***Alert*** View Wise's or my profile from 0730-1045 Eastern? Change your password

[Steven Edwards]

A scammer/spammer is trying a new (to me) method of stealing passwords.

If you visited my profile or Wise's profile from 7:30-10:45am Eastern and were asked to enter your login info, please change your password.

Thank you,

Steven

[Lazlo]

XSS attack?

[jody]

bummer

[t8burst]

XSS attack?

(mods if you don't want the specifics just delete this, I don't care) It was a simile image that returned a 401 HTTP code. Popped up a basic auth box, I didn't fill it in and click it so don't know what it did from there.

[Steven Edwards]

XSS attack?

t8burst has it right, I think. That or it was javascript piggybacked on a .gif file that mimicked the 401 request.

[Lazlo]

Tricky stuff!

[sjean423]

What good would it be to them to have a password anyway?

But that goes to show, never enter your password info, if you don;t expect the login box to be there.

[Steven Edwards]

What good would it be to them to have a password anyway?

They'd be able to PM your friends with spammy links, generating a higher click-through rate for them. (Because, you know, friends trust you not to send them malevolent content.)

[Leif]

A scammer/spammer is trying a new (to me) method of stealing passwords.

If you visited my profile or Wise's profile from 7:30-10:45am Eastern and were asked to enter your login info, please change your password.

Thank you,

Steven

I and the Russians stand by you Steven. We are ready to serve and help.

[sjean423]

They'd be able to PM your friends with spammy links, generating a higher click-through rate for them. (Because, you know, friends trust you not to send them malevolent content.)

Seems like an awful lot of trouble to generate traffic.

[Steven Edwards]

Seems like an awful lot of trouble to generate traffic.

They generally use automated tools, so it's all the same amount of effort to them.

[Leif]

Too much burgers - the Russians maybe

They generally use automated tools, so it's all the same amount of effort to them.

[badsign]

XSS attack?

my first thought also. Admins/Steven, I have a handy link you may be interested in if you plan any regular checking of the boards for xss vulns. PM me if interested.

[badsign]

What good would it be to them to have a password anyway?

But that goes to show, never enter your password info, if you don;t expect the login box to be there.

Solid advice about not entering your pword when it seems oddly out of place.

As for what they could do; that kinda depends on who they dupe. Imagine an admin with high level access to the innards of the forums being pwnd. That could lead to some craziness fo sho.