Home


  Main Index MAIN
INDEX
FAQ FAQ & HELP FAQ PHOTO GALLERY Who's Online WHO'S
ONLINE
Log in LOG
IN

Home: About This Site: Forum Help & Others:
Forum Security Issue..







kbs
Enthusiast


Nov 14, 2002, 8:47 PM

Post #1 of 13 (2522 views)
Shortcut
Forum Security Issue.. Can't Post

Hi Khoobg,

I found I think is a security flaw from the forum..

From Outlook Express, I received a reply from Khoobg (puppy.com.my) on the dog show, I clicked on the link, login as myself (kbs), went to read the reply. Then, I clicked on "Main Index" from the upper menu.. Suddenly, I see it is not myself that was logon, it became Khoobg that has logon.. ?

Webmaster, I think you should look into this maybe there is some bug somewhere?

Regards,
KBS


kbs
Enthusiast


Nov 14, 2002, 9:07 PM

Post #2 of 13 (2521 views)
Shortcut
Re: [kbs] Forum Security Issue.. [In reply to] Can't Post

After some testing, I think the web might be hacked. I tried even to logon from 3 other pc of mine. Still the same problem. Everytime I go back to Main Index, it is Khoobg that logon, not me.Crazy

And if we goto see "Who's Online", our IP address is shown as well?? And all user became disabled user??

Webmaster, better check it out?

Concern,
KBS


kbs
Enthusiast


Nov 14, 2002, 10:50 PM

Post #3 of 13 (2510 views)
Shortcut
Re: [kbs] Forum Security Issue.. [In reply to] Can't Post

Hi Khoobg,

I tried using a dial-up connection and it seems ok with that. But via my office firewall, then the problem occured. I don't know why?

Regards,
KBS


Khoobg
Webmaster


Nov 14, 2002, 11:33 PM

Post #4 of 13 (2506 views)
Shortcut
Re: [kbs] Forum Security Issue.. [In reply to] Can't Post

Hi KBS,

I have just on the network health and found that they are two backbones that is with substantial high packet lost. Still checking. Thanks for informing us.

Cheers


Dog Obedience and Agility - http://www.puppy.com.my/ob/
Events' Pictures - http://www.doggie.com.my
Online Pets Memorial - http://www.rainbowsbridge.com.my





boon
Doggyman


Nov 15, 2002, 1:53 AM

Post #5 of 13 (2500 views)
Shortcut
Re: [Khoobg] Forum Security Issue.. [In reply to] Can't Post

Hi,

Khoo u sure the network collision will effect the authentication behaviour in the forum software ?

Boon - I Love Fast Dogs That Hit Hard
You Ask Me To Fight For You, I Give You Freedom & Protection And Then You Question The Manner In Which I Provide It, I'd Rather You Just Said -- "Thank You" --


Khoobg
Webmaster


Nov 15, 2002, 2:01 AM

Post #6 of 13 (2499 views)
Shortcut
Re: [boon] Forum Security Issue.. [In reply to] Can't Post

Seriously, I do not know what caused the problem at KBS site. I am totally at loss. Packet loss is the only thing that I notice.

Cheers


Dog Obedience and Agility - http://www.puppy.com.my/ob/
Events' Pictures - http://www.doggie.com.my
Online Pets Memorial - http://www.rainbowsbridge.com.my





boon
Doggyman


Nov 15, 2002, 2:25 AM

Post #7 of 13 (2498 views)
Shortcut
Re: [Khoobg] Forum Security Issue.. [In reply to] Can't Post

OK, some info for u to check with,
Based on KBS's describtion, i would suggest u to check the cookies that u added upon login and the logout procude, does the software really clear the cookies upon logout or just empty the cookies string.

Also, the varaibles past from the software when during email notitication generation process, does the user name get overwritten or somehting.

U can look for the link generated in the mail notification after the url that should start with a '?'

Boon - I Love Fast Dogs That Hit Hard
You Ask Me To Fight For You, I Give You Freedom & Protection And Then You Question The Manner In Which I Provide It, I'd Rather You Just Said -- "Thank You" --


Khoobg
Webmaster


Nov 15, 2002, 2:44 AM

Post #8 of 13 (2497 views)
Shortcut
Re: [boon] Forum Security Issue.. [In reply to] Can't Post

Hi Boon,

Infact, shortly after KBS notified me, I changed the cookies parameter and I am not sure that actually solved KBS problem.

Cheers


Dog Obedience and Agility - http://www.puppy.com.my/ob/
Events' Pictures - http://www.doggie.com.my
Online Pets Memorial - http://www.rainbowsbridge.com.my





kbs
Enthusiast


Nov 15, 2002, 9:52 AM

Post #9 of 13 (2492 views)
Shortcut
Re: [Khoobg] Forum Security Issue.. [In reply to] Can't Post

Hi Khoobg,

I am now logon using my home pc, and it seems to be ok here. One more thing, I did not enable cookies on my pcs. And always, on the first logon, it is fine. Just after I go into any forum and go back to Main Index afterwards, the logon user name became Khoobg.. and I never able to view the latest post from there. The latest one is about 11am this morning even though my current time was about 1pm and I was very very sure there were posts later than that. Even after I've made the new forum posting "Forum Security Issue..", I was not able to see it if I go back to the Main Index.

The problem seems to happen only if I am behind my office firewall. (I tried to refresh the page, restart my pc, clear the IE cache/history etc but still the same) If I use normal dial-up on the same pc, things seems to be ok.

p/s: I even saved the Main Index Page which showed Khoobg logon in my office pc. If you want to see it, I can send it to your e-mail address? You can send me a mail to kbsz@ .net.my & I will reply along with the saved page. As I could not attach any file from the posting anymore.

Regards
KBS


Khoobg
Webmaster


Nov 15, 2002, 3:57 PM

Post #10 of 13 (2490 views)
Shortcut
Re: [kbs] Forum Security Issue.. [In reply to] Can't Post

I guess the some of the pages are still cached at your proxy server.


Dog Obedience and Agility - http://www.puppy.com.my/ob/
Events' Pictures - http://www.doggie.com.my
Online Pets Memorial - http://www.rainbowsbridge.com.my





kbs
Enthusiast


Nov 15, 2002, 6:56 PM

Post #11 of 13 (2487 views)
Shortcut
Re: [Khoobg] Forum Security Issue.. [In reply to] Can't Post

Hi Khoobg,

But how do we explain the wrong user name logon displayed on the page? And in the "Who's Online" list, I could see everybody IP addresses as well. (For example: XXX.XXX.XXX.XXX (ban)), there is always a ban word beside each IP. And beside the user list always for example: AnjingAhKau (Disabled User)

Regards,
KBS


kbs
Enthusiast


Nov 15, 2002, 6:58 PM

Post #12 of 13 (2485 views)
Shortcut
Re: [kbs] Forum Security Issue.. [In reply to] Can't Post

Hi Khoobg,

FYI, I am now logon behind my office firewall, but seems ok today so far.

Regards,
KBS


boon
Doggyman


Nov 15, 2002, 11:43 PM

Post #13 of 13 (2478 views)
Shortcut
Re: [Khoobg] Forum Security Issue.. [In reply to] Can't Post

Hi Khoo,

How long u set the cookies for expiration ?

KBS : try to load the http1.1 object every time u visit the page. U can change this in your IE by clicking on the Tools Menu and Choose Internet Options..., under the Temp Internet Files, click on the Setting Button and choose the check the first radio botton which stated Every Visit To the page.

This will definately help for those dynamic content pages, but if u are dial-up user, then this is not a good idea, because it takes longer for displaying the html pages due to the communication between/among the servers.

Boon - I Love Fast Dogs That Hit Hard
You Ask Me To Fight For You, I Give You Freedom & Protection And Then You Question The Manner In Which I Provide It, I'd Rather You Just Said -- "Thank You" --

 
 




Copyright 2001~ 2002 Hileytech Sdn Bhd , All Rights Reserved.  Disclaimer  Privacy Statement
For comments and Suggestion, Please contact the Webmaster at puppy@puppy.com.my