- Joined
- Jun 16, 2007
- Messages
- 415
This is no bug, but an exploit, which allows users to take on the identity of other users in the Hive Chat. The exploit uses a minimal amount of social engineering, and is easy enough to trick any hive user who is foolish enough just to press a tinyurl link or a link to another certain site.
The exploit works like this:
1. The exploiter will create a tinyurl which links to a phpsite on the hive.
2. The phpsite will include the javacommand:
javascript:new Ajax.Request('chat_ajax.php?do=write'+'&channel='+channel+'&message='+escape2(document.cookie),{onSuccess:sendMessageDone,onFailure:sendMessageFail});
3. Anyone who knows Javascript will know that this will make the user display a message in chat which contains his cookies.
4. With a bit more code one could even make the victim whisper him, so others don't see it happening, leaving all mods clueless of this action.
5. Once the cookies are acquired, the exploiter can use Firefox Cookie Editor to insert the cookie named PHPSESSID as his own. When reconnected to chat, this will make the exploiter be logged in as his victim even if his victim is already in chat.
6. Furthermore his name won't be displayed in the lobby or anywhere else, leaving no trace of who he is. Everything the exploiter types will be seen by the chat as typed from his victims, meaning he can make his victim say things that will result in the victim being banned, kicked or becoming hated on hive. If a mod falls for such a trap, he will furthermore gain all the powers of the mod, which include him being able to ban other users and kick them.
7. The victim, once it displayed its cookies is powerless in every way. It cannot get rid of the exploiter for the entire day at least, has no way of proving what he said and what the exploiter did, and if the exploiter is banned he will still be able to use his victims account in chat, making the victim entirely powerless, as well as moderators powerless, as their only option is to ban the victim.
8. This exploit is working 100% as it is described, and is NOT a theory. This can easily be used and is a danger to users on the hive who click a link which they don't know where it goes.
Here are ways to fix the exploit:
1. Make the system check when a message includes cookies and make it block the message. (This pretty much fixes it.)
2. Alert users to the danger of this exploit.
3. Block sites like tinyurl.com and all sites that lead to chat.hiveworkshop
The exploit works like this:
1. The exploiter will create a tinyurl which links to a phpsite on the hive.
2. The phpsite will include the javacommand:
javascript:new Ajax.Request('chat_ajax.php?do=write'+'&channel='+channel+'&message='+escape2(document.cookie),{onSuccess:sendMessageDone,onFailure:sendMessageFail});
3. Anyone who knows Javascript will know that this will make the user display a message in chat which contains his cookies.
4. With a bit more code one could even make the victim whisper him, so others don't see it happening, leaving all mods clueless of this action.
5. Once the cookies are acquired, the exploiter can use Firefox Cookie Editor to insert the cookie named PHPSESSID as his own. When reconnected to chat, this will make the exploiter be logged in as his victim even if his victim is already in chat.
6. Furthermore his name won't be displayed in the lobby or anywhere else, leaving no trace of who he is. Everything the exploiter types will be seen by the chat as typed from his victims, meaning he can make his victim say things that will result in the victim being banned, kicked or becoming hated on hive. If a mod falls for such a trap, he will furthermore gain all the powers of the mod, which include him being able to ban other users and kick them.
7. The victim, once it displayed its cookies is powerless in every way. It cannot get rid of the exploiter for the entire day at least, has no way of proving what he said and what the exploiter did, and if the exploiter is banned he will still be able to use his victims account in chat, making the victim entirely powerless, as well as moderators powerless, as their only option is to ban the victim.
8. This exploit is working 100% as it is described, and is NOT a theory. This can easily be used and is a danger to users on the hive who click a link which they don't know where it goes.
Here are ways to fix the exploit:
1. Make the system check when a message includes cookies and make it block the message. (This pretty much fixes it.)
2. Alert users to the danger of this exploit.
3. Block sites like tinyurl.com and all sites that lead to chat.hiveworkshop
