A cyber-stalker threatened me last year and, although it cost me several thousand dollars, I thought I’d outwitted him. I was wrong. And now I could be in danger.
Nine months ago I took my site off-line for several days to recover from an hacker attack. Someone with far too much time on his hands spent what had to be days, if not weeks, clicking away until he accessed my scripts and corrupted them. I took down the site, paid a professional to reprogram my entire database and added security measures that everyone said were invulnerable.
And they were. For nine months. Then on Saturday it became clear that security had again been breached.
On Saturday I knew that the details of my life had been compromised.
On Saturday I more fully appreciated the brilliance and determination of my assailant.
Although it took him months to do it, Bumpus (That’s what I call him now. If you’re familiar with the movie The Christmas Story, you’ll understand.) cleverly inserted a keystroke logger on my machine, buried in an email sent through my website contact plug-in. He managed to get through not only my top-of-the-line internet protection program, but also three layers of spam filters and my hosting company’s security measures. Bumpus is very, very smart.
For those unfamiliar with the term, a keystroke logger tracks and records, as the name suggests, every stroke of every key made on a computer. It’s the ultimate in cyber-spying. And through this window on my world, Bumpus silently spent 30 days intimately observing my every techno-move. Kinda creepy, isn’t it?
Bumpus watched me shop online and knows that I wear a size 10, my grandson is already into 18 months, and I buy clothes from Target and J. Crew. He doesn’t know that I returned the J.Crew items. Hah! Sucker! In hindsight, I’m a little disappointed in his prowess since he’s had access to my pictures and should have known those styles would make me look pregnant despite my relatively flat tummy. He knows a lot about me.
He knows which Diamondback games we’ll attend this season and in which seats we’ll be seated. He knows about trips planned to Palm Springs, Boston and Seattle. But does he know Seattle was canceled? Was he watching that closely?
Bumpus knows that I rabidly utilize the public library’s online reserve system and buy even more titles from Amazon. He’s privy to the fact that I read The Good Earth, Saffron Kitchen, Firefly Lane, The Year of Fog, The Night Listener, The Middle Place and Written on The Body during his 30-day foray. He may even know that I’m currently enjoying Change Me into Zeus’ Daughter and A Handful of Dust.
In addition to those facts, Bumpus knows my thoughts and feelings regarding each title because he read the “2009 Reading List” , which is kept on my laptop’s desktop, complete with personal rating system. Yes, I’m totally type-A.
Bumpus read (but didn’t help proofread) the letter of recommendation I wrote for a young job-seeker. He observed the details of a newly updated rental agreement, thus learning one of my kid’s addresses. He knows which universities my two younger children attend and the flight information for my eldest daughter’s trip from the UK. He knows my dentist’s name and when my next cleaning is scheduled. He knows when I get a bikini wax and when Charles colors my hair. He knows a lot. He knows too much.
For thirty days, via his keystroke logger on my computer, every document, transaction, communication and calendar item was at Bumpus’ disposal. For thirty days he collected usernames and passwords, PINs and credit card numbers. And he achieved it all while my Trend-Micro security system appeared to actively keep at bay all threats, and my web-host guaranteed complete privacy.
Bumpus is smart. So smart. And so incredibly patient.
After thirty quiet, patient, busy days, he made his move on Saturday.
Privy to so much, the assailant hacked into my BlueHost cPanel and went to work destroying www.katemclaughlin.net and www.katemclaughlinpoetry.com. He added 22 domains and renewed them for 10 years. He diverted my email to his accounts, masking the final destination by forwarding through nearly two dozen IP addresses. He inserted into my database a hidden folder that directed information to him every time the site was altered or updated. The instructions in that folder also alerted him to changes in security and financial information.
Then Bumpus began the defacement. He replaced my data and posts with foul language and pornographic images. He diverted visitors to sites that would disgust and frighten most of them. He inserted links to hateful places that only very unhappy or terribly disturbed people would create or frequent. He vented and ranted and raved and destroyed. He boldly wrought havoc.
But Bumpus didn’t count on one thing…I have incredibly good luck. Because my husband was on a plane grounded 15 minutes after take-off, my weekend plans were scuttled. Normally I’d have been committed and away while Bumpus did his dirty work. He would have had 48 hours to add layer upon layer of subversion and smut, the slogging through of which would have been daunting if not impossible. But I was home with no real plans and I caught him in the act before his destruction went too far or too deep. I hope I shut him down before you were exposed to his terror. If not, I’m truly sorry.
Here’s what happened: I tried to log into my admin pages and cPanel, but was denied access because usernames and passwords were incorrect. Immediately on the phone with BlueHost, I explained the situation and the tech expert and I got to work. He accessed my account. “Oh My God,” he gasped. “This is really bad. Your cPanel’s been hacked. Your site’s a mess. Have you seen the defacement?”
“No. I didn’t go to the sites, I only tried to access my admin pages.” I replied.
“Don’t. I’ve never seen anything like it. This isn’t a regular hack job, this is really personal. This guy is sick. I’m taking it down.” And he did.
My case was transferred to an abuse expert at BlueHost. Together we went through the process of deleting added domains, eliminating re-directions, and correcting security breaches. Then we deleted my entire database and reloaded a clean, saved version. Finally I changed my log-in information.
Within minutes Bumpus regained control. He bought more domain names with my newly replaced credit card, deleted my databases and inserted an instruction for automatic erasure if new information was uploaded. I changed a password and he knew it almost immediately. I deleted a credit card, he quickly knew the replacement. He may as well have been sitting next to me or peering over my shoulder.
I got emails from a secure account Bumpus had apparently overlooked, asking for change verifications and thus warning me of his intrusion on other sites. I worked with another abuse expert who discovered the keystroke logger on my machine. By the end of the day thousands had been charged to my credit cards and my sites had been destroyed and repaired three times.
For four hours on Sunday morning, a security expert scrubbed my computer and all the files on it. He discovered the keystroke logger Trojan, verified the date of infection and admitted he’d not seen this specific one before. He figured it was created just for me. I told you I was lucky! While he finished his work I warned my bank about potential misuse and abuse, informed my credit card companies of the theft and fraud, and canceled the involved accounts.
Following the scrub, I worked with BlueHost to clean and repair my cPanel and databases. During the process, which took nearly 20 hours, we discovered the hidden files that Bumpus inserted to learn security and database changes as they were made at BlueHost. My case was assigned to their most adept abuse expert who removed the added domains, reversed the charges, and then discovered and removed the brilliant bits of programming that Bumpus had created. Another member of the BlueHost staff corrected the email diversions and removed the auto-erase command Bumpus had buried. I then changed log-in information that had been compromised at 37 different sites.
My last support call to BlueHost occurred when I navigated three levels deep into my cPanel to correct a lingering email problem and discovered this message:
“Fatal Error. Do not assume that success is success. FATAL.”
Bumpus had broken into BlueHost’s own database and inserted this text into one of their static pages. Now he wasn’t just messing with me. He was messing with an emerging corporation with a lot to lose. In addition to their own programming and security worries, the folks at BlueHost suggested this might be a death threat. The FBI is involved.
And so, I’m at a crossroads.
I started this website because two of my children were diagnosed with a serious mental illness and I, for years, could find very little support. I set out to offer comfort and encouragement, and to share facts and solid, science and research-based information. I believe that stigma is rooted in ignorance and that knowledge and understanding will eradicate it. I’ve repeatedly resisted opportunities to monetize the site because I don’t want content to be altered by pharmaceutical or philosophical entities. Running this site is an expense on my ledger, not an asset. Why, then, does anyone want to sabotage it?
I believe Bumpus is terribly ill and is not medically compliant. I’d wager that, in the past, he was deemed a danger to himself or others and was hospitalized against his will. I believe that the side-effects of medication, which are often horrendous, are beyond Bumpus’ tolerance level and he fights for an individual’s right to refuse medical treatment.
Ironically, I agree with Bumpus. I’m not an advocate of forced medication. I believe in an individual’s right to choose or refuse medical treatment. Despite the worries, ruined relationships and devastation untreated mental illness can create, I adhere to the individual’s inherent right to choose. I’m on Bumpus’ side, but he seems unable to realize that.
He has fixated on me as the enemy, as someone who disseminates information he considers harmful. It’s partly because I’m a mom, and for him that is not a comfort. I feel deeply for Bumpus. I wish him wellness.
But what do I do now? As long as the threat was virtual, I felt safe. But now Bumpus knows my business address, my banking institutions and, most worrisome, my home address and phone number and where my kids live. Authorities have narrowed his location to a specific part of a specific state, and I’m somewhat comforted by the thousands of miles that separate us; but for some folks, miles are meant to be traveled. Is Bumpus one of those people?
