This morning some 'script kiddy' managed to steal a whole bunch of totse user passwords. These he then posted in NS&H.

PEOPLE, DO NOT CLICK ON LINKS UNLESS YOU 'KNOW' AND TRUST THE POSTER (ie avoid links posted by non-regulars on S&A)

Hopefully someone like cense or jeb from NS&H will post here and tell us how we can protect ourselves.

[This message has been edited by jackketch (edited 03-02-2007).]

Firefox+NoScript is an option to stop it if it's javascript based. If he did it with PHP, there is no way to stop it.



My suggestions are, make sure you have tinyurl preview enabled. Make sure you know the poster and trust them. Also take a look at the url. If it seems a bit out of the ordinary, don't click it. There is going to be alot of this going around, now that people know it's possible. Also, if it's not a tinyrul link, do a quick quote of the person who posted the link to make sure it doesn't lead somewhere other that what is displayed in the post

quote:Hopefully someone like cense or jeb from NS&H will post here and tell us how we can protect ourselves.

I'm a regular poster in NS&H and thats the best advice I can give at the moment



[This message has been edited by O RLY (edited 03-02-2007).]

Also, if your account was stolen Meta managed to 'save' about 75% of them. He'll be posting a list of them soon I hope and you'll be able to get your password from him.

Jack, would you mind please moving athis to SG too.

I know I could write one like it, or just cut and paste your, but I want to get O'Rly's reply too.

Much grass.

Edit: I forgot to add this: If anyone is trhinking they might have some fun with the accounts that were compromised, just remeber this: We know which ones were compromised, and so if we see a post from one of those accounts we can - and will - check the IP, which will still be yours.

[This message has been edited by Metaphysicist (edited 03-02-2007).]

bump. People, please keep bumping this up for me to the top of page until everyone has had a chance to read it.

Whoa, insane :/

I bet that little mother fucker is still sitting in his undies jacking off to his great stunt.

What's wrong with the youth of today?!

Well, people will know now from this stunt to be more carefull about clicking links. About 75% of the accounts were saved which is better then we could have hoped for. More damage would have been done if that list wasn't posted. I'm sure he might have left out a few accounts to keep for himself though.

i wonder if my acct works

Some fucking idiot reads some guides and this is what you get.

Would be nice to know what browser the victims have.

If firefox, then suggestion to all is to not use the save password manager with totse accounts. The flaw in firefoxs password manager allows for these kind of RCSR(Reverse Cross-Site Request).

Meh. Cookie stealing is ridonkulously trivial if you know what to look for.

Just disable cookies. Totse works without them.

EDIT: And upon deeper, further inspection, whatever cookies Totse DOES use are simply timestamps and have nothing to do with login information.

[This message has been edited by Trueborn Vorpal (edited 03-02-2007).]

quote:Originally posted by Trueborn Vorpal:

Meh. Cookie stealing is ridonkulously trivial if you know what to look for.

Just disable cookies. Totse works without them.

EDIT: And upon deeper, further inspection, whatever cookies Totse DOES use are simply timestamps and have nothing to do with login information.



TV, i have just quoted your answer in this thread's 'twin' over on SG http://www.totse.com/bbs/Forum3/HTML/332600.html

quote:Zok

Administrator posted 03-02-2007 15:54 Click Here to See the Profile for Zok Edit/Delete Message Reply w/Quote

EVERYONE should do this. Click on Preferences at the top of the page, then click the link that says "delete all cookies stored by totse.com" and then click the radio button that says "No" for "Store passwords and login info for one month?"

That is how people are getting your passwords. If you view your cookies, from totse.com there is an entry called Password with your UNENCRYPTED password. I am going to talk to Jeff ASAP about fixing this problem. Through other webpages people can write code that steals cookies from this site. In other words, someone can link you somewhere and find your password in a matter of seconds.

Everyone should change their password and password preferences NOW. http://www.totse.com/bin/bbs/ubbmisc.cgi?action=setprefs

bumpy bumpo bump

I have nothing to contribute.

Not even boobs.

I don't post here a lot, but thankz for the warning.

Here ya go Jack

BUMP!

Bump.

BUMP!

quote:Zok

Administrator posted 03-02-2007 15:54 Click Here to See the Profile for Zok Edit/Delete Message Reply w/Quote

Edit: You may want to block cookies from this site as well. I just noticed that it started saving my cookies again after I told it not to. I'm not sure why it did this, but I ultimately disabled cookies in my browser.

THIS IS IMPORTANT!

Done.

Can I just say a big thanks to Meta and JBH? Even though I didn't get mine stolen, they still did a tremendous job.

JBH should be made an honorary mod for his efforts.

Done, and done....

To the top!

quote:Originally posted by CptnCrackHound:

Yesterday I got an unusual pop-up, it said Java Update Available. I have never seen this pop-up before. Was this a coincidence or part of the phish.

It wasn't a phish, it was a cookie stealer.

quote:Originally posted by CptnCrackHound:

Wargsm has a bright career ahead of him!

How so?

Damn. This sucks.

Big thanks to Zok and all the mods for taking care of this shit. We <3 you guys.

And im thinking..... BAN STICK! Somebody needs to get a mutha fucking ban stick!

Swing batta batta SWING batta batta *SWING!* *Crack!* *Banzor!*

quote:Originally posted by XHippie HunterX:

BAnd im thinking..... BAN STICK! Somebody needs to get a mutha fucking ban stick!

Swing batta batta SWING batta batta *SWING!* *Crack!* *Banzor!*

Holy fuckin' shit!

That last part was THE funniest thing i've read in a long time!

If this bump appears, I have not been taken advantage of.

quote:Originally posted by ApocalypsePlease:

If this bump appears, I have not been taken advantage of.

Sorry man, I am straight. I don't do bumps!

quote:Originally posted by CptnCrackHound:

O RLY, I love you and admire your posts. I totally respect you. You are a smart man too.

But com'on, you didn't think of it and come up with the scheme. You have to admit, it was good. He provided a service to Totse to show vulnerability.

Well, he helped changed the passwords to save the accounts. I was the one that linked a mod to the thread right after it was posted. I also mentioned the first time when Meta's account was hijack the method of how they did it. No one listened to me back then and it happned again. I also gave some details and explained to Zok and a few mods on how they did it. No disrespect towards wargsm, this was a group effort and my thanks go out to all of them.

[This message has been edited by O RLY (edited 03-02-2007).]

Who was this fiend?!

And if you want to keep your TOTSE password saved, just don't do it with cookies. Most modern browsers have autofill, and I'm still using that.

Thank god I refuse to click links.

Who dares mess with the temple!?

Bump

Check.

I got an email saying "hiya bek! It appears you havent run a diagnostics scan on your computer in a while, it sounds like you've had some computer issues recently! Click the link below to start the diagnostics test NOW!"

I wonder if that was part of the thing, or if it was just a generic spyware trick.

Bump

quote:Originally posted by yoyobek:

Check.

I got an email saying "hiya bek! It appears you havent run a diagnostics scan on your computer in a while, it sounds like you've had some computer issues recently! Click the link below to start the diagnostics test NOW!"I wonder if that was part of the thing, or if it was just a generic spyware trick.

yoyo:

This was in instance where you click on a link and he accessed your Totse cookie and got your password, then tried the same password to the email account you have on record with Totse. The message you got was just a coincidence.

Edit: That does sound bizzare. To clarify what you saw, was not the Totse breach; however, that's not to say it wasn't something else. Just wanted to CYMA!

[This message has been edited by CptnCrackHound (edited 03-03-2007).]

___--__--__-Honor Amongst Thieves__--____-___--

script kiddy

Well you know (his/hers)Ip find a way to fuck him...

BUMP

BUMP!

hmm is mine affected *posts to find out*

*nudges to the top*

bump

quote:Originally posted by O RLY:

Well, he helped changed the passwords to save the accounts. I was the one that linked a mod to the thread right after it was posted. I also mentioned the first time when Meta's account was hijack the method of how they did it. No one listened to me back then and it happned again. I also gave some details and explained to Zok and a few mods on how they did it. No disrespect towards wargsm, this was a group effort and my thanks go out to all of them.



O RLY for MOD think about

I'll start a partition if you are interesred.

05-27-2006

Status: Regular

Total Posts: 4825

*headbutts yoyobek*

whats ns&h

Internet common sense people...

Bump!

Testing account.

I still seem to be here! or maybe I'm not...

I'm going to think about simply deleting links posted by noobs (under say maybe 100 posts?). I'll post in the Mod forum and see what Zok thinks.

quote:Originally posted by jackketch:

I'm going to think about simply deleting links posted by noobs (under say maybe 100 posts?). I'll post in the Mod forum and see what Zok thinks.

Good idea jack, but I think it violates what totses all about. Sides, some regulars change their account names.

quote:Originally posted by DesertRebel:

Good idea jack, but I think it violates what totses all about. Sides, some regulars change their account names.

I have posted in the mod's forum and we'll see what Zok says although i'm guessing too that it is too draconian for totse.

Mine works?

edit: Yep...

[This message has been edited by torqueman (edited 03-03-2007).]

I hate script kiddies.

Bumpity bump bump

I haven't been on here since about last week,before that I think it was a good month or so.

*Sigh,i'm actually feeling melancholy about it*

b

u

m

p

It's frighteningly easy to do though.

In the 'Would you date this?' thread, I happily clicked the links just assuming that the person was a worthwhile trustable human.



*hangs self*

quote:Originally posted by yoyobek:

It's frighteningly easy to do though.

In the 'Would you date this?' thread, I happily clicked the links just assuming that the person was a worthwhile trustable human.



*hangs self*

Well as someone pointed out in that same thread, a jpg probably is safe...probably...maybe..perhaps...

quote:Originally posted by jackketch:

Well as someone pointed out in that same thread, a jpg probably is safe...probably...maybe..perhaps...



I rarely click on links here. Maybe img tags would useful here?

Just like choosing the right sex partner... might have an STD...

Bump.

quote:Originally posted by stab:

Just like choosing the right sex partner... might have an STD...

Hell yes. My computer is the biggest, nastiest most infected slut there is.

Im here still.... Why is it always me WHYYYY !!!

BUMP!!