Spyro the Dragon Forums / Possible exploit found in Spyrochat

Re: Possible exploit found in Spyrochat

dummy@example.com (DanteAndVergil) — Sun, 27 Jul 2008 00:17:34 +0000

This is best to be locked now as well yeah I have no reason for a change <_>

Re: Possible exploit found in Spyrochat

dummy@example.com (Spyrorocks) — Sun, 27 Jul 2008 00:17:08 +0000

How the heck did you ever think this was a fight? Don't dig up old threads.

Re: Possible exploit found in Spyrochat

dummy@example.com (Aicebo) — Sun, 27 Jul 2008 00:16:26 +0000

Hail The Ice Dragon wrote:

>_< Sounds like a fight... *puts on whistle and black pants with striped shirt* Round 1! Doppel V.S. SR

Um, this thread is from nine days ago...=S

Re: Possible exploit found in Spyrochat

dummy@example.com (Hail The Ice Dragon) — Sun, 27 Jul 2008 00:09:50 +0000

>_< Sounds like a fight... *puts on whistle and black pants with striped shirt* Round 1! Doppel V.S. SR

Re: Possible exploit found in Spyrochat

dummy@example.com (Doppelgangergang) — Thu, 17 Jul 2008 17:39:12 +0000

I'm going to take a try on doing VPNs.

Re: Possible exploit found in Spyrochat

dummy@example.com (Spyrorocks) — Thu, 17 Jul 2008 17:32:33 +0000

Say Hello to my VPN server.

Re: Possible exploit found in Spyrochat

dummy@example.com (Doppelgangergang) — Thu, 17 Jul 2008 17:24:18 +0000

No, it's just a "what-if" scenario for example.

Also, do school/work administrators can log URLs the students/employees go to? I think they can.

(But say hello to my SSL home proxy. :devil:)

Re: Possible exploit found in Spyrochat

dummy@example.com (Spyrorocks) — Thu, 17 Jul 2008 17:07:29 +0000

And doppel, you CANNOT sniff the communications from other people logging in UNLESS they are on the same LAN as you. Its all SERVER side, none of other people's login info passes through your router. It goes from their PC to the Spyroforum Server, where they are authenticated and get a session id unique to them.

I don't know where you came up with this crazy stuff about you being able to log other members over the internet.

Re: Possible exploit found in Spyrochat

dummy@example.com (cynderfan) — Thu, 17 Jul 2008 08:29:48 +0000

Oh dear that is bad...

Re: Possible exploit found in Spyrochat

dummy@example.com (Spyrorocks) — Tue, 15 Jul 2008 21:41:55 +0000

Communications from the SF server to everyone else are unencrypted.

If someone is sniffing your wireless, they can possibly capture your spyroforum password as you login, or any other password for any site that you visit that has unencrypted communications.

Its really not a big deal. If you are paranoid, get an anonymous VPN. Your spyroforum/spyrochat account is not useful to anyone who is looking for passwords, as they want banking info for credit cards, not a forum account to chat about a purple dragon.

As for impersonation, thats just how IRC works. You can change your nick to anything, unless you use this command in the chat to register your nickname:

/ns register

To register your nickname so others cannot use it. BUT, if you do that, you will need to type this in every time you login:

/ns identify

Re: Possible exploit found in Spyrochat

dummy@example.com (Doppelgangergang) — Tue, 15 Jul 2008 16:49:08 +0000

Also, I have demonstrated that I can impersonate people.

I can use a program and punch in "DragonFireOKN" and I can chat under your name.

Change your passwords regularly.

Re: Possible exploit found in Spyrochat

dummy@example.com (DragonFireOKN) — Tue, 15 Jul 2008 15:43:12 +0000

I've noticed this ever since I got on the site. Since you could have seen our passwords, something needs to be done.

Possible exploit found in Spyrochat

dummy@example.com (Doppelgangergang) — Tue, 15 Jul 2008 05:07:11 +0000

I noticed that the SpyroChat sends usernames and passwords in URLs. With the right stuff (I don't wanna go to details) I logged every URL I go to, including this:

http://www.spyrochat.com/index.php?rand=748745461&su=Doppelgangergang&pw=&

That's the actual URL, minus my password of course. Seriously, if I am running a network and applied my magic on a router, I would have captured your logins when you go on my network and went on Spyrochat.

What do you think?

EDIT: I can also see it on my History.