[SECURITY BUG] Steemit vulerable to session hijacking
This bug could affect all users on Steemit!
Why?
Steemit uses your local storage and cookies to save your session. No additional security has been provided.
How?
Any malicious URL pasted here could lead to session hijacking when reading your local storage and cookie contents. This is also known as XSS attacks. You'll never notice it happened, but the consequenses could be severe and resulting in a hijacked account.
How can i test this?
I wont reveal to much information in this post to prevent intentional XSS attacking. However, if you have a basic knowledge on Javascript, you'll be able to replicate the issue on your local machine.
If your knowledge on Javascript is zero, then do some google searching on XSS attacks.
OMG! Did you report this already?
The issue has been reported, along with a fix proposal to prevent this from happening.
Now what? Is my account in danger?
Your account is safe as long as you play by the rules of internet.
Please, don't ever - for real! - click on a URL without knowing where it will lead you.
XSS hijacking is only one of many evil things that could happen to you when clicking random links.
Also don't trust short urls.
To prevent XSS attacks you can use an addon like NoScript.
Never trust any URL. For example:
Basic things, like hovering over the URL before clicking, thus displaying the true website you'll be visiting should prevent misleading evil URL's.
That's pretty severe. I've played with XSS exploits before and it's relatively easy to craft an attack along this vector even for a non-professional dabbler.
How involved/difficult is the proposed fix? Think we would all sleep a little better knowing nasty shit like that is taken care of on the platform.
BTW, in the meantime until this is fixed, one way to protect yourself from the exploit is to make sure your internet browser is set to never remember your Steem password, and the "keep me logged in" function is turned off.
I already did this (not save my pass in GOogle browser). I am not even using Steem mobile app (I have android) just i would need to save the pass in it. arghh
meep
It already happened about 2 weeks ago!
https://steemit.com/steemit/@steemitblog/important-security-announcement-steemit-ceo-ned-scott
https://cointelegraph.com/news/steemit-website-hacked-ceo-promises-to-reset-accounts-in-48-hours
https://news.bitcoin.com/steemit-hacked-weak-security/
Thanks for your warning. The issue needs to be fixed as soon as possible.
We need to stay vigilant
If you have more information or a specific vunerability please email: [email protected]