OSNews > Thread > "Cracker Attractor" by coderpunk

Linked by Eugenia Loli-Queru on Sat 13th Jan 2007 09:26 UTC

Last June a spin-off department of Red Hat, lead by desktop guru Havoc Pennington, announced Mugshot. Originally, Mugshot was in the midst of controversy whether it's a social networking application or not. Apparently, it instead is a "social networking aggregator". In order for this to work, access to third party data is a must.

3 · Read More · 19 Comment(s)

http://osne.ws/d2i

Thread beginning with comment 201350
To read all comments associated with this story, please click here.

Cracker Attractor

by coderpunk on Sat 13th Jan 2007 13:21 UTC

Member since:
2007-01-13

Having all of your logins stored on a 3rd party system just seems like a bad idea to me. Yeah, I'm paranoid, but a juicy target like this will certainly attract attempts to gain access to all that private information. And if the site is written in PHP, well ...

.cp

Reply Permalink Bookmark Score: 1

RE: Cracker Attractor

by porcel on Sat 13th Jan 2007 13:45 in reply to "Cracker Attractor"

Member since:
2006-01-28

How do you know that the site is written in PHP? Not to mention that there are some php applications with a decent security record.

Security is a process not an end-state provided out-of-the-box by any existing language.

Reply Parent Bookmark Score: 5

RE[2]: Cracker Attractor

by IamScared on Sat 13th Jan 2007 13:48 in reply to "RE: Cracker Attractor"

Member since:
2007-01-11

Exactly. A big example of this is the OpenBSD operating system. OpenBSD is written in C and has an excellent security record. Another example that comes to mind is the Apache Web Server.

Edited 2007-01-13 13:52

Reply Parent Bookmark Score: 1

RE: Cracker Attractor

by Adam S on Sat 13th Jan 2007 14:13 in reply to "Cracker Attractor"

Member since:
2005-04-01

And if the site is written in PHP, well ...

Good point! OS X, Windows, Gnome, and KDE all have bugs, and at least one app on each platform has bugs, so we should all stay away from C, C++, Objective C, C#, Python, Tcl/Tk, Perl, Ruby, Fortran, Javascript, XML, VB.NET, etc.

Also, I've seen bugs on webpages, so we should stay away from HTML altogether.

Everyone knows that poor programming means the language it's written in is flawed!

Reply Parent Bookmark Score: 1

RE[2]: Cracker Attractor

by Beta on Sat 13th Jan 2007 20:44 in reply to "RE: Cracker Attractor"

Member since:
2005-07-06

:D totally warranted post Adam; people point the finger at php, when they really should be looking at the developers of said sites.

Oh, and mugshot is Java. It only took three clicks to find that out, much easier than just presuming it's php and therefore full of holes.

But that's a whole argument I don't want to start.

Reply Parent Bookmark Score: 3

RE: Cracker Attractor

by jeremywc on Sat 13th Jan 2007 14:20 in reply to "Cracker Attractor"

Member since:
2005-08-02

You might want to try actually using Mugshot. You are not required to enter your passwords anywhere, only your usernames. You are normally be required to give this information out on a social networking service in order to, um, network.

Edited 2007-01-13 14:21

Reply Parent Bookmark Score: 2

RE[2]: Cracker Attractor

by coderpunk on Sun 14th Jan 2007 12:00 in reply to "RE: Cracker Attractor"

Member since:
2007-01-13

Thanks for the clarification jeremywc. I have no interest in social networking sites, so have not actually used it. If it is only using the usernames then there isn't a problem.

As for my PHP crack, just check Bugtraq.

http://search.securityfocus.com/swsearch?query=php&sbm=archive%...

Reply Parent Bookmark Score: 1

RE: Cracker Attractor

by Eugenia on Sat 13th Jan 2007 20:27 in reply to "Cracker Attractor"

Member since:
2005-06-28

You only enter your public username, not your password. So no, you can't crack into all these third party accounts just by cracking mugshot.

Reply Parent Bookmark Score: 1

RE: Cracker Attractor

by Shakey on Sat 13th Jan 2007 23:47 in reply to "Cracker Attractor"

Member since:
2005-10-11

I'm really do not agree with your statement about PHP, but I do think you have a valid point.

All your login info in one spot feels a bit "icky" to me too.

I guess it's too much like putting all of your eggs in one basket.

Reply Parent Bookmark Score: 1

RE[2]: Cracker Attractor

by Redeeman on Sun 14th Jan 2007 04:01 in reply to "RE: Cracker Attractor"

Member since:
2006-03-23

except that apparently it is NOT all login info, just the username.

now i dont know much about these things, as i dont use myspace, youtube or any other of these new fancy smancy things, but as far as i know, the username is not a secret.

Reply Parent Bookmark Score: 1

RE[2]: Cracker Attractor

by abraxas on Sun 14th Jan 2007 05:32 in reply to "RE: Cracker Attractor"

Member since:
2005-07-07

All your login info in one spot feels a bit "icky" to me too.

As it has already been stated, mugshot does not require passwords for accounts. Mugshot seems to take advantage of built in APIs provided by some of the sites, including rss feeds, while it may also employ some screen scraping. I can't really tell though because I don't even have an account with half of the communities that mugshot supports.

Reply Parent Bookmark Score: 1