The Watchtower of Destruction: The Ferrett's Journal - interesting...

The Watchtower of Destruction: The Ferrett's Journal - interesting...

[Recent Entries][Archive][Friends][User Info]

June 12th, 2004

09:07 am

interesting...
this is very interesting.

(NOTE: Apparently, some fuckwit's been posting an LJ script hack. If you see this in someone's journal, they didn't put it there, and you will be vulnerable if you click it.)

(EDIT: Officials say you don't have to change your password if you've accidentally clicked and had it posted, and that this is "trivial." What this thing does is use your browser's session info, temporarily masquerading as you to post a message in your journal that links back to the hack, all in order to encourage more people to unknowingly spread it. I've written some other thoughts on how this could have been harmful - but this one wasn't, since apparently this particular iteration did nothing aside from posting a message - and, theoretically, could have done nothing but post a message. Your password was not stolen, despite early reports to the contrary. Your user info is safe. And LJ has fixed the security hole, so there should be nothing to worry about for the time being.

(But even so, you know what I really wanted? Spreading LJ viruses and the worry about clicking on the wrong links. Now people can link to even more damaging places!)

Fucking crackers. I hope they all goddamned die.

(Tell me I'm full of it)

Comments

Page 1 of 4
<<	[1] [2] [3] [4]	>>

From:	xforge
Date:	June 12th, 2004 01:09 pm (UTC)

(Link)

Frazzen razzen virus script hack...

(Reply) (Thread)

From:	karlthepagan
Date:	June 13th, 2004 03:41 am (UTC)

Re: EVERYONE READ

(Link)

This cannot steal your password. That is false information. Passwords are not stored by LJ in cookies, only a login / session hash is stored.

Furthermore unless you have an entirely ancient and decrepit version of internet explorer or mozilla / netscape this can't even get your session key. I think he probably uses the "blah" image to simply track the spread of his virus.

(Reply) (Parent) (Thread) (Expand)

Re: EVERYONE READ -

xforge Expand

Re: it's HARMLESS, possibly GOOD because it got the exploit FIXED -

karlthepagan Expand

Re: it's HARMLESS, possibly GOOD because it got the exploit FIXED -

xforge Expand

kw34hd1 Expand

From:	zarhooie
Date:	June 12th, 2004 01:10 pm (UTC)

(Link)

ferrett love, are you sure you meant to do that?

(Reply) (Thread)

From:	wtfbrain
Date:	June 12th, 2004 01:16 pm (UTC)

(Link)

Yeah. Great. Another one. Thanks.

(Reply) (Thread)

From:	ohhjuliet
Date:	June 12th, 2004 01:22 pm (UTC)

(Link)

I've already been sucked in once! It will not happen again!

(Reply) (Thread) (Expand)

From:	theferrett
Date:	June 12th, 2004 01:48 pm (UTC)

(Link)

Yeah, I caught it from you. I don't blame ya, though. Bah!

(Reply) (Parent) (Thread) (Expand)

ohhjuliet Expand

bouncedreality Expand

From:	erisreg
Date:	June 12th, 2004 01:23 pm (UTC)

Re: cute,..

(Link)

/trust

(Reply) (Thread)

From:	erisreg
Date:	June 12th, 2004 01:46 pm (UTC)

Re: cute,..

(Link)

i retract the my ire,in your direction,..o.0

(Reply) (Parent) (Thread) (Expand)

kalieris Expand

From:	allah_sulu
Date:	June 12th, 2004 01:23 pm (UTC)

(Link)

Do you realize that that is probably another password miner, like the Russian "Who has the longest sausage" thing? You should change your password ASAP.

(Reply) (Thread) (Expand)

From:	ohhjuliet
Date:	June 12th, 2004 01:26 pm (UTC)

(Link)

Why would someone WANT my LJ password?

(Reply) (Parent) (Thread) (Expand)

allah_sulu Expand

ohhjuliet Expand

blowing__kisses Expand

mutedtelevision Expand

agloriousday Expand

johnfantastic Expand

kergillian Expand

ohhjuliet Expand

ravenblack Expand

msginnyo Expand

ravenblack Expand

temujin9 Expand

ravenblack Expand

temujin9 Expand

Re: Firefox rocks! but... -

duck1123 Expand

Re: Firefox rocks! but... -

moogleray Expand

Re: Firefox rocks! but... -

elmofromok Expand

Re: Firefox rocks! but... -

moondroplette Expand

Re: Firefox rocks! but... -

finstergrrrl Expand

Re: Firefox rocks! but... -

elmofromok Expand

Re: Firefox rocks! but... -

rev_tobias Expand

Re: Firefox rocks! but... -

moogleray Expand

Re: Firefox rocks! but... -

duck1123 Expand

Re: Firefox rocks! but... -

moogleray Expand

xkcd Expand

original_copy Expand

flense Expand

ravenblack Expand

flense Expand

ravenblack Expand

flense Expand

sandcake Expand

flense Expand

sandcake Expand

flense Expand

vortex Expand

Re: But it does prompt you if you are not logged in. -

justgoto Expand

erislover Expand

kw34hd1 Expand

ravenblack Expand

kw34hd1 Expand

ravenblack Expand

From:	mirichan
Date:	June 12th, 2004 01:34 pm (UTC)

(Link)

Must say I'm not pleased with whoever created that... I already knew to avoid URLS in IRCs... pisses me that now we'll have to start mistrusting links in LJs...

I changed my password and WARNED people in my LJ not to click on such a linked entry...

(Reply) (Thread) (Expand)

From:	theferrett
Date:	June 12th, 2004 01:47 pm (UTC)

(Link)

Me too. Fucker.

(Reply) (Parent) (Thread) (Expand)

morlockx Expand

revdj Expand

kw34hd1 Expand

From:	ytaya
Date:	June 12th, 2004 01:38 pm (UTC)

(Link)

There was a similar meme doing the rounds, a Russian one, yesterday. I checked it out with LJ support and they said it doesn't represent a security risk. You can check out what they said here.

They're still evil fuckers, mind. They should include a warning that it'll post an entry for you.

(Reply) (Thread) (Expand)

From:	wyldkyss
Date:	June 12th, 2004 01:43 pm (UTC)

(Link)

Yes, THAT one isn't going to steal your passwords and eat your babies. However! The one that has a username AND password blank.. that one IS evil. Of course, only an idiot would put their password on a meme to start with.

(Reply) (Parent) (Thread) (Expand)

theferrett Expand

wyldkyss Expand

mileshedgehog Expand

ytaya Expand

nuala Expand

ytaya Expand

nuala Expand

kaosrain Expand

ytaya Expand

kaosrain Expand

ytaya Expand

kaosrain Expand

trejkaz Expand

From:	ohhjuliet
Date:	June 12th, 2004 01:45 pm (UTC)

(Link)

He posted that in the mac community I belong to, which is how it got to me. He also has the most disturbing icon I've ever seen.

(Reply) (Thread) (Expand)

From:	zoethe
Date:	June 12th, 2004 01:48 pm (UTC)

(Link)

All I can say is, Jay-sus....

(Reply) (Parent) (Thread) (Expand)

ohhjuliet Expand

zoethe Expand

theferrett Expand

ohhjuliet Expand

harpygirl Expand

zoethe Expand

ohhjuliet Expand

chrestomanci Expand

lauria Expand

zoethe Expand

lilituc Expand

cathouse_blues Expand

zoethe Expand

cathouse_blues Expand

temujin9 Expand

flense Expand

temujin9 Expand

flense Expand

moiracoon Expand

kw34hd1 Expand

temujin9 Expand

kw34hd1 Expand

temujin9 Expand

ohhjuliet Expand

zoethe Expand

quizzicalsphinx Expand

blackwolfbwr Expand

Re: The website/icon... -

dreammaker182 Expand

merde Expand

thegreatdoogie Expand

wronganswer Expand

sassamifrass Expand

kw34hd1 Expand

ohhjuliet Expand

From:	lorriejharris
Date:	June 12th, 2004 01:52 pm (UTC)

(Link)

Thanks for the info, Ferrett! I did exactly what you advised, too.

(Reply) (Thread)

From:	swiftrat
Date:	June 12th, 2004 01:53 pm (UTC)

Re: =:{

(Link)

*worries*

(Reply) (Thread)

From:	gothwalk
Date:	June 12th, 2004 01:54 pm (UTC)

(Link)

Dude, it can't get your password. It's using the cookie on your machine. It's trivial; I could write one in about thirty seconds straight. It's no danger, and just a mild annoyance at it posting stuff to your lj that you then have to delete.

It's not a hack. It's not a crack. It's not even up to skript kiddie level, for gods sakes. Stop fussing, man. Chill.

(Reply) (Thread) (Expand)

From:	theferrett
Date:	June 12th, 2004 01:58 pm (UTC)

(Link)

Still. You know what I really wanted? LJ Viruses. Where I now have to worry about the links I click on.

What a complete and utter fuckwipe. It doesn't have to be Hi-Tech Shit to make something annoying and an asshole.

(Reply) (Parent) (Thread) (Expand)

gothwalk Expand

celticdragonfly Expand

ohhjuliet Expand

hopeevey Expand

celticdragonfly Expand

kw34hd1 Expand

beckyzoole Expand

theferrett Expand

livejamie Expand

theferrett Expand

vvvexation Expand

tormentedartist Expand

kw34hd1 Expand

theferrett Expand

tormentedartist Expand

beckyzoole Expand

theferrett Expand

kw34hd1 Expand

Re: You have nothing to apologize for -

fengi Expand

darlacet Expand

livejamie Expand

the_fire_of_me Expand

raen Expand

onebrightlight Expand

livejamie Expand

xforge Expand

albert71292 Expand

darlacet Expand

beckyzoole Expand

yellowrosetx Expand

beckyzoole Expand

kw34hd1 Expand

darlacet Expand

beckyzoole Expand

I'm so done with you I didn't bother to read your post. -

darlacet Expand

Re: I'm so done with you I didn't bother to read your post. -

beckyzoole Expand

trejkaz Expand

From:	tormentedartist
Date:	June 12th, 2004 02:23 pm (UTC)

(Link)

I hope this piece of shit, dies a slow death !!! And I think some thing that can make a post in your journal is sorta serious !!!! btw

(Reply) (Thread)

From:	erislover
Date:	June 12th, 2004 05:28 pm (UTC)

(Link)

The only way it can make a post in your journal is by using what YOU use to post in your journal. Unless you want post-less journals, not much you can do about it. Sorry.

(Reply) (Parent) (Thread)

From:	snowelf
Date:	June 12th, 2004 03:23 pm (UTC)

(Link)

Grr...that fuckwit...it makes me so very, very angry that someone would mess with other people like that. I appreciate the warning, Ferret.

(Reply) (Thread) (Expand)

kw34hd1 Expand

theferrett Expand

snowelf Expand

kw34hd1 Expand

(no subject) - (Anonymous) Expand

From:	crumblingredsky
Date:	June 12th, 2004 03:25 pm (UTC)

(Link)

Am i the only one here who thought "'Fucking crackers?' He's against annoying white people now?"

(Reply) (Thread) (Expand)

From:	temujin9
Date:	June 12th, 2004 04:12 pm (UTC)

(Link)

A "cracker" is what everyone thinks about when they hear the word "hacker". Except for actual hackers, which I think Ferrett is, who instead get frustrated at the incorrect usage that American media has caused.

(Reply) (Parent) (Thread)

samila Expand

lingeringxsoul Expand

vvvexation Expand

roxxi Expand

crumblingredsky Expand

From:	kaymera
Date:	June 12th, 2004 03:52 pm (UTC)

(Link)

I'm sorry to bother you but I'm now really thourougly confused and more than a little worried.

"If you see this in someone's journal, they didn't put it there, and you will be vulnerable if you click it."

If I see what in someone's journal? I feel a bit daft now but I really am hugely confused. What should I not click on?

(Reply) (Thread)

From:	malixe
Date:	June 12th, 2004 04:05 pm (UTC)

(Link)

It's the this is interesting link itself that you don't want to click on.

I bit on it in a friend's journal. My initial reaction was more along the lines of 'great--this is one of those practical joke things that gets played on you and then you turn around and play on the next sucker to come along...'....

Now after reading these responses I'm becoming a bit more concerned...

(Reply) (Parent) (Thread) (Expand)

kaymera Expand

malixe Expand

kaymera Expand

From:	wolfieboy
Date:	June 12th, 2004 04:09 pm (UTC)

Re: Not real interesting

(Link)

Note that if you go to this persons userinfo page, you'll see that he lists a toll free number for you to call and express your opinion. I even verified that it's the same as the toll free number on his domain record so he's not trying to get someone else's number implicated.

You might also want to direct people to this FAQ that tells them how to expire all sessions which they will likely want to do. This won't take your password (since your password isn't stored in the cookie) but it could do all sorts of interesting things with your journal if it keeps the session id.

If possible, folks also want to choose "Bind to IP Address" when they login as mentioned in this FAQ. This means that if someone manages to keep the session id, they can't use it unless they can spoof your ip address.

Note that I've looked at the code for the current mischief and it doesn't do more than is apparent but that doesn't mean that others won't.

(Reply) (Thread) (Expand)

From:	flense
Date:	June 12th, 2004 04:12 pm (UTC)

Re: Not real interesting

(Link)

binding is a great idea - unless you have a dynamic ip (right?)

(Reply) (Parent) (Thread) (Expand)

Re: Not real interesting -

wolfieboy Expand

Re: Not real interesting -

flense Expand

Re: Not real interesting -

batshua Expand

Re: Not real interesting -

kindaubiquitous Expand

Re: Not real interesting -

batshua Expand

Re: Not real interesting -

kindaubiquitous Expand

Re: Not real interesting -

die_aufopferung Expand

Re: Tangentially to the main topic, a small correction -

missysedai Expand

Re: Tangentially to the main topic, a small correction -

die_aufopferung Expand

Re: Tangentially to the main topic, a small correction -

Re: Tangentially to the main topic, a small correction -

missysedai Expand

From:	sneakingyoda
Date:	June 12th, 2004 04:35 pm (UTC)

Re: Forgive me on not understanding this one.

(Link)

OK Ferret,

Now is the link you have up on YOUR entry the real deal? or something you simply fabricated to look like the real deal so that your readers will not be infected even if they do bite?

(Reply) (Thread)

From:	quizzicalsphinx
Date:	June 12th, 2004 04:55 pm (UTC)

Re: Forgive me on not understanding this one.

(Link)

The link on this page links back to one of the Ferret's own entries. No worries; the bomb--here at least--has been defused.

(Reply) (Parent) (Thread)

From:	redpandacub
Date:	June 12th, 2004 05:02 pm (UTC)

(Link)

It's not a permanent cure... and the fucktards crackers still go on breathing - but this will save everyone A LOT of undue heartache

TURN OFF JAVASCRIPT!!!

That's how the virus is running - and it's that simple to avoid

this should also be a natural precaution to anyone surfing on any public site - fine, so you won't get to see those cute little roll-overs or super happy fun pop-up windows... but you'll still have your LJ account.

I hope this can be of some help to y'all

(Reply) (Thread) (Expand)

From:	jenlight
Date:	June 12th, 2004 07:50 pm (UTC)

(Link)

It isn't a virus. It's harmless. No database is made. The passwords aren't being harvested.

(Reply) (Parent) (Thread) (Expand)

redpandacub Expand

jenlight Expand

redpandacub Expand

jenlight Expand

keimel Expand

jenlight Expand

flense Expand

keimel Expand

flense Expand

trejkaz Expand

redpandacub Expand

trejkaz Expand

From:	draconity
Date:	June 12th, 2004 07:32 pm (UTC)

(Link)

I have a friend who downloaded the code and studied it. He says it's harmless.

(Reply) (Thread)

From:	lillybilly
Date:	June 12th, 2004 07:32 pm (UTC)

(Link)

what if you're not able to change your password again?

(Reply) (Thread)

From:	jenlight
Date:	June 12th, 2004 07:48 pm (UTC)

(Link)

http://www.livejournal.com/users/drawkward/332646.html?thread=1969254#t1969254

(Reply) (Thread)

From:	jenlight
Date:	June 12th, 2004 07:49 pm (UTC)

Re: oh and

(Link)

http://www.livejournal.com/users/nightway/63251.html?thread=181779#t181779

(Reply) (Thread)

From:	brackish18
Date:	June 12th, 2004 08:03 pm (UTC)

(Link)

i cant change my password?

(Reply) (Thread)

From:	xlucidiquex
Date:	June 12th, 2004 09:33 pm (UTC)

(Link)

NEITHER CAN I..

uh oh.

(Reply) (Parent) (Thread) (Expand)

brackish18 Expand

From:	youcallhersusie
Date:	June 12th, 2004 08:06 pm (UTC)

(Link)

It's impossible for it to steal your password as explained by my boyfriend.

http://www.livejournal.com/users/coolashell/364234.html?mode=reply

(Reply) (Thread)

The Ferrett's Domain

Powered by LiveJournal.com