LJ web security exploit

[mark]

If you use LiveJournal, you're probably aware of an exploit involving cross site Flash that was propagated over there for a little while last night (LJ news post). They've since taken steps to mitigate the issue, and are working on a permanent fix as we speak.

Some people have contacted me about Dreamwidth; this is something I should have posted about last night. We investigated both the source code of the exploit (Flash is easy to decompile) as well as the attack vector (how the exploit code works) and determined that Dreamwidth is not currently vulnerable to this attack.

I apologize for not posting about this last night. We investigated and made the determination that Dreamwidth was safe, but didn't mention it anywhere.

Comments

[kuwdora]

*Fist bump* You are awesome.

[hugh_mannity]

I'd rather not know that I'm safe than not know I'm at risk.

Thanks for all you do.

[ninetydegrees]

Thank you!

[annalee]

Just dropping in to say love to you guys for being on top of this and for your communication philosophy.

[yohjideranged]

Thank you very much for the answer!

[pinesandmaples]

I happened to get hit on LJ, and the first thing I did was check DW. I am so glad you guys have shored up that vulnerability.

I love feeling like this "isn't just a blog" to the Dreamwidth staffers. (I get that feeling all the time on LJ!)

[archersangel]

good to know!

[princess]

Thanks for posting that we're safe, and thanks for looking into it even if you forgot to post at the time!

[afuna]

<3

[ieune]

One more reason to be glad I quit LJ! Y'all rock!

[nubriema]

Now, believe me when I say that I certainly deleted my LJ for good now and changed the mail address before...
Seriously, I'm scared.

It's good to know that we're safe over here, but though I read the news post over on LJ now, I'm confused - can you tell what kind of "videos and other media" it is that got affected, or is that still uncertain? I'm not an expert at this, so I'm simply curious and want to know what I have to look out for and pay attention to.

<3 you guys for watching over us!

[mark]

It didn't affect videos and media, it's just that the exploit the attacker used was the same way you post videos and media. If you have ever posted a YouTube video, that's very similar to what the attacker did. Except instead of a YouTube video, they posted a "movie" that was a Flash file that did bad things.

[nubriema]

Oops, then I probably got that wrong. As I said, I'm not at all an expert at these things.

Thanks for explaining! :)

[keris]

Ah, thanks, that's a better explanation than I got from LJ. LJ's description sounded as though it was affecting real embedded videos. But even better that it doesn't afftect DW at all...

[xyndarella]

Thank you for promptly looking into this, even if the post was late. I really appreciate all that you and the DW staff do for the site. It's a nice place to be with a good atmosphere.

[softestbullet]

Thanks for letting us know!

[jade_assassin]

Thanks for posting this ;3

[ciphergoth]

Did you remove the vulnerability post-fork, or did LJ add it?

[mark]

It's because LJ had a Flash cross domain policy file that allowed any Flash application, running on any site, to connect to LiveJournal. We don't allow any Flash application (except ones we host ourselves) connect to Dreamwidth right now.

Which, I guess, means that it's a configuration difference. We decided we didn't need this functionality yet, and did not enable it.