I've had several posters ask me about it, but I really couldn't tell them anything...was it an actual hack or just password harvesting?

I noticed that some mods were affected by it, too; I saw several mods with it as their locations when I was here yesterday, but I dismissed it as some new mime I wasn't aware of. It wasn't until I went into SG and saw the thread about it that I found out it was wide-spread.

I never even heard about it.

IIRC, it was just a cross site request forgery.

Nothing was compromised. No passwords were stolen. There isn't anything to worry about in terms of account privacy or the like.

Basically, someone had to have set up a malicious site that, when viewed at the same time someone had an active Totse session (ie: Totse was loaded in another window/tab), the malicious site silently loaded a page that sent data (in this case, the location information) to the profile update form (profile.php?do=updateprofile). The data was sent the same way it would have been set had the user done it themselves. Nothing was compromised on the site. The site received the data, checked that it was coming from a valid session (which it would be if the user had a tab/window open with Totse loaded), and it changed the info in the database. It's a very simple exploit that capitalizes on vB (or at least, this instance of vB) not appending session identifying variables to important page actions and/or not requiring verification before make account changes.

Or to break it down into an even smaller soundbite, someone made a page that submitted a fake form to Totse that would update the users profile if they were currently browsing Totse. No account loss, no privacy problems, just an annoyance.

At least, I believe it was a simple XSRF exploit. Not sure if the exact cause has been determined yet.... But either way, no accounts were compromised.

This scares me.

EDIT: On a side note, is this (http://www.totse.com/community/showthread.php?t=2052553) thread anything to worry about?
I worry about someone somehow hacking my account and destroying my forums therough willfull destruction and violence before infracting hundreds of people and posting the M&A forum in public and somehow bring about the downfall of totse and my public humiliation and de-moderisation that would swiftly lead to depression and suffering and then my eventual suicide by attempting to drown myself in a bathtub of liquidised penut butter.

That, would be bad.

EDIT: On a side note, is this (http://www.totse.com/community/showthread.php?t=2052553) thread anything to worry about?I didn't read the whole thread, but I'll assume it's all about the first post.

No, that's nothing to worry about in terms of your account being hacked, unless they managed to guess your password. All he was talking about was signing in as Meta with the wrong password. If you attempt to log in with the wrong password more than 5 times (maybe 3, but I think 5), vB deactivates your account for something like 15 minutes. So if people kept fake logging in to Meta's account, it would keep getting deactivated and Meta wouldn't be able to log in.

Of course, this can happen to anyone, not just Meta.

But they wouldn't gain access to your account or anything, unless they happened to guess your password.

I deleted that thread, just in case.

I mean I have recently had someone try to get into my account - or to just disable it, I don't know which. Either way I did get a few emails saying I was locked out. But it also gave me the IP of the person who was doing it.

So far - knock on wood - I have had no problem of being locked out. I don't know if this is because I leave an open Totse window at all times. But in case it's just because of luck I deleted the thread. I don't want more idiots wanting to try it.

Yoyo, accounts are safe because vB requires password verification to change email addresses or passwords. It doesn't require verification to change certain profile details.

[url=http://www.totse.com/community/showthread.php?t=2052083]This was the thread in question. If you click the link with Totse open in a tab, your profile data will be changed. Unless you have NoScript or something activated. . I banned the poster.

Bobsled was the one who figured out how to do this and posted about it in N(i)S, but he didn't intend it maliciously and didn't realise anybody would try to apply it to Totse. As soon as he found out what was going on he removed the relevant parts of his post.

I got this in an email:


A hoy hoy... I believe that sirholkms was behind the cross site
request forgeries. Here is an msn conversation log between him and
myself.

[15:53:30] <Matthew - Movies sucked, you fucking killed it Jess.>
http://www.totse.com/community/showpost.php?p=8921054&postcount=4
[15:53:30] <Matthew - Movies sucked, you fucking killed it Jess.> LOL^
[15:53:33] <Matthew - Movies sucked, you fucking killed it Jess.> also
[15:53:40] <Matthew - Movies sucked, you fucking killed it Jess.> i
did that thingo^
[15:53:50] <Matthew - Movies sucked, you fucking killed it Jess.>
changed people's locations to "meta is a faggot"
[15:53:52] <Matthew - Movies sucked, you fucking killed it Jess.> rofl!
[15:54:10] <Me> enjoy your banz
[15:56:25] <Matthew - Movies sucked, you fucking killed it Jess.> lolwut
[15:56:35] <Matthew - Movies sucked, you fucking killed it Jess.> i
posted under "Mr. Bai"
[15:56:58] <Me> proxycondom?
[15:57:16] <Matthew - Movies sucked, you fucking killed it Jess.> yarly

-Some-random-totse-member-that-you-could-probably-work-out-who-is-if-you-tried-but-don't.

Man, the guy who did it sure has an annoying handle on MSN.

Well, annoying people are attracted to annoying things.

One of the reasons I killed MSN was the way people I spoke to would feel inclined to have the first entire fucking verse of a song as their screen-name. Reading it again and again became maddening.

I agree. Either way, it looks like it was just some dumb CSS script that caused the problems. People ought to be more careful and disallow scripting from sites they don't trust. If anyone gets word of people purposely spreading such links in the future, just post it here and I'll try and take care of it ASAP.