Family Tree Maker Software Producer Exposes Data on 60,000 Users

From an article by Phil Muncaster in the Info Security web site:

“A US tech company that manages popular family tree software has exposed tens of thousands of its users’ personal information online via a misconfigured cloud server, according to researchers.

“A team from WizCase led by Avishai Efrat discovered the unsecured Elasticsearch server leaking 25GB of data linked to users of the Family Tree Maker software.

“First released in 1989, it has had numerous corporate owners, including Broderbund, The Learning Company, Mattel and Ancestry.com, prior to Software MacKiev which is currently in charge of the code.

“WizCase informed the US software company of the incident and, although it didn’t receive a reply, the incident was apparently remediated shortly after.

“Among the details leaked to the public-facing internet were email addresses, geolocation data, IP addresses, system user IDs, support messages and technical details.”

You can read the full article at: https://www.infosecurity-magazine.com/news/genealogy-software-maker-exposes/ and a different view on the problem may be found at https://www.hackread.com/software-firm-leaks-ancestry-com-user-data/.

9 Comments

Pity they can’t leak some up to date software so that I can read those old Family Tree Maker’s CD-ROMs. The ones that Ancestry denies knowing anything about and which FTM say are Ancestry’s responsibility.

Like

    This is not exactly on topic but in reply to John’s comment, which I assume refers to the Family Tree Maker Family Archives CDs, I have found a possible solution that he (and others) might be interested in. I have a number of the Family Archive CDs, mine are BannerBlue, Broderbund and Genealogical.com and date from about 1995 to 2000, and they certainly were at the time a very valuable resource. Although I assume that much of the information on them (and there were more than 250 CDs in the Family Archives collection) is probably accessible somewhere on the Internet I suspect a lot is not and I still refer to them at times. I did attempt to find just how the information is stored on those CDs to see if they could be converted to other readable forms but it still seems you can only access the data using Family Tree Maker software, and specifically of about that era. Family Tree Maker did have the program FAV (Family Archive Viewer) but the most recent I have is version 4.0 and it cannot even be installed on Windows 10. However, much to my astonishment, Family Tree Maker 9.0 (FTW 9.0) did install easily and properly on my Windows 10 (64) system. The copyright date of 9.0 is 2001 and it is listed as being intended for Windows 95, 98 and ME, which makes it even more remarkable that it is accepted by Windows 10. When you install it you probably want to choose the normal installation subdirectory for such software on W10 (or W7), so “C:\Program Files (x86)” rather than its default of “C:\FTW”), and I believe you have to specify the directory as “C:\Progra~1\FTW”, but it does go on fine. The one additional detail needed is to go into the home directory, right click on “FTW.exe”, select ‘Compatibility” and check “Run as Administrator” (of course on those older Windows you were always “administrator”). You have to create a minimal tree of some sort to satisfy FTM before you can load and view your Family Archive CDs, and then you click on the CD icon on the top taskbar and you’re good to go. I did for curiosity import the GEDCOM 5.5 GED of my current, fairly large family database and it did eventually get converted and loaded into FTM, very, very slowly (as in about 1 to 2 hours) and with lots of unrecognized data noted, I assume because that FTM knows GEDCOM 5.0, at best. Once the information it recognized was imported (and it seems most of the record details were) you can use the program, as least as well as when it was new and in fact quite snappy on modern hardware. Actually I never liked FTM and settled on Reunion on the Mac very early, by about ’97.

    Like

    David Spencer’s solution will work IF you can get a copy of FTM 9.0. That may be a problem! Also, I’d like to say that I think MacKiev had a responsibility to inform it’s customers of this data breach. I’m very disappointed that they did not. Exactly when did this happen?

    Like

    First, a correction to my note. To access the subdirectory “C:\Program Files (x86)” (obviously on 64 bit Windows installations) when working with older software that still understands only the original MS-DOS 8.3 naming convention the proper form is “C:\Progra~2”, not what I wrote. However, I just checked this and FTM 9.0 is actually compatible with the current/newer naming conventions and during installation you can use the WinXP/7/8/10 directory naming.
    Sue Roe is obviously correct that my proposal assumes you actually have used FTM/FTW for a long time and may still have the FTM 9.0 installer CD or have access to one. I did a lot on Internet searches trying to find a newer Family Archive Viewer and there was a version 11 released a few years ago and it MAY have been able to read the older CDs but all links to it point to a non-existent file on the ‘genealogy.com’ website. You can find used FTM 9.0 program CDs for sale on eBay for what I would say is a ridiculously high price (and a very large number of the Family Archives CDs are available there as well, also at surprisingly high prices). The provenance of Family Tree Maker is clearly complicated and messy and it isn’t clear to me who really owns the rights to these older FTM products (so did Ancestry sell all rights to MacKiev, the current FTM/FTW seller?). I would think that FTM 9.0 (or most of the now older versions that immediately followed it) no longer has any commercial value to the current rights holder so why isn’t it just released as abandonware? This clearly is a stupid and unnecessary inconvenience for the many people who still have and use Family Archive CDs. I don’t know, as well, whether later versions of FTM could/can read/import the personal family data files of users of FTM 3 or 4 (now freely available) or even version 9.0.

    Like

    I know I’ll bet if I started inputting bogus family names in the tree EVERYONE says nobody has hacked ,in as little as 3 working days that COMPANY and a few others will say WE’VE FOUND A NEW RELATIVE. It’s enough to make you hang it up‼️

    Like

This is a reminder to never use a login/password more than once. I add another layer of protection by creating separate email addresses for different activities – for example, one just for genealogy logins, another for my Amazon account, and so on. This limits my exposure if one of these websites or email accounts is hacked, and it keeps my personal email address private.

Like

I still have a copy of fav110.exe

Like

I think there might be an easier solution. There are only so many image formats in the world and I suspect they did not invent a new one. I had the same issue years ago with some cds from another genealogy company. The company just took the image files and changed the file extension to something else. For example, the files were .jpg files and they came up with a different extension and renamed all the files. They created a viewer which could “read” the files with this extension. I just took one of their files and started renaming the files using a known image format extension. Guess what? They were .jpg files and as soon as I changed the extension to .jpg any image viewer could read the files. If anyone has an older cd with so-called proprietary files that “need” a special viewer, just try my process using an extension of .jpg, .tiff, etc. I suspect you will hit on the correct extension and can use many different apps to read the files.

Like

I finally did find the simplest solution to accessing the collection of FTM Family Archive CDs (and there were more than 250 of them produced) but it took many hours of Internet searching and general messing around. The last stand-alone version of FAV [Family Archive Viewer] was 11.0 and as far as I can tell there is now only one, real available source of it anywhere on the Internet, namely at the ‘WayBack Machine’, one of the many great resources at the Internet Archive (‘archive.org’). I hope that a URL will be acceptable here (Dick will decide) but if you go to :
http://web.archive.org/web/20130204112857/http://genealogy.com/abtffiv.html
you will get the original web page that described FAV11.0 at ‘genealogy.com’. When you click on the download link on that page you do get redirected to a slightly newer page at the ‘WayBack Machine’ :
http://web.archive.org/web/20140831181401/http://familytreemaker.genealogy.com/download/fav110.exe .
FAV11.0 installs and runs fine on Windows 10.
Kathy’s suggestion is one that I already considered and explored because I agree with her that it seems hard to believe that Banner Blue invented from scratch the database format used on those Family Archive CDs. I have examined (in a hex editor) every file on a Family Archive CD and the main data on each CD is in a file named ‘DATA.VIM’. Examining that file in a hex [binary] editor you find near the beginning of the file the text “Imagenation VME”, and there is/was indeed a commercial software product called “Imagenation Vector and Mark-up Editor” which was sold by, I believe, ‘Control Systems Unlimited’ [I have no idea who they are/were but they must have closed up shop, or changed their name, in 2005 because although I did find a web-site for this product and the company their web site seems to have been last updated in 2005 and the links for downloadable demo software are dead].

Liked by 1 person

Leave a Reply

Name and email address are required. Your email address will not be published.

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

You may use these HTML tags and attributes:

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <pre> <q cite=""> <s> <strike> <strong> 

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: