Shoutbox

STAY AWAY FROM YOUTUBE. Exploits have been taken further to now steal account details.
I HIGHLY recommend staying away from youtube for the time being. The exploit involves javascript which can be used to give your computer a shit time via browser exploits (this applies for all browsers). Watch youtube videos at your own risk.

Anyone can inject code to youtube videos

http://www.facepunch.com/showthread.php?p=23100690

And of course 4chan is involved as always

http://boards.4chan.org/v/res/65521163

And now it's been fixed.

quote:

---

Originally posted by Chris4
And now it's been fixed.

---

No it hasn't. All they did is hide the comments by default. (which is the part where the code injection can happen)

This is a suprisingly huge fuckup.

Cookies can be stolen, houses burnt and lives threatened.

* andrey puts youtube on his block list for the next few days..

quote:

---

Originally posted by andrey
All they did is hide the comments by default.

---

That's correct.. so none of the JavaScript pop-ups, disabled report buttons, text and images across the screen, website redirects, cookie grabbers, etc. now occur and therefore temporarily "fixed". They just have to delete the offending comments now, then re-enable comments.

quote:

---

Originally posted by Chris4

quote:

---

Originally posted by andrey
All they did is hide the comments by default.

---

That's correct.. so none of the JavaScript pop-ups, disabled report buttons, text and images across the screen, website redirects, cookie grabbers, etc. now occur and therefore temporarily "fixed". They just have to delete the offending comments now, then re-enable comments.

---

That's not what I'd consider a 'fix'. Fix would be to disable posting/display of comments completely for the time being, get their input validation fixed and delete the comments that abused the flaw.
Currently, all the JavaScript pop-ups, disabled report buttons, text and images across the screen, website redirects, cookie grabbers, etc. still work once you press the "show comments" link.

quote:

---

Originally posted by andrey
Currently, all the JavaScript pop-ups, disabled report buttons, text and images across the screen, website redirects, cookie grabbers, etc. still work once you press the "show comments" link.

---

Ah right, wasn't aware of that. In that case they should definitely disable comments for now until they're removed.

Anything posted is still up, but youtube has blocked all further posts..

Looks like they've removed the safety mode, now.  Has it all been fixed?

quote:

---

Originally posted by whiz
Looks like they've removed the safety mode, now.  Has it all been fixed?

---

Yeah