Possible exploit found in Spyrochat

Doppelgangergang · Jul 15, 2008 5:07 AM

I noticed that the SpyroChat sends usernames and passwords in URLs. With the right stuff (I don't wanna go to details) I logged every URL I go to, including this:

http://www.spyrochat.com/index.php?rand=748745461&su=Doppelgangergang&pw=<REMOVED>&

That's the actual URL, minus my password of course. Seriously, if I am running a network and applied my magic on a router, I would have captured your logins when you go on my network and went on Spyrochat.

What do you think?

EDIT: I can also see it on my History.

DragonFireOKN · Jul 15, 2008 3:43 PM

I've noticed this ever since I got on the site. Since you could have seen our passwords, something needs to be done.

Doppelgangergang · Jul 15, 2008 4:49 PM

Also, I have demonstrated that I can impersonate people.

I can use a program and punch in "DragonFireOKN" and I can chat under your name.

Change your passwords regularly.

Spyrorocks · Jul 15, 2008 9:41 PM

Communications from the SF server to everyone else are unencrypted.

If someone is sniffing your wireless, they can possibly capture your spyroforum password as you login, or any other password for any site that you visit that has unencrypted communications.

Its really not a big deal. If you are paranoid, get an anonymous VPN. Your spyroforum/spyrochat account is not useful to anyone who is looking for passwords, as they want banking info for credit cards, not a forum account to chat about a purple dragon.

As for impersonation, thats just how IRC works. You can change your nick to anything, unless you use this command in the chat to register your nickname:

/ns register <password> <your email>

To register your nickname so others cannot use it. BUT, if you do that, you will need to type this in every time you login:

/ns identify <password>

cynderfan · Jul 17, 2008 8:29 AM

Oh dear that is bad...

Spyrorocks · Jul 17, 2008 5:07 PM

And doppel, you CANNOT sniff the communications from other people logging in UNLESS they are on the same LAN as you. Its all SERVER side, none of other people's login info passes through your router. It goes from their PC to the Spyroforum Server, where they are authenticated and get a session id unique to them.

I don't know where you came up with this crazy stuff about you being able to log other members over the internet.

Doppelgangergang · Jul 17, 2008 5:24 PM

No, it's just a "what-if" scenario for example. tongue

Also, do school/work administrators can log URLs the students/employees go to? I think they can. neutral

(But say hello to my SSL home proxy. :devil:)

Spyrorocks · Jul 17, 2008 5:32 PM

Say Hello to my VPN server.

Doppelgangergang · Jul 17, 2008 5:39 PM

I'm going to take a try on doing VPNs.

Hail The Ice Dragon · Jul 27, 2008 12:09 AM

>_< Sounds like a fight... *puts on whistle and black pants with striped shirt* Round 1! Doppel V.S. SR

Aicebo · Jul 27, 2008 12:16 AM

Hail The Ice Dragon wrote:

>_< Sounds like a fight... *puts on whistle and black pants with striped shirt* Round 1! Doppel V.S. SR

Um, this thread is from nine days ago...=S

Spyrorocks · Jul 27, 2008 12:17 AM

How the heck did you ever think this was a fight? Don't dig up old threads.

DanteAndVergil · Jul 27, 2008 12:17 AM

This is best to be locked now as well yeah I have no reason for a change <_>

#1 Jul 15, 2008 5:07 AM

Possible exploit found in Spyrochat

#2 Jul 15, 2008 3:43 PM

Re: Possible exploit found in Spyrochat

#3 Jul 15, 2008 4:49 PM

Re: Possible exploit found in Spyrochat

#4 Jul 15, 2008 9:41 PM

Re: Possible exploit found in Spyrochat

#5 Jul 17, 2008 8:29 AM

Re: Possible exploit found in Spyrochat

#6 Jul 17, 2008 5:07 PM

Re: Possible exploit found in Spyrochat

#7 Jul 17, 2008 5:24 PM

Re: Possible exploit found in Spyrochat

#8 Jul 17, 2008 5:32 PM

Re: Possible exploit found in Spyrochat

#9 Jul 17, 2008 5:39 PM

Re: Possible exploit found in Spyrochat

#10 Jul 27, 2008 12:09 AM

Re: Possible exploit found in Spyrochat

#11 Jul 27, 2008 12:16 AM

Re: Possible exploit found in Spyrochat

#12 Jul 27, 2008 12:17 AM

Re: Possible exploit found in Spyrochat

#13 Jul 27, 2008 12:17 AM

Re: Possible exploit found in Spyrochat

Board footer