extreme-dm leaking user:pass in public referer stats - GoFuckYourself.com

rowan · 07-18-2003, 03:08 PM

<img src="http://media.sensationcontent.com/rowan/extreme-pw-leak.gif">

Never seen this before - someone has clicked through to another site from a link in my members area, and it's been recorded in that site's extreme-dm stats.

Several people have jumped on that URL in the past few minutes.

07-18-2003, 03:09 PM

Yup. I've noticed that quite a few times in my stats as well. Pretty shitty.

teenjump · 07-18-2003, 03:09 PM

Brutal. Looks like a bug.

detoxed · 07-18-2003, 03:09 PM

Woud happen with any stats program

rowan · 07-18-2003, 03:11 PM

Quote:

Originally posted by detoxed
Woud happen with any stats program

Yep, but IE doesn't normally include this information in the referer line. It must have been another browser that did it.

thekebie · 07-18-2003, 03:12 PM

How does well do fark boobies convert?

fiveyes · 07-18-2003, 03:37 PM

It's not the program revealing the username:password so much as it is alerting you to a compromised password.

Look at it this way, if someone accesses your site as http://yourdomain.com/ instead of http:// www.yourdomain.com and you use relative linking throughout, then their referers will always be of the form http://yourdomain.com/directory/page.html. Right?

Now, keeping that in mind- the question is, when does a person access a membership area using http://username:[email protected]/members/?

rowan · 07-18-2003, 03:44 PM

Quote:

Originally posted by thekebie
How does well do fark boobies convert?

Aha, you've noticed my site there?

415k clicks since it was listed in October 2001, I can't complain. I don't have any direct stats but I usually get a few signups per week from the 600-800 uniques they still send each day.

Twe Russ · 07-18-2003, 03:49 PM

fiveeyes is the only one with a clue, thats definetely a pw crack,
unless you have a bookmark script that adds them like that for
your members.

fiveyes · 07-18-2003, 03:49 PM

In fact, comng to think of it, go pull your referer log and find the first occurance of that usage. It'll will point back to the password site that has you hotlinked.

zzgundamnzz · 07-18-2003, 03:51 PM

Quote:

Originally posted by Twe Russ
fiveeyes is the only one with a clue, thats definetely a pw crack,
unless you have a bookmark script that adds them like that for
your members.

Looks like it. Is Necrohiphop up again?

rowan · 07-18-2003, 04:01 PM

I agree that it was probably a password crack that got the 'leaker' to my site, it was just unusual to see it carried through as-is... from checking my logs it looks like it's buried in quite a few other sites extreme-dm stats and has been for at least 2 weeks. My compromised account script didn't pick it up due to the URL being well hidden (for the most part), so there was hardly anyone using it until it hit the 'last 20 referers' of a site and got noticed.

07-18-2003, 03:08 PM	#1
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	extreme-dm leaking user:pass in public referer stats <img src="http://media.sensationcontent.com/rowan/extreme-pw-leak.gif"> Never seen this before - someone has clicked through to another site from a link in my members area, and it's been recorded in that site's extreme-dm stats. Several people have jumped on that URL in the past few minutes.

07-18-2003, 03:37 PM	#7
fiveyes Confirmed User Join Date: Aug 2001 Location: New Orleans Posts: 1,680	It's not the program revealing the username:password so much as it is alerting you to a compromised password. Look at it this way, if someone accesses your site as http://yourdomain.com/ instead of http:// www.yourdomain.com and you use relative linking throughout, then their referers will always be of the form http://yourdomain.com/directory/page.html. Right? Now, keeping that in mind- the question is, when does a person access a membership area using http://username:[email protected]/members/? __________________ <CENTER><A HREF="http://www.hot-off-bourbon.com/" target="_blank"><IMG SRC="http://www.hot-off-bourbon.com/images/hob-logosmall.jpg" border="0"></A> <FONT face="Comic Sans MS" SIZE="-1"><I>Mardi Gras, Spring Break, Wet-T, Night Club Action, UpSkirt, Oil Wrestling, Voyeur</I></FONT></CENTER>

07-18-2003, 03:49 PM	#9
Twe Russ Confirmed User Join Date: Jan 2003 Location: NYC Posts: 3,493	fiveeyes is the only one with a clue, thats definetely a pw crack, unless you have a bookmark script that adds them like that for your members. __________________ Contact information - ICQ: 7.9.0.3.0.0 · AIM: no roach · E-Mail: roachito \|\| @ \|\| gmail \|\| . \|\| com [Friend Finder - Geo Targeting & Incredible Site Ratio] - [Credit Card Traffic - Make $65 Per Join]

07-18-2003, 03:49 PM	#10
fiveyes Confirmed User Join Date: Aug 2001 Location: New Orleans Posts: 1,680	In fact, comng to think of it, go pull your referer log and find the first occurance of that usage. It'll will point back to the password site that has you hotlinked. __________________ <CENTER><A HREF="http://www.hot-off-bourbon.com/" target="_blank"><IMG SRC="http://www.hot-off-bourbon.com/images/hob-logosmall.jpg" border="0"></A> <FONT face="Comic Sans MS" SIZE="-1"><I>Mardi Gras, Spring Break, Wet-T, Night Club Action, UpSkirt, Oil Wrestling, Voyeur</I></FONT></CENTER>

07-18-2003, 03:09 PM	#2
shermo Guest Posts: n/a	Yup. I've noticed that quite a few times in my stats as well. Pretty shitty.

07-18-2003, 03:09 PM	#3
teenjump So Fucking Banned Join Date: Jul 2003 Posts: 1,595	Brutal. Looks like a bug.

07-18-2003, 03:09 PM	#4
detoxed vip member Join Date: Jan 2003 Posts: 17,798	Woud happen with any stats program

07-18-2003, 03:12 PM	#6
thekebie Confirmed User Join Date: Jun 2003 Location: The Hood of Burquitlam, BC Posts: 1,046	How does well do fark boobies convert?

07-18-2003, 04:01 PM	#12
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	I agree that it was probably a password crack that got the 'leaker' to my site, it was just unusual to see it carried through as-is... from checking my logs it looks like it's buried in quite a few other sites extreme-dm stats and has been for at least 2 weeks. My compromised account script didn't pick it up due to the URL being well hidden (for the most part), so there was hardly anyone using it until it hit the 'last 20 referers' of a site and got noticed.