Feb 18 2007

Another Mybloglog Exploit - This One A Little More Harmful

By Jeremy Schoemaker 43 comments

You know how when you goto peoples websites it knows your there? That is because of your cookie. Unfortunately that same cookie can also be used for a cross site script basically making you execute commands without your knowledge. I do not what to get into the exact code to make this work but I see people are doing it now.

If you look at my profile on MyBlogLog You will see 2 sites that I did not add.

I wonder if Yahoo could be possibly liable here because basically Yahoo is saying that I said I own these sites… yet I did not…

Check out Jason Calacanis community. Evidently in addition to calacanis.com he also owns and authors seoadwords.com …. right….

So what else can people do with cross site xploits on mybloglog? Oh I think we are just seeing the tip.

Bradford Knowlton said on February 18th, 2007 at 10:22 pm

Hello Shoe,

The reason I choose you, is because you have connections to get it fixed. This isn’t fancy hacking. This is the most basic hack.

Here is how it works:
Choose ad a Co-Author, type in the MyBlogLog member name. (for example: Shoemoney). This sends out a e-mail to the user account with a link add yourself as a co-author. Now most people won’t open them, or they get picked up as spam.

Now exam the link:
http://www.mybloglog.com/buzz/add_author_conf.php?sid=2000117014282382&mid=2000031118260237

SID = Site ID, which is the community you author
MID = Member ID, which is the member the e-mail went to

Now, if you open that url, it will automatically add the author, no clicking, no form etc.

If you send author requests to a bunch of people. For example, yourself. Then find their memberID, your own SiteID, and insert them into the url, open in a browser. Bam, you have new authors on the community.

Please let people know at MyBlogLog this needs to be fixed NOW. bugs like this will kill the community. I have posted complete details on the blog listed under Jason community.

Thanks,
Bradford Knowlton
Brad@UCanBOnline.net

[Reply]
Ron J said on February 18th, 2007 at 10:44 pm

I aw this noted on John Chow’s blog and explained on how it’s done on another user’s blog. I agree it’s most likely just the beginning of what users are going to discover.

[Reply]
Meg said on February 18th, 2007 at 11:12 pm

*Should* be easy enough to remove it from your profile though, if you click on the offending community’s “Edit Settings” (when in “my home”) and scroll down to “Remove site/blog from my profile”.

[Reply]
ShoeMoney said on February 19th, 2007 at 12:32 am

hmm ok so you didnt use the cross site =P well it still works non the less… geez how easy it this?

Also I dont get any email at all from them so…

[Reply]
engtech said on February 19th, 2007 at 12:56 am

I think someone needs more indoctrination with the “never trust users” school of thought.

[Reply]
ShoeMoney said on February 19th, 2007 at 1:33 am

well unless you never look at your profile then find out someday someone added a bunch of porn sites =(

[Reply]
Leonard Chen said on February 19th, 2007 at 1:35 am

I’ve received one of those emails. It just didn’t made sense to have someone you didn’t know to be a co-author so I had it labeled as spam.

[Reply]
dillsmack said on February 19th, 2007 at 1:57 am

Brad,

Or you could just put that link on a popular myspace page (or your blog, or forum posts, or all your emails, or anything else you can think of) as an iframe.

How do you say?

Voila.

[Reply]
dillsmack said on February 19th, 2007 at 1:59 am

So it *should* be pretty easy for you to cancel the transactions for things I bought with your stolen credit card, right?

[Reply]
Meg said on February 19th, 2007 at 2:25 am

Fair point

[Reply]
Meg said on February 19th, 2007 at 2:26 am

Ah ha - so that was you

[Reply]
tony greene said on February 19th, 2007 at 2:44 am

I noticed this came up from a spammy site that was asking people to be “author’s” of there site. That french or belgium thing with meme in it’s name. They have to fix this ASAP or they will be going down the tubes…soon.

[Reply]
IslandGiRL said on February 19th, 2007 at 3:33 am

Like shoe said we’re just seeing the tip of this. But hey that’s expected this is an ever evolving industry.

[Reply]
Tat said on February 19th, 2007 at 3:59 am

That’s just dirty. I just realized earlier today that MyBlogLog even sent emails when someone posted a heads up to a profile I was on.

[Reply]
ShoeMoney said on February 19th, 2007 at 4:09 am

ya I thought it was really awesome at first but really the privacy issues now kind of give me the creeps

[Reply]
Jason Bartholme said on February 19th, 2007 at 8:49 am

I saw another exploit, if you want to call it that. It appears that people are taking advantage of the fact that special characters are being sorted to the top in the “My Communities” section. Browser across some profiles and you will see a few examples. A simple solution would to have the communities come in at random.

[Reply]
Nick said on February 19th, 2007 at 9:32 am

It’s turning into a new form of myspace - spam, spam, and more spam. Just like everything.

-Nick

[Reply]
Cygnus said on February 19th, 2007 at 10:50 am

Yeah Shoe$, they added me as well…was pretty pissed. Granted, it takes like 2 seconds to remove those sites, it is a dirty trick. I was thinking about modding their title to something dirty and off TOS, but didn’t want to hurt the other duped authors.

[Reply]
Jack said on February 19th, 2007 at 11:52 am

I was flattered to be asked to co-author a Blog in Belgium this weekend. And I don’t even speak Flemish!
I am now saddened to see this is not the case.
However, I was pleasantly surprised to find that I have won the UK National Lottery and the dear nephew of the late Oil Minister of Nigeria has left me a sum of money.
So take the good with the bad!

[Reply]
Lee Bandoni said on February 19th, 2007 at 12:21 pm

I was also offered the position of being a blogger in Belguim for a unfinsihed blogspot blog with a messed up template and some stupid text Hey on the brightside atleast we know people are looking at our profiles lol

[Reply]
Bradford Knowlton said on February 19th, 2007 at 12:37 pm

There are no TOS for mybloglog. Ever notice that?

[Reply]
HMTKSteve said on February 19th, 2007 at 1:13 pm

Shoe,

I was the other blogger who added you as a co-author. I send a private message to you explaining what I did and why. i.e. to get the problem fixed as you have connections.

MyBlogLog has fixed the problem (I notified them too). The scary part to me is that if someone manages to become a co-author on your site you can’t remove them!

You can not set one user as the true owner of the the site. Afer I added you as a co-author (proof of concept for the hack) I then tried to remove you and could not do it.

[Reply]
HMTKSteve said on February 19th, 2007 at 1:16 pm

It is super easy. I’m only surprised it was not over-exploited.

[Reply]
HMTKSteve said on February 19th, 2007 at 1:18 pm

This was a mostly harmless hack.

[Reply]
Bill said on February 19th, 2007 at 2:26 pm

This definitely has to be stopped…I’m starting to see localhost/mybloglog/spamrun.php show up on some referrers, and it looks like someone’s on a mission.

[Reply]
ShoeMoney said on February 19th, 2007 at 7:01 pm

ya btw nice spam in your comment btw I moderate all outbound links so don’t try that crap again

[Reply]
Eric Marcoullier said on February 19th, 2007 at 9:47 pm

Shoe — always nice to see you holding our feet to the fire. We posted a pretty lengthy article about what happened and what we’re doing moving forward. http://mybloglogb.typepad.com/my_weblog/2007/02/weekend_spamtac.html

[Reply]
Stu said on February 20th, 2007 at 4:34 am

Yeah i got one of those stupid emails as well, almost clicked the link until i looked at the whole URL

[Reply]
claude said on February 20th, 2007 at 4:19 pm

Blogmemes is not responsible for the hack which occurred this weekend via the Mybloglog Web service.
The Mybloglog account of one of the network’s members was pirated without his knowledge.
We do not yet know why or who might be responsible.
It is not in line with the network’s code of ethics nor in its interest to proceed in this manner and serves only to discredit our community.
We are currently suffering many spam attacks on our Web sites, which we are combatting as much as possible.
We thank the mybloglog team for having now corrected this problem.

We are currently trying to answer all those who have written to us, to explain the situation to them.

Claude
co-founder of the blogmemes network

[Reply]
New MyBlogLog Exploit That Uses The Co-Author Email Request - Affiliate Marketing Blogger said on February 19th, 2007 at 4:14 am

[...] just posted about another MyBlogLog exploit that’s currently happening. In this exploit, a spammer can add his site to the list of [...]
Big Problems Facing MyBlogLog said on February 19th, 2007 at 1:09 pm

[...] 5 links” to enter in their own spammy keyword-laced links. Another is a way that uses a MyBlogLog cookie exploit to make people seem like they author websites (when they in reality do not). To me, the entire [...]
MyBlogLog Co-Author Request - Reaper-X .:[ ID ]:. said on February 19th, 2007 at 2:15 pm

[...] : it seems that there’s other people (famous people or the A-List Blogger such as Shoemoney, John Chow, Darren Rowse, and Danny Sullivan) that got the same problem like me too. And now i [...]
MyBlogLog - Is it Adding Value? said on February 19th, 2007 at 6:09 pm

[...] posted that they’d been added as authors on blogs that they didn’t write on including ShoeMoney, John Chow, Danny Sullivan and Web Metrics Guru. Reading the comments on these blogs shows that [...]
MyBlogLog Growing Pains » Aspects of Home Business Blog said on February 20th, 2007 at 2:20 pm

[...] Like thousands of other members, the other day I got an email from someone in Belguim asking me to be a coauthor on his blog. I thought that was really weird, obviously. Turns out they were taking advantage of an exploit, which I read about on ShoeMoney’s blog. [...]
MyBlogLog’s Co-Author Exploit | SYP said on February 21st, 2007 at 6:11 am

[...] then discovered the exact same thing reported on Blogpond. Apparently both Jeremy Shoemaker and John Chow were affected and added to be the co-authors of that spammy community. If you [...]
TechCrunch Japanese アーカイブ » MyBlogLog�?�著�??ブロガー�?�出入りを�?止�?高�?�る�??発 said on February 23rd, 2007 at 10:49 pm

[...] Shoemoney�?��?�去�?�も様々�?� �?ック�?タを出�?��?��?�る�?��?堪�?袋�?�緒�?�切れ�?�Yahoo!�?�鉄柱を下�?��?��?�今回�?�投稿�?��?�?�?��?�。�?��?��?ック�?��?�別�?�ユーザー�?��?り�?��?��?��?�ウェブサーフィン�?�る方法を照会�?��?��?�る。�?��?��?��?自分�?�コンピュータ�?�コードを少�?�書�??�?��?��?MyBlogLog�?�最新読�?��?�り専用ウィジェットをインストール�?��?��?誰�?��?り�?��?��?��?��?�MyBlogLogユーザー�?�プロフィール�?�ア�?ターを使�?��?�サイト�?�行�?��?��?�??�?�ウィジェット�?��??�?�ユーザー�?�行動�?��?��?�表示�?�れる�?�?��?��?��?��?��?�。 [...]
This Week In SEO - 2/23/07 - TheVanBlog said on February 23rd, 2007 at 11:11 pm

[...] Another Mybloglog Exploit - This One A Little More Harmful [...]
MyBlogLog Bans Blogger; Backlash Begins said on February 24th, 2007 at 2:34 am

[...] has posted various exploits in the past, but it wasn’t til this latest one that Yahoo! decided enough was enough. The [...]
Joe Whyte - Seo Consulting - Rockyfied » Mybloglog community positioning tactics said on March 26th, 2007 at 9:23 am

[...] MyBlogLog Showing Communities I did not Join [...]
Shoestring Empire - a webpreneur’s journey - » Socially Hardwired: How I am getting traffic, starting conversation and staying completely connected to the social community said on April 17th, 2007 at 11:27 pm

[...] a few spamming problems in this network. Just check out these two article from Shoemoney…1 2 personally as it stands right now the risk reward ratio make it worth it to me, but I reserve the [...]
techcrunch » Blog Archive » MyBlogLog Bans Blogger; Backlash Begins said on August 14th, 2007 at 7:02 am

[...] has posted various exploits in the past, but it wasn’t til this latest one that Yahoo! decided enough was enough. The exploit [...]
This Week In SEO - 2/23/07 | TheVanBlog said on January 29th, 2008 at 9:42 pm

[...] Another Mybloglog Exploit - This One A Little More Harmful [...]
MyBlogLog Insecure | Blogging Sueblimely said on February 5th, 2008 at 8:57 am

[...] am not sure if these security problems are part of the same MBL issues that Shoemoney revealed last year or if other loopholes have been discovered since. Shoemoney was banned from MBL and [...]