PSA: LiveJournal security issue

[desh]

There's recently been a security issue on LJ. The security settings of some of your posts may have been affected. Everyone should read this for more info. (It's a post in a community that discusses goings-on on LJ, and it's a pretty thorough explanation of what happened, how you can find out if your entries were infected, and how to fix it.)

Comments

[outcastspice.livejournal.com]

thank you!

it seems to be only if you used stuff from lj-toys.com, right? (it's early, want to make sure i read that correctly)

[desh]

No, I think even viewing things from lj-toys could've done it too. And lj-toys means any embedded content (usually videos).

I'm still not 100% sure on this. I can try to clarify after I learn more.

[outcastspice.livejournal.com]

oh, weird!

[desh]

OK, the news post explained it well. If you don't have "embedding placeholders" on (that is, if you see youtube videos that people post on your friends page without having to click a placeholder link first), and if you don't use flash blocking software to block all such videos, then you were at risk. Viewing your friends page while logged in, if the malicious code was in any entry on your friends page when you viewed it, would likely cause you to be affected as well. This was true from when the exploit started (probably around 10:30 EDT last night) until embedding was disabled by LJ (before midnight).

I was affected, so if you looked at your friends page during the time period in question, you were probably affected too. Check your recent entries to see if they have surprising security levels or some stuff like this:



in them.

[outcastspice.livejournal.com]

thank you! i was asleep during that timeframe :D