Clubhabbo is haxxed

Printable View

Show 40 post(s) from this thread on one page

15-01-2008, 07:41 PM
Decode

Clubhabbo is haxxed

There cutenews is hacked.
15-01-2008, 07:43 PM
GoldenMerc

Happned the other day rly.
gd newz
15-01-2008, 07:43 PM
Invent

Lmao. Stupidly simple to do.
15-01-2008, 07:43 PM
Orangeesh

nice find :)
15-01-2008, 07:46 PM
--ss--

Well seeing as there's several threads in the Website section telling sites not to use cutenews due to security risks they shouldn't be using cutenews :eusa_whis.
But unlucky to them.
15-01-2008, 08:11 PM
John!

Good find.

Lol @ Tweety owning Favourtism

I never used ClubHabbo so this doesn't really bother me.
15-01-2008, 08:12 PM
WarezKid

lol@tweety

good one tbh, since it popular ;).

Ye, they shoulkd be more careful.
15-01-2008, 08:14 PM
L!nK..

Noob Favourtism

and haha @ ~~club~~craphabbo
15-01-2008, 08:26 PM
Black_Apalachi

ClubHabbo uses Cutenews!? Oh dear.

I noticed that their news section was down at a random visit yesterday lol. I do find all this "hacking" seriously pathetic.
15-01-2008, 08:34 PM
e5

Someone did post an article about cutenews being easy to hack if peple use dictionary words as their password. :8
15-01-2008, 08:37 PM
Invent

It doesn't matter how secure their passwords were.
*Text Removed*

Edited by Agesilaus (Forum Super Moderator): Please do not discuss techniques that can possibly hack another webiste.
15-01-2008, 08:59 PM
Decode

Quote:

Originally Posted by Invent

It doesn't matter how secure their passwords were.
*Text Removed*

Wasnt that what i had done in that pm and u said it was wrong?
15-01-2008, 09:22 PM
SkaterChu

ClubHabbo wasn't the only fansite to be 'hacked' via this exploit, HabboHarmony and HFFM are just two others who were effected, sorted now ;)
15-01-2008, 09:25 PM
Orangeesh

Quote:

Originally Posted by SkaterChu

ClubHabbo wasn't the only fansite to be 'hacked' via this exploit, HabboHarmony and HFFM are just two others who were effected, sorted now ;)

Are you going to continue using cutenews?
15-01-2008, 09:29 PM
SkaterChu

Quote:

Originally Posted by Tweety

Are you going to continue using cutenews?

Unless we get a new news system, once weve sorted the exploit then i guess so.
15-01-2008, 09:31 PM
Pyroka

Quote:

Originally Posted by Tweety

Are you going to continue using cutenews?

I don't see them coding their own News System even though it is very much possible and much safer. It costs money however to employ/pay a coder for the News System to be built to a more secure meaning. News systems on Habbo are traditionally cutenews however if you searched long and hard on Google, I think there are safer alternatives.

If you're listening Simon, do it. =P
15-01-2008, 09:32 PM
--ss--

Quote:

Originally Posted by SkaterChu

Unless we get a new news system, once weve sorted the exploit then i guess so.

You might aswell use one of the free ones available here as they all use sessions which are much more safer than cookies that cutenews uses.
15-01-2008, 09:32 PM
Portish1

I've seen about 10 sites with the same issued today, including HabboHarmony which is official.
15-01-2008, 09:59 PM
Frisky

To be honest, it's good that things get hacked. Therefore making the website realise where they're vunerable and knowing they can patch it up.
15-01-2008, 10:00 PM
Rhiz

Loads of sites have got it, duckylove, habbosmart, haboz, habble-aus, habbozone, hobtech, habfever loads more
its a bit sad really that people spend time doing it when it gets removed within minutes lol
15-01-2008, 10:31 PM
Black_Apalachi

Anyway apart from the news, did any other part of the site get affected?

Btw, slightly off topic, but when Ryan mentioned HFFM it reminded me. Do HFFM an ClubHabbo have the same owners/management? I know Ryan is CH owner but is there anyone else who runs both? I'm only asking because they both seem really similar.
15-01-2008, 11:50 PM
benno123

an australian based site called wearelegion is hacking all of the official fansites cutenews.
every official australian fansite has been hacked and they're starting to hack international sites.
just a piece of advice if you'd like the news that they delete. do a backup.
there's that cutenews exploit that lets them in. they don't need a password or anything, just one of the users account names.
16-01-2008, 02:52 AM
beau03

Quote:

Originally Posted by Robald

Anyway apart from the news, did any other part of the site get affected?

Btw, slightly off topic, but when Ryan mentioned HFFM it reminded me. Do HFFM an ClubHabbo have the same owners/management? I know Ryan is CH owner but is there anyone else who runs both? I'm only asking because they both seem really similar.

I noticed too but I don't think Ryan and Carnio get along to well! :P
16-01-2008, 03:53 AM
siz

Im in a krew that haxxed habbox and runescape...

Its no big..
16-01-2008, 03:59 AM
Sabbath

Quote:

Originally Posted by siz

Im in a krew that haxxed habbox and runescape...

Its no big..

OMG SIZROCKS GANG GONNA PWN YOU!
16-01-2008, 11:20 AM
Pyroka

Quote:

Originally Posted by Sabbath

OMG SIZROCKS GANG GONNA PWN YOU!

LOLIRL! Well that's interesting! Why not just put the cutenews on a seperate DNS to the website, and iFrame it? I guess the impact shouldn't be as bad then if they were to hack it unlike how it is most of the time. I guess that's a makeshift way of fixing it.
16-01-2008, 11:25 AM
Hitman

Quote:

Originally Posted by Pyroka

LOLIRL! Well that's interesting! Why not just put the cutenews on a seperate DNS to the website, and iFrame it? I guess the impact shouldn't be as bad then if they were to hack it unlike how it is most of the time. I guess that's a makeshift way of fixing it.

Good idea but people would still be able to find where it's hosted. :P

I'd suggest another news script.
16-01-2008, 11:36 AM
Pyroka

Quote:

Originally Posted by Hitman

Good idea but people would still be able to find where it's hosted. :P

I'd suggest another news script.

Obviously they would? All they'd have to do is look into the source code, however the consequences wouldn't be so severe.
16-01-2008, 12:00 PM
Hitman

Quote:

Originally Posted by Pyroka

Obviously they would? All they'd have to do is look into the source code, however the consequences wouldn't be so severe.

Well, from what I know (not much haha) they could get into cutenews and delete, add, edit news etc... redirect the page and all that. So if it's still being shown on the page from the other server and it got 'hacked' then it could be redirected, deleted etc... on the main site.
16-01-2008, 12:09 PM
Pyroka

Quote:

Originally Posted by Hitman

Well, from what I know (not much haha) they could get into cutenews and delete, add, edit news etc... redirect the page and all that. So if it's still being shown on the page from the other server and it got 'hacked' then it could be redirected, deleted etc... on the main site.

Regular backups combat the deletion & edition. As for addition, just a recovery account would be ok, somewhere placed on the cutenews as an invisible user, even to administrators (I'm sure it could be done). Redirecting the page which is in an iFrame? Oh the pain of it all. iFrames can be easily closed too, so if there was a problem all they need to do is redirect it to a maintenance page. It's not as hard as it sounds, it's just a little bit of precaution.
16-01-2008, 12:14 PM
Hitman

Quote:

Originally Posted by Pyroka

Regular backups combat the deletion & edition. As for addition, just a recovery account would be ok, somewhere placed on the cutenews as an invisible user, even to administrators (I'm sure it could be done). Redirecting the page which is in an iFrame? Oh the pain of it all. iFrames can be easily closed too, so if there was a problem all they need to do is redirect it to a maintenance page. It's not as hard as it sounds, it's just a little bit of precaution.

That is true, good point. Redirecting the iframe is still bad, if it was to a porn site or something... unless the users were feeling horny haha. But really, I'm sure there's a code for redirecting out of iframes (so the site opens in a new window/tab) - I'm not the best when it comes to iframes. :P
16-01-2008, 03:26 PM
Pyroka

Quote:

Originally Posted by Hitman

That is true, good point. Redirecting the iframe is still bad, if it was to a porn site or something... unless the users were feeling horny haha. But really, I'm sure there's a code for redirecting out of iframes (so the site opens in a new window/tab) - I'm not the best when it comes to iframes. :P

Redirecting out of iFrames? That'd most probably be Javascript in the form of:

"IF URL = 'www.clubhabbo.net/news_display'
THEN Keep iFrame display true
ELSE iFrame display = False or Redirect to = 'www.clubhabbo.net/maintenance' "

As an example... I'm not sure if that can be done to what I've said but it's something which could be used. Best to ask the resident JavaScript man, Invent. :P Otherwise, then it'd just be a mere little edit they've done in the website. It wouldn't inflict its credibility too much.
16-01-2008, 03:34 PM
Hitman

Quote:

Originally Posted by Pyroka

Redirecting out of iFrames? That'd most probably be Javascript in the form of:

"IF URL = 'www.clubhabbo.net/news_display'
THEN Keep iFrame display true
ELSE iFrame display = False or Redirect to = 'www.clubhabbo.net/maintenance' "

As an example... I'm not sure if that can be done to what I've said but it's something which could be used. Best to ask the resident JavaScript man, Invent. :P Otherwise, then it'd just be a mere little edit they've done in the website. It wouldn't inflict its credibility too much.

I can do PHP (not loads but I can) however I can not do Javascript. :P There's usually a way to do most things though. But I get where you're coming from, 'tis a good idea. But if your cutenews is hacked and it's on your main server it can't do any other destruction anyway (apart from what cutenews can do, edit news, delete etc...)

I read somewhere Cutenews have decided to leave the development of it... so people will have to patch it themselves, which I think some have already (on the CN forums)
16-01-2008, 03:40 PM
Pyroka

Quote:

Originally Posted by Hitman

I can do PHP (not loads but I can) however I can not do Javascript. :P There's usually a way to do most things though. But I get where you're coming from, 'tis a good idea. But if your cutenews is hacked and it's on your main server it can't do any other destruction anyway (apart from what cutenews can do, edit news, delete etc...)

I read somewhere Cutenews have decided to leave the development of it... so people will have to patch it themselves, which I think some have already (on the CN forums)

Mmm... Incorporation of technologies like AJAX using Cutenews would be great, and since they've halted development I guess you could take it for your own, edit it and well... Rebuild it into something intense. But that's my 2 cents, I'm being very pursuing. =P
16-01-2008, 04:47 PM
--ss--

To edit cookies you do not need any javascript knowledge at all as there is an add-on the can do it for you ;).
16-01-2008, 04:51 PM
Invent

Looks like its happened again...?
16-01-2008, 04:57 PM
GoldenMerc

rofl it redirects to
http://www.google.co.uk/search?hl=en...G=Search&meta=
16-01-2008, 05:02 PM
:Act

Yup redirects you to a google search when u search "ClubHabbo just got owned"

odear, looks theyre having more problems :l
I remember they went thru lots of hackings a few months ago..
Just not their day ..
16-01-2008, 05:07 PM
Pyroka

I think the problem needs to be addressed and solved sooner rather than later...

http://www.jpowered.com/php-scripts/...nt-management/
http://www.xigla.com/absolutenm/
http://www.codefixer.com/tutorials/n...stem_part1.asp

Well, that was hard.
16-01-2008, 05:07 PM
Hitman

Quote:

Originally Posted by --ss--

To edit cookies you do not need any javascript knowledge at all as there is an add-on the can do it for you ;).

Yeah there's a free addon for Firefox. :D

Oh dear again!? Their best bet would be to take down search.php...

Show 40 post(s) from this thread on one page