Feb 2 2007

MyBlogLog Exploit - Getting Free Keyword Targeted Links

47 people have said their piece on this post. What say you?

In the last year I have found many little holes in applications and with networks like Google, Microsoft, Firefox and ect… I shoot them a email with what I find and they email me back and its fixed. I was doing this with the MyBlogLog people but now that they are owned by the man it seems they would rather out things publicly and try to embarrass people rather then email so lets just get these out in the open then shall we.

One of the first examples I saw of this is TechCrunches hosted Mybloglog community page (a special deal they have with mybloglog to host it on the techcrunch.com domain) that shows the #1 link on his site is pornotube. But wait… Michael Arrington doe not link to pornotube does he? How the crap does that work? So I started doing some investigating…

Well this one is pretty simple… I don’t even think its worth calling a exploit.

Check out Andreas site. Notice the Free Ringtones link in her top visited links?

Andrea MyBlogLog Links

How did that happen? She does not even have a link on her site for Free Ringtones?

Basically all you have to do is make a html with the MyBlogLog javascript code for the site you want your link to appear on (view source on the page to get the code) Then put your links on the same page like you see here on my dev site.

Click on the link then back as many times as you think needed to appear #1 then watch the next day as your free targeted traffic rolls in. If you run live headers you should be able to find a even easier way to do this…..

Its amazing that this works really… there is no checking of unique ip addresses or referrers… Should be pretty easy to fix.

(O ya sorry andrea for using your site as a guinea pig) <3

Blue said on February 2nd, 2007 at 4:11 pm

hah! I bet Yahoo regrets try embarrass Andy Beal now.
CPA Affiliates said on February 2nd, 2007 at 4:13 pm

*LOL* i am sure tomorrow there will be all kinds of links for various things on peoples mybloglog!!
Cameron Olthuis said on February 2nd, 2007 at 4:14 pm

Haha, I love the way you smacked down MyBlogLog for the Andy Beal incident. In all fairness though it wasn’t their fault what JZ did.
ShoeMoney said on February 2nd, 2007 at 4:17 pm

I am not saying its anyones fault… but if you want to out spamming techniques then lets out them. Just like JZ drew attention to how effective a avatar could be (notice how everyone uses a sexy girl or something)
Tom said on February 2nd, 2007 at 4:52 pm

Ya, it probably isn’t the best of ideas to call out bloggers, with a track record such as Andy Beal, especially when they are not doing anything wrong in the first place.
rog said on February 2nd, 2007 at 5:05 pm

nice catch shoe taking this off my site now
Scott Rafer said on February 2nd, 2007 at 5:09 pm

AKA

@ Cameron — yeah, what you said.
alek said on February 2nd, 2007 at 5:53 pm

Hilarious - definately worth a DIGG!
baron said on February 2nd, 2007 at 7:46 pm

Oooohhh that smarts. Well at least you were kind enough to keep the real ones from public. See who the real spammers are now!
Matt said on February 2nd, 2007 at 10:11 pm

So in your attempt to get back at Jeremy (an invididual) you publicly distribute a serious exploit for MyBlogLog (a product you openly adore and take pride in being one of the main reasons for its success)? Kind of harsh don’t you think?
nuevojefe said on February 2nd, 2007 at 10:32 pm

Hey, he could have started a list instead of just posting one
ShoeMoney said on February 2nd, 2007 at 10:46 pm

please dude if you think this is a serious exploit you are really sheltered in the security world. Its a frickin html page
Matt said on February 2nd, 2007 at 10:50 pm

I’m sorry - ***somewhat-harmful*** exploit. Still doesn’t negate the logic.
John said on February 3rd, 2007 at 2:42 am

I think the proper term should be ‘loophole’ instead of explolit.

The exploit in wordpress that caused all the seo blogs to be hacked is an exploit.
Mikkel deMib Svendsen said on February 3rd, 2007 at 2:52 am

Too funny!
The only thing is it won’t do much for linkpop being just a JavaScript but for traffic generation its probably fine - if you target the right blogs
Global Investor said on February 3rd, 2007 at 1:58 pm

Great stuff. The program is still young tho.
Scott Rafer said on February 3rd, 2007 at 3:33 pm

Hi, do you mind approving my longer, slightly earlier remark where i said something substantive?
ShoeMoney said on February 3rd, 2007 at 3:38 pm

Scott your auto whitelisted so anything you comment is posted…
Tamar Weinberg said on February 3rd, 2007 at 6:45 pm

Hey Shoe, I don’t see Scott’s comment but I figured he’d say something (the MyBlogLog guys are pretty good about responding to this kind of thing) and was wondering what he said… so with that, maybe you should find out why his post didn’t make it through your whitelist.
Andrea said on February 4th, 2007 at 12:20 pm

Nice, now people are using my site to see the changes hahahah oh well, its fun!!!
RapidWeb said on February 4th, 2007 at 5:31 pm

Hey nice tip! Thanks, sorry moved your #1 Free Ringtones down to #2! but i had to test to see if it worked…
andrew wee said on February 4th, 2007 at 8:14 pm

Nothin like free traffic, gurl….

Looks like the ringtones have slipped. But now you got child care center spam…
Cygnus said on February 4th, 2007 at 10:27 pm

If you run mybloglog, check your referrers; some not-so-clever person is running something that shows up as:
http://localhost/mybloglog/spamrun.php

I wonder what the intent is there.
John Loch said on February 5th, 2007 at 4:05 am

Thats just the test run..
LOOK WHAT YOU’VE DONE NOW SHOE !!! (Its all your fault)
Eric Marcoullier said on February 5th, 2007 at 3:34 pm

For the rtecord, Shoe, the PornoTube link *is* a link that was on TechCrunch. It’s not our fault if his readers love porn too. The day he covered our reader rolls he also posted about some dating site, which got four times the clickthrough that we did. People are predictable.

Thanks for calling out the spam technique. Fixing this isn’t quite as simple as we would hope, but we’re working on it.
Steve Poland said on February 5th, 2007 at 3:38 pm

Not that it matters, but Arrington does link to Pornotube
Eric Marcoullier said on February 5th, 2007 at 4:07 pm

Following up on my previous post: http://www.techcrunch.com/2006/07/25/youtube-has-porn-clone
sergey said on November 3rd, 2007 at 9:42 am

Thanks for information.
seoalligator said on January 20th, 2008 at 4:32 am

it is interesting - thanks for the information!
Mybloglog - Just BEGGING to be Spammed said on February 2nd, 2007 at 5:15 pm

[...] Update: MyBlogLog Exploit - Getting Free Keyword Targeted Links bookmark this article: [...]
links for 2007-02-04 at Baron VC said on February 3rd, 2007 at 6:27 pm

[...] MyBlogLog Exploit - Getting Free Keyword Targeted Links Yikes! People can put porn and ringtone affiliate links onto your community site. (tags: mybloglog exploit) [...]
MyBlogLog Exploit » SELaplana said on February 4th, 2007 at 1:59 am

[...] Now, you can actually insert a link on this list which is actually not found on the site. I mean, there’s a techique you can use so that a site will be listed on this list. This technique is discovered by Shoemoney. Basically all you have to do is make a html with the MyBlogLog javascript code for the site you want your link to appear on (view source on the page to get the code) Then put your links on the same page like you see here on my dev site. [...]
MyBlogLog “Hacks” from SoloSEO » Webomatica said on February 5th, 2007 at 2:56 pm

[...] a hack at ShoeMoney. I’m sure this will only get more interesting as MyBlogLog becomes more [...]
Max’ Roter Hut SEO » Blog Archive » Keywordlinks von MyBlogLog said on February 6th, 2007 at 9:41 am

[...] und so einige HighQuality Keywordlinks für seine Projekte bekommen. Wie, das hat Shoemoney herausgefunden und vor ein paar Tagen in seinem Blog [...]
See…this is why I love Shoemoney said on February 8th, 2007 at 7:45 pm

[...] for exploits isn’t my forte it makes me feel all warm and fuzzy knowing that there is another really smart guy who can give a n00b like me the lowdown on spam how it’s done, and most importantly how to [...]
techipedia. » Blog Archive » MyBlogLog Spam Getting Worse? I’d Say So. said on February 18th, 2007 at 2:40 pm

[...] and I’ve been relatively impressed by their promptness in answering these concerns in various blog comments. But I think there are some major issues that need to not just be “addressed” [...]
Big Problems Facing MyBlogLog said on February 19th, 2007 at 9:56 am

[...] - Shoemoney has covered two of them and I’m sure more exist. One is a flaw that lets anyone hijack your “top 5 links” to enter in their own spammy keyword-laced links. Another is a way that uses a MyBlogLog cookie [...]
MyBlogLog Bans Blogger; Backlash Begins said on February 23rd, 2007 at 3:48 pm

[...] has posted various exploits in the past, but it wasn’t til this latest one that Yahoo! decided enough was [...]
Blog Mirrors » MyBlogLog Bans Blogger; Backlash Begins said on February 23rd, 2007 at 4:30 pm

[...] has posted various exploits in the past, but it wasn’t til this latest one that Yahoo! decided enough was [...]
Multimedias.mobi » MyBlogLog Bans Blogger; Backlash Begins said on February 23rd, 2007 at 5:46 pm

[...] has posted various exploits in the past, but it wasn’t til this latest one that Yahoo! decided enough was [...]
TechCrunch Japanese アーカイブ » MyBlogLog�?�著�??ブロガー�?�出入りを�?止�?高�?�る�??発 said on February 23rd, 2007 at 7:15 pm

[...] Shoemoney�?��?�去�?�も様々�?� �?ック�?タを出�?��?��?�る�?��?堪�?袋�?�緒�?�切れ�?�Yahoo!�?�鉄柱を下�?��?��?�今回�?�投稿�?��?�?�?��?�。�?��?��?ック�?��?�別�?�ユーザー�?��?り�?��?��?��?�ウェブサーフィン�?�る方法を照会�?��?��?�る。�?��?��?��?自分�?�コンピュータ�?�コードを少�?�書�??�?��?��?MyBlogLog�?�最新読�?��?�り専用ウィジェットをインストール�?��?��?誰�?��?り�?��?��?��?��?�MyBlogLogユーザー�?�プロフィール�?�ア�?ターを使�?��?�サイト�?�行�?��?��?�??�?�ウィジェット�?��??�?�ユーザー�?�行動�?��?��?�表示�?�れる�?�?��?��?��?��?��?�。 [...]
Tech Blot » Blog Archive » The Great Marketing Tool That is MyBlogLog said on February 23rd, 2007 at 7:18 pm

[...] Shoemoney reports on a exploit in MyBlogLog to get free keyword targeted links. The exploit utilizes the top links for your Blog provided by MyBlogLog which would allow marketers to use this and have their site appear on a community’s top links section. A brief post about this can be found at Shoemoney. [...]
TasSense » MyBlogLog Bans Blogger After Revealing Security Exploits said on February 24th, 2007 at 12:49 am

[...] reports, popular affiliate marketing blogger has been banned from MyBlogLog after revealing several MyBlogLog exploits. With a particular one sending him over the edge with [...]
SoloSEO Blog » Nobody Logged Into MyBlogLog Anymore? said on March 15th, 2007 at 8:07 am

[...] after the Shoemoney incident MyBlogLog fixed the authentication issue and in order to be logged in you had to go back and log in [...]
מדריך שיווק ב�?ינטרנט קידו�? ופרסו�? �?תרי�? » MBL Exposes Users Personal E-mails; is this the last MBL Exploit said on March 16th, 2007 at 3:43 am

[...] this post please read my friends great SEO Blog- Eli Feldblum . links to some former MBL exploites: shoemoney-1, shoemoney-2, jensense, [...]
Ajax Girl said on March 23rd, 2007 at 7:08 pm

[...] has posted various exploits in the past, but it wasn’t til this latest one that Yahoo! decided enough was [...]
Shoestring Empire - a webpreneur’s journey - » Socially Hardwired: How I am getting traffic, starting conversation and staying completely connected to the social community said on April 17th, 2007 at 11:22 pm

[...] than a few spamming problems in this network. Just check out these two article from Shoemoney…1 2 personally as it stands right now the risk reward ratio make it worth it to me, but I reserve the [...]