1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Appearing as other BHW members (big security issue)

Discussion in 'BlackHat Lounge' started by wizard04, Jul 7, 2015.

Thread Status:
Not open for further replies.
  1. wizard04

    wizard04 Elite Member

    Joined:
    Apr 1, 2014
    Messages:
    2,700
    Likes Received:
    2,538
    Location:
    Outside your house
    I am appearing as other BHW members and it repeating constantly. I think this is a big security issue as others can exploit this.
    I didn't try opening any PM probably after a few second you can't but someone maybe can and misuse the info.

    In the last 30 min I have changed to X6-8 people and I have decided to make screenshots of the lat 3 just to show what is going on and how risky it is.
    wtf11.jpg

    wtf33.jpg

    wtf2.jpg
     
  2. proxygo

    proxygo Jr. VIP Jr. VIP

    Joined:
    Nov 2, 2008
    Messages:
    18,678
    Likes Received:
    10,081
    Occupation:
    PROVIDING PROXIES FOR GSA SCRAPING.
    Location:
    BHW
    Home Page:
  3. BassTrackerBoats

    BassTrackerBoats Super Moderator Staff Member Moderator Jr. VIP

    Joined:
    Mar 10, 2010
    Messages:
    16,765
    Likes Received:
    30,781
    Occupation:
    Selling CPA Sites
    Location:
    Not England
    Home Page:
    • Thanks Thanks x 4
  4. welly_59

    welly_59 Power Member

    Joined:
    Aug 30, 2011
    Messages:
    698
    Likes Received:
    258
    i wouldnt say its a security issue but its definitely a privacy issue. Imagine i ghost logged in as someone else, went to look at my private messages, and saw them talking about me or someone or even mentioning their niches etc. i know you cant read the messages, but the title says a lot sometimes
     
  5. Panther28

    Panther28 Jr. VIP Jr. VIP

    Joined:
    May 2, 2010
    Messages:
    2,677
    Likes Received:
    3,669
    Occupation:
    Internet.
    Location:
    Internet.
    Home Page:
    Come on guys, its the internet, and the best forum on it, cut them a bit slack, i'm sure they are working hard to get it fixed
     
  6. Riders On The Storm

    Riders On The Storm Jr. VIP Jr. VIP

    Joined:
    Feb 27, 2012
    Messages:
    1,270
    Likes Received:
    515
    Due to varnish/nginx maybe. I had spent several days fixing up my sites for same type of issues.
     
  7. livifox

    livifox BANNED BANNED

    Joined:
    Jan 23, 2014
    Messages:
    54
    Likes Received:
    14
    I don't think it's a real security issue but like said above it is a privacy issue.
    For example i tried to acces http://www.blackhatworld.com/blackhat-seo/profile.php?do=editavatar by logging in and directly going to the url (like the error with your inbox) but it doesnt seem to work so i don't think you need to worry about getting your account changed.

    also i think it can be pretty funny sometimes. Schermopname (207).jpg
     
    Last edited: Jul 7, 2015
  8. sergey007

    sergey007 Jr. VIP Jr. VIP

    Joined:
    Nov 13, 2014
    Messages:
    883
    Likes Received:
    328
    Location:
    pbn.rocks
    I had the same issue today, now everything is fine. it seems that the problem is already solved.
     
  9. whiteblackseo

    whiteblackseo Jr. VIP Jr. VIP

    Joined:
    Apr 11, 2015
    Messages:
    2,496
    Likes Received:
    930
    Home Page:
    Happened to me 2 times. Eh, just forget about it.
     
  10. wizard04

    wizard04 Elite Member

    Joined:
    Apr 1, 2014
    Messages:
    2,700
    Likes Received:
    2,538
    Location:
    Outside your house
    Probably its not a security but we can't be sure. But still its enough just to see the PM's and you will know what all about. I have changed two more times, its kinda annoying.
     
  11. Neon

    Neon Jr. VIP Jr. VIP

    Joined:
    Nov 3, 2013
    Messages:
    2,856
    Likes Received:
    6,963
    Gender:
    Male
    Occupation:
    Traveling the world
    Location:
    Berlin
    • Thanks Thanks x 1
  12. seosky

    seosky Power Member

    Joined:
    Feb 4, 2013
    Messages:
    735
    Likes Received:
    107
    I thought it's just me, appearing as someone else.
     
  13. wizard04

    wizard04 Elite Member

    Joined:
    Apr 1, 2014
    Messages:
    2,700
    Likes Received:
    2,538
    Location:
    Outside your house
    If someone is appearing as me and can see my PM's just ti give a heads up, its full with Gay porn images.
     
  14. Apricot

    Apricot Administrator Staff Member Moderator

    Joined:
    Mar 26, 2013
    Messages:
    12,802
    Likes Received:
    8,196
    Gender:
    Female
    Occupation:
    BHW Admin
    Location:
    Station 2E
    Home Page:
    As neonskull said, we are aware of the problem and we're working on it. The glitch only affects the display and you cannot do anything to another member's displayed profile, including opening PM's. If you're concerned about the subject line being visible, archiving PM's in folders and deleting old messages is good practice and, while we get this sorted out, will prevent them from being seen if the inbox is displayed incorrectly.
     
    • Thanks Thanks x 2
    Last edited: Jul 7, 2015
  15. Floopa75

    Floopa75 Jr. VIP Jr. VIP

    Joined:
    Feb 6, 2014
    Messages:
    843
    Likes Received:
    729
    Gender:
    Male
    Haha kinda funny you had my profile in there. I haven't had this happen to me yet
     
  16. ttrox

    ttrox Regular Member

    Joined:
    Jun 28, 2013
    Messages:
    217
    Likes Received:
    76
    Probably not the best time of my life to be sending my papal password on PM's title
     
  17. T0NYS

    T0NYS Supreme Member

    Joined:
    Jun 21, 2014
    Messages:
    1,340
    Likes Received:
    1,031
    Gender:
    Male
    Location:
    #Alb-IT
    I never thought I would become this famous :D
     
    • Thanks Thanks x 1
  18. Avid Learner

    Avid Learner Regular Member

    Joined:
    Oct 28, 2014
    Messages:
    315
    Likes Received:
    105
    Occupation:
    BHW Apprentice
    Location:
    In the BHW Jungle
    Didn't see an update in past couple of days, so, fyi... I ran into this issue today. I assume it is still WIP.
     
  19. Apricot

    Apricot Administrator Staff Member Moderator

    Joined:
    Mar 26, 2013
    Messages:
    12,802
    Likes Received:
    8,196
    Gender:
    Female
    Occupation:
    BHW Admin
    Location:
    Station 2E
    Home Page:
    Unfortunately, yes. We are working on it as a matter of urgency. There hasn't been an update yet because we want to make sure it's resolved instead of posting anything glib or meaningless.

    Diamond Damien's set up a master thread to discuss this : http://www.blackhatworld.com/blackh...ome-different-profile-name-caching-issue.html. please continue any discussions there. It's important that we have one point of contact where everyone can get the same information so I'll close this thread off now.
     
    • Thanks Thanks x 1
Thread Status:
Not open for further replies.