B&H site is messed up; be careful

David_S85David_S85 Administrators Posts: 13,245 moderator
edited September 29, 2005 in The Big Picture
EEEEK! Just a warning. Today, B&H's site went down, and is at this moment messed up, and the site security is possibly compromised. See this thread over at DPReview:

http://forums.dpreview.com/forums/read.asp?forum=1019&message=15175986

I just tested the shopping cart function (I don't have a BH cookie - erased the last one a month ago), and pulled up their most recent order...

bhcart.gif

No names or personal data, but who knows what else is visible to someone that has hacking on their resume.

Now, I guess it goes without saying, that this sort of thing should not happen. So, if you are about to order through them (very reputable company), I would suggest that you should call in your order for the next couple of days until they can sort all this out.
My Smugmug
"You miss 100% of the shots you don't take" - Wayne Gretzky

Comments

  • David_S85David_S85 Administrators Posts: 13,245 moderator
    edited September 25, 2005
    ...and now all I get is their site in spanish. Hmmmmmmmm...... ne_nau.gif
    My Smugmug
    "You miss 100% of the shots you don't take" - Wayne Gretzky
  • AndyAndy Registered Users Posts: 50,016 Major grins
    edited September 25, 2005
    site looks normal to me, i shopped a bit, added to cart, saw nothing untoward...

    www.bhphoto.com

    ne_nau.gif
    Andy

    Portfolio • Workshops • Facebook • Twitter
  • gusgus Registered Users Posts: 16,209 Major grins
    edited September 25, 2005
    Works fine for me here David but it was down earlier on today.

    Very odd about the spanish....they usually revert to latin.
  • David_S85David_S85 Administrators Posts: 13,245 moderator
    edited September 25, 2005
    Humungus wrote:
    Works fine for me here David but it was down earlier on today.

    Very odd about the spanish....they usually revert to latin.
    The thread at DPR is being updated every minute. Some people are seeing names, addresses and Visa card numbers. This is scary. I am seeing a different shopping cart and shipping address every time I hit the button.
    My Smugmug
    "You miss 100% of the shots you don't take" - Wayne Gretzky
  • HarrybHarryb Registered Users, Retired Mod Posts: 22,708 Major grins
    edited September 25, 2005
    David_S85 wrote:
    ...and now all I get is their site in spanish. Hmmmmmmmm...... ne_nau.gif
    Its screwed up. I tried to go to "digital photography" and ended up on a page in Spanish. I tried a enter camers/ photogear" and got a reponse to a "search" I never requested. Two other attempts ended up with bizarre results.
    Harry
    http://behret.smugmug.com/ NANPA member
    How many photographers does it take to change a light bulb? 50. One to change the bulb, and forty-nine to say, "I could have done that better!"
  • AndyAndy Registered Users Posts: 50,016 Major grins
    edited September 25, 2005
    lol3.gif my cart just turned into portugese. thiago, oh thiago, where are you??? headscratch.gif

    also: on the left side of the cart page, it says "hacker safe" so hopefully this is just a server glitch. but yowser, it's bad.

    i emailed henryp.
    Andy

    Portfolio • Workshops • Facebook • Twitter
  • David_S85David_S85 Administrators Posts: 13,245 moderator
    edited September 25, 2005
    andy wrote:
    lol3.gif my cart just turned into portugese. thiago, oh thiago, where are you??? headscratch.gif

    also: on the left side of the cart page, it says "hacker safe" so hopefully this is just a server glitch. but yowser, it's bad.

    i emailed henryp.
    Happening also with Firefox for others. Lots of people emailing Henry. I emailed their webmaster with info.

    UPDATE #1. I emailed Henry also. I was able to hit a few more buttons and what I viewed was too scary to post a screenshot of. They most definately have a red alert security concern on their hands with this mess. :uhoh

    UPDATE #2: Monday morning. Got a reply back from Henry Posner at B&H about the matter. They became aware of it over the weekend. Site was pulled down a second time, repaired, and is now back up. I could not duplicate the security problem from Sunday. I have pulled the above screenshot, as I promised Henry I would. All seems fine now. :D
    My Smugmug
    "You miss 100% of the shots you don't take" - Wayne Gretzky
  • AndyAndy Registered Users Posts: 50,016 Major grins
    edited September 25, 2005
    while we're talking about b&h
    it's a good time to remind folks that b&h will be closed for the upcoming jewish holidays.

    linky on their websitey

    rosh hashanna, tues oct 4th and wed oct 5th

    yom kippur, oct 12 (noon) 13th, 14th (noon)

    succos, monday oct 17th (1pm) thru wed october 26th (yes, 9 days)

    every year, people get caught off-guard with these holidays. so, plan ahead, but don't worry: if b&h is closed, dgrin flea market is open!
    Andy

    Portfolio • Workshops • Facebook • Twitter
  • luckyrweluckyrwe Registered Users Posts: 952 Major grins
    edited September 26, 2005
    Hmmm just logged in to B&H, my cart has a digital camera and a roll of film in it. I did not do that! I remove them and not I have a Canon 100-400 in my cart! Okay bye bye to that. Now I have an empty cart.

    Let me see my wishlists. They are gone! :cry

    Let me go back to my cart and see what language I have. Ah it is English but now I have a Canon 100-400, A Konica-Minolta flash control and Konica-Minolta hand strap in there! Weird! Let me delete those.

    Haha now I have that roll of film back in there again. Delete! Now I have a Pelican foam refill. Hey I can use that. But I better wait, they are indeed very hacked up.
  • David_S85David_S85 Administrators Posts: 13,245 moderator
    edited September 26, 2005
    I ordered Andy up some new equipment, and billed it to windoze. I'll let them sort it out together. rolleyes1.gif
    My Smugmug
    "You miss 100% of the shots you don't take" - Wayne Gretzky
  • gusgus Registered Users Posts: 16,209 Major grins
    edited September 26, 2005
    David_S85 wrote:
    I ordered Andy up some new equipment, and billed it to windoze. I'll let them sort it out together. rolleyes1.gif
    The only 2 people i know that speculate in a futures lens market.
  • lynnmalynnma Registered Users, Retired Mod Posts: 5,208 Major grins
    edited September 26, 2005
    Oh geez.. I just this second orded a whole pile of photo paper pro.. of course THEN I saw this thread.. hmmmm
    website
  • AndyAndy Registered Users Posts: 50,016 Major grins
    edited September 26, 2005
    i just spoke with henry posner live on the telephone, they are looking into it.....

    cheers and david, thanks for the heads up.
    Andy

    Portfolio • Workshops • Facebook • Twitter
  • David_S85David_S85 Administrators Posts: 13,245 moderator
    edited September 26, 2005
    andy wrote:
    i just spoke with henry posner live on the telephone, they are looking into it.....

    cheers and david, thanks for the heads up.
    I just got an email from Henry. Looks very well composed and diplomatic. Seems as if he needed to reply to a whole bunch of concerned customers about the matter.

    And, as a B&H customer myself, I am happy to report that I could not duplicate the problem that they had yesterday. All seems fine now.

    As I promised Henry, I will pull down the linked screenshots above, as well as others that I would never dare post in a public forum.
    My Smugmug
    "You miss 100% of the shots you don't take" - Wayne Gretzky
  • henryphenryp Registered Users Posts: 144 Major grins
    edited September 28, 2005
    David_S85 wrote:
    I just got an email from Henry. Looks very well composed and diplomatic. Seems as if he needed to reply to a whole bunch of concerned customers about the matter.

    And, as a B&H customer myself, I am happy to report that I could not duplicate the problem that they had yesterday. All seems fine now.
    Thank you. I do try to be diplomatic. I'm sorry it took a while to get over here, but I am pleased to report that the site glitch was short-lived and is now entirely repaired. The problem was internal, new safeguards will ensure it cannot recur and all is now well.
    Henry Posner
    B&H Photo-Video
  • AndyAndy Registered Users Posts: 50,016 Major grins
    edited September 28, 2005
    henryp wrote:
    Thank you. I do try to be diplomatic. I'm sorry it took a while to get over here, but I am pleased to report that the site glitch was short-lived and is now entirely repaired. The problem was internal, new safeguards will ensure it cannot recur and all is now well.


    thanks henry. now, about the b&h champagne room idea??? ne_nau.gif where do we stand on that lol3.gif
    Andy

    Portfolio • Workshops • Facebook • Twitter
  • David_S85David_S85 Administrators Posts: 13,245 moderator
    edited September 29, 2005
    henryp wrote:
    Thank you. I do try to be diplomatic. I'm sorry it took a while to get over here, but I am pleased to report that the site glitch was short-lived and is now entirely repaired. The problem was internal, new safeguards will ensure it cannot recur and all is now well.
    Thanks again, Henry.

    When I got back from work yesterday, I found a long note (written by Mrs. David_S85) that one of the web team staff had called me at home to explain the situation as it occured on Sunday and to reassure me that everything was now fixed. They were sorry for the problems, admitted they really were as people were reporting them on the forums (didn't gloss over it at all). There is a new security layer in place, and an automatic shutdown of the site if anything gets strange again in the future.

    I should say that I didn't ask anyone to call. They just did this on their own.

    Man, that's service! thumb.gif
    My Smugmug
    "You miss 100% of the shots you don't take" - Wayne Gretzky
Sign In or Register to comment.