You know how when you goto peoples websites it knows your there? That is because of your cookie. Unfortunately that same cookie can also be used for a cross site script basically making you execute commands without your knowledge. I do not what to get into the exact code to make this work but I see people are doing it now.

If you look at my profile on MyBlogLog You will see 2 sites that I did not add.

I wonder if Yahoo could be possibly liable here because basically Yahoo is saying that I said I own these sites… yet I did not…

Check out Jason Calacanis community. Evidently in addition to he also owns and authors …. right….

So what else can people do with cross site xploits on mybloglog? Oh I think we are just seeing the tip.

By Jeremy Schoemaker

Jeremy "ShoeMoney" Schoemaker is the founder & CEO of ShoeMoney Media Group, and to date has sold 6 companies and done over 10 million in affiliate revenue. In 2013 Jeremy released his #1 International Best selling Autobiography titled "Nothing's Changed But My Change" - The ShoeMoney Story. You can read more about Jeremy on his wikipedia page here.

44 thoughts on “Another Mybloglog Exploit – This One A Little More Harmful”
  1. Hello Shoe,

    The reason I choose you, is because you have connections to get it fixed. This isn’t fancy hacking. This is the most basic hack.

    Here is how it works:
    Choose ad a Co-Author, type in the MyBlogLog member name. (for example: Shoemoney). This sends out a e-mail to the user account with a link add yourself as a co-author. Now most people won’t open them, or they get picked up as spam.

    Now exam the link:

    SID = Site ID, which is the community you author
    MID = Member ID, which is the member the e-mail went to

    Now, if you open that url, it will automatically add the author, no clicking, no form etc.

    If you send author requests to a bunch of people. For example, yourself. Then find their memberID, your own SiteID, and insert them into the url, open in a browser. Bam, you have new authors on the community.

    Please let people know at MyBlogLog this needs to be fixed NOW. bugs like this will kill the community. I have posted complete details on the blog listed under Jason community.

    Bradford Knowlton

  2. I aw this noted on John Chow’s blog and explained on how it’s done on another user’s blog. I agree it’s most likely just the beginning of what users are going to discover.

  3. *Should* be easy enough to remove it from your profile though, if you click on the offending community’s “Edit Settings” (when in “my home”) and scroll down to “Remove site/blog from my profile”.

  4. hmm ok so you didnt use the cross site =P well it still works non the less… geez how easy it this?

    Also I dont get any email at all from them so…

  5. well unless you never look at your profile then find out someday someone added a bunch of porn sites =(

  6. I’ve received one of those emails. It just didn’t made sense to have someone you didn’t know to be a co-author so I had it labeled as spam.

  7. Brad,

    Or you could just put that link on a popular myspace page (or your blog, or forum posts, or all your emails, or anything else you can think of) as an iframe.

    How do you say?


  8. So it *should* be pretty easy for you to cancel the transactions for things I bought with your stolen credit card, right?

  9. I noticed this came up from a spammy site that was asking people to be “author’s” of there site. That french or belgium thing with meme in it’s name. They have to fix this ASAP or they will be going down the tubes…soon.

  10. Like shoe said we’re just seeing the tip of this. But hey that’s expected this is an ever evolving industry.

  11. That’s just dirty. I just realized earlier today that MyBlogLog even sent emails when someone posted a heads up to a profile I was on.

  12. ya I thought it was really awesome at first but really the privacy issues now kind of give me the creeps

  13. […] just posted about another MyBlogLog exploit that’s currently happening. In this exploit, a spammer can add his site to the list of […]

  14. I saw another exploit, if you want to call it that. It appears that people are taking advantage of the fact that special characters are being sorted to the top in the “My Communities” section. Browser across some profiles and you will see a few examples. A simple solution would to have the communities come in at random.

  15. It’s turning into a new form of myspace – spam, spam, and more spam. Just like everything.


  16. Yeah Shoe$, they added me as well…was pretty pissed. Granted, it takes like 2 seconds to remove those sites, it is a dirty trick. I was thinking about modding their title to something dirty and off TOS, but didn’t want to hurt the other duped authors.

  17. I was flattered to be asked to co-author a Blog in Belgium this weekend. And I don’t even speak Flemish!
    I am now saddened to see this is not the case.
    However, I was pleasantly surprised to find that I have won the UK National Lottery and the dear nephew of the late Oil Minister of Nigeria has left me a sum of money.
    So take the good with the bad!

  18. I was also offered the position of being a blogger in Belguim for a unfinsihed blogspot blog with a messed up template and some stupid text 🙁 Hey on the brightside atleast we know people are looking at our profiles lol

  19. […] 5 links” to enter in their own spammy keyword-laced links. Another is a way that uses a MyBlogLog cookie exploit to make people seem like they author websites (when they in reality do not). To me, the entire […]

  20. Shoe,

    I was the other blogger who added you as a co-author. I send a private message to you explaining what I did and why. i.e. to get the problem fixed as you have connections.

    MyBlogLog has fixed the problem (I notified them too). The scary part to me is that if someone manages to become a co-author on your site you can’t remove them!

    You can not set one user as the true owner of the the site. Afer I added you as a co-author (proof of concept for the hack) I then tried to remove you and could not do it.

  21. […] : it seems that there’s other people (famous people or the A-List Blogger such as Shoemoney, John Chow, Darren Rowse, and Danny Sullivan) that got the same problem like me too. And now i […]

  22. This definitely has to be stopped…I’m starting to see localhost/mybloglog/spamrun.php show up on some referrers, and it looks like someone’s on a mission.

  23. […] posted that they’d been added as authors on blogs that they didn’t write on including ShoeMoney, John Chow, Danny Sullivan and Web Metrics Guru. Reading the comments on these blogs shows that […]

  24. ya btw nice spam in your comment btw I moderate all outbound links so don’t try that crap again

  25. Yeah i got one of those stupid emails as well, almost clicked the link until i looked at the whole URL

  26. […] Like thousands of other members, the other day I got an email from someone in Belguim asking me to be a coauthor on his blog. I thought that was really weird, obviously. Turns out they were taking advantage of an exploit, which I read about on ShoeMoney’s blog. […]

  27. Blogmemes is not responsible for the hack which occurred this weekend via the Mybloglog Web service.
    The Mybloglog account of one of the network’s members was pirated without his knowledge.
    We do not yet know why or who might be responsible.
    It is not in line with the network’s code of ethics nor in its interest to proceed in this manner and serves only to discredit our community.
    We are currently suffering many spam attacks on our Web sites, which we are combatting as much as possible.
    We thank the mybloglog team for having now corrected this problem.

    We are currently trying to answer all those who have written to us, to explain the situation to them.

    co-founder of the blogmemes network

  28. […] then discovered the exact same thing reported on Blogpond. Apparently both Jeremy Shoemaker and John Chow were affected and added to be the co-authors of that spammy community. If you […]

  29. TechCrunch Japanese アーカイブ » MyBlogLogã?Œè‘—å??ブロガーã?®å‡ºå…¥ã‚Šã‚’ç¦?æ­¢ã€?高ã?¾ã‚‹å??発 says:

    […] Shoemoneyã?¯é?ŽåŽ»ã?«ã‚‚様々ã?ª ãƒ?ックãƒ?タを出ã?—ã?¦ã?„ã‚‹ã?Œã€?å ªå¿?袋ã?®ç·’ã?Œåˆ‡ã‚Œã?ŸYahoo!ã?Œé‰„柱を下ã?™ã?®ã?¯ä»Šå›žã?®æŠ•ç¨¿ã?Œåˆ?ã‚?ã?¦ã? ã€‚ã?“ã?®ãƒ?ックã?§ã?¯åˆ¥ã?®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã?«æˆ?ã‚Šã?™ã?¾ã?—ã?¦ã‚¦ã‚§ãƒ–サーフィンã?™ã‚‹æ–¹æ³•ã‚’照会ã?—ã?¦ã?„る。ã?ªã?®ã?§ã€?自分ã?®ã‚³ãƒ³ãƒ”ュータã?®ã‚³ãƒ¼ãƒ‰ã‚’å°‘ã?—書ã??æ?›ã?ˆã€?MyBlogLogã?®æœ€æ–°èª­ã?¿å?–り専用ウィジェットをインストールã?—ã?¦ã€?誰ã?‹æˆ?ã‚Šã?™ã?¾ã?—ã?Ÿã?„MyBlogLogユーザーã?®ãƒ—ロフィールã?¨ã‚¢ãƒ?ターを使ã?£ã?¦ã‚µã‚¤ãƒˆã?«è¡Œã?‘ã?°ã€?ã??ã?®ã‚¦ã‚£ã‚¸ã‚§ãƒƒãƒˆã?«ã??ã?®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã?®è¡Œå‹•ã?¨ã?—ã?¦è¡¨ç¤ºã?•ã‚Œã‚‹ã€?ã?¨ã?„ã?†ã?“ã?¨ã? ã€‚ […]

  30. […] Another Mybloglog Exploit – This One A Little More Harmful […]

  31. […] has posted various exploits in the past, but it wasn’t til this latest one that Yahoo! decided enough was enough. The […]

  32. […] MyBlogLog Showing Communities I did not Join […]

  33. Shoestring Empire - a webpreneur’s journey - » Socially Hardwired: How I am getting traffic, starting conversation and staying completely connected to the social community says:

    […] a few spamming problems in this network. Just check out these two article from Shoemoney…1 2 personally as it stands right now the risk reward ratio make it worth it to me, but I reserve the […]

  34. […] has posted various exploits in the past, but it wasn’t til this latest one that Yahoo! decided enough was enough. The exploit […]

  35. […] Another Mybloglog Exploit – This One A Little More Harmful […]

  36. […] am not sure if these security problems are part of the same MBL issues that Shoemoney revealed last year or if other loopholes have been discovered since. Shoemoney was banned from MBL and […]

  37. […] Another Mybloglog Exploit – This One A Little More Harmful […]

Comments are closed.