PSA: LiveJournal security issue

[desh]

There's recently been a security issue on LJ. The security settings of some of your posts may have been affected. Everyone should read this for more info. (It's a post in a community that discusses goings-on on LJ, and it's a pretty thorough explanation of what happened, how you can find out if your entries were infected, and how to fix it.)

Comments

[outcastspice.livejournal.com]

thank you!

it seems to be only if you used stuff from lj-toys.com, right? (it's early, want to make sure i read that correctly)

[desh]

No, I think even viewing things from lj-toys could've done it too. And lj-toys means any embedded content (usually videos).

I'm still not 100% sure on this. I can try to clarify after I learn more.

[desh]

OK, the news post explained it well. If you don't have "embedding placeholders" on (that is, if you see youtube videos that people post on your friends page without having to click a placeholder link first), and if you don't use flash blocking software to block all such videos, then you were at risk. Viewing your friends page while logged in, if the malicious code was in any entry on your friends page when you viewed it, would likely cause you to be affected as well. This was true from when the exploit started (probably around 10:30 EDT last night) until embedding was disabled by LJ (before midnight).

I was affected, so if you looked at your friends page during the time period in question, you were probably affected too. Check your recent entries to see if they have surprising security levels or some stuff like this:



in them.

[outcastspice.livejournal.com]

oh, weird!

[outcastspice.livejournal.com]

thank you! i was asleep during that timeframe :D

[krisispm.livejournal.com]

I think the post explains it awfully - not in a way I can digest on my lunch break, since I have no idea what LJ-toys even is.

Also, any security breach should go out as a push communication to all users; it's shameful to be finding this out on a random check of my friends page.

One of the many reasons I took my blog-eggs out of the LJ basket some time ago.

[desh]

To be fair, news did a much more thorough explanation about an hour after I posted this, about 8-9 hours after the exploit was patched (and that entire stretch of time was after business hours in LJ's time zone). I think that's fair, and that news is the appropriate way to communicate this. I think they handled all of this quite well. The post I linked above was just the best way to get info out quickly before official communication.