Someone hacked my account - please help

Nicci

Someone changed my login info/email and changed my site. I can't find a number to call. Please help! :cry

jfriend

Tecnicole wrote: »

Someone changed my login info/email and changed my site. I can't find a number to call. Please help! :cry

http://www.smugmug.com/help/emailreal will get you in direct contact with someone from Smugmug as will clicking on the Contact link at the bottom of http://www.smugmug.com.

Nicci

i tried that but i am scared they are going to delete all my photos and customizations which took me a lot of time. how do i get help right away to prevent further changes? they already made some that i didn't have backed up anywhere!

jfriend

Tecnicole wrote: »

i tried that but i am scared they are going to delete all my photos and customizations which took me a lot of time. how do i get help right away to prevent further changes? they already made some that i didn't have backed up anywhere!

I'm just a volunteer here. I don't know of any more immediate way. Smugmug doesn't do phone support.

Nicci

SmugMug really needs to implement a system where you have to confirm an email address change via the old email address.

This waiting game is ridiculous and now someone has access to my entire site and was able to lock me out by changing the email address.

Even twitter sends a confirmation email to the old email address before implementing any changes.

Andy

Tecnicole wrote: »

SmugMug really needs to implement a system where you have to confirm an email address change via the old email address.

This waiting game is ridiculous and now someone has access to my entire site and was able to lock me out by changing the email address.

Even twitter sends a confirmation email to the old email address before implementing any changes.

I'll have someone answer your ticket right away.

Andy

Tecnicole wrote: »

Someone changed my login info/email and changed my site. I can't find a number to call. Please help! :cry

The very fastest way to get us is http://smugmug.com/help/emailreal

We never close, 365 days a year.

how did your account get compromised - did you give out your password?

Nicci

i don't know how it was compromised but i am so concerned that they are going to change all my customizations that i struggled with on my own.

also, they keep putting a slideshow of weird overweight people

thankfully i was still logged in so i can keep changing the way the page looks to the public but that is it

with information so sensitive on this site, why wouldn't you confirm with the old email address before updating to a new one?

Nicci

Can you please ease my mind and tell me if he made any changes, if you can revert them back?

My heart rate is elevated!

Andy

Tecnicole wrote: »

Can you please ease my mind and tell me if he made any changes, if you can revert them back?

My heart rate is elevated!

Nicole - no need to post more here. Rich has all your tickets at the help desk.

Nicci

Andy wrote: »

Nicole - no need to post more here. Rich has all your tickets at the help desk.

But there are security issues with the site that others should know of, no? I have not been satisfactorily helped AND I made him aware of security issues that would allow someone to make changes even after the email address and password were changed. And then after I was told it was resolved, more changes were made to my site that I am told is not fixable.

So all of my work is down the drain and there are still security problems on my site?

I am sorry if I seem upset, but all of this could have been prevented. The person that did this to me called himself a "malevolent hacker" and was somehow able to obtain access to my site without my permission.

There was no security in place to prevent him from changing my email address. (simple confirmation to old email address would have prevented this)

AND, there was no security in place to prevent him from making further changes once the email address and password were changed by SmugMug. As long as he did not log out on his computer, he was able to make more changes to my site and essentially destroy it.

Then I was told that SmugMug can't fix the changes he made.

Does any of this seem fair?

Andy

Tecnicole wrote: »

But there are security issues with the site that others should know of, no? I have not been satisfactorily helped AND I made him aware of security issues that would allow someone to make changes even after the email address and password were changed. And then after I was told it was resolved, more changes were made to my site that I am told is not fixable.

So all of my work is down the drain and there are still security problems on my site?

I am sorry if I seem upset, but all of this could have been prevented. The person that did this to me called himself a "malevolent hacker" and was somehow able to obtain access to my site without my permission.

There was no security in place to prevent him from changing my email address. (simple confirmation to old email address would have prevented this)

AND, there was no security in place to prevent him from making further changes once the email address and password were changed by SmugMug. As long as he did not log out on his computer, he was able to make more changes to my site and essentially destroy it.

Then I was told that SmugMug can't fix the changes he made.

Does any of this seem fair?

Hi Nicole, I'm investigating, please standby.

Nicci

Andy wrote: »

Hi Nicole, I'm investigating, please standby.

Thank you because changes are still being made now and I have no control.

PLEASE help me put my site back how it was. The major changes were not made until after I was told the email address and pw were changed. I shouldn't have to be going through this for something preventable.

Andy

Nicole, we're gonna take care of you, Rich is going to call and we'll get your site back to the way it was.

- Andy

Nicci

Possible security issues with SmugMug and my site hack
Thank you Andy. I am still waiting on some answers and fixes, but things look a lot better than before.

Also, it appears as if there are some security issues with the site that need to be worked out.

For instance, if someone gains access to your account and changes your email address, there is no "safety net" of a confirmation email to the old email address.

Also, if a user believes their account has been compromised and changes their email address and/or password, anyone currently logged into the account can still make changes to the SmugMug site as long as they do not sign out of the site.

So in my case, I alerted SmugMug to the problem and my email address and password were changed. I was told the problem was solved. But then after that, I sat here and watched more and more of my site change and I had no control over it.

In my opinion, this is a big problem that not only should be fixed, but I think it is only fair that current users are notified that all of their work (customizations and photos) can easily be compromised - even if they change their login info.

I am a newer user, and I love SmugMug so far even with this incident. But if I had known this was an issue, I would have handled things differently. Is there a way to either fix the security problem right away, or send a message to users letting them know of the issue?

Andy

Tecnicole wrote: »

For instance, if someone gains access to your account and changes your email address, there is no "safety net" of a confirmation email to the old email address.

There is a confirmation email sent to the old address, Nicole. I'm guessing that this other person had access to your email, too - or maybe it went to your spam folder?

Nicci

As I explained to Rich on the phone (and he agreed), the confirmation only tells you it has been changed. It does not ask you to confirm that the change is valid. This is what I received:

This email confirms that your email address has successfully been changed to XXX. From now on, you'll need to use XXX to log in to your SmugMug account.

Thanks for being a part of the SmugMug family!

http://www.smugmug.com

That is how I found out the account had been hacked, but I was locked out. They attempted to do the same with my twitter account, but twitter sends an email to the old address before allowing the change to be valid. And twitter is not holding a photographer's original works. Don't you think there should be more security in place and/or users should be aware of the vulnerability?

Additionally, it still stands that if a user realizes that their account is compromised and they change the login info, that does not lock out anyone who may have already obtained access to the account.

I was told that I would be assisted further yesterday, but Rich did not get back to me.

I was told that things could go back how they were and they aren't there yet.

I simply would like help putting things back the way they were or I would like an answer to the questions that I emailed Rich about me needing to go back and fix everything.

The person who obtained access to my account only made some minor changes. However, even after Rich changed the email and password and removed some of the horrible things he was posting, the hacker continued to make changes to my site. He could not stop him.

In order to attempt to rectify the problem, Rich created a whole new account for me and closed the one the hacker was using. That is because of the security vulnerability. There was no way to lock the hacker out as long as he didn't sign off.

In doing so, I lost all the site-wide settings and customizations that were still there before Rich duplicated the account.

So understandably, I am still a bit upset and wondering why it was not resolved yesterday as I was told?

Nicci

I do understand that this is likely a unique situation and good thing it happened so you all can hopefully fix this vulnerability.

However, I would rather have someone get back to me within the time frame I was told. At least let me know you all need more time.

I would like to know what is going on please.

And will these security issues be resolved?

Andy

Tecnicole wrote: »

I was told that I would be assisted further yesterday, but Rich did not get back to me.

I was told that things could go back how they were and they aren't there yet.

We've been digging in google cache, and working to get your site back, Nicole. All weekend. Please have patience, Rich will get back to you, I promise.

Andy

Tecnicole wrote: »

There was no way to lock the hacker out as long as he didn't sign off.

We're looking at this. Thanks for pointing it out!

Nicci

Andy wrote: »

We've been digging in google cache, and working to get your site back, Nicole. All weekend. Please have patience, Rich will get back to you, I promise.

Apologies for impatience, I understood I would hear something Saturday and was concerned when I didn't.

Thank you for all your help. Things are almost back to normal.

It was so stressing to watch it all go down the tubes. Although my site looks very simple, it actually took me a great deal of time to sort through all the available customizations and get things how I preferred. I am very new to all of this.

I hadn't even been able to finish upload my galleries and get things going! The only thing I completed was my design and customization and I couldn't believe I had to watch it all get flushed!

Whew. I still wish I knew how he obtained my password. I found out the person that did this was someone who helped me with my portal page at humansafterall.com. But he did no work on and did not have access to my SmugMug account.

mbrady

Tecnicole wrote: »

Whew. I still wish I knew how he obtained my password. I found out the person that did this was someone who helped me with my portal page at humansafterall.com. But he did no work on and did not have access to my SmugMug account.

Did you have the same password in both places?