eytanz wrote:
The links in the deleted thread went offsite, not to Caravelgames, except the first one which was probably a decoy.
The links used flaws in the forum to inject javascript code to redirect the user to a private site, which would then grab the clicker's CaravelNet password, and redirect the clicker back to the forum.
halyavin wrote:
There is a difference between phishing and XSS. The links were leading to caravelgames as far as I remember, and so there is no fake site here.
Pardon my misuse of terminology. The poster used a commercial program to find flaws in the forum which he could then exploit.
Also I think that without example you wouldn't start to fix the forum as no one want to discuss a DROD solver until I show it. I am even not sure that you are going to fix the forum after this clear evidence of the problem.
You see, if the poster had some altruistic desire to make the forum more secure, he would have sent the vulnerabilities to someone who could fix them. He wouldn't have taken advantage of the vulnerabilities by using them to steal passwords. He did it this way to get attention.
If there is no hole in the forum, there is no big problems in storing password in the cookies. That's why this is not worth to fix the issue. But unfortunately the holes do exist and now they are suitable to compromise passwords. Your beatiful logic leaded to bad consequences.
I'm not saying, nor do I believe I've ever said, that the forum is flawless. I have very limited time to work on the forum - you do realize it's not a full-time paying position, right? I have a long list of things that are more interesting to me than chasing script kiddies. So yeah, I try to make things secure, but stuff slips by.
I wonder what would change if you know the ones name?
You still not answer first question .
I'm not sure what you even mean. I do know his name, and his address, and his phone number. And the school computer he used to find the exploits. I'm not sure what you expect to change.
____________________________
The greatness of a nation and its moral progress can be judged by the way it treats its animals.
--
Mahatma Gandhi