Follow along with the video below to see how to install our site as a web app on your home screen.
Note: This feature may not be available in some browsers.
Bob, we have been working today to clean up the mess. Can you tell me if you were trying to change your password here, in the forum, or over on the club's main site, under Account Management? Thanks!
I am more than a little incensed at how this is being handled by the organization. I would expect a full responsible accounting of what is going on and not have to go to a forum to find out what other's think is going on.
Very poor management. Is this a cover up?
I am more than a little incensed at how this is being handled by the organization. I would expect a full responsible accounting of what is going on and not have to go to a forum to find out what other's think is going on.
Very poor management. Is this a cover up?
This is probably the first time I have thought of quitting the Club. Right now I feel as much a member to the BMWOA as I feel being a member of Costco.
good morning,
cover up? What's to cover?
Here's the issue as i see it.
Background: The moa runs a membership e-commerce system. These systems are very expensive (think six figures) and take a ton of time to implement. The moa invested the time and effort to get the member database integrated with a system that allows us to preregister for the rally, join, renew and buy some swag from the country store.
That's a huge member benefit that in this day and age the average user thinks should perform like a utility, i.e. Always be there. I see this with it at work because people have no idea what it really takes to "keep the lights on." especially with regards to costs and delivery time.
Along the way we rolled out the forum using v-bulletin. Vb is recognized as one of the gold standards of forum software. It's run by many sites larger than this and some of the chartered clubs also run vb.
The challenge was and still is how do you maintain a member database for the e-commerce and have the same user id and log in work across the forum. The easy way out is to purchase the forum module from the e-commerce vendor but when you compare it to vb it is painfully bad.
The solution involves a custom interface between the two databases. This is not off the shelf stuff and it isn't something that some geek in a closet can do in a day, or perhaps even a week. Iirc the original interface took months.
As an admin of a vb forum i can testify that they offer patches and updates on a frequent basis. They are very quick to provide information and a patch on urgent security issues. They're so good that as a volunteer admin sometimes i have a hard time keeping up. That's because a good admin doesn't just load patches willy-nilly, first the db is backed up and the patch might even be run on a test system first. The moa has very good vb admins, sometimes i go to them for advice on my system.
The elephant in the room is the interface. Every patch and update to either system carries the risk that the interface will need to be re-coded. This is something that's much easier to deal with if it can be planned, tested and validated, vs being built due to a system down issue. Break fixing sucks.
So to sum it up, the moa admin team is challenged to keep both systems current and the interface working just right; plus you've got 90 days until rally registration opens which is a big hit on the system. Because of the need to test and validate every patch it's completely understandable that they got caught by a hacker, the same thing happened to my board but as it's smaller i just took it off line for five days. Our admins don't have the luxury of being able to do that.
Ultimately what happened is someone got into the vb database and pulled out username, email (in plain text) and passwords (in hash keys). That's all they got.
What the admin team has been able to do is update the forum to the latest update for this version. This should have closed the leak. I'm willing to wager they're working on updating to the most current version which is a huge job, plus the user interface will change. If you want to see what it looks like check out the yb forum. it is also quite possible that they'll stay with this version as long as vb is supporting it; if i was running the show that would be a strong consideration, especially with rally registration coming up. At the very least i'd get the ball rolling on testing so the upgrade trigger could be pulled on my schedule, not some hackers.
The worst thing that will happen to the users is more spam. If you use gmail, comcast etc chances are you won't even notice, it'll just be more load on their spam boxes. You should watch out for the ones that do get through, they will not be offering to grow your unit, they'll have a link that they want you to click.
These emails could even look like they came from the moa with instructions to click here to update your personal information.
Do not do that.
there has been plenty of discussion on passwords and such, by now you really should have changed your password to something different but most importantly you should change your password on *every* site that you've subscribed to or made a purchase from using the same e-mail address you used here.
The other golden rule is never, ever check the box labeled "save information for later" or "save credit card". While it sounds convenient that's the info the hackers are always after.
So no, no conspiracy, but at the most technical level there is perhaps one or two people on the board and one or at best two people in the office who really understand how this works, the bulk of it is managing the vendors.
I hope this provides some understanding as to what is likely going on in the back room. No conspiracy at all. There's no need for an adversarial attitude either, folks that run services like this care more about performance and up-time than you do so calling them out or talking about cancelling your membership only adds to the acid in the gut. It will not provide any positive motivation for the guys in the trenches.
Rather than mud slinging, we should all say a big THANK YOU to Kurt, Darryl, and Gary for working hard all week to contain and clean up the mess. Many on the forum have no idea how much clean up was necessary because these guys were on top of it.
Kudos to them!
I am not sure if this is related but I thought I would post this in the event that others are seeing similar "probes" after the hacking incident:
- I received a text on my cell from a number 92500 telling me that my yahoo account had been modified to remove my cell number. (I never linked a cell number to my yahoo account
- There was a mysterious gmail asking me about a cute kitten. This was followed by an e-mail from Rob Nye about spam
- I received a call on my cell from 406-530-5319 which I let roll to voice mail. I googled the number and found this thread in a google support forum http://www.google.com/support/forum/p/Places/thread?tid=4c9cd8606f1b4fa7&hl=en
I did not respond to any of these unsolicited messages but I was wondering if other members are seeing similar unusual activity. My goal is to determine if these incidents are related to the hack or if I have another security issue that is brewing.
Thanks,
dick
The cute kittens email was a result of the hack......
If your anti-virus software is a few years old it's time to upgrade.
I would also like to take a moment to mention that you can get FREE excellent anti-virus software from Microsoft. I figure that if anyone can handle keeping windows clean it's Microsoft. Another huge benefit is it doesn't bog your system down like Norton.
So update your anti-virus software and watch out for suspicious emails, if it looks fishy chances are it is.
thanks for the feedback Rob - I was hoping the second cute kitten e-mail was from you
It was or the reply all with the tag as spam instructions was the one I sent.