In somewhat related news, it appears LiveJournal had to make some changes today because
some accounts were compromised—possibly up to
900,000 of them—by a similar cookie grabber.
This makes me think. Does anyone remember a few months back, with the myspace.com pseudo-virus? That one made it so if you viewed an infected user lookup,
your lookup became infected too. In the space of 24 hours, over 1
million people were infected with it.
And then there was something on xanga.com on new year's. I never looked up the details of it, but it was supposedly similar to the myspace one.
And now neopets, and livejournal.
So it seems that neopets isn't alone in this. This type of website is relatively new and the security kinks haven't all been worked out, and cracking them is just starting to become thought about.
An interesting thing to note is that the media picked up on all three of the other cases I talked about, but I haven't seen anything (and don't expect to) about neopets, even though it's a simliarly sized website. Another interesting thing, and probably the
reason the media hasn't picked up on it, is that the number of accounts with problems on neopets was tiny compared to those: Livejournal was 900,000, myspace was over 1 million, I don't know about xanga but I'd expect it was similar.... and neopets was, as far as I know, under 1000.
As to why that is, I suspect—though it is just my suspicion— that it's partially because of the way neopets is set up, and mostly because the crackers themselves weren't as good as strong as the ones in the other cases.
This is ending without a conclusion now.
Nabile pwns you...
...At Lenny Connundrum.