Uncategorized (149)

No, it wasn't the Russians... In fact, it would appear it was some Brazilians?!?

What the heck is going on with CAGMain over the past 18 hours?

If you've tried to send a CAG link to a friend in the past 18 hours on Facebook or InstaGram, you might have seen that CAGMain.com wouldn't be accepted in the message temporarily. Here's what was going on...

As Crisis Application Group has grown its membership base, we decided it was time to develop the new site and mobile application. We had outgrown our previous content management system's capabilities and needed to get into a more robust, long-term software platform. So we had the new site built and had the content migrated over from the previous site.

During that migration process, there was a directory from the previous content management system that was automatically transferred over to help preserve some of the content. Unfortunately, we overlooked an old archive of that folder. 

On 6/4/17, that leftover archive from the old system was compromised and allowed some files to be injected into the file structure which might redirect some browsers. We dug through and found the old directory that was the issue, and removed it from the site. We restored a clean backup from before that time period, and as of about 8:00 a.m. this morning the site was 100% secure and restored to full functionality. 

We also put in an appeal for re-instatement with Facebook and Instagram, which has since been granted as they confirmed that the site is 100% safe and secure. The new Content Management System is robust, secure, and thoroughly proven through the web-industry. It was indeed a vulnerability that we inherited from the previous system which has since been resolved.

We certainly apologize for anyone who was experienced the brief hiccup, and as always we will continue to work through any growing pains that might scarcely arise.

For the vast majority of members, their "username" is their email account that was originally on file with CAG. If someone is trying with a valid email address, and the password of “changeme1” then it will let them in.

Let’s take an example. I’m going to use Adrian Rusch’s account since he has never logged in before:

I’m going to the front-end of the site and will use This email address is being protected from spambots. You need JavaScript enabled to view it. as the username and “changeme1” as the password. The result is below (it let me login just fine):

My point being that that if people are having trouble logging in then they are likely doing one of two things (with a third alternate scenario):

1. Not using the email address that was on the Excel membership sheet that I received
   • Most people have multiple email addresses, so they are likely not using the one that they originally registered with
   • Alternate scenario is that they are trying to login with a username and not an email address. Because we imported these users off of the original member spreadsheet and not from another source, we don’t have their original usernames for most users.
2. Not using “changeme1” as the password (without the quotes)
   • They are likely using their old password, which won’t work. Because of the encryption method, it’s not possible to migrate passwords when migrating users
3. Account is Disabled. There is also a third scenario. If a user tries with the correct username but incorrect password more than 5 times, it will deactivate their account which will require manual re-activation by an administrator.

Note that if you're still having trouble logging in, please contact us using the form below and the administrator will get in touch with you as soon as possible: