Connect Internet Solutions Ltd MerseyMail Mersey Mail shut down shutdown closed hack hacking user accounts email broken vulnerability
Posted on | August 14, 2009 | Comments Off
OH DEAR! Message to all Mersey Mail users:
Connect Internet (MerseyMail) now lie to users and call me a HACKER! As ever, these inept companies LIE and BLAME others to cover up their own ACTIONS!
View full TRUE information HERE
There is also a Liverpool community forum here: YO! LIVERPOOL!
Connect Internet issued the following completely inaccurate and plain WRONG statement to their MerseyMail users:
“GENERAL MESSAGE TO ALL USERS REGARDING THE CLOSURE OF THE MERSEYMAIL SERVICE
INCIDENT SUMMARY
A vulnerability has been identified within MerseyMail, possibly affecting a small number of users in a specific set of circumstances. A hacker attacked our system using this vulnerability and then posted a guide on how to do this on their website. We therefore had to respond quickly and, as soon as we were aware of the problem, temporarily suspended the website while we investigated. As a result of this investigation, Connect has taken a business decision to close down the MerseyMail service. We will continue to provide access to any messages within the service using standard mail programs (such as Microsoft Outlook) until 5.00pm BST on Tuesday 8th September 2009, to allow users to retrieve any messages they have stored in the MerseyMail system. The vulnerability has been closed and is no longer exploitable.
Connect has provided MerseyMail as a free service to the Merseyside community for a number of years and hopes that it has been useful to many people in that time. However, we feel that the Web has moved on since the introduction of MerseyMail and there are now many other free e-mail services (such as GoogleMail and Microsoft’s Hotmail) which offer many benefits to users. We therefore feel that it is appropriate to close down MerseyMail. Ideally, we would have liked to close the service in a more structured way (indeed as the first step in this process we stopped new registrations some time ago), but the actions of this hacker have made this impossible.
THE VULNERABILITY
This vulnerability could possibly have affected a small number of users in a specific set of circumstances:
1) The hacker must have somehow obtained your MerseyMail “session ID”
2) You would have to had be logged in to MerseyMail while the hacker was trying to gain access to your account
3) Even if you were still logged in, you would have had to have been active within the “session timeout period”
The hacker only has a few of ways of obtaining the “session ID”. They can somehow see it in your browser (e.g. if you send them a screen shot including your browser’s address bar) or they need to own a web server and actively obtain it from within their system.
If a hacker were to have obtained such access to the system, they would have only been able to access information about that user. They would not have been able to access information about other users.
Connect is not aware of any active attempts to exploit this vulnerability. The only known exploit has been the original hack mentioned earlier.
SENSITIVE INFORMATION
Although there is only a small possibility that your e-mail could have been seen by someone and we have no evidence of that being the case, as a precautionary measure we would suggest changing your password on any account where your current password has been sent to your MerseyMail address. This could be for a forum, or some other type of site requiring membership.
This is only an issue if you received an e-mail including your password in plain text and you have not changed the password since then. It will not affect you if the e-mail was an “activation e-mail” which did not contain the password or if you have subsequently changed that password.
We are really sorry for the inconvenience this has caused, however we feel that this is the appropriate course of action.
mail.team@merseymail.com”
***NOTE: they send and have a reply address to a “closed” service – utterly stupid – Ling
So now I am “a hacker”!!!
Let me deal with this, and these fools and idiots at Connect.
I am not a “hacker”. I am a website owner who sells cars. I have a fantastic personal reputation as anyone can see by reading the 1,350 customer testimonials on my website here: CUSTOMER LETTERS.
MerseyMail freely and knowingly passed MerseyMail user session IDs to websites (being visited by MM users) when links to websites were clicked through in emails, and did not check IPs if the session IDs were used by the website to gain reverse access to MM user email accounts.
Connect (aka MerseyMail) gave away the entry key to users email accounts in a widespread fashion and did not (and were not planning to) inform users until I blew the whistle.
This does not make me a “hacker”. Their use of the term is completely incorrect. Connect were acting as if they were like the Royal Mail posting your front door key to any business that send you a letter to which you respond.
If I was a “hacker”, the police would have arrested ME. Instead, I am the complainant! Connect’s choice of language is astonishing. It is CONNECT who were the subject of police action!
This whole saga is completely and utterly a faux-pas by Connect. A shooting in the foot by them. It was an own-goal in football terms (people in Merseyside will get that).
Now, Connect are lying. I deal with their points – It is not “affecting a small number of users in a specific set of circumstances” it is affecting EVERY user in a very common circumstance. They are being blatantly disingenuous and are misleading.
What they should say is:
“Connect have been giving away your privacy every time every user clicked a website link in an email”
Damn right the actions of the “hacker” (ME) caused them to shut down the service in an “unstructured manner”. The service was giving away every user’s full personal information! How long would they have allowed this to continue in a “structured” manner???
One question is, how many of their users have been exposed to abuse and invasion of privacy and malice by Connect’s criminal condoning of this vulnerability?
Yes, it is criminal. It is a criminal offence under the Data Protection Act.
I did not “somehow” obtain the session ID. – Connect gave it away in plain text with the click through.
It is true that you would have had to have been logged in (ie the session still active), But, knowing the vulnerability, this would have made it easy for criminals. It is easy to act while people are still logged in. Few people click links and then close the program immediately. You click to a website and keep your email program OPEN, to read other messages. Once I logged in, I took over the session, the user could have logged out and I would have still been inside, squirrelling away.
As any link to a website goes to the website owner’s server, every website visited can grab the plain text session key (and plain text username). It is easy. Connect make it sound unlikely. It appeared in front of my eyes like a neon sign saying “rob me, come on in”!
True, the intruder could only compromise (the whole email account) of one user at a time. Connect are saying “don’t worry, the malicious intruder can only break into YOUR house”.
Users will have to change (or should change) lots of passwords to different services. As many people tend to use the same password for many services, giving a thief a good guess at what password the user has for everything, Connects statement about passwords is false. It would only be true if users used unique strings for every account password of theirs. People do not act in that way. We all know that.
Also, an intruder can read ALL user mail, see what you services you are signed up for and hammer away at them all, if they know one typical password.
The intruder can also access a user’s whole address book, raising the issue of the heavy use of MerseyMail by schools and kids.
In their statement Connect are utterly and irresponsibly minimising the danger to users.
I will say to Connect, you are acting diabolically. I am that “Hacker”. Come and get me arrested!!!!
The problem Connect have, is that the police decided Connect were in the wrong and went and knocked on THEIR door, not mine.
I disclosed everything, immediately, to a) the MerseyMail user, b) Connect (who ignored me), c) the police, d) the BBC… all to cover myself, as well as e) on my website here www.lingscars.com/merseymail.php , and f) here on this forum, as well as on my blog and on Twitter. I was completely open.
Questions:
1. Have they informed the Data Commissioner of the scale and their complicity in this scandal?
2. When will they tell the truth to users, including saying that there was no “hacker” in this instance and that the police told CONNECT to close the service down, it was so bad?
3. When will they say it is widespread and happened with EVERY click through, therefore EVERY user has MASSIVE risk?
4. When will the Managing Director/CEO of Connect resign?
Comments
Recent Posts
- News bleat: Woman hurtee-hurtee in house gas blast
- Spotting latest: Murder suspect found dead in cell
- News DAWDLE: Jaguar Academy of Sport : COMMONWEALTH SWIMMING CHAMPION TO MENTOR RHYS WALKER
- News KITTEN: Fear of NHS (wonderfulling free human fixing service) bill damage to Tories
- More news: Firefighters tackle house blaze
- Bottom feeder news: Court rejects Pakistan PM appeal
- News ABUSE: Girl, lah, 10, lah, kept as ‘virtual slave’
- News CHEW: VIDEO: Mexico Tommy Atkins Liberation Army seizes 15 tonnes of drugs
- News CHEW: VIDEO: Highlights of 2012 Design Awards
- News TRICKLE: VIDEO: How Bafta trophy is made
- Gimme News, DOG: VIDEO: Caught out on live TV – it’s Odd Box
- Glowing report: ‘Orderly exit’ for race charity
- Gimme news bleat: Papers discuss Province of Engrish running-dogs coach role
- News CLUCK: Little snow but ice affects roads
- Spotting latest: Barclays’ profits fall to ÂRMB Yuan #5.9bn
Categories
- Car lease News Press releases Lings Car leasing informa
- CAR LEASING HELP RANTS & RAVES!
- CAR LEASING WHOLE BLOG
- Website updates
Archives
- February 2012
- January 2012
- December 2011
- November 2011
- October 2011
- September 2011
- August 2011
- July 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- July 2010
- June 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
- July 2006
- June 2006
- May 2006
About
I am Ling Valentine as seen on Dragons' Den I lease cheap cars in the UK!. Have a look at my Cheap car leasing website
Subscribe to my feed!
My Twitter page!
Search
Admin
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
