Don't open the I wear clownshoes threads

Forums:
Email this Topic • Print this Page

I did and look what it spawned.

Topic Stats
Top Replies
Link to this Topic

Type: Discussion • Score: 7 • Views: 1,073 • Replies: 25

[+5] - Robert Gentel - 10/15/2016This bug should be fixed. There was a bug in the bbcode parser library the site uses that allowed arbitrary html injection into the color tag. The "hacker" kids who did this used that bug...
[+5] - Robert Gentel - 10/15/2016Wasn't just me, lots of others helped.
[+5] - Robert Gentel - 10/15/2016As far as I know no user computers or servers were compromised (so no keystroke loggers etc). There was a bug in the bbcode library we use that let a carefully crafted post insert html. Doing that...
[+3] - momoends - 10/14/2016it happened to me when i reported the photo on another topic... ItÂ´s getting out of the admin hands....
[+3] - jespah - 10/15/2016Thank you to everyone who did the fixes and thank you to the community for reporting.

@edgarblythe,

edgarblythe wrote:

I did and look what it spawned.

Delete the thread if you do. Another spawns. Hacker embeded thread. Not sure who the original poster is.

*EDIT* Camfp is the hacker.

2 Replies

@Krumple,

Yeah, I opened it only because I obviously thought it was yours edgar.

Krumple, we can't delete threads, only admin can do that.

I assume edgar that you reported it?

1 Reply

@chai2,

chai2 wrote:

Yeah, I opened it only because I obviously thought it was yours edgar.

Krumple, we can't delete threads, only admin can do that.

I assume edgar that you reported it?

You can delete a post you "start" as long as no body replies to it.

The hacker is making it so the viewer becomes the poster. That gives you the optiin to delete it.

He is spamming every thread with that image.

1 Reply

@Krumple,

it happened to me when i reported the photo on another topic... It´s getting out of the admin hands....

0 Replies

@edgarblythe,

he´s all over the place

0 Replies

@edgarblythe,

This bug should be fixed. There was a bug in the bbcode parser library the site uses that allowed arbitrary html injection into the color tag. The "hacker" kids who did this used that bug to post a javascript that would post the message over and over if you viewed one of the posts. The posts have been removed and the bbcode parser's bug has been fixed.

2 Replies

@Robert Gentel,

Thanks, Robert!

1 Reply

@Walter Hinteler,

Wasn't just me, lots of others helped.

0 Replies

@Robert Gentel,

thank god! my eyes are still bleeding

0 Replies

They (?) must have used keystroke logging to make the false posts, because i was there, but i wasn't logged in; i looked at the threads, but i don't believe they logged in on my account and propagated their awful thread.

1 Reply

Thank you to everyone who did the fixes and thank you to the community for reporting.

0 Replies

the folks who clicked on the hack topics lost their profile descriptions.

to everyone else --

if you have a profile you'd hate to lose to something like this in the future, go into your settings and save it somewhere...

0 Replies

http://able2know.org/account/profile/

0 Replies

@Krumple,

You can delete your own thread for approximately ten minutes, and then you can't, unless I'm remembering wrong, which I suppose is possible.

0 Replies

@Setanta,

As far as I know no user computers or servers were compromised (so no keystroke loggers etc). There was a bug in the bbcode library we use that let a carefully crafted post insert html. Doing that allowed them to link to a javascript, the javascript made the browser try to post the threads and if you were already logged in it worked. We patched the bug in the bbcode library that allowed the html so that won't work again.

1 Reply

I was not certain. Did a whole computer scan just in case.

0 Replies

I'm glad to think that "they" weren't getting anyone's passwords or credit card numbers. While i'm here, thanks to you and Peter.

0 Replies

@Robert Gentel,

Robert Gentel wrote:

As far as I know no user computers or servers were compromised (so no keystroke loggers etc). There was a bug in the bbcode library we use that let a carefully crafted post insert html. Doing that allowed them to link to a javascript, the javascript made the browser try to post the threads and if you were already logged in it worked. We patched the bug in the bbcode library that allowed the html so that won't work again.

Don't open the I wear clownshoes threads

Quick Links

My Account

able2know