Slashdot Mirror
Details of the LiveJournal Account Hacks
An anonymous reader writes "Brian Krebs of the Washington Post has written about the recent spate of
hijackings at Six Apart's popular LiveJournal service. Hundreds of journals have now been taken over by a
notorious group called 'Bantown' using a series of complicated cross-site-scripting vulnerabilities. Krebs details the recent security changes made by LiveJournal in response to the takeovers." From the article: "It is unclear whether LiveJournal has managed to close the security holes that the hackers claim to have used. The company says it has, but the hackers insist there are still at least 16 other similar JavaScript flaws on the LiveJournal site that could be used conduct the same attack. [Bantown] group members said they plan to turn their attention to looking for similar flaws at another large social-networking site. "
Maybe they should write about how they did it in their blog, I mean someone elses blog.....
Nooo! Poor Emos! I can just see them shivering in a cold, dank corner, cutting themselves because their journal was hi-jacked. What is becoming of this world?!
Someone took all the amateur porn and replaced it with goatse?
This is a wake up call to people who use these services... sites like MySpace, LiveJournal, all have fancy features that do things that "users want", but at the expense of security because users don't think of/realize/care about security unless it actually results in a successful hack against them. Those who have hacked LJs might want to consider running their blog using plain text instead of all that wacky Javascript (not exactly necessary for something as basic as text on a web page). Ya get what you pay for... I'd be pretty choked if I was a LJ user who paid for a membership and had my pages all highjacked beyond repair, though...
Considering the majority of personal blogger write about their personal lives and reveal the most secret of details does it surprise anybody that they're extremely susceptible to targeted attacks? If you're writing about your latest illegal activities or at least embarrassing moments you probably don't aren't going to be too careful about keeping your username and password secret.
I know I'm generalizing but there have been plenty of stories here and in print media about all the trouble people get themselves into by posting things about their teachers, school mates, etc. on their blogs and myspace type sites.
Of course nobody deserves to have their privacy violated, but some people aren't very careful with it to begin with.
How on Earth are all those white kids in the suburbs going to express their teen angst now?
Cross Site Scripting exploits are not going to go away until the fundamental way these these operates changes.
If we don't fight for ourselves no one will.
I'm betting that this group will take down myspace accounts next. That website is notoriously bad for bugs and well, in my opinion is just horribly written. I guess we'll see what 'Tom' has to say ... :)
Big numbers make for good stories, you have to wonder if Bantown has actually comprised as many accounts as the reporter says they have. Looking at the latest Live journal news post, they don't seem to claim that they've closed all the holes, just that they've taken steps to make their service more secure.
How come there are no details on the exploit?
My work here is dung.
How many livejournalers are unstable?
Whatch, some overly depressed LJ'er is going to flip out and take a sledgehammer to the skulls of the perpetrators. Very dangerous to mess with the jouranls of unstable people.
*click*
*cluck*
*cluck*
*cluck*
*cluck*
Just ignore the sound of me loading rounds into my clip...you didn't hear that...
from the article:
Bantown claims to have figured out a way to subvert that test, and to have even released a free, open-source program that others could use to do the same.
I like how it was pointed out that this little program is "open-source" almost as if that's a bad thing.
Hexy - a strategy game for iPhone/iPod Touch
Its a good thing that only a few sites run the LJ engine. They tend to be rather short-lived because of LJ's vulnerability. One of the others running the LS Engine is DeadEngine, a journal for gothic, emo kids (http://www.deadjournal.com/).
They also don't tell us which browser is affected on the newspost. How can we be safe if we are not informed? Can Six Apart actually deal with this in a professional way? I've been noticing LiveJournal is really slow and it hangs a lot lately. It seems that they know nothing about security and are just randomly mashing buttons in a attempt to hit the nail in the head.
Is Six Apart that incompetent that they can't prevent such attacks after they have been going for days, or is this bantown group really that good?
Bored? Browse Slashdot with a +6 modifier for Troll comme
As we move more towards applications that depend on the JavaScript enabled client (AJAX and all his relatives) we will see more of this hacking.
On the bright side, it will eventually get people to code securely in a non-trusted enviroment becuase the source code is not only available, but changeable.
Sadly, there will be a bunch of rough lessons between that wonderful future and what we have right now, espeically with all the focus on WEB 2.0 and Ajax.
Fantasy remains a human right; we make in our measure and in our derivative mode... -- JRR Tolkien
If you're going to hack myspace, please start here.
And can you disable the tag while you're at it?
Thanks,
Nathan
...they hacked into my LJ and corrected all the meter in my "I am sad/I want to die" goth poetry!
"Made up/misattributed quote that makes me look smart. I am on
It means that people can see how it's done and try modifying it, instead of just running a binary.
In the same way that having the source can be good when used in positive ways, you've got to admit that it's also bad when used in negative ways.
500GB of disk, 5TB of transfer, $5.95/mo
"How on Earth are all those white kids in the suburbs going to express their teen angst now?"
Post to Slashdot.
It would've been nice if LJ's news post on starting to fix this vulnerability had said which "popular browser" was affected.
Also, I somehow find myself suspecting that the anonymous person calling this 'Bantown' group 'notorious' is probably a member of it.
Details are scarce; all I could find in the LJ_Dev community relating to this wasone post about the effects of the first phase of the fix. Especially check Brad's comments.
egypt urnash minimal art.
From TFA:
Bantown members said they created hundreds of dummy member accounts featuring Web links that used the Javascript flaws to steal "cookies"...
And they claim to have the cookies for nine-hundred thousand accounts?!?! I'll admit that's probably a bloated number, but even ten percent of that is impressive.
Honestly, for all the money we put towards advocating safe sex, we should be putting at least a little towards safe browsing.
How many worms/virii/exploits in the past two years have required the victim to be duped into clicking on a mysterious link, or running a file in a mysterious e-mail?
I'm not saying that I mind the earnings when I get to clean up one of those infected computers, but it's just astounding.
Great! While they're in there hacking around they can fix all the spelling errors and bad grammer so prolific in LJ
I wouldn't say that. Cross-site scripting is usually caused by user-supplied data being inserted into a page improperly. That's a problem with the bit that generates the HTML. Using more Javascript on a page doesn't change that; a page can use no Javascript whatsoever and still be vulnerable to cross-site scripting attacks.
Bogtha Bogtha Bogtha
If you want to put tons of dancing Jesus's on your page, and you get hacked, is it really that big a surprise? I'd be tempted to hack someone's blog just to shut off the Dancing Jesus on every post.
But if you get hacked for Peanut Butter Jelly Time, now there's a travesty!
stuff |
Current mood: 0wned
I am officially gone from
these guys should watch themselves. Myspace and Livejournal are huge, and probably big business by now. I'd expect a criminal investigation, and at least a few lambs thrown to the wolves (read: jail time).
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I don't see how it will necessarily be *more* dangerous than today... simply hit some main points.. strip script tags altogether from user input... or detect/escape them. with link tags, remove them if the href starts with "javascript:" and third, remove on* event attributes from any user inputted tags... issue resolved (for the most part)...
The problem isn't the level of javascript in a site, the problem is checking/validating user input. This is something most developers, especially professional ones, should know.
Michael J. Ryan - tracker1.info
he used his worm to add people to his buddy list! that's really really funny! look how popular i am! i've got millions of friends! no one will laugh at me now!... er... i uh... yes... i wrote a worm to make friends for me....
[ says to himself ]
Please let it be MySpace. Please let it be MySpace.
Thats the usual way of doing it, but AJAX is commonly used to generate HTML within the javascript, meaning that without proper care, the AJAX code itself can be used to delete the text. Take for instance an annotation system where you highlight text on a website and write your own annotation, which can in turn be annotated. As a "feature", the javascript creates a new div containing the text to be annotated, and a textarea for your annotation. If you add an annotation containing some html tags escaped to appear as etc then someone highlights that and hits "annotate", if the javascript doesn't check to re-escape the < etc, it might spit the script tag out intact, for the browser to process.
If I have been able to see further than others, it is because I bought a pair of binoculars.
And this is different from going out in public and shouting down a conversation or trying to shut down a protest that you disagree with, how? These crackers are brown shirts, not heros.
When your site is down & Livejournal's making you angry
You can always blame - Bantown!
When you've got blogs, all the noise and the worry
Seems to stop, I know - Bantown!
Just listen to the music of the vulnerable website
Linger on the domain where the CSS is not right
You only lose!
The lags are much longer there
You can see all your troubles, see all your fear
So go Bantown! things'll be worse when you're
Bantown! - no security measures, for sure
Bantown! - everyone's waiting on you!
He who knows best knows how little he knows. - Thomas Jefferson
I've written an FAQ on this type of attack which can be found below.
The Cross Site Scripting FAQ
Believe me, if I started murdering people, there would be none of you left.
Mod parent up, it's true. A user posted an email he got from bantown saying that on his LJ, too.
Bored? Browse Slashdot with a +6 modifier for Troll comme
I'd love to see these guys hack facebook.
RichM
Data Center Knowledge
The GNAA Security Center released working exploit code for the Xanga blogging service (which, I might add, predates MySpace by quite a long time, and maybe LJ too).
This exploit works because Xanga lets users insert Javascript codes into their websites. A malcious user just needs to add the code to their "Look and Feel" control panel and then the Javascript code will send the login cookies of anyone who visits their page to a remote server. Xanga has rudimentary JS filtering of "bad" functions but these filters can easily be bypassed by using the document.print method to write out the bad code across several calls (i.e. document.print("");). Xanga knows about the problem but will not fix it.
This code was used to breach security of several Xanga administrators for many months.
Black Invention Myths
since the six apart acquisition and the moving of the data center from seattle to san francisco, livejournal has actually had perpetual technical issues. User pictures being jumbled, comment notification emails broken(this has been a reoccuring one), problems during peak load hours, community comments, and the like. Every day I look on in greater dismay as admin messages telling me something else is broken or having troubles. I like the service enough to pay for it, so I can keep in touch with old friends I've moved away from. But the 6apart and data center swap were terrible, terrible ideas that are degrading service quality inch by emo little inch.
(Chris paints some abstract art and gives it to his father for his birthday)
"Its partially an expression of my teenage angst... But mostly it's a moo-cow!"
These sites aren't made by professionals. Even if the coders are good, the management isnt.
A few months ago I interviewed with the company the owns myspace. They told me they would expect me to be modifying code on the live servers on the first day.
No time to poke around and see if my changes might break something else.
No staging server.
No debugging.
Direct modifications to the live servers.
That works fine if you are working on the site for a Quake clan, but for a high traffic, "professional" site with millions of users? Obviously not.
If you want to allow users to put in any HTML except for malicious javascript, it gets a little more tricky than that.
B is for #bantown.
...about the 16 other XSS attacks.
I've reported an XSS flaw exploitable over IE to LJ over 2 years ago, and the flaw is still exploitable to this day.
(Yes, the email report was read by the right folks over at LJ.)
I'm slightly overdue to send them my yearly reminder, I think. (I should probably set up a cron job for that.)
Jameth has a history of being part of these sorts of things - he was involved in 'ljdrama.com', a website dedicated to pointing people to LJ entries full of 'drama' to point and laugh, and possibly troll, and was also involved in 'frienditto', a spinoff of LJDrama that would make publicly-viewable archives of friends-only posts... if you gave it your username and password to log in as, of course.
Interestingly enough, Hepkitten, who is mentioned in the Encyclopedia Dramatica page cited in the article as being Bantown's site, is also part of the ljdrama/frienditto/etc circles.
I'd take that email with a salt mine or two.
egypt urnash minimal art.
Let Slashdot know about it. GNAA/Bantown/ANUS/Buttes has a rather good track record of getting these types of ignored security holes fixed rather quickly.
I presume that Bantown hasn't been nice enough to supply details of their 16 other exploits, perhaps not even of the first ones, to LJ. Perhaps the only ones that know the details of the exploit(s) are the members of Bantown. Has anyone tried contacting this group and asking for details?
My father's been designing multiuser apps since the '80s on quantumlink.
He taught me a simple, valuable lesson that programmers ignore every day, often with harsh consequences.
DON'T TRUST THE CLIENT.
There's never a guarentee that the computer your server is communicating with is running client you wrote, be it in 6502 assembly or Javascript.
It should be that the worst consequence of clicking a mysterious link is seeing something you don't want to see. Preventing XSS requires more work than it probably should when you want to allow a subset of HTML. Putting the onus on the user isn't right even though the alternative requires a lot of work.
Cross Site Scripting is compounded by the fact that many of these sites use plain cookies for authentication.
A while back I decyphered mySpace's cookie encoding so I could log in as any user. I was disgusted. When I managed to chat with mySpace's CIO, and it became clear they had no intention on fixing this.
In their opinion, the economics of better security didn't make sense. Server clustering meant that traditional {fast} sessions wouldn't work, and using a database to store session info was too slow.
I'm not sure if this is still true, but at the time, advertising hit counts mattered, security did not.
Sorry, I should've been more clear. I didn't mean to say that the fault falls entirely, or even mostly, on the end user. To say so is just plain naive.
What I am saying is that it would be nice to have users at least exercise *some* care in what links they click on.
So, can we have the code?
Is there an easier way to check for injections on rendering of the data rather than on saving of the data?
I do security
as a LiveJournal user, and a California resident I'm a little confused, as per state law they are required to inform users of breaches of security like this
Cue the 500 posts about "haha, sucks for those Livejournal-using emo fucks" which help (a) put me off of Slashdot for a few days, and (b) obscure the actual information about how I should secure my account or what vulnerabilities these break-ins made use of.
I'm taking a deep breath and trying not to get in an argument with the "Livejournal is stupid" crap that will get modded funny. Just be aware that it gets on the nerves of those of us who use it, and there will inevitably be posts by people defending LJ, and then ridiculous anti-LJ evangelizing posts (as if anyone commenting on Slashdot doesn't know their way around blogs).
If you're posting anti-LJ jokes, please try to make them funny. And if you see useful information about the exploits, mod it up.
xkcd.com - a webcomic of mathematics, love, and language.
Although LJ is currently holding the record in the "most ignored security bugs I reported" category (clocking at 25 months. previous holder was MS, and that was only 2 months), my usual disclosure policy is to not publicize details of a bug once it has been acknowledged until after it gets fixed.
XSS on LJ seems minor enough not to warrant an exception.
Actually no, you want to check on input, and when you move between tiers. Something that is valid in the client, might be a problem in the application tier or the data tier. And as someone someplace else stated, never trust input. So your database would validate the information before its stored, your application would check the data (from the client and from the database) when it is passed into that tier. Of course when you pass stuff up into the client tier, you should mistrust that as well.
Fantasy remains a human right; we make in our measure and in our derivative mode... -- JRR Tolkien
In general when looking at restricting things I find it's better to determine what is ok instead and only let through those things you know are not harmful. For example, maybe you wrote a website in 1998 that let users post to a guestbook, so you filtered out javascript, frames, etc. Well along comes xhtml+css and now there's new ways to embed javascript, so you have to update the things you strip out. You are now constantly reacting to the changes or extensions of the specification which may result in malicious behaviour in the future.
Instead the easier way would be to do something like only allow img, b, i, and a tags, and for img you only allow src attributes and for a you only allow href attributes. For both those attributes they must start with http:/// or https://./ Now no matter how html changes in the future or new browser extensions are added, they can't be exploited because your policy, by default is going to deny those things since they are new and not allowed.
Being a perl person, I use a module from cpan for this called HTML::TagFilter, which saves a lot of time :p
Free Online Woodworking Resources Directory
My account had a bogus email address after it got compromised, until I changed it (and then it was suspended) They are probably holding off everything until the situation is more under control.
-mkb
...the same exploit that was used to comprimise a great number of Neopets accounts earlier this week?
Isn't it funny how people post here about the angst-ridden LJ'ers and yet have all day to moan and complain here? Is your angst just directed toward different things?
And yes, I'm aware of the irony of me whining about other users on Slashdot. And yes, I have a LJ account.
SCO, Microsoft, P2P, what's your hot button?
is often why bugs get out of control and cause more damage than they often would otherwise if they were disclosed to a large audience instead of being sat on.
I'd mod you up if I had points. I'm almost 40 and use LJ for everything from keeping up with family to seeing who wants to go out for sushi after work. It's a place where my old friends can check up to see what I've been doing and check it again later if they forget. It serves some functions much better than email or phone.
Here is the text:
I'm not going to complain about anyone's typing on
Firefox 2.0 - Spell Rightly.
That's a great idea. Does anyone know of example code to do this in java or .NET? I often find it difficult to wrap my mind around writing good validation code for complex data. (like blog entries) I have a blog site setup, but it has terrible data validation. I'd love to handle html safely.
MidnightBSD: The BSD for Everyone
Or at least I did, until my account was hacked and locked today.
A question for my own reference. By chance, do you use windows? And if you do, do you use Internet Explorer 6?
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
I think your sight is already hacked because you're too blind to realize that sight and site are two different things. Any just because they're pronounced the same doesn't mean they are the same thing. It's like son and sun.
Saying I wasn't going to complain anymore was a lie. I may start complaining more actually.
Firefox 2.0 - Spell Rightly.
Yea ... I couldn't read past "evar" ...
No, I am not an English major. My posts are subject to typos and incorrect grammar. Do not expect perfection.
You can backup from LJ direct, or use one of multiple different 3rd party apps to do so. And since you can post with any date, you can restore your journal. Not the comments though, which could sting.
But yes - hopefully it is a wake-up call, and one that will foster a new golden age of universal staged backups. Oh yes.
The Bantown kids are notorious troublemakers. #bantown is juped on several EFnet servers and many networks because of their "Banbot", which invites tens of thousands of users to bantown and then kickbans them. They are pretty funny though, and I have enjoyed some of the time I have spent in their channel (when they aren't scrolling ANSI penis and goatse). You can find them at irc.rizon.net #bantown and they have a tollfree contact number at 888-LOL-WHAT. Yes, that number is real and works.
Having been on both sides, as a security bug reporter, and as a web company employee having had to figuring out how to handle those exact kind of reports, I try to be reasonable on both sides.
I agree there are situations where public disclosure of an unpatched vulnerability is the right thing to do.
In the LJ case, the underlying problem, in my opinion, is that their HTML parser attempts to filter bad things using a blacklist approach, rather than a whitelist.
If I go public and effectively force them to scramble and fix those particular bugs quickly, I can guarantee the fix will end up being a few more blacklisted patterns. This in turns guarantees the exact same situation will happen over and over again.
So I'm holding out, in hope they will use that time to rewrite proper HTML filters.
Another way to look at it is, if I had gone public with my bugs 2 years ago, they'd have been fixed quickly, and the recent bantown crap would have happened in exactly the same way, causing just as much damage.
Both strategies appear to be equally ineffectual here, with the difference that my approach still gives me some theorical leverage I'm using to try and gently prod the LJ team toward fixing this the right way.
1) Yes, Windows XP
2) No, Firefox 1.5 thankyouverymuch.
My Karma: ran over your Dogma
StrawberryFrog
Using Javascript was just ASKING for someone to bust in and screw with your stuff.
Funnily enough, a couple months ago LJ told me my password was too insecure. I told them they had no right to talk to me about security.
Looks like I was right after all.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Wrong. That's a security problem in the CGI script, not in the JavaScript.
When you type something into a webpage and it renders immediately, a copy is sent to the backend CGI script. Only you will see the copy that's rendered immediately, so the only person who you can exploit is yourself. Subsequent users will fetch your input from a CGI script.
Any CGI script that allows user input and redisplays it to other users without escaping HTML and JavaScript appropriately is asking to be exploited. This can happen regardless of whether the input is sent via AJAX or if it's a traditional form submission.
For those curious what was done with said accounts, they were also used to post a number of comments on the following posts: here here here Look at the comments.
Oh wow. I wonder if they brute forced your account or did they get fire fox to somehow comprimise your account?
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
I found a cross-site scripting hole in LiveJournal about two years ago, and wrote a very effective proof-of-concept exploit for it. I never disseminated any information about it, but it sounds like Bantown is exploiting similar vulnerabilities. LiveJournal's security is far too easy to circumvent if you can find a way to sneak JavaScript into a journal page.
Move 'sig'. For great justice!
This is not the first time that Javascript-related vulnerabilities caused trouble for a lot of people and it will not be the last time. Therefore people with common sense would like to simply turn off Javascript in the browser setting so that for example bank account information (cookies etc.) cannot be revealed to malicious web sites. But, without Javascript enabled most bank web sites cannot be accessed. By law everybody who likes to operate a car has to pass a driver's test. Why is not require at least common sense to operate a bank web site?
Apparently it was done due to flaws in Lj's secutiry model, judging by friends acounts, it happened to about 5% of the total LJ population today.
My Karma: ran over your Dogma
StrawberryFrog
I think the best solution is to replace html tags with "<" and ">" in all user input. If you want users to format their output use a markup language you define or something pre-existing like Textile
The best education consists in immunizing people against systematic attempts at education. - Paul Feyerabend
That's really asstute of you to notice that. Here is my business plan: I have some softwares you might want for free but it'll cost ya. My softwares will help you grow your own busyness at hoam using the simple tool of emails. The more emails you send the more money you can make. The profit margins oare all up to you my friend. Some of my partners have made millions with my softwares. And you can too. Just ask me how.
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
and I'm a terrible poker player.
As I've detailled on the child of your older sibling post, I don't intend to post it publicly.
I consider those particular bugs are mere symptoms of a flawed underlying design decision.
My hope is that they adjust their design, not quickly cover their collective behinds.
It's a long shot, I know.
Being a frequent livejournal user, I can tell you all with confidence that LJ has a very small population of emos. Why the hell would any emo make a livejournal when they could make a deadjournal or a Xanga?
~= scwizard =~
fuck mercatur that smelly cunt, cracky-chan is bettar
I was one of those kids back in the late 1990s. Funny thing is, the only "exploit" anyone managed on my machine was to upload a pirated movie to a publicly accessible write-only SMB share (an isolated folder set up as a drop box), thinking they could use my box as a transfer point (and no doubt getting very upset when they couldn't move it anywhere else).
So not only was the "vulnerability" they exploited a by-design feature present in most Windows boxes, it would have been more exploitable on Windows 95/98. All they managed to do to my system was tie up some bandwidth during the upload and tie up some disk space until I checked the drop box -- and get my port shut down when someone like you freaked out and saw that I was running something with different TCP ports than your typical Windows box.
The point of hacking people's journals is Astroturfing and Google page rank modification. If you did it right, you could create a false sense of community trust or like of your product and the blog owner would never know. Companies that forge letters from dead people on their behalf, invent "apple switchers" and pay students to talk to strangers about product and pressure their professors are all over that kind of thing. Companies like Microsoft have long focused on pleasing "decision makers" as a means of selling more of their junk. Haven't you noticed the crapflood of M$ apologists here on Slashdot?
Deceptive techniques like this invariably backfire. A crap flood here on Slashdot filled with praise of XP was the last time I took any praise of anything Microsoft seriously. I read comment after comment of +5 informative drivel that mirrored M$ marketing I would hear elsewhere later, "It's based on the NT kernel so it's solid ..." and other better tempered bullshit. Five years later, we see that it was no more stable than any other M$ junk, has a 12 minute half life on any network, and that it did little more than force people to buy new hardware to get the same old things done. There are countless other examples of bogus praise M$ has bought here in one way or another. The net result of this kind of bullshit is for me to not trust anything positive I hear about anything M$.
Friends don't help friends install M$ junk.
"...group members said they plan to turn their attention to looking for similar flaws at another large social-networking site..."
Is Slashdot next?
Give me my freedom, and I'll take care of my own security, thank you.
Perhaps you can use Perl from inside Java or .Net? I don't know, here's the source of that perl module just in case:
/ TagFilter.pm
http://search.cpan.org/~wross/HTML-TagFilter-1.03
Why not turn that email address in for monitoring by the authorities? Proxy or not, an ISP can traceroute. Find the IP owner (If static, if not find out which IP address was allocated at the time of access to that email account and trace back from there) and blast his ass in court. Even though it's a blog, (IANAL) I say they infringed on your personal property, and you shoudl have a right to defend yourself against this shit.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
You should read the laws that you are trying to apply, they would only be required to notify you if data that could be used to steal your identity had been compromised, and even then, only if it wasn't protected when it was stolen (unencrypted, etc.). So unless you make it a regular habit of posting your social security number in your live journal, then this is not a situation that would apply.
EXPLOIT THAT MOTHERFUCKER! The only way SixApart and LJ will get their asses in gear is when you start costing them money. Just like Microsoft, just like most other software/service vendors that care about money more than the satisfaction of their customers. (And if you don't know what I mean, go google the problems everyone's had with LJ. They're WIDELY-MENTIONED.)
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Let me tell you why. Maybe you'll get some insight into the hatred/love of LJ. I made a community called DIERIAA. The purpose of the community, stated in the info page about the community, was to "Expose people to the music that bands and their labels (indie or not,) release on the web for free promotion." LJ took this as VIOLATING THE LAW, and shut down my community subsequently, before it ever had it's first post. They even told me I was breaking the law (How am I breaking the law if I haven't even posted a link to music that is copywritten and not offered on the internet for public consumption?) That's just my example, and I have HTTPTrack records as proof on a ZIP disk. LJ, while I enjoy it from time to time, can KISS MY FUCKING ASS for the bullshit they've pulled on their supporters.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Ah yes, me versus a giant money-grubbing corporation. An epic fight, where two men enter, one man leaves. That'd show them.
Seriously though, the only reason I find security bugs in stuff is because I use that stuff in the first place. I use it because I like it, so I don't have any particular ill-will toward them.
I've been around enough coders to know how easy it is to screw up, particularly when you don't really understand all the security implications of what you're doing.
They're thoroughly incompetent, and arrogant as hell to boot - do business with these clowns at your peril.
Hmmm... sounds like Slashdot's duplicated code style (approximately the bottom half of page n posts are repeated at the top of page n + 1.
Delenda est Carthagena
Slashdot entertains. Windows pays the mortgage.
irc.rizon.net #bantown if you want to tell them exactly how thrilled you are with their behavior.
Here's the livejournals of a few people known to hang out in #bantown:
I can't confirm either way that they're personally involved in all of this mess or not, but at the very least, why don't you click on through and let them know what you think about the people they hang out with. You can tell a lot about a person by the company they keep, no?
It'd be a real shame if someone exploited their Lj accounts in the same way they've been exploiting others'. A real fucking shame. It'd be even more of a shame if something happened to their irc net. I bet we'd all feel real bad for them.