Dear Mr. Ferro:
Hello. I’m a former member of this message board, back because of the recent hacking.
You purchased the Chicago Reader and its related entities, including this website, almost two years ago. You’ve made public comments that set the Reader as a key investment. “The Reader is what we wish everything was like. Self-sufficient. They make money,” you said. You are also on record as identifying, correctly I believe, the waning of print media and the need to establish a profitable digital strategy for the content previously distributed in printed periodicals You impressed Reader publisher Allison Draper with your “digital savvy.”
So here we are. Digital. I don’t know much about how to run a profitable digital content-generation business. Maybe no one does yet. But I do know this: the digital world is a social one, information hates being hidden in darkness here, and transparency is paramount to anyone with aspirations to profit from the trust of digital customers. Which is to say, in the wake of the recent hacking of the Straight Dope Message Board’s database, your digital customers are not going to write a letter to a snail mail address and they’re not going to call an old-fashioned, 20th Century “1-800” number. No, Mr. Ferro, if you want to profit to digital customers you’ll have to get used to dealing with digital failures in a public digital space.
In connection with that, I have some questions about the recent hacking of the message board’s software.
We are told that a “security team” “recently” discovered that the database had been hacked. How recently? Specifically, how much time elapsed between the discovery of this hacking and the disclosure of it?
When did this hacking occur? Was it a one-time event or did it occur over time?
How did the hacking occur? There are rumors of a zero-day security issue with the message board’s software vendor VBulletin, which rumors the owners of VBulletin dispute. Was this hacking a result of a VBulletin vulnerability, of poor password practices by administrators of the site, of a sustained brute-force attack which was undetected while it was ongoing or some other way? If another way, how? If through a VBulletin failure, is the message board still vulnerable? Is it still vulnerable anyway?
The notice specifies that the information stolen included usernames, email addresses and passwords. Was that all the information taken, or was other information taken? I’m asking here about text information which users may have included in their profiles, IP information, status as a paid, free, or administrative member or any other information.
The notice claimed that the message boards do not collect or store Social Security numbers or credit card information. Yet, many members have provided exactly that information to Paypal using this message board as a conduit. What method does the message board software use to determine who has paid and when? Do they use a transaction number from PayPal? Can that number or other information which the software does retain be in turn be associated with a credit card number by a sufficiently diligent hacker? Can you reinforce the claim the notice made that users’ credit card numbers were not obtained by the hackers and further, can you make it clear that no other information was stolen might be used to obtain such numbers?
The notice which was sent by email employed links back to this message board which were formatted in such a way as to resemble a “phishing” email, alarming many who received the email and in some cases causing the email to go to users’ spam folders. Does your team now understand that that was a poor idea, particularly in an email discussing a security breach?
Like any message board, this one has turnover. Only approximately 5% of the accounts registered to this website are active. Will you agree to purge the accounts of those users who are not active (say, who have not signed in for a year) to minimize the damage done by future security breaches? If not, why not? What benefit is gained by retaining a large database of usernames, passwords and other information if the users are not active?
More broadly, Mr. Ferro, we’d like to hear your voice on this hacking generally. You can’t be happy about it. You doubtless know both that no site is 100% safe from the kind of security breach which occurred here and that such events erode trust in the sites to which it happens, even if that eroded trust is undeserved. In this case, what you may not know is that the site has now been successfully hacked at least three times. What assurance can you give your customers here that you are making the necessary investments in personnel, hardware and software to minimize the chance of a recurrence of this breach? What other thoughts do you have about what happened? It’s very difficult to believe that the over-lawyered notice your organization originally sent out and your employess’ subsequent radio silence reflects your view of how such things should be handled.
Thank you for your attention to this matter. I’ll be leaving after this issue is settled; I never intended to return but for the hack. However, after addressing this issue, you may want engage the remaining users in a discussion about ad blockers, malware and the class of advertiser you allow to access your customers on this site.
MODERATOR NOTE: Please be aware this thread is from Jan 2014, resurrected in Post #17 in Jun 2014. – CKDH
is a symbol for a winking eye. This indicates to readers that I did not intend the statement preceding it as a threat. Sites getting hacked goes with the territory and there is no reason to get lawyers involved at this point. OTOH (more jargon, “On The Other Hand”), my mentioning it recognizes that someone who suffers a loss because of the hacking will disagree. I know that anybody’s first reaction is to clam up for fear of making the situation worse, or in hopes of it going away, but time and again the clamshell method has encouraged people to create their own interpretations of a company’s silence, and people do not default to making positive interpretations. Openness is an essential part of good customer relations and I hope you understand this.