they are open-source and safe.

@OP I recommend you to back-up all of your essential data and then wipe out all drives of your pc. After that you should install a safe Linux distro on your system instead of using Windows operating system because Linux distros are much safe as compare to Windows OS. That thing will at least secure you from the hackers if they have installed a malware in your system. Other than that I suggest you to change password of your e-mail account which you use on this forum because if someone has access to your e-mail account then that hacker can do even worse things with your other accounts on different platforms where you used the same e-mail to register your accounts.

I hope that soon you may get access to your account on forum once again and you may post from your own account. Best of luck in getting your account back. I believe a good member like you should get his account once again and I also believe that the all members of the forum will support you in getting your account back.

We have to ensure that nobody have access to the device we use to login to the forum at any time, we shouldn't reveal our login details or private keys, passwords email credentials or any sensitive information about us, try check your email as well as your contact number if not hacked as well, it might be someone close to you who have access to your device or things you do that are unhealthy for your safety online.

Cookie stealers mostly concentrate on Google accounts, especially YouTube but this may be the first time in my knowledge if that is the actual reason for this compromise.

In the recent past, a few accounts were compromised in the same way but they just used to take loans via bitcointalk and let the owners pay it back so possibly the same group targeted the bitcointalk accounts again with much more severe like spreading malware and possibly to attack more users whoever by clicking the link.

So I wonder if this is going to be a big issue if this happens to other accounts too.

Apart from using strong passwords, we don't really have any mechanism to fight against this so probably this can be the reason to implement 2FA on bitcointalk.

The chance of getting your Account is already there but nobody can say how long that will take if you are right for what you say.
Sometimes it goes fast like 1 or 2 Weeks but it also can be take longer like a month or 2 so i guess you have to wait and follow the instructions from the recovery team.

Looks like the verified Message is right but its not the year 2003 that you have written in the Message.

For now harizenbanappeal the red tagg from me on your hacked Account will be stay there til you got your Account back.
Write here in this thread with your harizen Account when you have it and i will remove the negativ Feedback then.

So starting from the assumption that everything you have told us is true, there is a simple thing you should check first
- log in to all accounts created with the email address used for the forum!
- that doesn't trigger any red flags try to verify all accounts for which you have used the username/password combination

If you have discovered others have also been hacked or are blocked for logins or anything fishy then you might have a ton more problems than the bitcointalk account.

Once you zero in on this account only, then it's far easier, no malware will only target your Bitcointalk account, no hacker will be satisfied with this!
From mistakenly using a clone website to log via a phishing link to connecting by mistake to a compromised Wi-Fi while traveling, not that just because it happened now doesn't mean that the person got access yesterday, he might have had it for months and just waited for it or was unable to use it.

Perhaps some cybercriminals were able to extract your Bitcointalk session cookies and sell them on a darknet marketplace while you were away (this can be mitigated by logging out and back in again).

Or maybe a low-tech explanation is that somebody got access to a device you were logged in to Bitcointalk with, or they got your username/password, and then they started to make the malware posts.

Explain the whole situation from start to end in your appeal. And sign your staked address to prove that you are still the owner of this account, at this moment. By the looks of it, somehow a hacker managed to guess the password and used it to post malicious thing! Are you sure it was not someone you know personally? If it was a hacker, there was no point in spaming the forum. Rather he would try to sell as soon as possible. Just my assumption.

If OP deposits into his staked address, he'll find out if it's compromised....

As far as I know, that works when you're banned, but not when your account is locked.

The only safe assumption is that anything is compromised now. Which means you'll have to wipe your computer, reinstall everything from scratch, change all your passwords, and restore your user data from backup.
While you're at it:

It is more obvious that you made a wrong step somewhere, because if this were not the case, someone else would not have gained access to your account. Regardless of where you store your login information, the moment you enter it in your browser, it becomes vulnerable if you have a keylogger or RAT on your computer or smartphone.

Did you check your IP logs as advised by @tranthidung, do you see the IP address the hacker used?

This is not the first time that we have seen a good user banned, obviously through no fault of his own. Nevertheless, it would be useful to ask the OP if you have any guesses as to how it could have happened that another person used your account. This is useful to all of us, and you will do a great job if you tell us what was asked last time. What system do you have? Browser? Do you use shared Wi-Fi, and are you the only owner of your device? In addition, could there be a click on a phishing link? All questions seem naive; however, these are the most obvious holes through which a hacker can get to the user.

Thanks, everyone for the input!

This is really strange. I mean how??

I still don't know how that hacker was able to breach my account. I tried to recap what I did these past days and weeks. As an internet guy for a long, basically, I know the basic and advanced safety measures for protecting my personal account. Although there's no 100% guaranteed protection, I'm really sure I didn't do some crappy moves that lead to this. My Bitcointalk account was only accessed here in my IP's home and on my mobile data (single network) when away.

No downloading attachments, no downloading apps, not entering any inputs on a field, etc.

I don't welcome any random apps, browser plugins, extensions, etc. from random sources on my PC. It's been well protected by me for years and this is actually the first time I got to this kind of situation. Aside from that, all my keys, passwords, and any personal stuff can't be found on my PC, email, notepad, files, etc. as I stored those on my external flash drive and a backup USB drive.

In the first place though, I'm glad that my account got locked right away after posting that thread as it might do some sh*tty moves. I was around 2-3 days offline until I realized that my account was compromised. Hopefully, I can get back my beloved account.


Hey Kabayan.

Did you just send an email to the provided address and just wait? No follow-up?  

Is your email shown as pwned with https://haveibeenpwned.com/ ?

Abandon your pwned email is good but hackers might have deeper access to more of your accounts and even your devices are compromised too.

Old or new email, using a strong password is important too because weak passwords are easily to be bruteforced.

• Are your passwords in the green ?
• [GUIDE] How to Create a Strong/Secure Password

It took me I think or more than a week when I experienced the same thing. My account got hacked last year, and with that, I knew that the email that I used in this account is being pwned (I think this is the term they used correct me please if I'm wrong). I changed my email, used an email that hasn't been used ever since, but created for quite some time, and until now, it's been all good in the hood.

Just wait for it I guess since you have your signed address up there. It took longer for me because I need to find where did I put the seed phrase of my address where I put my sign here. Luckily, I found it or my account will be gone forever. Good Luck, and that will be temporary OP. I guess change your email to an email that hasn't been used in anything. Worked for me. Of course, be careful as well.

---

P.S. @tranthidung, yes unfortunately. It says "Pwned in 3 data breaches and found 3 pastes (subscribe to search sensitive breaches)"
Yes currently, I'm not using that email anymore, and the worst thing is that, I'm always receiving random emails from potential scammers. Not annoying for me though. I guess that hacking incident that happened to me with my account is what I considered as "blessing in disguise" since I learned something from that mistake.

Anyway, thanks for sharing that links. Bookmarked it already.

Harizen can check his IP last 30 days https://bitcointalk.org/myips.php. If real owner and hacker both use Tor, it can not help to detect suspicious login sessions.

If you are not using Tor and the IP address is the same for the past months, this will be useful.

Do you have contact with a trusted person in this forum, such as your phone number, or have you been communicating for years on Telegram or any platform outside this forum? You can send him a message and ask him to confirm that you are the real owner of this account.
Try as much as possible to provide data and add information that the hacker cannot know.



This can be confirmed if there has been a change in the writing style in recent days compared to previous months. The account has a long record of posts.

Is it the verification or signing a message of the staked address and the email used is enough for account recovery? regardless how the hackers able to access all of those you mentioned?

If that's really the case, OP should reset its account password, email associated to its account, and lastly reset/reformat its device to a new one.

I have another assumption that if his computer was hacked. His forum account was open on the browser, and logged in; the hacker could, when he finds the computer idle, control the mouse and keyboard and publish what he wants through the account because he cannot change the password or email if he does not get them through the keylogger or text documents.

@Harizen, I wish you all the best in returning to your account after the administrators review what you provided and unlock the account. I believe it was locked as a security precaution after the scam ANN topic was published from it.

Now, all that must be done is to find out the real reason that the hacker was able to access your account; you should think and review what you did before this happened. I also advise you to use another device and change the complete account security information if your account has been unlocked until you make sure of this hacker; he cannot reaccess the account again.

It will not be easy to restore this account. Because it is unknown how deep the hackers penetrated the account. What if they accessed the email, the private wallet keys, and anything else that can be accessed. Maybe this person's computer was hacked and the hackers accessed everything that was possible. Where is the guarantee that this didn't happen? It's just my opinion. At any rate, good luck in recovering your account.

That's what those hackers do. They no longer change passwords so that the owner of the account won't be alert through their email address that the password has been changed. All they do is log into the compromised account and the post links to malware

If the owner of the account or the mods are not attentive enough, this can appear as though the real own of the account made such a post.

Anyway, good luck to Harizen on recovering his account and perhaps a reminder to use stronger passwords, different passwords for different sites and avoid malicious apps or browser extensions on his device.

Considering the message and given that there's no record of ban on modlog, it seems that you didn't get banned and your account is locked. There's a probability that someone tried to reset your password using your secret question.
See the topic created by achow101: PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT.

Since you signed a message from your staked address and sent an email to the provided email address, I think your account should be unlocked.
Just wait.

That's sad, not sure what you can do in this situation. seclog does not show any thing like Password change etc to suspect account hack.

That means your password was probably compromised and someone was able to login and post that thread.

Your only chance of getting back your account back is proving that your account was hacked. I guess moderators might not have access to your IP addresses and only theymos have such access. He can verify if that topic was created from some what "different ip/location", and also if your hacker was in your pc then good luck.

Since you don't know how your account was accessed and the malware link that was dangerous for others was posted here, I will advise you to take security measures into consideration first as to enhance your security, as I can see that your account password has not yet been changed and was also not changed at the time of the incident.
 
If the password was not changed, anyone who did this might have used your device or a device you last logged in with, or the person who has access to your password, which you should change even though the account is still banned.

Sorry harizen, you are banned from using this forum!
For security, your account has been locked. Email ...

Anyway, I already followed the instructions here and hoping for good progress.
https://bitcointalksearch.org/topic/recovering-hackedlost-accounts-5089777

Are you sure your account has been banned? What's the message you see after you login to the forum?

There is no record of ban for your account on modlog which means that the account has not been banned. Of course, since temporary bans are not displayed in the modlog, there's a chance that your account has been banned temporarily.

After 3 days off, I was shocked that my forum account, harizen, got banned and locked today.
https://bitcointalksearch.org/user/harizen-458393

Exploring what kind of sh*t happened while I'm off, I've seen this thread in the Scam Accusation thread:
https://bitcointalksearch.org/topic/harizen-users-spreading-viruses-5469184

Clearly, I'm not the one who posted that and I don't know how it's possible that someone got access to my account where I know in the first place the security measures in taking care of my personal account, not just here in the forum. I will never post such malicious posts.

I don't know what's the chance of getting my account unlocked but I'm hoping.

I already sent an email to the address given on the error message.


Here is the unedited post where I posted that address: https://bitcointalksearch.org/topic/m.24176166