How is it possible to steal a profile on AdultWork?

[SirPhilipXX]

Can anyone explain how a WG or her pimp can steal another girl's profile?  On reading pretty Brittney-Debute's profile I see that apparently this has happened to her:  External Link/Members Only or External Link/Members Only

The only way I could imagine it happening is if someone got hold of the girl's email address AND her password to log on to her profile, then changed the password so that she could no longer log on to it. But how could someone get that information?

[cambs-man]

From what I understand, if a WG is on AW as a member of a group, the group admin has full access to her profile.

Brittney-Debute is a member of a group so this may be the source of her problems.

[Corus Boy]

In all areas of life, many people are not very clever with passwords and password security.

Crack one account password and you may have access to much of their online life.

At my gym the locker is secured with a four digit code that you type in to secure it and to release it.

A quick and unscientific survey revealed that most people used their Debit Card PIN to secure their locker.

So a sneaky watch over a shoulder both gets you into their locker and access to their money.

So I ask;

Do you have a different PIN for different cards?
When was the last time you changed your PIN?
Do you have different passwords for other accounts?
When was the last time you changed your password?

[CoolTiger]

From what I understand, if a WG is on AW as a member of a group, the group admin has full access to her profile.

Brittney-Debute is a member of a group so this may be the source of her problems.

See separate thread I started where a girl cannot remove herself form a group. However, this girl appears to be a current member of this group (and referring to an old profile), so this would only be applicable to her if she was part of a different group previously. 

In all areas of life, many people are not very clever with passwords and password security.

Crack one account password and you may have access to much of their online life.

At my gym the locker is secured with a four digit code that you type in to secure it and to release it.

A quick and unscientific survey revealed that most people used their Debit Card PIN to secure their locker.

So a sneaky watch over a shoulder both gets you into their locker and access to their money.

So I ask;

Do you have a different PIN for different cards?
When was the last time you changed your PIN?
Do you have different passwords for other accounts?
When was the last time you changed your password?

Rather than being "hacked", as CB mentions, some of these girls have had phishing/spam emails where they have inadvertently given their passwords, which has led to their AW accounts being compromised, etc.

Also, occasionally AW may have pulled their profile down, for breach of their terms, etc and the girls then claim that they were hacked, so have set up a new profile.   

Finally, there been some fake profiles in which such claims are made, in order to make it appear legit.

[AnthG]

The only way I could imagine it happening is if someone got hold of the girl's email address AND her password to log on to her profile, then changed the password so that she could no longer log on to it. But how could someone get that information?

You do not need to know the email address. To login to AW you just need the nickname - which is the one on the top of the profile. And then the password.

To add to insult it seems to change the email address on the account AW works by

An email will be sent to the new address. To verify it you will need to click on the link within the email or enter the code it contains, here.

So it seems someone just needs your password and that is it. They can then get into the account and then immediately change the email address to their own.

And given that most girls sign in with a mobile phone most passwords will likely be something simple like "qwerty" or something.

[AnthG]

Looking further into this out of curiosity. The biggest security flaw on AW is the email address change page

External Link/Members Only

For this you do not need to even be signed in to your account. The problem with this is it does not need a captcha code entered at all. It also does not need the correct email address being entered to verify you have put the right password in. As regardless of what password you put in it actually gives you a unique hit if you put the right password in.

For example you put the wrong (i.e any picked out of thin air) email address in but the right password you get

Your email address is currently verified. If you want to change it you must login and visit the Registration Details Page within the My Details Section of the Site.

Put the wrong password and wrong email in you get

There is no registered member with the Nickname and Password you supplied

That means you use a brute forcing application onto that page. Set the success phrase as "Your email address is currently verified." And the failure phrase as "There is no registered member" leave it running for 20 mins with a common password passlist and you can very easily get into anyone's AW account if they do not have a difficult password (which most girls wont).

I am not exaggerating with how easy it will be too. So the moral is have a difficult password to your AW account!

[Corus Boy]

Rather than being "hacked", as CB mentions, some of these girls have had phishing/spam emails where they have inadvertently given their passwords, which has led to their AW accounts being compromised, etc.
 

Covered by;

"...In all areas of life, many people are not very clever with passwords and password security..."