Data Breach Notice - Immediate Attention Required

[Hahvoc The Decepticon]

Someone managed to sign up to the forums with a blank username. This causes a bug in MyBB which causes them to be BCCed on every private message. Said person knew what they were doing and what the results would be - immediately on activating their account, they went straight to pms and started hitting refresh.

Vekseid is working on a solution to this and the user in question has been banned and no longer has access to PMs. However, they did manage to gain access to about a dozen PMs rather than the hundreds they could have read. The user's email address has also been invalidated.

It came to our attention that the reason the username was blank was because of a character byte error, which has been addressed.As this hasn't happened before, Vekseid is currently working on a proper solution to the BCC problem, and will be sending the solution to the MyBB team accordingly.

Vekseid will be contacting the users who had their PMs read and following up with them, and will be issuing an apology.

This shouldn't have happened, and we as staff, are sorry this has occurred at all.

 

[Vekseid]

Again, I'm sorry about this, everyone.

I have resolved the underlying bug (which the patch did not fix) and fired it off to the MyBB team.

Am going to be pming the affected users now, along with the pm reported. If you don't get a PM from me about this, your pm did not get read.

 

[darkangel76]

Thanks, Vek. As always, you're awesome. *much love*

 

[Vekseid]

Everyone who had a PM read has been messaged regarding each individual incident.

Fortunately, though the attacker had access to some two thousand pms (about five hours worth), they didn't very many, nor did they use the export feature (thank fucking heavens).

Again, this was entirely a trick exploiting a couple of bugs in the system to get BCCed on every single message that did not have a BCC explicitly specified. No e-mails or details not otherwise publicly visible, besides PMs and their subjects were exposed.

 

[Solidsnake61988]

Dayum. Wonder what other bugs there are

 

[solitaryman]

Vek, thank you for your efforts.

 

[ThomasRHellsing]

That sucks, but I don't think anyone blames BM itself. people are sometimes ass holes. It's part of the internet. I'm glad it didn't happen to me, but even if it did I wouldn't be angry with you guys.

 

[White-wolf]

Well two of my messages seemed to be affected by this but apparently none of them where read.

However wow... what people do to entertain themselves.

 

[Raziel99]

I'm glad this was cleared up, and it shows Vek's mastery in this art. You did a good job. I was wondering why it said multiple people got messages. Weird quirk.