Blue's WordPress Blog

If you recall, ezboard, Inc. claimed to have been the victim of a hacker when they lost 70,000 or so messages from our ezboard alone when the alleged hacker deleted current posts and the “backups” that we were paying them to keep for us – see my earlier post on this.

Following this data loss and the ensuing debacle with ezboard, Inc. clearly being caught with their pants down, followed by one of their Customer Services [sic] people making false accusations against me when I began asking awkward questions of them, I began watching and taking part on a board hosted by ezboard. As more and more details emerged in that forum, ezboard’s employees started editing and deleting posts and banning users taking part in an effort to silence us. Fortunately, copies of posts were kept and shortly before ezboard deleted the message board in its entirety, a full backup copy of the board was taken. Ironic isn’t it that some users could achieve what ezboard themselves had failed to do.

In the meantime, a number of us users were invited to start posting on a similar message board hosted by InvisionFree which was basically private for viewing purposes. That board included the only link at that time to the ezboard backup hosted on a secured server elsewhere. The server logs started showing access attempts from a number of unidentified IP addresses, so that raised some questions as to who they were and how they knew about the backup.

Around that same time, I discovered a security flaw in Yuku: in common with most message board systems, the board Administrators and Sysops can see the IP address of the person making posts on the board. Unfortunately, the implementation of Yuku at that time was such that although the IP addresses of those posting on forums such as the Yuku Help [sic] Forums were not visible when viewing the forums in a browser, they were as soon as the source code was viewed, so that any Tom, Dick or Harry could see the IP addresses of anyone who’d posted on the Yuku Help [sic] Forums.

Cross-checking the IP addresses from those running authentication hack attempts and the IP addresses for ezboard’s staff and CEO revealed a number of matches. Attempts had been made to access the ezboard backup using usernames and passwords that would only have been known to the ezboard users or those with enhanced privileges at ezboard, Inc.

Another message board has since been set up on InvisionFree to discuss ezboard and Yuku following the infiltration of the first one and there is a full discussion about the successful authentication hack attempt in this thread, which I’ll reproduce below:

“How ezboard employees hacked into my server…, … and our former Invisionfree board!

Yes, you read that right. The company who claims to be hacked in May 2005 accessed without permission my private webserver starting the 16th of february 2006, and after access was restricted with a password continued trying to access it after using a so-called authentication hacking attack, in this case using ezboard usernames and passwords trying to get in. This attack, logged in detail on my server, initially failed. The authentication was eventually cracked by a ezboard employee using information gleaned from a cloaked forum at Invisionfree called EzDisasterOf2005, a community for ezboard critics only. This forum only could have been accessed by using usernames and password equal to those at ezboard that some people used on that forum. A little further checking has given us evidence that at least one account had been breached that way and was used up until the 15th of April to access that private forum before all the passwords were changed. Of course by then we already basically stopped posting in that place and started a public one again; the one you’re reading right now.

Also I’ve learned ezboard filed complaints at Invisionfree about violation of certain copyright (against a private and cloaked forum they had no authorized access to!). Even though these few bits were removed in the end the complaint had no legal base at all, since criticism, comment and parody are fair-use, and so this was basicaly just plain harassment by ezboard, added to their unauthorized access.

Let me try to put it into context a bit and add some specifics as well. I have left some detail like IP addresses and hostnames out for security reasons. But you can be sure I’ve them all ready if challenged to provide them!

On February the 18th without any warning ezboard closed down a board called The Great Ezboard Disaster of 2005. It was locked down claiming accordance with the Terms of Use. Why exactly a board that existed already ten months, discussing quite candidly the The Great Hack as well as the future of ezboard and the coming Yuku was closed will remain a question. It doesn’t matter for this story though, even while I’ve some ideas since some material was posted there in February by a ‘newcomer’ that was censored out immediately by ezboard staff without warning. Maybe material for a future follow-up…

Back to that locked down board. In the summer of 2005 some of the members there already felt the need to have a cloaked board away from ezboard and started a private community at Invisionfree to speculate more freely about things all the while thinking ezboard might close down the older public board at some point. When posts at the original board, The Great Ezboard Disaster of 2005, started being edited by ezboard staff in February 2006 some of us wondered if the last days of that community finally had been entered. This brought me to the action of spidering the board to create an off-site archive. After spidering it was converted in into a PHPBB for ease of search by a great phpbb-mod called ezboard-conv.

After having posted the URL to the archive at the private and cloaked Invisionfree board for reference, right away a lot of IP addresses started accessing the archive. Some of those were very familiar but some were not: they belonged to ezboard staff. The way I knew this is because back then IP-addresses showed up in Yuku when posts or announcements were made by staff or the CEO. This ‘feature’ was disabled later on but helped to track down this hack. There are a couple of other sites where over time the link between IP and certain ezboard staff could be verified. It’s a 100% match without any doubt in terms of dynamic IP addresses or things like that. What do we have exactly then?

Unauthorized access of the private archive by so-called ezmods, to be more precise “alison aka ezAtlas aka Pink”, “mishmaroo aka ezMish”, “GoalieAunt” and “jennifer aka Ezjennifer”, as well as access from what appears to be a San Francisco office where ezboard often operates out from, using Covad as DSL supplier (just to let you know we have the details here). The most serious authentication hacking attack occurred from this last address only and we can only assume the ezmods followed or assisted in…. whatever they were looking for in an archived ezboard community they had nuked the day before themselves! The evidence of the authentication hacking consists of a logfile showing several ezboard accounts and passwords being used that were in use at the original ezboard community, see also the attachment to this post. All from the same IP address in San Francisco, one I know is used by ezboard staff, one I know is used to post CEO announcements and by the main developer at times.

I don’t know who accessed our private forum at Invisionfree using ezboard usernames and passwords from their user administration but we know from logfiles ‘mishmaroo Ezmish’ was still reading there in April 2006. We tracked down the account she had hijacked for this purpose and changed passwords there too.

So here we have the whole wonderful ezboard family, the ones we’re supposed to love and trust and feel bad for how they were ‘hacked’ in May 2005. But if hijacking accounts of other messageboard systems and guessing passwords to enter private servers is the habit for these people, I really start to wonder if these people can be trusted to tell the truth about anything at all, especially when they claim to be ‘hacked’ by some very mysterious shadowy hacker who had access to almost everything.

The case is too complex for a legal battle over hacking since my private server was not in the USA. While a case has been filed at various abuse departments the abuse is just too small for ISPs to take much action. But perhaps the truth can get out with this post nevertheless.

This boils down to ethics: why ezboard, as a ‘respected’ company, should attempt to access our password protected backups (as if they can be trusted with it), why they should hack, infiltrate or attempt to harass consumer groups. Feel free to respond or just draw your own conclusions.

(Attached: cleaned up logfile with authentication hacking in progress)”

This is what the attachment says:

h-68-167-xxx-xx.snfccasy.covad.net – - – [23/Feb/2006:09:55:47 +0800] “GET /ezboard/archive/tged2005/index.php HTTP/1.1″ 401 409 h-68-167-xxx-xx.snfccasy.covad.net – Dinkster123 xxxxxxx [23/Feb/2006:09:56:40 +0800] “GET /ezboard/archive HTTP/1.1″ 401 409 h-68-167-xxx-xx.snfccasy.covad.net – Dinkster123 xxxxxxx [23/Feb/2006:08:57:08 +0800] “GET /ezboard/archive/ HTTP/1.1″ 401 409 h-68-167-xxx-xx.snfccasy.covad.net – I love MJNet xxxxxxx [23/Feb/2006:10:12:13 +0800] “GET /ezboard/archive/ HTTP/1.1″ 401 409 h-68-167-xxx-xx.snfccasy.covad.net – RichardHMorris xxxxxxx [23/Feb/2006:10:12:40 +0800] “GET /ezboard/archive/ HTTP/1.1″ 401 409 h-68-167-xxx-xx.snfccasy.covad.net – zanack xxxxxxx [23/Feb/2006:10:13:21 +0800] “GET /ezboard/archive/ HTTP/1.1″ 401 409 h-68-167-xxx-xx.snfccasy.covad.net – AutobotXYZ xxxxxxx [23/Feb/2006:10:13:53 +0800] “GET /ezboard/archive/ HTTP/1.1″ 401 409 h-68-167-xxx-xx.snfccasy.covad.net – soggybendoggy xxxxxxx [23/Feb/2006:10:14:19 +0800] “GET /ezboard/archive/ HTTP/1.1″ 401 409 h-68-167-xxx-xx.snfccasy.covad.net – finally got it! xxxxxxx [23/Feb/2006:11:48:16 +0800] “GET /ezboard/archive/tged2005/index.php HTTP/1.1″ 200 21669 

Like the original post says, draw your own conclusions.

Of course, given that ezboard, Inc.’s CEO apparently reads this Blog (or at least someone claiming to be him and using the same IP address range as our records indicate), Rob Labatt might choose to ‘set the record straight’ by commenting here…
 

The final update from Rob Labatt on his Yuku thing brings into play the “Feature Voter” – you’ll have to be registered with Yuku and logged in to actually view or use this facility.

Yuku say:

“At Yuku we believe that you know what features you want and when you want us to build them. We created the Yuku feature poll so you can tell us what features you want us to develop next.”

I’m frankly amazed that at this stage in Yuku’s development, some of the features being discussed are still at the “will we, won’t we” stage, given that most of them are already included in competing products available today (no, really available today…).

Not included amongst the features to be voted on are such items as the promised advertising revenue management sharing, the board backup facility – now promised to be available “eventually” (!), etc. but then given that the list is written by Yuku rather than the users, it’s not surprising they’re missing.

Amongst the items included are those they’ve already announced such as the Photobucket integration I mentioned earlier! No doubt this will then be used as a way to say, “look! We do listen to what you say and ask for!”

And the title of this post? Well, if you look at what Labatt said at DEMOfall in September 2005, he said they’d had 100 interviews with their biggest board owners and received 33,000 responses to a questionnaire (presumably) looking at what ezboard users wanted. So has this all been brushed aside in favour of the new “feature voter”? The one that’s so impressive that with the claimed Yuku/ezboard millions and millions of users, the most popular feature so far, “Domain HTML Pages”, has received a massive 19 votes!

ezboard, Inc.’s CEO, Robert Labatt’s positive spin on just how slow Yuku is (and their outages as I noted here last week) is on his Yuku Bleurgham.

He says they’re fixing the (unspecified) problem now and are installing some more servers.

Apparently, the “tons” of users using Yuku are what’s causing the slowness … which is good news! This is, of course, before all the ezboards are brought over to Yuku and the system flooded with the many millions of (claimed) ezboard users.

If you think it’s slow now…

But never mind:

 ”Keep it up! Make us slow (we can handle it and promise to fix it fast).”

Er, didn’t Labatt promise to make Yuku faster waaay back in March?

So, moving on to those updates ezboard’s CEO, Robert Labatt, in his own Yuku “blorum”.

When Yuku was opened up to ezboard users and just before my account was globally banned by ezboard from ezboard, I advised their then lead (only?) developer of an issue with including images hosted on Yuku in a post on Yuku, specifically just how difficult it was to accomplish this especially when compared with doing the same task in vBulletin. The message was subsequently deleted so I can’t link to it or give a certain date when I advised them of this, but I would guess it was sometime in February 2006.

So imagine my amusement when I read this post:

“…I know the images folders are not the easiest to use right now. We are developing new screens for images management that are waaay easier to use. And, we have a deal with PhotoBucket that will let you access your PhotoBucket account right from the post editor. Cool huh.”

For best impact, click through to that post (if you have JavaScript enabled and don’t mind a number of tracking elements cutting in…) and note that that post had to be created and then edited four times to get the image and the text in it

Waaay cool, Rob!

OK, setting aside that irony for one minute, let’s look at the ‘meat’ of that announcement: the “deal” with Photobucket.

Ignore for a moment the ease with which you can link to your online images hosted elsewhere in other blogging platforms and more particularly how with a hosted vBulletin installation, including your own images couldn’t be more simple.

Concentrate instead on the “deal” with Photobucket. Sounds good, eh? A waaay cool coup for Yuku/ezboard, isn’t it?

Whatever you do, don’t look at this blog entry from Photobucket themselves where they announce that capability for “any Web site” (emphasis added) and Photobucket’s Jwidget affiliate program if you don’t want the exclusivity illusion shattered. Yes, it’s available to any web site and Yuku/ezboard stand to make money from it.

Some more updates from ezboard’s CEO, Robert Labatt, in his WordPress “CEO Blog” on ezboard and on his own Yuku “blorum”. I’ll deal with the Yuku updates in a separate post as this one will be fairly lengthy.

ezboard’s Customer Services [sic] staff have been doing their best to ‘rubbish’ the ezboard platform for a while now, as did Rob Labatt in one of his original blog entries on 7 March 2006 (referred to by Cincom as it was apparently critical of its product, Smalltalk, that ezboard was based upon). 

And yet now we have Labatt saying:

“Well, today ezbaord has more features than Yuku.”

Given ezboard, Inc.’s criticism of, er, ezboard and given that ezboard has been working on Yuku for what, 18 months now, wouldn’t you expect Yuku to have at least as many features as ezboard by now? The same Yuku that ezboard heralded when they lost all that data in May/June 2005. The same Yuku that was launched as “available today” at DEMOfall in September 2005.

So after all this time developing Yuku, Labatt says they’re building new message boards “right now”, presumably having spent the last 18 months faffing about with user profiles? Surely the core element of Yuku must be its message board system? He goes on to say that they will be faster, although he doesn’t state what Yuku will be faster than. Presumably he means faster than ezboard rather than faster than competing products like vBulletin. I made a post on another message board comparing a like-for-like visit to a thread within a forum on Yuku and another at the same level on a vBulletin installation:

“Let’s see how fast it is from a new browser instance (already opened) navigating to http://help.yuku.com then the busy bug reporting forum followed by the first non-sticky thread.

I am on a 2MB ADSL connection here in the UK with only a 20:1 contention ratio. This is with Firefox on a PC.

Not bad today: 38 seconds.

For comparison, I went to a vBulletin installation I have running on a shared server. I entered the URL of the board, then clicked on a forum and the first non-sticky thread.

7 seconds.”

So it looks like Yuku still needs some significant work to make it faster and more feature-packed than even ezboard was. Hmm. What about Rob Labatt’s CEO Blog entry on 14 March 2006 where he writes:

“Ceco and his team are working to make Yuku faster and we are developing new features every week.”

Oh dear…

Labatt then goes on to say that once they’ve finished writing the message boards – “this summer” – they will then build the board import tools. But wait: didn’t ezboard say on 13 March 2006 that:

“In the next few weeks there will an easy to follow Free Board migration process available in Yuku.”

and

“In the next few weeks there will an easy to follow Gold Board migration process available in Yuku.”

and

“During the next two months we will help you move your board over…”

Yes, yet again, the promised timescales and milestones from Rob Labatt continue to drift and pass by without being met.

Back to the Bizarre Land of Yuku/ezboard then with the next statement from Rob’s latest CEO Blog entry:

“What you see on Yuku today is not what you will see in a few months.  So don’t go making plans based on what you see today.”

Yes, this is also the line being trotted out on the Yuku Help [sic] Forums whenever anyone takes a look at Yuku and declares themselves unhappy with the ‘look and feel’, speed or other aspect of Yuku.

And yet, Yuku was launched back in September 2005 and ezboard users were actively encouraged to go and give it a try. Indeed, users visiting their ezboard user control panels presently will see an import/export button to create a matching Yuku profile that can be used on Yuku. Why bother showing someone something only to say that it won’t be like that when it’s finished? And why bother developing and supporting something that’s apparently going to change so significantly? Unless, of course, the users are starting or continuing to vote with their feet…

And didn’t Rob Labatt also write in his CEO Blog entry on 14 March 2006 that:

“Personally, I think we are a month or so away from the time that you will look at Yuku and say ‘wow, I need to be there’.”

More than three months later, it seems that even Labatt himself still isn’t wowed by Yuku…