- This topic has 4 replies, 4 voices, and was last updated 21 years, 5 months ago by
.
-
Posts
-
I didn’t really know where to post this but here since most users are AIM or aim related.
This will take some explaining. (and yes I have contacted subprofile.com about this with no reply).
You don’t have to be aim to see what I mean. But a friend and me discovered something most interesting. Most likely SQL injection vulerability. I think they’re running an outdated apache & php… it seems it hasn’t changed in a year. Plus some other info we found out about which I won’t post here as I don’t want to point out the security hole discovered and them getting hacked cause of it.
By changing the ID in the URL and getting diff profiles, you will discover all have the ringtone crap on the first line under LINKS. The same spam in THOUSANDS of profiles and most people don’t even know it. Real nice how the person hacking can just change plain decimal #’s in the URL and hit them all in order. They prob. run a script once a day that hits SP a few hundred thousand times.
So by example (not spam) Here’s mine: http://chromium.subprofile.com/v.php?id=101134&nick=
Change the #’s after the ID= to see loads of other profiles. Mine has been edited as often as possible to remove the spam link I speak of. But if you change the number to anything and scroll on down to LINKS: you will discover spam. Then if you look at the view log you will discover that they have the same user names (which I block and remove as often as possible because they have porn in their profile.)
So in light of this recent discovery one should be prepared to remove spam often and know that you can only block 25 of the hundreds of names this person has. And also that subprofile might close down cause of all this or something else who knows.
Also be prepared the subprofile.com tries to download spyware to your computer as well as a trojan if you go to their main webpage. Which also might be the access point for this so called hacker.
Please pass this message on to as many friends of yours that use this. It’s important.
Nice catch. Amy, you could give http://www.smartprofile.net a whirl, and the link doesn’t use &nick at the end, so most people can’t simply enter a fake screen name. Jason is always on top of things and knows his php, so something like this is very unlikely to happen.
Yeah I suggest you all check out Jasons smart profile, unlike all the other profiles out there Jasons’ smart profile allowed HTML and Javascript codes. You can also not trick the profile into thinking you are somebody else. There are also no links in there unless you add them. So if you haven’t already be sure to check out http://www.smartprofile.net or if you have any questions go to the support forums which are found at http://www.ejdude.com . Hope to see you all there!!
- You must be logged in to reply to this topic.