Just the Facts, Ma’am...
Jul. 10th, 2010 02:09 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
ellenmillionThe Very, Very Short Version
Some information from the customer-end databases at Ellen Million Graphics were compromised: if you have an account at EMG-Zine or at Portrait Adoption, your email and password have been publicized.
The Still Fairly Short Version
Ellen Million Graphics, and several of its various sub-sites, have been under near-constant spam/hack attacks for... well, for a very long time. The forums frequently receive 10-100 ‘spam’ join attempts daily. Recently, in the past three months, those attacks have stepped up in intensity and success, and spread out from the forums into SQL injection attacks throughout the sites.
The short version of the long and sordid battle I’ve been fighting with these attempts is that I have met each problem I've uncovered within a day of finding out about it. This week, however, I discovered that one of the early attempts (mid-April) was able to crack into the database and get all passwords and emails from the customer database. Not satisfied with harvesting this information, the perpetrators of this hack have posted this information (emails and passwords only) to several public forums, so that this information has been propagated pretty far.
The security changes I made (back in April, as soon as I discovered the problem) stopped all further leaks at the time, but I was not aware of the scope of the problem or the fact that the emails and passwords had already been harvested and spread until I found one of these forums - just this week - and started to snoop further.
What Should You Do About it?
Change your passwords – immediately, and not just at EMG-Zine or Portrait Adoption. Although there is no personal information stored in your EMG-Zine or Portrait Adoption account, if you use the same password for your email login, that account can be considered compromised! Go and change your passwords. Right now! Get in the habit of using individual passwords at different sites, and change them frequently. Chances are good that this can – and may have already – happened at other sites you use, too. Hackers do not leave polite calling cards letting webmasters know that they’ve been by, and if an alert customer had not let me know about this problem, I’d still be in the dark.
Artist accounts were not (to the best of my knowledge) affected - the only thing they got were the customer-end accounts (EMG-Zine readers and Portrait Adoption customers), where no personal information was stored. No credit card, address, phone, payment or order information was taken. Using the information that they stole, the only thing they could really do at my sites is change your menu preferences and submit descriptions. The major risk is the possibility of your email being hacked if you use the same password here and there. The most likely outcome is that you will see an increase in spam emails (or have, already).
What Am I Doing About it?
Additional security has been and is still being added throughout the site. Every page is being scrutinized for weaknesses and all SQL entries are being ‘sanitized.’ All out-of-the-box software is being updated promptly whenever updates are available. Database passwords are being changed regularly. I am keeping a close eye on my site statistics to stay on top of further attacks, and my hosting company is also watching out for spikes at the server that might indicate a problem. All of this will delay the release of the new Fantasy Art Shop, but clearly takes precedence.
The event has been reported to the authorities and I am attempting to have forums with the lists in circulation shut down.
Some of this, I did before, and I’m only stepping up my frequency and alertness. Some of this is learning a new set of programming skills, and I'm consulting with people who know much more than I do and I am learning everything I can about pro-active countermeasures.
I am deeply apologetic for this breach of your privacy. It is embarrassing and I feel wretched that it happened under my watch. I am angry that there are people out there who would do this, and will do everything in my power to keep it from happening again.
Please contact me if you have any concerns.
How Do I Feel About This?
You have no idea.
I have been through all five stages of grief since I found out a few days ago:
flat denial (I was sure that the problem could not possibly be as big as all this...)
anger (fury that used up my vocabulary for swearwords within moments)
bargaining (maybe it's not so bad if I look at it this way? *snort*)
depression (cried myself dry a few times and wondered why on earth I even bother with this...)
acceptance (it's done, I'm screwed, be transparent, fix what I can, and move on...).
I can't say I've entirely worked past all of the anger and depression, either. I have implemented more security - though most of the damage was done back in April and early May, and I had fixed all those problems at that time, even if I didn't know the full extent of what had happened. The first part of this post will be going out to all of my customers once I've got it polished a little better - I don't want to institute a panic, but it's important to be completely transparent about what happened. Even if it causes me deep shame and makes me feel like a fraud and a bad, bad person.
I was in the middle of an otherwise fantastic trip to Petersburg at the time - I was actually fairly successful (after a night spent crying and telling myself I was an awful, horrible person) in shunting it aside as something I simply didn't have the tools to deal with immediately, and enjoyed the gorgeous weather and sights of the area. We drove down Metkof highway and got to see dozens of eagles (including a golden that dwarfed the balds), porcupine, deer and more.
I did catch a cold - probably due at least in part to the depressed immune system thanks to a sleepless night of epic-level stress. It has settled in my sinuses and upper chest - I've got a solid, raspy cough and am regularly expunging major snots. Nothing major, but a decided dampener on my spirits. Which I did not need right now, but you roll with what you get, or you go under, and I'm not down yet.
Older, wiser, a tad bitter and more than a little depressed, but not defeated.
Some information from the customer-end databases at Ellen Million Graphics were compromised: if you have an account at EMG-Zine or at Portrait Adoption, your email and password have been publicized.
The Still Fairly Short Version
Ellen Million Graphics, and several of its various sub-sites, have been under near-constant spam/hack attacks for... well, for a very long time. The forums frequently receive 10-100 ‘spam’ join attempts daily. Recently, in the past three months, those attacks have stepped up in intensity and success, and spread out from the forums into SQL injection attacks throughout the sites.
The short version of the long and sordid battle I’ve been fighting with these attempts is that I have met each problem I've uncovered within a day of finding out about it. This week, however, I discovered that one of the early attempts (mid-April) was able to crack into the database and get all passwords and emails from the customer database. Not satisfied with harvesting this information, the perpetrators of this hack have posted this information (emails and passwords only) to several public forums, so that this information has been propagated pretty far.
The security changes I made (back in April, as soon as I discovered the problem) stopped all further leaks at the time, but I was not aware of the scope of the problem or the fact that the emails and passwords had already been harvested and spread until I found one of these forums - just this week - and started to snoop further.
What Should You Do About it?
Change your passwords – immediately, and not just at EMG-Zine or Portrait Adoption. Although there is no personal information stored in your EMG-Zine or Portrait Adoption account, if you use the same password for your email login, that account can be considered compromised! Go and change your passwords. Right now! Get in the habit of using individual passwords at different sites, and change them frequently. Chances are good that this can – and may have already – happened at other sites you use, too. Hackers do not leave polite calling cards letting webmasters know that they’ve been by, and if an alert customer had not let me know about this problem, I’d still be in the dark.
Artist accounts were not (to the best of my knowledge) affected - the only thing they got were the customer-end accounts (EMG-Zine readers and Portrait Adoption customers), where no personal information was stored. No credit card, address, phone, payment or order information was taken. Using the information that they stole, the only thing they could really do at my sites is change your menu preferences and submit descriptions. The major risk is the possibility of your email being hacked if you use the same password here and there. The most likely outcome is that you will see an increase in spam emails (or have, already).
What Am I Doing About it?
Additional security has been and is still being added throughout the site. Every page is being scrutinized for weaknesses and all SQL entries are being ‘sanitized.’ All out-of-the-box software is being updated promptly whenever updates are available. Database passwords are being changed regularly. I am keeping a close eye on my site statistics to stay on top of further attacks, and my hosting company is also watching out for spikes at the server that might indicate a problem. All of this will delay the release of the new Fantasy Art Shop, but clearly takes precedence.
The event has been reported to the authorities and I am attempting to have forums with the lists in circulation shut down.
Some of this, I did before, and I’m only stepping up my frequency and alertness. Some of this is learning a new set of programming skills, and I'm consulting with people who know much more than I do and I am learning everything I can about pro-active countermeasures.
I am deeply apologetic for this breach of your privacy. It is embarrassing and I feel wretched that it happened under my watch. I am angry that there are people out there who would do this, and will do everything in my power to keep it from happening again.
Please contact me if you have any concerns.
How Do I Feel About This?
You have no idea.
I have been through all five stages of grief since I found out a few days ago:
I can't say I've entirely worked past all of the anger and depression, either. I have implemented more security - though most of the damage was done back in April and early May, and I had fixed all those problems at that time, even if I didn't know the full extent of what had happened. The first part of this post will be going out to all of my customers once I've got it polished a little better - I don't want to institute a panic, but it's important to be completely transparent about what happened. Even if it causes me deep shame and makes me feel like a fraud and a bad, bad person.
I was in the middle of an otherwise fantastic trip to Petersburg at the time - I was actually fairly successful (after a night spent crying and telling myself I was an awful, horrible person) in shunting it aside as something I simply didn't have the tools to deal with immediately, and enjoyed the gorgeous weather and sights of the area. We drove down Metkof highway and got to see dozens of eagles (including a golden that dwarfed the balds), porcupine, deer and more.
I did catch a cold - probably due at least in part to the depressed immune system thanks to a sleepless night of epic-level stress. It has settled in my sinuses and upper chest - I've got a solid, raspy cough and am regularly expunging major snots. Nothing major, but a decided dampener on my spirits. Which I did not need right now, but you roll with what you get, or you go under, and I'm not down yet.
Older, wiser, a tad bitter and more than a little depressed, but not defeated.
![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
no subject
Date: 2010-07-10 10:18 pm (UTC)no subject
Date: 2010-07-10 10:25 pm (UTC)*hugs!* It is not your fault! Where there's a will, there's a way, and any determined-enough spammer/hacker/JERKFACE will find some way to get what they are after eventually. And if I hear of anyone doing something like this, I'll punch 'em in the balls. <3
no subject
Date: 2010-07-10 10:37 pm (UTC)no subject
Date: 2010-07-10 10:38 pm (UTC)no subject
Date: 2010-07-10 10:46 pm (UTC)(and Ellen, don't you DARE feel bad about what I just said, because I was stupid enough to use my email password in several places at once!! It was my responsibility to make sure all my accounts were secure - if it hadn't happened through the nasty hackers on your site, it would have happened somewhere else. I call it a lesson learned. And it may not have been a result of this at all - I'll never know, because there were a couple of ways it could have happened. Because I was a password idiot.)
no subject
Date: 2010-07-10 10:59 pm (UTC)It's not your fault, we don't blame you at all, and you're absolutely not bad! <3
no subject
Date: 2010-07-10 11:01 pm (UTC)no subject
Date: 2010-07-10 11:10 pm (UTC)no subject
Date: 2010-07-10 11:17 pm (UTC)no subject
Date: 2010-07-10 11:20 pm (UTC)I wonder if the attacks (and extra security) are why I keep getting timed-out messages when trying to access any of your sites? I'm not getting that with other sites.
I don't have a customer account, but do have an artist account...and Torn World, of course.
Botheration. This just isn't fair! I'd rather have you doing creative stuff!!!!!
no subject
Date: 2010-07-11 01:22 am (UTC)no subject
Date: 2010-07-11 01:55 am (UTC)no subject
Date: 2010-07-11 02:30 am (UTC)how does one change a password from lilypad? I can't find it anywhere.
no subject
Date: 2010-07-11 02:51 am (UTC)I can't imagine how you must have felt finding out about this so long after the fact. :( *hug* Thank you for letting us know so we can take our own precautions! I think folks should have several different passwords for things anyway... And hacks can happen to anyone, be exploited by anyone. Even AT&T was abused by that wacky group recently. :(
no subject
Date: 2010-07-11 03:25 am (UTC)(And Ellen, I second what
no subject
Date: 2010-07-11 04:02 am (UTC)I'm so glad he didn't get your money. I'm also reassured to know that my gmail account was not brute-force hacked. I've been paranoid since it happened, and knowing where the attack came from helps me to know that my account is secure.
no subject
Date: 2010-07-11 04:28 am (UTC)Meredith - I was wondering the same thing about the lilypad, but this is how you can change your password on there...just login to your account & the on the left side under "FAQ", "entrance" etc. there is a link called "reset your password". you are good to go from there.
no subject
Date: 2010-07-11 05:02 am (UTC)So it wasn't just you who couldn't find the link!
no subject
Date: 2010-07-11 04:39 pm (UTC)Jenny
Date: 2010-07-11 05:01 pm (UTC)*does a search on her e-mail address* first thing that pops up some HHfun security team page, stupid a-hole hackers. *goes to change PA lily pad password Thwarting the evil hacker monkeys!* I need to change all my passwords anyways, I've been putting it off because I have to write them all down. I need a little black book.
*HUGS again*
no subject
Date: 2010-07-11 07:39 pm (UTC)no subject
Date: 2010-07-11 09:13 pm (UTC)Let's get things straight, dear and put blame were it belongs: it's their fault, not yours.
Passwords changed everywhere where it matters already a few months ago.
Big hugs from both of us.
no subject
Date: 2010-07-11 10:45 pm (UTC)Hey Ellen, you have a great site, keep up the good work. As for the hackers, I'd like to send out a big wormhole to suck them all up and deposit them in a black hole!
Nothing was compromised here as Jenny is the one who did my PA registry and the password she used doesn't match anything else. I also did a search on Google and came up with two sites that have this e-mail address with the PA password. Both sites are for hackers, one from Brazil.
I'm with Jenny on that black book thing, sticky notes just seem to get lost and trying to access the correct password files in my brain.......right out !
Hugs from here too!
no subject
Date: 2010-07-11 11:08 pm (UTC)no subject
Date: 2010-07-12 12:32 am (UTC)