Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Privacy Security The Internet

Details of the LiveJournal Account Hacks 246

Posted by Zonk from the my-rss-reader-is-unhappy dept.
An anonymous reader writes "Brian Krebs of the Washington Post has written about the recent spate of hijackings at Six Apart's popular LiveJournal service. Hundreds of journals have now been taken over by a notorious group called 'Bantown' using a series of complicated cross-site-scripting vulnerabilities. Krebs details the recent security changes made by LiveJournal in response to the takeovers." From the article: "It is unclear whether LiveJournal has managed to close the security holes that the hackers claim to have used. The company says it has, but the hackers insist there are still at least 16 other similar JavaScript flaws on the LiveJournal site that could be used conduct the same attack. [Bantown] group members said they plan to turn their attention to looking for similar flaws at another large social-networking site. "
This discussion has been archived. No new comments can be posted.

Details of the LiveJournal Account Hacks More

Details of the LiveJournal Account Hacks

Comments Filter:

  • Blog (Score:5, Funny)

    by Ribbo.com ( 885396 ) on Friday January 20, 2006 @02:11PM (#14520940) Homepage
    Maybe they should write about how they did it in their blog, I mean someone elses blog.....
    • That is about all they can do. What is the point of hacking a livejournal account? I guess you could put up some ads...

      I suppose they aren't going do the nice thing of explaining these 16 supposed holes to livejournal.

      • Re:Blog (Score:3, Insightful)

        by Ribbo.com ( 885396 )
        The correct answer to any "What is the point" question is always "Because they can". Just like the idiots who insist on being the first to post to any new thread, others also crave "being the first" no matter how pointless, insignificant or downright rude it is. It will take a much smarter person than me to work out why they do it (maybe they actually want a job in internet security!)

        • Re:Blog (Score:3, Insightful)

          by pipingguy ( 566974 )

          It will take a much smarter person than me to work out why they do it (maybe they actually want a job in internet security!)

          I'm not smarter than you but I know that those who fuck things up for the rest of us tend to be young (chronologically or mentally) interested in "making a mark". Like peeing to claim territory.

          I'm not immune to the occasional harmless troll myself, but this is just pure abuse.
      • if you can explain that, you can explain all this weird world [encycloped...matica.com]
        • [encyclopediadramatica.com]

          I'm a little put off how there appears to be multiple ads for ban saws on the side of the main page

      • What is the point of hacking a livejournal account?

        Replacing crap with more better crap? Maybe they wanted to show of their l33t skilz and still claim moral obligation as a defense.

  • Poor Emos! (Score:4, Funny)

    by Ardeocalidus ( 947463 ) on Friday January 20, 2006 @02:13PM (#14520949)
    Nooo! Poor Emos! I can just see them shivering in a cold, dank corner, cutting themselves because their journal was hi-jacked. What is becoming of this world?!

  • Wake up call (Score:4, Insightful)

    by Anonymous Coward on Friday January 20, 2006 @02:13PM (#14520953)
    This is a wake up call to people who use these services... sites like MySpace, LiveJournal, all have fancy features that do things that "users want", but at the expense of security because users don't think of/realize/care about security unless it actually results in a successful hack against them. Those who have hacked LJs might want to consider running their blog using plain text instead of all that wacky Javascript (not exactly necessary for something as basic as text on a web page). Ya get what you pay for... I'd be pretty choked if I was a LJ user who paid for a membership and had my pages all highjacked beyond repair, though...

    • Re:Wake up call (Score:4, Interesting)

      by Lehk228 ( 705449 ) on Friday January 20, 2006 @02:17PM (#14520998) Journal
      myspace already got owned by a javascript worm that worked it's way into millions of profiles.

      now instead of fixing the site it asks you for your password 50 f*cking times a day.

      • it was funny (Score:5, Funny)

        by conJunk ( 779958 ) on Friday January 20, 2006 @02:40PM (#14521219)
        that was the funniest part of TFA:

        So far, the damage has been mostly harmless. The most high-profile case so far came in mid-October when one Myspace.com user released a self-replicating computer worm that took advantage of Javascript flaws to add more than a million fellow users to his buddy list. A similar worm hit the online community Xanga on New Year's eve (there is also some strong language at this link.)

        he used his worm to add people to his buddy list! that's really really funny! look how popular i am! i've got millions of friends! no one will laugh at me now!... er... i uh... yes... i wrote a worm to make friends for me....

      • Re:Wake up call (Score:2, Informative)

        by Neoprofin ( 871029 )
        1) The problem was actually in IE's ability to fix and execute broken CSS code which allowed him to input a broken call to a script to get it past the filters and then have IE fix and execute it. THe author himself took down his profile to stop the spread and after a few hours of downtime the problem was fixed, in fact there's a /. article about it. 2) You have to enter your password every time you log out, which is every time you close your browser. Never close the browser never log out. Simple.
        • it's more than just every time you log out almost any time you follow a link form outside myspace in you have to log in, even if you have another window already logged in.

          1998 called and wants their hairy spaghetti code website back

    • Re:Wake up call (Score:3, Insightful)

      by deep44 ( 891922 )

      This is a wake up call to people who use these services... sites like MySpace, LiveJournal, all have fancy features that do things that "users want", but at the expense of security because users don't think of/realize/care about security unless it actually results in a successful hack against them.

      While I agree with your point, keep in mind that the accounts in question were compromised when the account owner clicked on a web link pointing to malicious JavaScript, which then stole the appropriate LiveJou

    • these guys should watch themselves. Myspace and Livejournal are huge, and probably big business by now. I'd expect a criminal investigation, and at least a few lambs thrown to the wolves (read: jail time).

      • Re:I don't know (Score:3, Interesting)

        by neocon ( 580579 )
        ``Lambs'', of course, are innocent and defenseless. I think you mean ``wolves thrown to the farmers''...
        • I guess it depends on how you look at it. Most of these guys are just punk kids playing digital vandal without the slightest clue as to the world of hurt they'll be in if they get caught. Does a kid with a can of spray paint expect to face years in jail and millions of fines? From the perspective of a script kiddie that's all they really are. It's not that they're innocent, I'm just saying they probably don't have a clue of the scale of things here.
          • No, you're right -- my analogy was extremely unfair...

            ... to the wolf. At least the wolf, when it breaks into the fold, is trying to feed itself and its pack. These punk kids are just breaking things for the joy of hearing them break. It's not like it's 1983 again, either -- these things have been against the law (and the law has been enforced) for the entire lifetime of some college freshman now downloading shellcode which he couldn't write and doesn't really understand.

            Throw the book at 'em. :-)

  • Oh dear! (Score:5, Funny)

    by Junky191 ( 549088 ) on Friday January 20, 2006 @02:15PM (#14520963)
    How on Earth are all those white kids in the suburbs going to express their teen angst now?
    • What a dumb question.
      Clearly, they will use the new <lj-hijack> tags to drone on about the stupidity of parents, education, and responsibility on someone else's journal. ;)

    • Oh dear!-SlashBlog (Score:2, Funny)

      by Anonymous Coward
      "How on Earth are all those white kids in the suburbs going to express their teen angst now?"

      Post to Slashdot.
    • (Chris paints some abstract art and gives it to his father for his birthday)

      "Its partially an expression of my teenage angst... But mostly it's a moo-cow!"

    • Re:Oh dear! (Score:5, Informative)

      by StrawberryFrog ( 67065 ) on Friday January 20, 2006 @03:19PM (#14521569) Homepage Journal
      How on Earth are all those white kids in the suburbs going to express their teen angst now?

      How on Earth are all those white kids in the suburbs going to express their teen angst now?

      I wouldn't know mate. I'm in my 30s, and I use LJ to keep in touch with family and friends around the world (UK, Australia, US and South Africa mostly).

      Or at least I did, until my account was hacked and locked today. A good number of other accounts are in the same boat. I just hope that the LJ admins sort it out soon. My account email address was changed to bantownlj292@mailinator.com . I just hope my posts are OK. I can't even tell at present.

  • I bet it's myspace (Score:2, Insightful)

    by janvo ( 639733 )
    I'm betting that this group will take down myspace accounts next. That website is notoriously bad for bugs and well, in my opinion is just horribly written. I guess we'll see what 'Tom' has to say ... :)
    • Horrible doesn't begin to describe the awful coding. I've seen bugs as amateur as off-by-1 bugs in their pagination code. It's like the don't check it at all. If you've got 25 posts, and the page size is 25, why am I seeing a next button? Oh well, *click* (blank page comes up).

      Not to mention random bug after random bug that makes navigation difficult to impossible at times. They're extremely lax input validation makes it possible for spammers to set up camp and add 50,000 friends, while appearing to have

    • Re:I bet it's myspace (Score:4, Funny)

      by MikeFM ( 12491 ) on Friday January 20, 2006 @04:07PM (#14522005) Homepage Journal
      I'd be more impressed if they could index every dirty picture on MySpace and copy them all out so you could look at them in some linear way without having to work through all that annoying crap about peoples lifes. Gee at least that'd be useful.

  • Legal Implications (Score:3, Informative)

    by eldavojohn ( 898314 ) * <eldavojohn@gSTRAWmail.com minus berry> on Friday January 20, 2006 @02:18PM (#14521018) Journal
    In LiveJournal's TOS [livejournal.com], they state:
    JOURNAL CONTENT

    Guidelines for posting to your online journal shall be as follows:

    1. All Content posted to LiveJournal.com in any way, is the responsibility and property of the author. LiveJournal is committed to keeping the Service in decent standing for all audiences but is not responsible for the monitoring or filtering of any journal Content. Within the confines of international and local law, LiveJournal.com will generally not place a limit on the type, or appropriateness of user content within journals. Those users posting material not suitable for all audiences must agree that they are fully responsible for all the content they have posted anywhere on the service. Should content be deemed illegal by such law having jurisdiction over the user, LiveJournal.com is committed to submitting all necessary information to the proper authorities; ....
    So it sounds like they might be in trouble with people losing property, however also in the TOS:
    MODIFICATIONS TO SERVICE

    LiveJournal.com reserves the right to modify or discontinue, temporarily or permanently, the Service (or any part thereof) with or without notice at any time. You agree that LiveJournal.com shall not be liable to you or to any third party for any modification, suspension or discontinuance of the Service.
    And there are other parts that make it sound like LiveJournal would never be in trouble for this unauthorized access parts. But really, who would bother to post their thoughts and words on a site that has no garauntee of saving them? At any minute, LiveJournal could format its servers and databases and start over with no one able to say anything.
    • This may apply to the free service, but it would never fly for their pay service (I think they still have a pay service anyway). Just because you write something doesn't make it legal or enforcable. Lawyers usually write this sort of garbage and write it in a manner which seems to obsolve them of any sort of legal responsibility ever. In the real world many of these terms don't stand up in court.
    • Comment removed based on user account deletion
    • That's why there are personal backup clients for anyone who cares.
  • How many livejournalers are unstable?

    Whatch, some overly depressed LJ'er is going to flip out and take a sledgehammer to the skulls of the perpetrators. Very dangerous to mess with the jouranls of unstable people.

    *click*
    *cluck*
    *cluck*
    *cluck*
    *cluck*

    Just ignore the sound of me loading rounds into my clip...you didn't hear that...

  • Oh no! (Score:2, Insightful)

    by BigZaphod ( 12942 )
    from the article:

    Bantown claims to have figured out a way to subvert that test, and to have even released a free, open-source program that others could use to do the same.

    I like how it was pointed out that this little program is "open-source" almost as if that's a bad thing.
    • It means that people can see how it's done and try modifying it, instead of just running a binary.

      In the same way that having the source can be good when used in positive ways, you've got to admit that it's also bad when used in negative ways.
    • Bantown claims to have figured out a way to subvert that test...

      CAPTCHA images are useful, but not unbreakable. If they were planning on using that as their only line of defense against scripts, they were really kidding themselves. Simple distorted and discolored text is difficult but not impossible to crack. The CAPTCHA Project [captcha.net] is working on more sophisticated forms, using multiple words, image groups, and even audio.

    • Livejournal itself is open source, but I rarely see that mentioned.

  • Is Six Apart able to deal with this properly? (Score:5, Insightful)

    by mpontes ( 878663 ) on Friday January 20, 2006 @02:20PM (#14521050)
    I've been following this lately, and Six Apart's behaviour on this situation seems quite lacking. If what the article says is true and bantown have been just stealing cookies, the only measure they took, a recent change in LJ's subdomain policy [livejournal.com] seems quite pointless, since cookies are binded to .livejournal.com, anyway.

    They also don't tell us which browser is affected on the newspost. How can we be safe if we are not informed? Can Six Apart actually deal with this in a professional way? I've been noticing LiveJournal is really slow and it hangs a lot lately. It seems that they know nothing about security and are just randomly mashing buttons in a attempt to hit the nail in the head.

    Is Six Apart that incompetent that they can't prevent such attacks after they have been going for days, or is this bantown group really that good?

    • First of all, NONE of my e-mail or forum memberships log in automatically. Even though I live alone and even tho my desktop automatically locks (and, I CTRL + ALT + L when I leave before the screen saver locks). I purge the cookies after each site logon, even when I switch between two IDs on the same servicing site.

      On a site of which I have a membership, I logged out, closed the tab for that site, went into: /home/username/.kde/cache-username/http/letter-of- site-being-talked-about

      and then disconnected the

    • Re:Is Six Apart able to deal with this properly? (Score:4, Interesting)

      by Max Threshold ( 540114 ) on Friday January 20, 2006 @04:50PM (#14522378)
      The LiveJournal development and support staff have always been incompetent. In the past, they've compensated paid users with extensions on their subscriptions because of extended service problems they didn't seem to know how to fix. Most recently, they moved their servers from Seattle to L.A., and for the next month, nobody was receiving their comment notifications. They claimed to have fixed it, then realized they hadn't, then sort of brushed it under the rug. I'm still missing all my comment notifications from the month following November 22, 2005. (And there's no other way to follow threads in communities.)

      In many ways, LiveJournal is becoming one of those sites that people only use because it's well-established. If it were new, the glaring problems with the software that runs it would leave it DOA... much like Photo.net and Slashdot.

  • Ahhhhh security.... in Web 2.0 land (Score:5, Interesting)

    by TedTschopp ( 244839 ) on Friday January 20, 2006 @02:21PM (#14521053) Homepage
    As we move more towards applications that depend on the JavaScript enabled client (AJAX and all his relatives) we will see more of this hacking.

    On the bright side, it will eventually get people to code securely in a non-trusted enviroment becuase the source code is not only available, but changeable.

    Sadly, there will be a bunch of rough lessons between that wonderful future and what we have right now, espeically with all the focus on WEB 2.0 and Ajax.

    • As we move more towards applications that depend on the JavaScript enabled client (AJAX and all his relatives) we will see more of this hacking.

      I wouldn't say that. Cross-site scripting is usually caused by user-supplied data being inserted into a page improperly. That's a problem with the bit that generates the HTML. Using more Javascript on a page doesn't change that; a page can use no Javascript whatsoever and still be vulnerable to cross-site scripting attacks.

    • Re:Ahhhhh security.... in Web 2.0 land (Score:4, Interesting)

      by aztracker1 ( 702135 ) on Friday January 20, 2006 @02:37PM (#14521189) Homepage
      I don't see how it will necessarily be *more* dangerous than today... simply hit some main points.. strip script tags altogether from user input... or detect/escape them. with link tags, remove them if the href starts with "javascript:" and third, remove on* event attributes from any user inputted tags... issue resolved (for the most part)...

      The problem isn't the level of javascript in a site, the problem is checking/validating user input. This is something most developers, especially professional ones, should know.
      • It seems to be fairly hard to remove javascript from input where other tags are allowed. By removing things you introduce other things. And web browser parsing becomes even more complex.

        Is there an easier way to check for injections on rendering of the data rather than on saving of the data?

        • Is there an easier way to check for injections on rendering of the data rather than on saving of the data?

          Actually no, you want to check on input, and when you move between tiers. Something that is valid in the client, might be a problem in the application tier or the data tier. And as someone someplace else stated, never trust input. So your database would validate the information before its stored, your application would check the data (from the client and from the database) when it is passed into that

        • In general when looking at restricting things I find it's better to determine what is ok instead and only let through those things you know are not harmful. For example, maybe you wrote a website in 1998 that let users post to a guestbook, so you filtered out javascript, frames, etc. Well along comes xhtml+css and now there's new ways to embed javascript, so you have to update the things you strip out. You are now constantly reacting to the changes or extensions of the specification which may result in m

        • I think the best solution is to replace html tags with "&lt" and "&gt" in all user input. If you want users to format their output use a markup language you define or something pre-existing like Textile [textism.com]
    • My father's been designing multiuser apps since the '80s on quantumlink.

      He taught me a simple, valuable lesson that programmers ignore every day, often with harsh consequences.

      DON'T TRUST THE CLIENT.

      There's never a guarentee that the computer your server is communicating with is running client you wrote, be it in 6502 assembly or Javascript.

  • Even more appalling... (Score:5, Funny)

    by Orrin Bloquy ( 898571 ) on Friday January 20, 2006 @02:25PM (#14521077) Journal
    ...they hacked into my LJ and corrected all the meter in my "I am sad/I want to die" goth poetry!
    • I just don't get the massive amounts of these jokes that appear on slashdot. Almost everyone I know uses LJ, and none of them use it to post goth poetry. They just use it as a blog...

  • Details are scarce. (Score:4, Insightful)

    by Peganthyrus ( 713645 ) on Friday January 20, 2006 @02:28PM (#14521111) Homepage

    It would've been nice if LJ's news post on starting to fix this vulnerability had said which "popular browser" was affected.

    Also, I somehow find myself suspecting that the anonymous person calling this 'Bantown' group 'notorious' is probably a member of it.

    Details are scarce; all I could find in the LJ_Dev community relating to this wasone post about the effects of the first phase of the fix [livejournal.com]. Especially check Brad's comments.

    • Looks like this wasn't really a browser problem. I just spotted this in the comments section of the Post's story, probably written by the author:

      "Wiredog -- Shoot, I forgot to address that in the posting. LJ considered the flaw related to a Firefox problem, but Bantown says that's not really the issue here. From my discussion with the Bantown people: "Livejournal assumed the majority of our javascript injection attacks involved malicious code implanted in style sheets or user posts, and they have heavi

  • Great! (Score:2, Funny)

    by blake3737 ( 839993 )
    Great! While they're in there hacking around they can fix all the spelling errors and bad grammer so prolific in LJ
  • If you want to put tons of dancing Jesus's on your page, and you get hacked, is it really that big a surprise? I'd be tempted to hack someone's blog just to shut off the Dancing Jesus on every post.

    But if you get hacked for Peanut Butter Jelly Time, now there's a travesty!

  • Seen on a hacked page (Score:5, Funny)

    by dkleinsc ( 563838 ) on Friday January 20, 2006 @02:34PM (#14521160) Homepage
    Current mood: 0wned

  • MySpace (Score:3, Funny)

    by phalse phace ( 454635 ) on Friday January 20, 2006 @02:41PM (#14521226)
    [Bantown] group members said they plan to turn their attention to looking for similar flaws at another large social-networking site.

    [ says to himself ]
    Please let it be MySpace. Please let it be MySpace.

  • Bantown! (sung in the Petula Clark style) (Score:5, Funny)

    by digitaldc ( 879047 ) on Friday January 20, 2006 @02:52PM (#14521323)
    When your site is down & Livejournal's making you angry
    You can always blame - Bantown!
    When you've got blogs, all the noise and the worry
    Seems to stop, I know - Bantown!
    Just listen to the music of the vulnerable website
    Linger on the domain where the CSS is not right
    You only lose!

    The lags are much longer there
    You can see all your troubles, see all your fear
    So go Bantown! things'll be worse when you're
    Bantown! - no security measures, for sure
    Bantown! - everyone's waiting on you!

  • This is Cross Site Scripting (Score:5, Informative)

    by mrkitty ( 584915 ) on Friday January 20, 2006 @02:56PM (#14521366) Homepage
    I've written an FAQ on this type of attack which can be found below.
    The Cross Site Scripting FAQ [cgisecurity.com]
  • The GNAA Security Center [www.gnaa.us] released working exploit code for the Xanga [xanga.com] blogging service (which, I might add, predates MySpace by quite a long time, and maybe LJ too).

    This exploit [grok.org.uk] works because Xanga lets users insert Javascript codes into their websites. A malcious user just needs to add the code to their "Look and Feel" control panel and then the Javascript code will send the login cookies of anyone who visits their page to a remote server. Xanga has rudimentary JS filtering of "bad" functions but these filt

  • frequent problems (Score:2, Interesting)

    by headonfire ( 160408 )
    since the six apart acquisition and the moving of the data center from seattle to san francisco, livejournal has actually had perpetual technical issues. User pictures being jumbled, comment notification emails broken(this has been a reoccuring one), problems during peak load hours, community comments, and the like. Every day I look on in greater dismay as admin messages telling me something else is broken or having troubles. I like the service enough to pay for it, so I can keep in touch with old friend

  • I'm pretty sure they're not bluffing... (Score:3, Interesting)

    by metalpet ( 557056 ) on Friday January 20, 2006 @03:23PM (#14521616) Journal
    ...about the 16 other XSS attacks.

    I've reported an XSS flaw exploitable over IE to LJ over 2 years ago, and the flaw is still exploitable to this day.
    (Yes, the email report was read by the right folks over at LJ.)

    I'm slightly overdue to send them my yearly reminder, I think. (I should probably set up a cron job for that.)

  • And now, (Score:5, Insightful)

    by Council ( 514577 ) <rmunroe@gFREEBSDmail.com minus bsd> on Friday January 20, 2006 @04:04PM (#14521976) Homepage
    Cue the 500 posts about "haha, sucks for those Livejournal-using emo fucks" which help (a) put me off of Slashdot for a few days, and (b) obscure the actual information about how I should secure my account or what vulnerabilities these break-ins made use of.

    I'm taking a deep breath and trying not to get in an argument with the "Livejournal is stupid" crap that will get modded funny. Just be aware that it gets on the nerves of those of us who use it, and there will inevitably be posts by people defending LJ, and then ridiculous anti-LJ evangelizing posts (as if anyone commenting on Slashdot doesn't know their way around blogs).

    If you're posting anti-LJ jokes, please try to make them funny. And if you see useful information about the exploits, mod it up.
  • Isn't it funny how people post here about the angst-ridden LJ'ers and yet have all day to moan and complain here? Is your angst just directed toward different things?

    And yes, I'm aware of the irony of me whining about other users on Slashdot. And yes, I have a LJ account.

  • Bantown contact info (Score:2, Interesting)

    by Anonymous Coward
    The Bantown kids are notorious troublemakers. #bantown is juped on several EFnet servers and many networks because of their "Banbot", which invites tens of thousands of users to bantown and then kickbans them. They are pretty funny though, and I have enjoyed some of the time I have spent in their channel (when they aren't scrolling ANSI penis and goatse). You can find them at irc.rizon.net #bantown and they have a tollfree contact number at 888-LOL-WHAT. Yes, that number is real and works.
  • Using Javascript was just ASKING for someone to bust in and screw with your stuff.

    Funnily enough, a couple months ago LJ told me my password was too insecure. I told them they had no right to talk to me about security.

    Looks like I was right after all.

  • For those curious (Score:2, Interesting)

    by cythrawll ( 868585 )
    For those curious what was done with said accounts, they were also used to post a number of comments on the following posts: here [livejournal.com] here [livejournal.com] here Look at the comments.
  • This is not the first time that Javascript-related vulnerabilities caused trouble for a lot of people and it will not be the last time. Therefore people with common sense would like to simply turn off Javascript in the browser setting so that for example bank account information (cookies etc.) cannot be revealed to malicious web sites. But, without Javascript enabled most bank web sites cannot be accessed. By law everybody who likes to operate a car has to pass a driver's test. Why is not require at least c

Slashdot Top Deals

Economists state their GNP growth projections to the nearest tenth of a percentage point to prove they have a sense of humor. -- Edgar R. Fiedler

Close