Suspicious Messages

[+4Freds]

Getting lots of messages from multiple accounts.  Someone have a clue how to block, I’ve tried from app and webpage without success.  

[+igator210]

It hit me too.... the funny thing in the Message Center it is coming from the same user, but all the emails I'm getting are coming from different users.

 

Edited July 2, 2020 by igator210

[+4Freds]

Son's account getting them as well.

[Keystone]

There have reports over the last few days of spam arriving in geocacher email inboxes.

Geocaching HQ have already been working to resolving this matter.

Today, spam appears to also be arriving via the Geocaching Message Center.

 

These messages come from different addresses, with similar message text.

Geocaching HQ has already been made aware.

 

It would appear the same message is being sent simultaneously to groups of geocaching users at the same time.
After receiving the initial spam message, users have replied to the message, not realizing they are sending dozens (if not hundreds) of replies to other recipients.

 

If you receive one of these spam messages - DO NOT REPLY and DO NOT CLICK ON ANY LINKS.

 

Your geocaching mobile app may be providing a notification when a message has been received - which could result in many notifications.

 You can disable notifications on your smartphone for any apps that may be constantly alerting (email, Geocaching app)

 

If you also wish to disable email notifications for Message Centre messages:

• Log into your Geocaching account via web browser
• Go to Settings (in the top right, click on the down arrow)
• Go to Email Preferences
• Remove the checkmark beside Message Centre

[+WeBeRVing]

When the geocaching website has been compromised like this it would be smart if HQ would send out a notice to users who have not read this specific thread!  How would anyone know what is happening until they crash into it if HQ doesn't tell people they have been compromised!

[+igator210]

HQ needs to turn of all messages. My email in box is getting so spammed right now.

[Keystone]

It is 7:00 in the morning at Geocaching HQ.  I am sure they are working on this and will post an update once the awesome Lackeys tackle the problem.

[+on4bam]

3 minutes ago, igator210 said:

HQ needs to turn of all messages. My email in box is getting so spammed right now.

It's probably a very small percentage of users getting this spam, so blocking all mail would do a lot more harm than good. Spam needs to be handled at the source (account sending it) not the receiving end.

 

[+rkedge]

3 minutes ago, on4bam said:

It's probably a very small percentage of users getting this spam, so blocking all mail would do a lot more harm than good. Spam needs to be handled at the source (account sending it) not the receiving end.

 

I'm guessing this problem is growing and getting worse by the minute. A temporary freeze (an hour or two) would barely impact anyone. And it's geocaching.com how important are email notifications?

[+leffelfam]

I've been hit almost every minute for the last hour. Disabled Messaging until there's a fix.

[+thebruce0]

People just need to stop replying to that message thread. It's just like a mistaken Reply-To-All CC'd email blast, only much worse.

 

[Frau Potter]

Geocaching HQ has been investigating the issue since 5:30am. We believe that someone is spamming our community, but sometimes making it appear as if the messages are coming from an active user (or a group of users). We do not believe they were actually sent by that user. DO NOT REPLY to the messages. 

 

We will work to resolve this issue as quickly as possible.

[+dagger38]

6 minutes ago, Frau Potter said:

DO NOT REPLY to the messages. 

 

Already replyed to the messages
Noticed they do not appear in message centre itself?

 

[+TeamAroo]

21 minutes ago, leffelfam said:

I've been hit almost every minute for the last hour. Disabled Messaging until there's a fix.

I looked, how does one disable the messaging?  Thx

[+dagger38]

1 minute ago, TeamAroo said:

I looked, how does one disable the messaging?  Thx

See KEYSTONE"s post above

 

[+jmsantafe]

I think people's accounts are being hacked and compromised.

Edited July 2, 2020 by jmsantafe
Added image

[+on4bam]

Looking at he full headers of the messages may shed a light on things. Are the actually send from GC servers? If so HQ shouldn't have a problem finding how/where from the spam is send. They may even found a bug in the code that allows them to send it.

If I see the amount of tries on my little mailserver and website I can only imagine how many hits a large domain gets.

 

[+FrostedBroccoli]

I would imagine since all of the messages in the chain have one name, I would imagine that's the initial account that was hacked in the chain, no?

[+Team DEMP]

I have 105 messages in the last hour or so and they are coming in fast. 

Saying "stop responding" is rather useless as I would guess 1% of individuals use the forums and 50% don't even use the web site. 

Edited July 2, 2020 by Team DEMP

[+lcount]

Blocked the message and turned off email notifications from website. However when in app, still get notifications of new messages from individual users about new message. Mine was about winning iPhone. I mistakenly replied stop which blew it up. 

[+jmsantafe]

People's accounts are being hacked. I would recommend you change your password. it would be nice if a Lackey made an announcement about this.

Edited July 2, 2020 by jmsantafe
Added image

[Keystone]

@jmsantafe, please read the post above yours from Geocaching HQ Lackey, Frau Potter.

[+jmsantafe]

What I mean is, It would be helpful if an email was sent out explaining what is happening to some users. Not everyone who is getting these messages is checking the forum.

[Frau Potter]

Geocaching HQ is aware that a user sent many spam messages through the Message Center today, July 2, 2020. The user was able to make it appear as if the messages came from another geocacher, in a group chat with many other users. We realize this caused a great deal of confusion. We recommend you do not reply to any of these messages. We do not believe this user had access to your account, or the account of other users. You do not need to delete the app, change your password, or delete your Geocaching account. 

 

We temporarily turned off the Message Center on our website at 8:00am (Pacific Daylight Time) in order to troubleshoot this issue. The Message Center is now turned back on. You may still receive email notifications or app notifications for messages sent earlier today. You should ignore these messages. We are working to delete these group conversations from the Message Center.

 

We truly appreciate the geocaching community, and are sorry that someone has taken advantage of some users. We will be working hard to prevent future issues such as this with our Message Center.
 

[+Viajero Perdido]

9 minutes ago, Frau Potter said:

The user was able to make it appear as if the messages came from another geocacher

 

So people may have blocked non-spamming cachers by mistake then?  I suppose statistically they'd have blocked complete strangers - so no big deal - with only a very tiny chance of having blocked people they might actually want to hear from.  I blocked a random cacher today, who appeared to be another random cacher.

[+jmsantafe]

1 hour ago, Frau Potter said:

We truly appreciate the geocaching community, and are sorry that someone has taken advantage of some users. We will be working hard to prevent future issues such as this with our Message Center.

Thank you!

[+Wet_Ground]

Yeah. I got two random messages one saying; "I love turtles".

and the other a bit meaner with foul language. 

Edited July 2, 2020 by Wet_Ground

[+Wet_Ground]

Just found a message in spam from 9 hours ago it is some random message and a https link to some site.

 

 

Note: I guess people are taking up new hobbies in the newfound quarantine free time. Hobbies like hacking?

Edited July 2, 2020 by Wet_Ground

[+JCs Girl]

I received 48!! spam emails this morning. What is going on?? Messages are from “normasgirl!” “hiker_licious!” “kyliemarie318!” “flipmstr2!” “sharks_mummie!” “RcAmAxcucuycyc!” “weow!” “mswilkes!” “Mighty Paragon!” “abrothers!” “eetanam!”  Please do something about this hack.

[+Max and 99]

2 minutes ago, JCs Girl said:

I received 48!! spam emails this morning. What is going on?? Messages are from “normasgirl!” “hiker_licious!” “kyliemarie318!” “flipmstr2!” “sharks_mummie!” “RcAmAxcucuycyc!” “weow!” “mswilkes!” “Mighty Paragon!” “abrothers!” “eetanam!”  Please do something about this hack.

48 is nothing compared to the several hundred many of us received.  They are doing something, and as explained elsewhere the messages sent before they shut it down may continue. They went to work on it immediately! 

[+Max and 99]

4 minutes ago, JCs Girl said:

I received 48!! spam emails this morning. What is going on?? Messages are from “normasgirl!” “hiker_licious!” “kyliemarie318!” “flipmstr2!” “sharks_mummie!” “RcAmAxcucuycyc!” “weow!” “mswilkes!” “Mighty Paragon!” “abrothers!” “eetanam!”  Please do something about this hack.

Some of the messages are from geocachers I've messaged before. Most I've never heard of. May be just a coincidence, but of my 5 accounts, only the PM one is affected. 

[+Bl4ckH4wkGER]

@JCs Girl I recommend rereading the post from Frau Potter above, I have quoted it below, too and marked the crucial bit for you in bold.
 

Quote

4 hours ago, Frau Potter said:

Geocaching HQ is aware that a user sent many spam messages through the Message Center today, July 2, 2020. The user was able to make it appear as if the messages came from another geocacher, in a group chat with many other users. We realize this caused a great deal of confusion. We recommend you do not reply to any of these messages. We do not believe this user had access to your account, or the account of other users. You do not need to delete the app, change your password, or delete your Geocaching account. 

 

We temporarily turned off the Message Center on our website at 8:00am (Pacific Daylight Time) in order to troubleshoot this issue. The Message Center is now turned back on. You may still receive email notifications or app notifications for messages sent earlier today. You should ignore these messages. We are working to delete these group conversations from the Message Center.

 

We truly appreciate the geocaching community, and are sorry that someone has taken advantage of some users. We will be working hard to prevent future issues such as this with our Message Center.
 

 

I recommend deleting the emails and calling it good. We cannot influence emails that were already sent to you before we took action. We can influence all that happens on our side and have done so to take care of that. Emails, especially in large volumes, may get delivered over a period of time to not overwhelm email services. That is where checking the time stamp helps.

Thank you for your understanding and apologies for the inconveniences.

[+Labrat1984]

I'm lucky in that I didn't have any

 

Having had a look down old email messages I suspect there is some inkling of what might have happened

 

All the emails I have had have come from an email address made up of a mixture of letters and numbers, these always seem to be a block of 8 digits-4 digits - 4 digits - 4 digits - 12 digits @ the usual.com

 

If each user has his own string rather than being a unique code per conversion then it might be possible someone has either used a random generator and hit used addresses or has discovered a list of these addresses somewhere - however the user ID seems to change occasionally 

 

The question is where would you find the list of codes to email someone, the answer is simple - log onto anyones profile and right click the "message xyz" code and copy the link - this has that mixed ID code as part of the link

 

I have tried to email myself using the code from here and it hasn't worked but that might be due to it being turned off

 

It's sounds more likely it was some bored teenager who built some sort of Web crawler to harvest them for a laugh to me than anything majorly malicious 

 

[+thebruce0]

I know this is done, but I found it an intriguing predicament.  My assessment was that someone found a loophole in the messaging system (either active or being developed) that allowed a message to be sent and received at multiple accounts. The problem is that individuals who get the message with notifications received emails with the message content, but the message center was not set up to handle multiple accounts in one conversation - and this is the key point why people thought accounts were being hacked, or one account was sending multiple messages. Viewing the MC on the web, you would only see the account of the most recent (possibly first viewed, uncertain) "commenter" and the rest were attributed to them. Yet, the email notifications sent out a copy of each message AND the correct sender of the message.

 

"Conversations" were occurring in the MC among numerous people, and without people knowing what was going on, every response contributed to the hysteria. Some people joined in sending meaningless messages for fun, some repeated the same message over and over, some told people to stop sending them messages, etc etc. But that endless cycle of mass--messaging was kind of like a mistaken mass-CC-email where one person replies-to-all by default, and everyone gets a message intended to be for one person; but people keep replying and everyone gets all the replies... until everyone stops replying to everyone!

 

My guess is the ONLY actual spam/hack that occurred was the first message to accounts in bulk. After that, human nature caused chaos and confusion (and a message center UI that was not equipped to properly handle the structure of the conversation).  Ironically, it seems, the email notification system did exactly what it was supposed to do. Causing people to get bulk emailed with every single reply to that mass-user conversation.

[+cachercats]

I got a kind of a crude vulgar message today and notified Geocaching head quarters. Sent them copy of message and they should reply to me in a few days, we hope. Anyway I blocked any messages from this sender. Think it is suspicious because the caching name has no hides and no finds. Just some idiot with time on their hands.  I have a coffee cup that says, "Dont mess with a geocacher because we know all the good places to hide a body. May have to apply that here. LOL

Edited July 26, 2020 by cachercats

[+HereKittyKitty]

Just adding my voice. The spam message issue is widespread.

 

I got this message today

<Message removed by moderator>

Edited July 26, 2020 by Rock Chalk
Removed content of the spam message

[+Max and 99]

Why are you helping them spread these kind of messages? Block them and report them. Don't help them by sending it to more people. 

[+Will Stamp 4 Cache]

Yeah, add me to the list of vulgar message receivers. <Message removed by moderator>

Edited July 26, 2020 by Rock Chalk
Removed content of the spam message

[+Max and 99]

It is totally unnecessary to repeat the vulgar message here. 

I am not easily offended by those kinds of things. But I most certainly am not going to help them spread their message. 

Edited July 26, 2020 by Max and 99

[+cerberus1]

3 minutes ago, Max and 99 said:

It is totally unnecessary to repeat the vulgar message here. 

 

 - Hopefully one of the family-friendly forum member's kids isn't gonna click on the link too ...

[+Qbar]

Gee, I'm late to the game but I finally got one too.  Didn't open it, not completely dumb, but if I was to use geocaching terms here, (rate my..) I'd guess difficulty 1, terrain 5?

(Sorry, I'm bored here, waiting for something to finish so I can get on with my day)

[+on4bam]

Why are some people posting these messages on the forum? Isn't it enough people are spammed by mail/ Me§§y center. Reposting those links is even worse than what the spammer do.

 

Spam should be dealt with silently as in report and delete not spread it some more.

 

 

[+amy jean]

I just got one of those messages also.

I looked at the "contact us" option for Groundspeak but couldn't find a topic out of the 21 listed that it would classify under.

[+Max and 99]

1 minute ago, amy jean said:

I just got one of those messages also.

I looked at the "contact us" option for Groundspeak but couldn't find a topic out of the 21 listed that it would classify under.

That's a good point. If it was me I'd be tempted to choose 16. 

[+niraD]

6 minutes ago, Max and 99 said:

That's a good point. If it was me I'd be tempted to choose 16. 

That's pretty close. They really should have an "Other" option though. And after they add an "Other" option, then they can add a "Spam/Abuse" option.

[Rock Chalk]

Engineers are aware of the issue and working on it.

[+TCMuffin]

I've had one too, from a user called intasrabatt1996...0 finds, 0 hides, 0 FPs.

Reported to GCHQ.

[+Old River Runner]

@Rock Chalk -- Thanks!  I hope the engineers get it taken care of soon!

 

[+cachercats]

I blocked the messenger and reported it to HQ. They took care of it as far as I am concerned. They deleted from my messages. People need to jump on this as soon as it appears. Satisfied as to the way it was handled.