8 ms·

Myspace lets you hijack any account just by knowing the person’s birthday

140 points by happy-go-lucky 9y ago

rosariotech 9y ago
Does MySpace still exists?
- figgis 9y ago
  Of course it does..
- JoshGlazebrook 9y ago
  Don't expect there to be anything there from back when you actually used it. They deleted all of your wall and private messages years ago.
  - smnrchrds 9y ago
    Why would they do that? To alienate the few people who are still using the website for some reason?
  - 13of40 9y ago
    I have mine in a zip file somewhere... They had an option to download it for a while.
    - djsumdog 9y ago
      Yea I think I have mine somewhere as well. I really hate they removed all that historical data though. They could have probably banked on a trickle of logins simply from people looking for the nostalgia.
  - runamok 9y ago
    I actually recently requested and received and export of my blog posts. So there is that at least...
- prawn 9y ago
  The default friend account and one of the founders (Tom) is on Instagram these days travelling the world and sharing info on taking photos. Seems like a really friendly and genuine guy, and his travels and photos are very good: https://www.instagram.com/myspacetom/ https://www.instagram.com/myspacetom/
  - mrkrabo 9y ago
    Which reminds me of this particular (and funny) incident: https://s.aolcdn.com/hss/storage/adam/bce869ebaccb357b9955f371bebefdb0/myspace-tom-polotapia-exchange.jpg https://s.aolcdn.com/hss/storage/adam/bce869ebaccb357b9955f3...
  - kuschku 9y ago
    Why isn’t he on MySpace?
    - prawn 9y ago
      Because he cashed out and it's now more or less dead. Maybe he changed as a person, and customising the look of his social profile matters less to him at this age than the content that he posts?
thinkfurther 9y ago
I remember a time where you could embed js and css in the forums. I never want farther than seeing if I could steal my own login cookie (being new to js I was sure I just had to have overlooked something) and change posts of a user without that user seeing that change haha (test user also being myself, in some god forsaken part of the forum nobody used), then backed off that stuff for fear of being banned and made little "utilities" like expanding text boxes, and pretty stylesheets of course. There was just nooooobody paying attention, I can absolutely vouch for that.
- 13of40 9y ago
  I found a bug like that in Yahoo Personals back in the day. Used it to impress a girl by making extra stuff pop up in her timeline or whatever. Nowadays it would be worth a fat bounty though.
- chrischen 9y ago
  I remember being able to get higher rates as a web developer/designer in high school by being able to make special myspace pages that covered up the UI for businesses.
  - dawnerd 9y ago
    Some of my first gigs/job were setting up new myspace layouts for indie bands. Company I worked for had a custom player built and everything. I remember finding some awesome hacks to make stuff work when myspace rolled out their own player and tried to force it on everyone.
    - Maddison34 9y ago
      It took me just few minutes to get started as a paid member on this site [Check Details Here⇒>https://is.gd/qKRnJt https://is.gd/qKRnJt ] and I work few hours a week but make enough money to last me for a whole month. Talk about less effort and more profit. Paid surveys at home is the best site to join for online surveys. What a great site!
vpribish 9y ago
wow. I haven't gone to it yet - what could it be? what would be the most interesting thing it could have turned into? a cryptocurrency? a UK political party? e-cards? An asteroid mineral rights ponzi scheme? wow.
apostacy 9y ago
Myspace was an XSS playground. You could embed javascript into anyone's profile, by leaving a flash applet (or for that matter a java applet) in a comment, and having it do an openurl to a javascript: url, which would execute in the context of the user viewing it. I had fun replacing people's profile pictures after the page loaded, or stopping all of that annoying background music. It was also possible to capture someone's document.cookie, as late as 2008. Good times...
- maaaats 9y ago
  A Norwegian social site back in the days called Nettby ("net-city") also allowed some html, but did it by just removing unallowed tags. I realised I could write <scr<script>ipt>, and after it did the removal of the first script tag I still had one. This trick still works on surprisingly many sites. Allowing custom html is hard, so think long before rolling your own.
  - bsamuels 9y ago
    a good content security policy goes a very long way towards allowing workable custom html
  - gboudrias 9y ago
    Honestly if it's comments, just use Markdown or something. No reason for your users to have access to HTML.
    - TheDong 9y ago
      You might not realise it, but the average markdown spec allows embedding html as well.
    - joepie91_ 9y ago
      And then this happens: https://github.com/ChALkeR/notes/blob/master/Improper-markup-sanitization.md https://github.com/ChALkeR/notes/blob/master/Improper-markup...
shimon_e 9y ago
No less secure than most people's bank accounts.
Eiriksmal 9y ago
Who owns MySpace now and why does the author's screenshots have varying typos? The "email found" prompt changes from "...Please remeber [sic] update your email address after you log in" to "Please remember to update your email address after you log in." Also, the real MySpace.com's account recovery for "I don't have access to my email" is now taking you to a myspace.desk.com ticketing frontend and a screen that looks nothing like the author's post. Suspicious.
- djsumdog 9y ago
  The variations on the screen shots might have been the author using debugging tools to change some info so not as to use or compromise a real account. I have done that myself for some tutorials and posts. The post was made today, but maybe it got big enough MySpace immediately change it? ¯\_(ツ)_/¯
- mrmondo 9y ago
  It’s another Murdoch ‘asset’ I believe.
  - rmason 9y ago
    Rupert Murdoch bought it for $580 million in 2005 and then sold it to Justin Timberlake and Specific Media Group a few years later for $35 million. According to their Wikipedia page Timberlake & Co sold it in 2016 to Time Inc. http://variety.com/2016/digital/news/time-inc-myspace-viant-1201703860/ http://variety.com/2016/digital/news/time-inc-myspace-viant-...
    - runamok 9y ago
      And it was an assets sale to Time which resulted in all common stock holders (aka employees) getting wiped out. Good times.
    - viraptor 9y ago
      The last trade is a shame. I saw the demo of MySpace around 2014 and found it almost exciting. It was at the time when they were trying to make it all about media consumption with transparent handover between devices and TVs / computers. The tech looked quite fun. Looks like they couldn't get enough interest to pull it off :-( For some reason they were trying to get geeks at local meetups excited about it. I got a can of MySpace-branded energy drink which was one of the weirdest gifts...
sundvor 9y ago
That's brilliant. :) Apologies if snarky, but perhaps $15 on this would be well advised: (Humble Bundle deal also on FP today) https://news.ycombinator.com/item?id=14791255 https://news.ycombinator.com/item?id=14791255 Just bought the bundle; looking forward to learning more about security myself. I would like to think I know the obvious things, but will probably find big gaps if I get through all of it..
cm2187 9y ago
I took the habit of feeding fake random information to all websites asking too noisey questions and keeping track of them in case I need them for recovery. A website doesn't need my exact date of birth, at most it may need my approximate age. It doesn't need my real name either, even if it wants to deliver something to me, the address should be all it takes. It doesn't need my real email address, all it needs is some email alias that I can delete. Good practice for privacy, spam management and security since it is harder to guess this information and to reuse it when leaked.
- x32 9y ago
  So much this. I've never saw the need to do give information out like that. As far as every website is concerned my DOB is 01/01/1990.
  - noja 9y ago
    Thanks for the information :)
  - Siemer 9y ago
    I always use 1/1/1911 to shave off a few more of those precious microseconds
    - sverhagen 9y ago
      If so, did you then just compromise yourself?
    - deleted 9y ago
      [deleted]
  - drewmol 9y ago
    01/23/45, down side is I am getting targeted for a lot of end of life planning ads as of recently! (through snail mail of course)
- hueving 9y ago
  Careful with mailing physical things via the USPS to different names at your address. You might run afoul of mail fraud laws.
deleted 9y ago
[deleted]
wodenokoto 9y ago
Are birthdays part of the 360 million user account breach?
indigochill 9y ago
I attempted recovering my ancient Myspace account just now claiming I'd lost the email. I was directed to a Zendesk form that looked different from the one shown in the screenshots. So looks like they might have changed the process now?
collyw 9y ago
Myspace still exists?
antihero 9y ago
Also the amount of poor/broken English on that form and the dialogs makes me suspect outsourcing.
franciscop 9y ago
In https://help.myspace.com/hc/en-us/articles/201989404-Forgot-Email- https://help.myspace.com/hc/en-us/articles/201989404-Forgot-... they even spell "myspace.com" wrong...
- sushid 9y ago
  Where? If you're referring to the capitalization, I think it's always been "Myspace."
  - franciscop 9y ago
    It might have been removed/changed, but there was a wrong link.
WhiteOwlLion 9y ago
What's MySpace?
wwwhatcrack 9y ago
Oh no, I hope my Digg and Hotmail accounts are still safe.

Does MySpace still exists?

figgis 9y ago
Of course it does..
JoshGlazebrook 9y ago
Don't expect there to be anything there from back when you actually used it. They deleted all of your wall and private messages years ago.
- smnrchrds 9y ago
  Why would they do that? To alienate the few people who are still using the website for some reason?
- 13of40 9y ago
  I have mine in a zip file somewhere... They had an option to download it for a while.
  - djsumdog 9y ago
    Yea I think I have mine somewhere as well. I really hate they removed all that historical data though. They could have probably banked on a trickle of logins simply from people looking for the nostalgia.
- runamok 9y ago
  I actually recently requested and received and export of my blog posts. So there is that at least...
prawn 9y ago
The default friend account and one of the founders (Tom) is on Instagram these days travelling the world and sharing info on taking photos. Seems like a really friendly and genuine guy, and his travels and photos are very good: https://www.instagram.com/myspacetom/ https://www.instagram.com/myspacetom/
- mrkrabo 9y ago
  Which reminds me of this particular (and funny) incident: https://s.aolcdn.com/hss/storage/adam/bce869ebaccb357b9955f371bebefdb0/myspace-tom-polotapia-exchange.jpg https://s.aolcdn.com/hss/storage/adam/bce869ebaccb357b9955f3...
- kuschku 9y ago
  Why isn’t he on MySpace?
  - prawn 9y ago
    Because he cashed out and it's now more or less dead. Maybe he changed as a person, and customising the look of his social profile matters less to him at this age than the content that he posts?

I remember a time where you could embed js and css in the forums. I never want farther than seeing if I could steal my own login cookie (being new to js I was sure I just had to have overlooked something) and change posts of a user without that user seeing that change haha (test user also being myself, in some god forsaken part of the forum nobody used), then backed off that stuff for fear of being banned and made little "utilities" like expanding text boxes, and pretty stylesheets of course. There was just nooooobody paying attention, I can absolutely vouch for that.

13of40 9y ago
I found a bug like that in Yahoo Personals back in the day. Used it to impress a girl by making extra stuff pop up in her timeline or whatever. Nowadays it would be worth a fat bounty though.
chrischen 9y ago
I remember being able to get higher rates as a web developer/designer in high school by being able to make special myspace pages that covered up the UI for businesses.
- dawnerd 9y ago
  Some of my first gigs/job were setting up new myspace layouts for indie bands. Company I worked for had a custom player built and everything. I remember finding some awesome hacks to make stuff work when myspace rolled out their own player and tried to force it on everyone.
  - Maddison34 9y ago
    It took me just few minutes to get started as a paid member on this site [Check Details Here⇒>https://is.gd/qKRnJt https://is.gd/qKRnJt ] and I work few hours a week but make enough money to last me for a whole month. Talk about less effort and more profit. Paid surveys at home is the best site to join for online surveys. What a great site!

vpribish 9y ago

wow. I haven't gone to it yet - what could it be? what would be the most interesting thing it could have turned into? a cryptocurrency? a UK political party? e-cards? An asteroid mineral rights ponzi scheme? wow.

apostacy 9y ago

Myspace was an XSS playground. You could embed javascript into anyone's profile, by leaving a flash applet (or for that matter a java applet) in a comment, and having it do an openurl to a javascript: url, which would execute in the context of the user viewing it. I had fun replacing people's profile pictures after the page loaded, or stopping all of that annoying background music. It was also possible to capture someone's document.cookie, as late as 2008. Good times...

maaaats 9y ago
A Norwegian social site back in the days called Nettby ("net-city") also allowed some html, but did it by just removing unallowed tags. I realised I could write <scr<script>ipt>, and after it did the removal of the first script tag I still had one. This trick still works on surprisingly many sites. Allowing custom html is hard, so think long before rolling your own.
- bsamuels 9y ago
  a good content security policy goes a very long way towards allowing workable custom html
- gboudrias 9y ago
  Honestly if it's comments, just use Markdown or something. No reason for your users to have access to HTML.
  - TheDong 9y ago
    You might not realise it, but the average markdown spec allows embedding html as well.
  - joepie91_ 9y ago
    And then this happens: https://github.com/ChALkeR/notes/blob/master/Improper-markup-sanitization.md https://github.com/ChALkeR/notes/blob/master/Improper-markup...

shimon_e 9y ago

No less secure than most people's bank accounts.

Eiriksmal 9y ago

Who owns MySpace now and why does the author's screenshots have varying typos? The "email found" prompt changes from "...Please remeber [sic] update your email address after you log in" to "Please remember to update your email address after you log in." Also, the real MySpace.com's account recovery for "I don't have access to my email" is now taking you to a myspace.desk.com ticketing frontend and a screen that looks nothing like the author's post. Suspicious.

djsumdog 9y ago
The variations on the screen shots might have been the author using debugging tools to change some info so not as to use or compromise a real account. I have done that myself for some tutorials and posts. The post was made today, but maybe it got big enough MySpace immediately change it? ¯\_(ツ)_/¯
mrmondo 9y ago
It’s another Murdoch ‘asset’ I believe.
- rmason 9y ago
  Rupert Murdoch bought it for $580 million in 2005 and then sold it to Justin Timberlake and Specific Media Group a few years later for $35 million. According to their Wikipedia page Timberlake & Co sold it in 2016 to Time Inc. http://variety.com/2016/digital/news/time-inc-myspace-viant-1201703860/ http://variety.com/2016/digital/news/time-inc-myspace-viant-...
  - runamok 9y ago
    And it was an assets sale to Time which resulted in all common stock holders (aka employees) getting wiped out. Good times.
  - viraptor 9y ago
    The last trade is a shame. I saw the demo of MySpace around 2014 and found it almost exciting. It was at the time when they were trying to make it all about media consumption with transparent handover between devices and TVs / computers. The tech looked quite fun. Looks like they couldn't get enough interest to pull it off :-( For some reason they were trying to get geeks at local meetups excited about it. I got a can of MySpace-branded energy drink which was one of the weirdest gifts...

sundvor 9y ago

That's brilliant. :) Apologies if snarky, but perhaps $15 on this would be well advised: (Humble Bundle deal also on FP today) https://news.ycombinator.com/item?id=14791255 https://news.ycombinator.com/item?id=14791255 Just bought the bundle; looking forward to learning more about security myself. I would like to think I know the obvious things, but will probably find big gaps if I get through all of it..

cm2187 9y ago

I took the habit of feeding fake random information to all websites asking too noisey questions and keeping track of them in case I need them for recovery. A website doesn't need my exact date of birth, at most it may need my approximate age. It doesn't need my real name either, even if it wants to deliver something to me, the address should be all it takes. It doesn't need my real email address, all it needs is some email alias that I can delete. Good practice for privacy, spam management and security since it is harder to guess this information and to reuse it when leaked.

x32 9y ago
So much this. I've never saw the need to do give information out like that. As far as every website is concerned my DOB is 01/01/1990.
- noja 9y ago
  Thanks for the information :)
- Siemer 9y ago
  I always use 1/1/1911 to shave off a few more of those precious microseconds
  - sverhagen 9y ago
    If so, did you then just compromise yourself?
  - deleted 9y ago
    [deleted]
- drewmol 9y ago
  01/23/45, down side is I am getting targeted for a lot of end of life planning ads as of recently! (through snail mail of course)
hueving 9y ago
Careful with mailing physical things via the USPS to different names at your address. You might run afoul of mail fraud laws.

deleted 9y ago

[deleted]

wodenokoto 9y ago

Are birthdays part of the 360 million user account breach?

indigochill 9y ago

I attempted recovering my ancient Myspace account just now claiming I'd lost the email. I was directed to a Zendesk form that looked different from the one shown in the screenshots. So looks like they might have changed the process now?

collyw 9y ago

Myspace still exists?

antihero 9y ago

Also the amount of poor/broken English on that form and the dialogs makes me suspect outsourcing.

franciscop 9y ago

In https://help.myspace.com/hc/en-us/articles/201989404-Forgot-Email- https://help.myspace.com/hc/en-us/articles/201989404-Forgot-... they even spell "myspace.com" wrong...

sushid 9y ago
Where? If you're referring to the capitalization, I think it's always been "Myspace."
- franciscop 9y ago
  It might have been removed/changed, but there was a wrong link.

WhiteOwlLion 9y ago

What's MySpace?

wwwhatcrack 9y ago

Oh no, I hope my Digg and Hotmail accounts are still safe.