We'd like to remind Forumites to please avoid political debate on the Forum... Read More »
Mumsnet website attack warning
lizd31
Posts: 25,216 Forumite
Just had this email from Mumsnet so thought I should warn you
Site attacks and hackergate: here's what we know, what we're doing about it and what we think you should do. Please read!
Dear Mumsnet user,
On the night of Tuesday 11 August, Mumsnet came under attack from what’s know as a denial of service (DDoS) attack. Our servers were bombarded with requests, which required our internet service provider to massively increase server capacity to cope.
We were able to restore the site at 10am on Wednesday 12 August. Meanwhile a Twitter account, @DadSecurity, claimed responsibility, saying in various tweets "Now is the start of something wonderful", "RIP Mumsnet", "Nothing will be normal anymore" and "Our DDoS attacks are keeping you offline".
To add to the 'fun', it seems @DadSecurity also resorted to swatting attacks. Swatting is a criminal practice in which someone makes an emergency call to the police claiming that a crime is taking place at the house of the intended victim, in order to get the police to send out an swat team to the address.
An armed response team turned up at my house last week in the middle of the night, after reports of an armed man prowling around. A Mumsnet user who engaged with @DadSecurity on Twitter was warned to "prepare to be swatted by the best" in a tweet that included a picture of a swat team, after which police arrived at her house in the middle of the night following a report of gunshots. Needless to say, she and her young family were pretty shaken up. It’s worth saying that we believe these addresses were not gained directly from any Mumsnet hack as we don’t collect addresses. The police are investigating both instances.
@DadSecurity also claimed that he had access to Mumsnet user data. Later on August 12th, it became apparent that someone/ones had hacked into some of Mumsnet’s administrative functions, at which point they were able to redirect our homepage to the @DadSecurity Twitter profile page, as well as to edit posts from two users’ account and a MNHQ account on our forums.
Someone claiming to be the hacker also posted on the thread on which users were discussing the site outage. We immediately locked down all access to our admin functions and reported the attack to the police. We were confident that users’ passwords had not been accessed, because MNHQ doesn’t hold them as plain text; they’re all encrypted, so that no one - not even us - can see them.
However, over the weekend, a user reported that posts had been made under her name which weren’t by her, and we spotted two other cases where this had happened. This clearly suggested that the hacker had nonetheless been able to get hold of some users’ passwords.
Our best guess at this stage (and it is just a best guess) is that this has been done via a form of phishing, in which the hacker creates a fake Mumsnet login page to which users are directed when clicking on our login button. The page would have had a different url but otherwise would look just like the usual page. The hacker would have been able to see passwords in plain text when they were typed in.
We take great care to protect the information you give us and not to ask for or store any more information than we need to run the site, but though we can’t know how many accounts have been affected, there have been enough breaches for us to ask all Mumsnet users to change their passwords. As a result, you’ll no longer be able to log in to Mumsnet with your current password, and will need to create a new one, here.
This will mean that any passwords the hacker has been able to harvest up to this point will be useless. We are looking into what we can do to strengthen our defences against phishing, but in the meantime we need to ask you to be vigilant, and to check the URL of the login page for the foreseeable future. The correct URL is www.mumsnet.com/session/login and it reads https:// rather than http:// at the beginning. We will place a warning on the login page reminding you to do this.
Alternatively use the social login option (ie Facebook/Google) as then you won’t be required to enter a password. And if you log into any other sites using the same password as you use on Mumsnet, it makes sense to change your password on those sites, too.
We’re really sorry for the alarm and inconvenience this might cause, and we realise you’re likely to have further questions about what’s been happening, so here's a summary of answers to the most obvious questions.
You say the hacker was able to access Mumsnet users’ data: was data from my personal account accessed?
We have no way of knowing how many Mumsnetters were affected - so far we have evidence of 11 user accounts being hacked but it’s an ongoing investigation. Those users have been informed, and their passwords have been reset. We think it prudent, however, that everyone reset their passwords - which in any case is a sensible thing to do from time to time.
What data could the hacker see?
By using your password and login, he would have been able to see the data on your profile - so that includes your username or email plus your password, your postcode if you’ve supplied it, your username history and your Mumsnet inbox.
Now that I’ve changed my password, can you guarantee that my data is safe?
Unfortunately, we can't give you a cast-iron guarantee of this - no site can. By forcing a password reset the hacker won’t be able to log in as you; however, if phishing was the cause, the page could be phished again, which is why it’s important that you check the URL of the login page when you enter your details, or use your social login. If the URL is anything other than www.mumsnet.com/session/login, don’t use it.
Final thoughts
The internet is of course brilliant, but it’s not 100% safe and secure. Whenever you share anything on the web, either publicly (such as on a Mumsnet thread) or privately (such as the data you give to a website when signing up), have a think about how happy you’d be for that information to fall into the hands of someone else. Make your passwords as secure as possible and change them every few months. Use different passwords for different accounts. Close redundant accounts that you no longer use.
And if you read nothing else...
I do realise this email is long, so here’s a quick summary:
DO reset your Mumsnet password
DO make passwords really strong to reduce the risk of them being guessed
DO check the URL of any login page to reduce risk of phishing
DO verify that https:// is being used on login pages
DO use social login to avoid typing passwords
DON’T give out information to any organisations without verifying they are who they say they are (such as the fake @mumsnetsupport twitter account that had also been started but has now been removed by Twitter).
Please post on this thread or mail us on contactus@mumsnet.com with any questions or thoughts. As you can imagine our inbox is fairly voluminous at the moment but we'll get back to you as quickly as we can.
Thanks very much for reading,
Justine
Site attacks and hackergate: here's what we know, what we're doing about it and what we think you should do. Please read!
Dear Mumsnet user,
On the night of Tuesday 11 August, Mumsnet came under attack from what’s know as a denial of service (DDoS) attack. Our servers were bombarded with requests, which required our internet service provider to massively increase server capacity to cope.
We were able to restore the site at 10am on Wednesday 12 August. Meanwhile a Twitter account, @DadSecurity, claimed responsibility, saying in various tweets "Now is the start of something wonderful", "RIP Mumsnet", "Nothing will be normal anymore" and "Our DDoS attacks are keeping you offline".
To add to the 'fun', it seems @DadSecurity also resorted to swatting attacks. Swatting is a criminal practice in which someone makes an emergency call to the police claiming that a crime is taking place at the house of the intended victim, in order to get the police to send out an swat team to the address.
An armed response team turned up at my house last week in the middle of the night, after reports of an armed man prowling around. A Mumsnet user who engaged with @DadSecurity on Twitter was warned to "prepare to be swatted by the best" in a tweet that included a picture of a swat team, after which police arrived at her house in the middle of the night following a report of gunshots. Needless to say, she and her young family were pretty shaken up. It’s worth saying that we believe these addresses were not gained directly from any Mumsnet hack as we don’t collect addresses. The police are investigating both instances.
@DadSecurity also claimed that he had access to Mumsnet user data. Later on August 12th, it became apparent that someone/ones had hacked into some of Mumsnet’s administrative functions, at which point they were able to redirect our homepage to the @DadSecurity Twitter profile page, as well as to edit posts from two users’ account and a MNHQ account on our forums.
Someone claiming to be the hacker also posted on the thread on which users were discussing the site outage. We immediately locked down all access to our admin functions and reported the attack to the police. We were confident that users’ passwords had not been accessed, because MNHQ doesn’t hold them as plain text; they’re all encrypted, so that no one - not even us - can see them.
However, over the weekend, a user reported that posts had been made under her name which weren’t by her, and we spotted two other cases where this had happened. This clearly suggested that the hacker had nonetheless been able to get hold of some users’ passwords.
Our best guess at this stage (and it is just a best guess) is that this has been done via a form of phishing, in which the hacker creates a fake Mumsnet login page to which users are directed when clicking on our login button. The page would have had a different url but otherwise would look just like the usual page. The hacker would have been able to see passwords in plain text when they were typed in.
We take great care to protect the information you give us and not to ask for or store any more information than we need to run the site, but though we can’t know how many accounts have been affected, there have been enough breaches for us to ask all Mumsnet users to change their passwords. As a result, you’ll no longer be able to log in to Mumsnet with your current password, and will need to create a new one, here.
This will mean that any passwords the hacker has been able to harvest up to this point will be useless. We are looking into what we can do to strengthen our defences against phishing, but in the meantime we need to ask you to be vigilant, and to check the URL of the login page for the foreseeable future. The correct URL is www.mumsnet.com/session/login and it reads https:// rather than http:// at the beginning. We will place a warning on the login page reminding you to do this.
Alternatively use the social login option (ie Facebook/Google) as then you won’t be required to enter a password. And if you log into any other sites using the same password as you use on Mumsnet, it makes sense to change your password on those sites, too.
We’re really sorry for the alarm and inconvenience this might cause, and we realise you’re likely to have further questions about what’s been happening, so here's a summary of answers to the most obvious questions.
You say the hacker was able to access Mumsnet users’ data: was data from my personal account accessed?
We have no way of knowing how many Mumsnetters were affected - so far we have evidence of 11 user accounts being hacked but it’s an ongoing investigation. Those users have been informed, and their passwords have been reset. We think it prudent, however, that everyone reset their passwords - which in any case is a sensible thing to do from time to time.
What data could the hacker see?
By using your password and login, he would have been able to see the data on your profile - so that includes your username or email plus your password, your postcode if you’ve supplied it, your username history and your Mumsnet inbox.
Now that I’ve changed my password, can you guarantee that my data is safe?
Unfortunately, we can't give you a cast-iron guarantee of this - no site can. By forcing a password reset the hacker won’t be able to log in as you; however, if phishing was the cause, the page could be phished again, which is why it’s important that you check the URL of the login page when you enter your details, or use your social login. If the URL is anything other than www.mumsnet.com/session/login, don’t use it.
Final thoughts
The internet is of course brilliant, but it’s not 100% safe and secure. Whenever you share anything on the web, either publicly (such as on a Mumsnet thread) or privately (such as the data you give to a website when signing up), have a think about how happy you’d be for that information to fall into the hands of someone else. Make your passwords as secure as possible and change them every few months. Use different passwords for different accounts. Close redundant accounts that you no longer use.
And if you read nothing else...
I do realise this email is long, so here’s a quick summary:
DO reset your Mumsnet password
DO make passwords really strong to reduce the risk of them being guessed
DO check the URL of any login page to reduce risk of phishing
DO verify that https:// is being used on login pages
DO use social login to avoid typing passwords
DON’T give out information to any organisations without verifying they are who they say they are (such as the fake @mumsnetsupport twitter account that had also been started but has now been removed by Twitter).
Please post on this thread or mail us on contactus@mumsnet.com with any questions or thoughts. As you can imagine our inbox is fairly voluminous at the moment but we'll get back to you as quickly as we can.
Thanks very much for reading,
Justine
Positivity is the key to success
0
Comments
-
I think this message is from the hackers.0
-
Crystal_Green wrote: »I think this message is from the hackers.
What makes you say that?2019 Wins
1/25
£2019 in 2019
£10/£20190 -
Well I just changed my password and then I deleted some messages at which point I got forwarded to an to an iffy looking page with just the word 'success' written on it with no http.
Better safe than sorry. I may be wrong.0 -
why does the mumsnet link given above take you to Facebook ?0
-
Crystal_Green wrote: »Well I just changed my password and then I deleted some messages at which point I got forwarded to an to an iffy looking page with just the word 'success' written on it with no http.
Better safe than sorry. I may be wrong.
Ahhhh, okay! I completely understand where you're coming from!2019 Wins
1/25
£2019 in 2019
£10/£20190 -
Just go to Mumsnet yourself - type in the address bar. I've changed mine fine and deleted messages as I won a competition with them a couple of weeks ago and had to send my address - I didn't want SWAT teams at my door thanks!Thanks to all posters :A0
-
I'm just glad that I had deleted a message I sent with all my postal details in it for a prize I won - the moment the prize arrived last week...0
-
http://www.dailymail.co.uk/news/article-3202952/Armed-police-launch-late-night-raid-home-Mumsnet-founder-fake-tip-fathers-group-said-hacked-website.html
Much as I hate to refer anyone to the Hate.0 -
Thanks for this.
Can anyone post a link to the list? I believe there is a thread in Mumsnet that someone has done just showing all the user names affected (they have removed the passwords).
My password has obviously changed as I cannot sign in and I am reluctant to create a new one just now.The best things in life are free.....0 -
Think this is the thread you are talking about:
http://www.mumsnet.com/Talk/_chat/a2451977-Am-I-on-the-list
There are 4 posts from akkakk @ 09:01 - 09:03 that have the usernames.
HTH.0
This discussion has been closed.
Confirm your email address to Create Threads and Reply
Categories
- All Categories
- 350.1K Banking & Borrowing
- 252.8K Reduce Debt & Boost Income
- 453.1K Spending & Discounts
- 243K Work, Benefits & Business
- 597.4K Mortgages, Homes & Bills
- 176.5K Life & Family
- 256K Travel & Transport
- 1.5M Hobbies & Leisure
- 16.1K Discuss & Feedback
- 37.6K Read-Only Boards