Serious Security Problem!!!

ConcernedOne · Post by **ConcernedOne** » Wed Jun 22, 2011 5:52 pm

With MJ new software, they slipped in a new "feature" that is a horror. Located in the advanced users, selecting "My Magicjack" will automatically take the person to your personal account on the web WITHOUT asking for a password!!!!

I chatted with MJ customer support and this was confirmed. I am posting the conversation below.

In short, if you have registered another MJ for your son or daughter away at school, any of their friends can gain access to you, the parent's, account information. That includes your address, email address, ability to change password, complete telehone call list history, access to all your private features, etc. Likewise, it is also possible that if you have guests at your house and you need to run outside, or downstairs, they can gain access to all your personal and private information too, simply by clicking the My Magicjack selection in the front of the software. No Password required. There is NO WAY to fix this! The older software did not do this, and when they "upgraded" the software for you, they also exposed you to an atrocity of risk. If you have sent a MJ to a friend or relative in a foreign country, you are completely exposed!!!

Please wait for a site operator to respond.
You are now chatting with 'Lira'
Your Issue ID for this chat is *************8X
Lira: Hello, how may I help you?
Todd: Hi Lira, when I log into the My Magicjack from the menu of the software, it automatically puts me into my account WITHOUT asking for a password! How can I turn that off for security purposes?
Todd: hello?
Lira: I see.
Lira: So you clicked on the "MY" on the dial pad right?
Todd: NO
Todd: I click the button "Menu", and from that list are several... one being the "My Magicjack"
Lira: Thank you for the information.
Todd: When I click that, it takes me to the web and automatically logs me into my account
Todd: And I never put in a password!!!
Lira: I am sorry to inform you that it will automatically login to the magicjack account with out using the password since the dial pad is already online it would just directly login without asking the password.
Todd: that cannot be! Who made this decision? Anybody that walks up to my computer, can gain access to everything private and personal!!!
Lira: However our engineers have noted this issue since there are some customer having the same issue.
Todd: All my record of phone numbers, my address, everything!
Todd: This needs to be fixed today.
Lira: And hopefully they will add some modifications in the magicjack.
Lira: If you don't want anyone to access your account.
Todd: OF course I don't.
Lira: All you have to do is sign out the magicjack dial pad and activate the forwarding feature once you are not around in your house.
Todd: And if i go downstairs and friends are visiting, I have no way of knowing if they click my account, when i am not in the room!
Todd: No, your suggestions are no good.
Todd: This is too critical to be such a major gaff as it is.
Todd: How do you sign out of the dial pad? I don't know what you mean by that.
Lira: I know it is very critical.
Lira: All you have to do is click on MENU > Sign out.
Todd: that is not a command in my menu
Lira: Please click on MENU in the dial pad.
Lira: Please inform me what you see in there?
Todd: I don't see it. My "Menu" is located in the top right, above my contacts list.
Todd: above the dial pad is END and SEND
Todd: above that is MY.... AMAZON.... YAHOO
Todd: Anyway, that is not a solution.
Lira: The MENU button is at the top left of the dial pad
Todd: I need to speak with your top manager on this, because this nees to be fixed, like Yesterday.
Lira: One moment please...
Lira: I am transferring you to one of our top 10% agents as rated by our customers. Please hold while I transfer you.
Todd: ok
Please wait while I transfer the chat to the best suited site operator.
You are now chatting with 'Riona'
Your Issue ID for this chat is ************8X
Riona: Hi, this is Supervisor Riona and I will be assisting you for today. Please let me read your past conversation with the other agent. Thank you so much!
Todd: ok
Riona: Thanks
Riona: Let me inform you if your magicjack is plugged in on your computer then anyone can log in into your magicjack account there is no password which need to verify.
Todd: I know that!
Todd: That needs to be fixed, NOW!
Todd: So my son has a magicjack at college, and now all his buddies and fraternity guys can gain access to his dad's account info.!!!!
Riona: Let me inform it is not an issue with the magicjack device
Todd: That is a horror!
Todd: what do you mean?
Riona: If you do not want to use magicjack with any other person then you can keep your device with you all the time
Todd: but that is not what you advertise, and that is not how people use this!
Todd: We buy additional devices, register them, and we expect basic security and privacy, but you have blown it!!!!
Todd: And anybody in my house can gain access, if i go downstairs, go outside, leave the room, etc.
Riona: I am sorry there is no such kind of security
Todd: I could spell out 50 scenarios, all of which are cases for fraud
Todd: There needs to be!
Todd: It did not use to do this!
Riona: Okay I can forward your request from my end
Todd: WHen I first bought my magicjack, this was not an issue. Your upgrade created ths problem.
Todd: This needs to be broadcast on the news. I will send it to CNN, FOX, MSNBC, etc.
Riona: Todd, All the feature are provided by our engineers. If you want to suggest this then I can forward your suggestion from my end only
Todd: do so
Todd: And i will forward to the news, too.
Riona: Sure, Please wait .............
Riona: Mr. Todd, I am done with the report and I have mentioned your suggestion there. I have sent it to our concerned department now they will look into this.

nailgunner · Post by **nailgunner** » Wed Jun 22, 2011 6:36 pm

Not that it makes much of a difference but it's been doing that, at least for me, for a few months now, way before the latest update.

bitstopjoe · Post by **bitstopjoe** » Wed Jun 22, 2011 7:57 pm

Yep it sure has................... For quite a few updates now..

Nothing new and I havent heard anyone "upset" over it... Honestly I saw it as an easier way to access my account...
But then I don't look for boogymen in my closet either...

neo2121 · Post by **neo2121** » Wed Jun 22, 2011 11:43 pm

Well now...that's been that way for years. All the account can and have been harvested before. Magicjack is really bad at security.

nailgunner · Post by **nailgunner** » Thu Jun 23, 2011 2:06 am

neo2121 wrote:Well now...that's been that way for years.

The issue referred to by the OP has NOT been that way for years. It used to be to get into "my magicjack" you had to log in. And you could log out and stay logged out.

They now have a tab to log out, but you don't stay logged out. As soon as you click on the "my magicjack" link you are automatically logged back in again. There is no way to force a log-in page, which is what is bothering the OP.

But I'm with Joe, who gives a crap. Of all the security issues I would be worried about with my kid at college, someone clicking on his/her MJ icon and opening up the magicjack account info, comes in at about 139th on the list. And my guests doing it while I run outside or downstairs? Seriously? By the time they decide to look at the MJ account info, I'll be at the door tapping my foot and clearing my voice asking them what the hell is going on.

No offense to "ConcernedOne", but this sounds like our paranoid old friend "Bartholomew Diogenes" posting again.

Darkman90808 · Post by **Darkman90808** » Thu Jun 23, 2011 10:48 am

... but this sounds like our paranoid old friend "Bartholomew Diogenes" posting again.

OT, but I'm glad you said it and not me. lol. Thanks for the trip down memory lane; it brought me a good chuckle.

cell14 · Post by **cell14** » Thu Jun 23, 2011 11:04 pm

Wow ! It is true. Now I am concerned, too. What if I go to the bathroom and my cats, who sometimes walk over the keyboard, access the account ??

Barada Nels · Post by **Barada Nels** » Fri Jun 24, 2011 7:49 am

cell14 wrote: Wow ! It is true. Now I am concerned, too. What if I go to the bathroom and my cats, who sometimes walk over the keyboard, access the account ??

If you trust your cats to urinate and take dumps within your home, I think MagicJack access is below them . . . you should give them full administrator rights to your PC!

My cat? Oh, he craps outside with the dog! LMAO JK!

Diggs · Post by **Diggs** » Sat Jun 25, 2011 11:39 am

Secure the user account on the machine with a password. Put on a locked screensaver set a 1 minute. Not sure why the paranoia.

genxweb · Post by **genxweb** » Sat Jun 25, 2011 11:44 am

The risk is low. A malicious user would need access to your MJ to launch that link and log into your account. I have feeling that it uses a part of the logged in credentials along with the URL to access your account without the password, a form of two factor. Something you have the device and something you are your account.

ConcernedOne · Post by **ConcernedOne** » Wed Jun 29, 2011 12:32 pm

genxweb wrote:The risk is low. A malicious user would need access to your MJ to launch that link and log into your account. I have feeling that it uses a part of the logged in credentials along with the URL to access your account without the password, a form of two factor. Something you have the device and something you are your account.

The security risk is not low. But I have a much better and perfect solution -- Magicjack company put the required password back in place, like it used to be.

nailgunner · Post by **nailgunner** » Wed Jun 29, 2011 1:00 pm

ConcernedOne wrote:Magicjack company put the required password back in place, like it used to be.

Well one of us has a special MJ account then, because it hasn't changed a bit on mine. The only way I get can get to the log-on screen to enter in a password is to sign out of mymagicjack. But when I exit from the log-on screen without signing in, and open it again through the soft-phone, no password is needed.

nailgunner · Post by **nailgunner** » Wed Jun 29, 2011 2:38 pm

Gee. You know, I think in a re-reading of the post, he was PROPOSING that MJ do it as the solution, not that they had. DOH!!!

You do have to wonder why they didn't just add an option to stay signed in, if you want, for the clueless like me who don't give a crap. I get irritated when the sites I use that option on have a limit, like 2 weeks, and I have to sign in that often.