Okay...as I suspected the Russian sauage and the "This is interesting"
things were suspicious...and could compromise your LJ username/password.
I gacked all my cookies, changed my password and I think I'll stick to
e-mail + PGP signing posts for a while...
In other news...Sean and I have had several talks about the
current situation and all is okay.
I'm still bummed out and frustrated with life, but is a week enough time to
move, settle in, and find a job? No. Not even close to being realistic.
But who said I was realistic?
Enough for now...Sean and I are off to go explore the Moraine Hills State
Park...
4 comments:
okay, keep in mind I am not a computer savvy individual, but a guy on my friends list said that, "they don't use your password, they use the fact that you are already logged in and they give your browsers HTTP POST information to send along to LJ."
So I guess the password would be safe, but I went ahead and changed it anyways because I wouldn't feel completely safe otherwise
they can get your password and your login...
I'm the type who is slightly more paranoid after six years of running an ISP...
I've heard too many "yes it's a hack" and "no, it does not take your password" so I don't know. I think its safer to change passwords anyways.
Odds are it's similar to the recent "holes" in phpNuke and phpBB. It's a "cross-scripting" hack.
Essentially, if you are logged in CURRENTLY and click on the link, the URL to post into your own journal is the same for EVERY user and since you are already logged in, there's no need to login at all... So by going to that special URL it posts into your journal.
Technically, if they pulled the cookies, yes, they could get into your account, but not your username/password. (Course, they could spoof a "livejournal-looking" site and capture it that way, but that's a whole 'nother thing.)
For example, the URL listed might instead redirect the visitor to:
www.livejournal.com/postjournal.php?Subject=TEST&body=This_is_a_test...Check_it_out!_URL
which would then auto-post a journal entry. :P (That doesn't work, just a guess.)
Such hacks are quite common, but highly annoying.
Post a Comment