User's avatar was switched, does anyone know how this could have happened?

Background:

http://www.newsfixboard.com/t6117-could-someone-tell-me-what-they-see-as-my-avatar-please

In short, the user's account was displaying a different avatar earlier today than the one she chose; several other members saw it and one of them posted it in the thread I have linked to.

A few members said they saw the changed avatar for her on their mobile devices but her usual avatar (the one she chose for herself) in the desktop version.

She also told me she's not seeing some of the comment-editing tools, such as the emoticons box.

I've checked in the control panel for any of the administrators having changed her avatar or data in any way; there's no record of a change to her account.

Any help would be appreciated!

It could that the site hosting the avatar had some issues.  I have seen this on different forums, blogs, websites, and sites.

SLGray wrote:It could that the site hosting the avatar had some issues.  I have seen this on different forums, blogs, websites, and sites.

Thanks, but the user actually uploaded her avatar from her computer to our site. I'd think if it was a host issue, she'd get a broken image rather than a completely different one.

It will show a broken link if the image has been removed or deleted.  Sometimes an image hosting site will have issues where images get mixed up.  I have seen it on my forum.

Hello

I am not able to recreate the bug. I can see rose avatar via my computer (Chrome FF and EI) via a mobile

Buttercup wrote:Hello

I am not able to recreate the bug. I can see rose avatar via my computer (Chrome FF and EI) via a mobile

As Ben is American and is asleep while we are awake and I was the person it happened to, he asked me to explain to you in detail, because of his concern and because of previous problems.   You will only see the rose now because we fixed it.
In the link Ben supplied it shows what was happening while the problem was ongoing.   My avatar was a picture I took of a painting I did of a rose, it had nothing to do with any hosts.   Overnight, when I looked at the site from my phone, my avatar was a picture of a woman in a shroud, so I looked at the site on my computer and my phone at the same time.   On my computer it was still my rose picture, and yet other people assured me they could see the shroud, and on my phone it was the shroud, something I had never seen before.   I did not change it, there is nobody in my household who could change it, my partner has no idea how a computer works.   People were looking at the site from different electronic sources, and from some sources it was showing as my rose picture and on some the shroud, at the same time.    In fact, someone looked at the site on his computer from Firefox and from Chrome, they showed different pictures at the same time.   Following that, Ben advised me to change my password as he discovered that the picture of the shroud came from a site I had never heard of.   When I tried to change my password, even though it had just let me log in, it didn't recognise my password to allow me to change it.   Ben had to email another password.   I spoke to a computer expert and he said he couldn't understand how it was possible, especially as when I went to reload my avatar, the picture was showing as the rose, but had the number was of the site of the shroud picture, something he had never come across before.    Sorry, long explanation, but very complicated situation.

Buttercup wrote:Hello

I am not able to recreate the bug. I can see rose avatar via my computer (Chrome FF and EI) via a mobile

The gentleman who linked to my computer to see what was going on has now pm'd you.

  

sassy1261 wrote:

Buttercup wrote:Hello

I am not able to recreate the bug. I can see rose avatar via my computer (Chrome FF and EI) via a mobile

The gentleman who linked to my computer to see what was going on has now pm'd you.

Is this topic actually solved?

Furthermore support should only be done via private message when giving private information e.g. Email addresses OR when requested by a member of staff.

It sounds like there is an issue with the mobile device.  Have you scan your mobile device?

SLGray wrote:It sounds like there is an issue with the mobile device.  Have you scan your mobile device?

There was no issue with the mobile device, some mobiles saw the rose, some mobiles saw the shroud, ONE computer by looking at the site from both chrome and firefox could see both avatars from the same computer.   My password had been changed.   I gave all the information above.   Please wait for the Admin of the site to contact you, as I said he is American and it's his work time at the moment, he has also had threats to the site.   Thank you for your suggestion though.

So you think that someone gained access to this member's account?

SLGray wrote:So you think that someone gained access to this member's account?

I'm the member it happened to, Ben, who started this thread is the Admin, he will be able to discuss it better with you as he obviously has administration information, but is American and working at the moment, will contact you as soon as he can.

But you said that your password was changed.

SLGray wrote:But you said that your password was changed.

I had logged on with my normal password, after Ben looked as the Administrator he could see that something had happened, so advised me to change my password.   I went into the modify password, you obviously have to put in your present password to do that.   It said that the password I put in, which was the correct password (I did it very, very carefully and knew it was right) said it was not available on the database.   Ben had to email me a new password.

I put all this in great detail in my long post above.   Could I request that you read through that, it gives all the information.   Any other information obviously has to come from the Administrator, Ben, and he won't be free until later.

I did a Google search of the image, and it is related to the conflict between the Israel and Palestine.

It just looks very suspicious; she has been posting a lot about Israel and Gaza lately and the "other" avatar was a photo of wounded Palestinians. It hardly seems like a coincidence to me, and it was seen by a number of users, one of which posted the photo in the thread I linked to in the OP and which you can research with the Google image search.

I'm just asking that you do whatever you can to look into it. We have had anonymous PMs to the admins threatening disruption to the site; I've been in the habit of laughing them off, but I'll start reporting them here.

Edit: Sorry SL, didn't see your post before.

Ben_is_easily_amused wrote: We have had anonymous PMs to the admins threatening disruption to the site; I've been in the habit of laughing them off, but I'll start reporting them here.

With all Threats to sites can almost be took with a pinch of salt but when it comes down to hacking of an account then we take it very seriously, The problem is we need more info about the hacks that is made, what  you can do is if a member is hacked see if that member has made a post in the last 24 to 48 hrs then see if the Ip address is the same on all posts if it is not the same then you can ban that ip that is not the same,

This will help keep that hacker out of your forum
also a change of password will help witch you have already done.
Other then that there is not a lot more the staff here can do The pro Admin may have other tools to help but i can not see it.

Can i ask one other thing who was the images hosted by ?

APE wrote:

Ben_is_easily_amused wrote: We have had anonymous PMs to the admins threatening disruption to the site; I've been in the habit of laughing them off, but I'll start reporting them here.

With all Threats to sites can almost be took with a pinch of salt but when it comes down to hacking of an account then we take it very seriously, The problem is we need more info about the hacks that is made, what  you can do is if a member is hacked see if that member has made a post in the last 24 to 48 hrs then see if the Ip address is the same on all posts if it is not the same then you can ban that ip that is not the same,

This will help keep that hacker out of your forum
also a change of password will help witch you have already done.
Other then that there is not a lot more the staff here can do The pro Admin may have other tools to help but i can not see it.

Can i ask one other thing who was the images hosted by ?

I did the IP check, I didn't see any activity from her account that looked suspicious. Unfortunately, the avatar switch happened before I checked in on the site (I'm an American and they're mostly British, so they get going before I wake up) and I had no chance to check the hosting service used for the other avatar.

However, if there is a way to view the avatars uploaded to Forumotion sites where I can check to see if anyone actually uploaded the other avatar to NewsFix, I'll do so (please let me know).

Again, I appreciate your help, I understand there's only so many ways to check suspicious activity.

Our Pro Admin (Buttercup) will not be back until Tuesday or Wednesday.

SLGray wrote:Our Pro Admin (Buttercup) will not be back until Tuesday or Wednesday.

I'm sure Buttercup is busy, but I appreciate any insight he/she can offer. It's fine to PM me with anything found out as well. Again, thanks.