One onOne with Mike Wong

I wanted to circle back and provide an update to my earlier post about the spam emails that some people have received. In total, we received 19 reports from users (including employees here at onOne) who received an email (click here and here for examples of what the emails looked like – warning: I would not recommend going to any URL that you see in these graphics) to an email address that had only been supplied to onOne Software for the purpose or requesting a trial download or registering a product purchased at a retail store. Just to reiterate, we did not sell or knowingly make available any email address to a third-party.

Since this was brought to our attention, we have spent over 240 hours collectively between 3 employees of onOne Software and 2 external contractors that we have worked with for over 4 years looking into this incident. Clearly, some of you received these spam emails to addresses that were only made available to us, and since we didn’t send them (the original emails were sent via exploiting the Share This feature at Flickr as discussed here) that would imply some sort of breach of our database. During our investigation, we found that a php file that we did not create was somehow copied into a temporary directory that was used by a php-based site search engine that we had been using for over a year. In that php file were many links pointing to another site that in turn had a set of links formatted in the same way that pointed to yet another web site based in Russia. It appeared to us that this Russian-based web site had done this in an attempt to increase their Google search ranking as there were very specific calls in the php file to try to get picked up by Google search engines.

However, just writing a file to that temporary search directory would not have given anybody access to our database. Additionally, we realized that this file had been placed in this directory within 24 hours and removed it and the search engine immediately. We have since replaced that search engine with one that we have licensed from Google.

Aside from this temp directory being written to, we could find no other evidence of a server or database breach. This is frustrating, but I can’t provide a concrete evidence of how any email address could have been stolen from us. I could speculate, but it would be just that. Regardless, here is what we’ve done to try to prevent anything like this from happening again.

1. We’ve updated all of our servers with the most recent security patches available and have double-checked our existing plan to have updates applied on a regular basis.
2. We’ve contracted with two separate consultants to perform a security audit of our site and have implemented their recommendations.
3. We have recently renewed our Verisign SSL Certificate using their 256-bit encryption to meet their Extended Validation requirements which is their highest level of SSL Certificate they provide ensuring a secure environment for any e-commerce transaction.

I’d like to thank everybody who sent the emails they received to us to help us try to figure out what happened. I’ll be following up with each of you individually after this blog post. Further, I’d like to thank Kevin C. from Yahoo! who helped clear up some confusion of mine about how the spammers had taken advantage (ever so briefly) of Flickr’s Share This feature. If you have any questions or comments you can share them with me using our Contact form.