Slashdot Mirror
Details of the LiveJournal Account Hacks
An anonymous reader writes "Brian Krebs of the Washington Post has written about the recent spate of
hijackings at Six Apart's popular LiveJournal service. Hundreds of journals have now been taken over by a
notorious group called 'Bantown' using a series of complicated cross-site-scripting vulnerabilities. Krebs details the recent security changes made by LiveJournal in response to the takeovers." From the article: "It is unclear whether LiveJournal has managed to close the security holes that the hackers claim to have used. The company says it has, but the hackers insist there are still at least 16 other similar JavaScript flaws on the LiveJournal site that could be used conduct the same attack. [Bantown] group members said they plan to turn their attention to looking for similar flaws at another large social-networking site. "
Maybe they should write about how they did it in their blog, I mean someone elses blog.....
Nooo! Poor Emos! I can just see them shivering in a cold, dank corner, cutting themselves because their journal was hi-jacked. What is becoming of this world?!
This is a wake up call to people who use these services... sites like MySpace, LiveJournal, all have fancy features that do things that "users want", but at the expense of security because users don't think of/realize/care about security unless it actually results in a successful hack against them. Those who have hacked LJs might want to consider running their blog using plain text instead of all that wacky Javascript (not exactly necessary for something as basic as text on a web page). Ya get what you pay for... I'd be pretty choked if I was a LJ user who paid for a membership and had my pages all highjacked beyond repair, though...
How on Earth are all those white kids in the suburbs going to express their teen angst now?
I'm betting that this group will take down myspace accounts next. That website is notoriously bad for bugs and well, in my opinion is just horribly written. I guess we'll see what 'Tom' has to say ... :)
I've seen your pictures and can definitively say that the hackers were doing the world a service.
This guy's the limit!
My work here is dung.
They also don't tell us which browser is affected on the newspost. How can we be safe if we are not informed? Can Six Apart actually deal with this in a professional way? I've been noticing LiveJournal is really slow and it hangs a lot lately. It seems that they know nothing about security and are just randomly mashing buttons in a attempt to hit the nail in the head.
Is Six Apart that incompetent that they can't prevent such attacks after they have been going for days, or is this bantown group really that good?
Bored? Browse Slashdot with a +6 modifier for Troll comme
As we move more towards applications that depend on the JavaScript enabled client (AJAX and all his relatives) we will see more of this hacking.
On the bright side, it will eventually get people to code securely in a non-trusted enviroment becuase the source code is not only available, but changeable.
Sadly, there will be a bunch of rough lessons between that wonderful future and what we have right now, espeically with all the focus on WEB 2.0 and Ajax.
Fantasy remains a human right; we make in our measure and in our derivative mode... -- JRR Tolkien
...they hacked into my LJ and corrected all the meter in my "I am sad/I want to die" goth poetry!
"Made up/misattributed quote that makes me look smart. I am on
"How on Earth are all those white kids in the suburbs going to express their teen angst now?"
Post to Slashdot.
It would've been nice if LJ's news post on starting to fix this vulnerability had said which "popular browser" was affected.
Also, I somehow find myself suspecting that the anonymous person calling this 'Bantown' group 'notorious' is probably a member of it.
Details are scarce; all I could find in the LJ_Dev community relating to this wasone post about the effects of the first phase of the fix. Especially check Brad's comments.
egypt urnash minimal art.
Great! While they're in there hacking around they can fix all the spelling errors and bad grammer so prolific in LJ
Current mood: 0wned
I am officially gone from
I don't see how it will necessarily be *more* dangerous than today... simply hit some main points.. strip script tags altogether from user input... or detect/escape them. with link tags, remove them if the href starts with "javascript:" and third, remove on* event attributes from any user inputted tags... issue resolved (for the most part)...
The problem isn't the level of javascript in a site, the problem is checking/validating user input. This is something most developers, especially professional ones, should know.
Michael J. Ryan - tracker1.info
he used his worm to add people to his buddy list! that's really really funny! look how popular i am! i've got millions of friends! no one will laugh at me now!... er... i uh... yes... i wrote a worm to make friends for me....
[ says to himself ]
Please let it be MySpace. Please let it be MySpace.
``Lambs'', of course, are innocent and defenseless. I think you mean ``wolves thrown to the farmers''...
When your site is down & Livejournal's making you angry
You can always blame - Bantown!
When you've got blogs, all the noise and the worry
Seems to stop, I know - Bantown!
Just listen to the music of the vulnerable website
Linger on the domain where the CSS is not right
You only lose!
The lags are much longer there
You can see all your troubles, see all your fear
So go Bantown! things'll be worse when you're
Bantown! - no security measures, for sure
Bantown! - everyone's waiting on you!
He who knows best knows how little he knows. - Thomas Jefferson
The perpetrators just need to make sure they never visit the victim's parent's basements.
*click*
*cluck*
*cluck*
*cluck*
*cluck*
Somehow, I don't think they're going to be very afraid of the mechanical chicken you just activated.
I've written an FAQ on this type of attack which can be found below.
The Cross Site Scripting FAQ
Believe me, if I started murdering people, there would be none of you left.
The GNAA Security Center released working exploit code for the Xanga blogging service (which, I might add, predates MySpace by quite a long time, and maybe LJ too).
This exploit works because Xanga lets users insert Javascript codes into their websites. A malcious user just needs to add the code to their "Look and Feel" control panel and then the Javascript code will send the login cookies of anyone who visits their page to a remote server. Xanga has rudimentary JS filtering of "bad" functions but these filters can easily be bypassed by using the document.print method to write out the bad code across several calls (i.e. document.print("");). Xanga knows about the problem but will not fix it.
This code was used to breach security of several Xanga administrators for many months.
Black Invention Myths
since the six apart acquisition and the moving of the data center from seattle to san francisco, livejournal has actually had perpetual technical issues. User pictures being jumbled, comment notification emails broken(this has been a reoccuring one), problems during peak load hours, community comments, and the like. Every day I look on in greater dismay as admin messages telling me something else is broken or having troubles. I like the service enough to pay for it, so I can keep in touch with old friends I've moved away from. But the 6apart and data center swap were terrible, terrible ideas that are degrading service quality inch by emo little inch.
...about the 16 other XSS attacks.
I've reported an XSS flaw exploitable over IE to LJ over 2 years ago, and the flaw is still exploitable to this day.
(Yes, the email report was read by the right folks over at LJ.)
I'm slightly overdue to send them my yearly reminder, I think. (I should probably set up a cron job for that.)
Cue the 500 posts about "haha, sucks for those Livejournal-using emo fucks" which help (a) put me off of Slashdot for a few days, and (b) obscure the actual information about how I should secure my account or what vulnerabilities these break-ins made use of.
I'm taking a deep breath and trying not to get in an argument with the "Livejournal is stupid" crap that will get modded funny. Just be aware that it gets on the nerves of those of us who use it, and there will inevitably be posts by people defending LJ, and then ridiculous anti-LJ evangelizing posts (as if anyone commenting on Slashdot doesn't know their way around blogs).
If you're posting anti-LJ jokes, please try to make them funny. And if you see useful information about the exploits, mod it up.
xkcd.com - a webcomic of mathematics, love, and language.
I'd mod you up if I had points. I'm almost 40 and use LJ for everything from keeping up with family to seeing who wants to go out for sushi after work. It's a place where my old friends can check up to see what I've been doing and check it again later if they forget. It serves some functions much better than email or phone.
Here is the text:
I'm not going to complain about anyone's typing on
Firefox 2.0 - Spell Rightly.
I think your sight is already hacked because you're too blind to realize that sight and site are two different things. Any just because they're pronounced the same doesn't mean they are the same thing. It's like son and sun.
Saying I wasn't going to complain anymore was a lie. I may start complaining more actually.
Firefox 2.0 - Spell Rightly.
The Bantown kids are notorious troublemakers. #bantown is juped on several EFnet servers and many networks because of their "Banbot", which invites tens of thousands of users to bantown and then kickbans them. They are pretty funny though, and I have enjoyed some of the time I have spent in their channel (when they aren't scrolling ANSI penis and goatse). You can find them at irc.rizon.net #bantown and they have a tollfree contact number at 888-LOL-WHAT. Yes, that number is real and works.
For those curious what was done with said accounts, they were also used to post a number of comments on the following posts: here here here Look at the comments.