The epidemic of "white cats" in LJ (lj embedded and social engineering)
An epidemic is raging in LiveJournal right now. Cards of varying degrees of disgust appear in the friendly tape, with accompanying text like “cool stuff” or “look what I found” and a link.
If you click on the link and are logged in to LJ, then nothing will happen. In fact, You will have a stupid cat in the magazine, and an invitation to follow the link.
It looks like this:
')
Now how it works. I had no time to understand thoroughly, but it seems that the known vulnerability in lj embedded is being used. In fact, a normal repost occurs. The password is not compromised.
It works on win and mac, did not work in opera, linux was not checked.
Want to see the code (without the risk of infection) - it is here: Most likely there is something else pulling up.
Want to practice on cats? shadowjack fatal ru. Just do not be surprised to appear in the LJ post.
It is interesting to observe the development of the epidemic. It is enough to take a friend of a thousand, as soon as cats begin to pour into it. If possible, I try to warn people, but you know, curiosity is ineradicable.
The social component, as well as the implementation of well thought out.
Be carefull.
upd 0:44 mutations have gone - now full use of shortcut links.
PS In the comments I will be glad to see a more detailed analysis of the mechanism, they will reach the very hand only tomorrow evening.
If you click on the link and are logged in to LJ, then nothing will happen. In fact, You will have a stupid cat in the magazine, and an invitation to follow the link.
It looks like this:
')
Now how it works. I had no time to understand thoroughly, but it seems that the known vulnerability in lj embedded is being used. In fact, a normal repost occurs. The password is not compromised.
It works on win and mac, did not work in opera, linux was not checked.
Want to see the code (without the risk of infection) - it is here: Most likely there is something else pulling up.
Want to practice on cats? shadowjack fatal ru. Just do not be surprised to appear in the LJ post.
It is interesting to observe the development of the epidemic. It is enough to take a friend of a thousand, as soon as cats begin to pour into it. If possible, I try to warn people, but you know, curiosity is ineradicable.
The social component, as well as the implementation of well thought out.
Be carefull.
upd 0:44 mutations have gone - now full use of shortcut links.
PS In the comments I will be glad to see a more detailed analysis of the mechanism, they will reach the very hand only tomorrow evening.
Source: https://habr.com/ru/post/114381/
All Articles