Justine's account

[RebeccaMumsnet]

Well!

I am fresh out of the shower from a fabulous camping trip in sunny Wales to a call from one of our lovely staff to say that there was a thread started by "Justine" that was really rather vile.

Apologies all, it seems as though we have some nasties hanging around and have managed to hack Justine's account.

Tech are onto it now and we are looking at in what happened.

Justine is on hols atm. Please do report anything odd that you see.

Thanks all and apologies.

Wonder if tech use remote logons to administor the site and what authentication and security is in place.

I recognise a few of those names.

I have reported it to Tech

plus that was just one site I found - I am sure there are others

Hi all,

We are here and sounding the alarm.

My non-tech brain is playing catch-up but we have shouted loudly and tech are looking now.

We think it may be an idea to get rid of the link to the passwords now, thanks Tiger for the heads-up and we will contact that site and ask for them to remove it asap.

We will update this thread as soon as we know more.

Please do change your password if you haven't already.

I was about to go on a password changing spree but then I realised that the only other place I use this password/email combo is ApprovedFood so unless a hacker wants to gorge himself on out of date dry goods I'm probably ok

MNHQ are all poo poo smelly bums.

And I am not the BoreOfWhabylon...

... or am I?

Mmmm, out of date dried foods you say? If I was a hacker that's the first place I'd go a hacking.

Even if you decide to wait for confirmation of patch before changing password, you might want to look at the details stored on your account registration page and minimise/remove them for the duration.

If you use your MN password for anything else, then it's probably a good idea to change those immediately.

Rebecca, is it ok to change passwords on here now or should we wait till tech says all secure? That link is terrifying - will you be able to notify those affected?

I also only use my password for here, although have changed now.
Rebecca, what about the info in our account details, though?

Fair enough Rebecca. Will do.

It looks patched for that specific vulnerability. You can check at Qualys.com.

Wait, I use it for MyFitnessPal too.
Once they've filled up on stale crisps they can illegally diet!

I used the same pw for here and pof. They are welcome to my share of tossers from on there

And maybe replace the last 2 weeks of cheese, chips and wine with salad?
Thanks awfully.

Maryz

MNHQ - Your security certificate is still showing up as 5 months old. You need to install a new one.

And understand that sometimes a bottle of wine can be classed as lunch, if it's an exceptionally fruity one.

We can't change it from the app can we?

That's just common sense tweasels. Any app that doesn't understand that needs completely redesigning never mind hacking

So going by what garlic has said we shouldn't yet be changing our MN password???

No, topknob, it's recommended to wait until they've updated their certificate. No harm in changing it, obv, but we'll need to change again when Mumsnet gets a new cert.

I've changed all my passwords to something different (from each other and what was it was previously) when things have settled down I'm going to do it again. I wasn't sure what best course of action was so thought this covered all bases

Cross posted again, sorry, garlic says it better than I have.

Thanks garlic not too concerned atm as don't use it anywhere else, just don't want to change it until it is fixed.