someone should teach those bastards about copyrights

Yes, that is my real email-address! Tonight, i had the “fortune” to meet a real believer of the mainstream-press. The problem, i knew this men half my life… Tonight, i realized, that people, who think for themselfes, are no longer accepted in this society. This is no chatter of someone with to much time on his hands – no, this is an outcry to people, who have the ability, to follow a movement, that will bring down this system to it’s knees. I don’t want to hear them grey mice complaining – i wan’t people, who whant this land, rotten with corruption, to burn. This text is no joke, no scam – this is the last opportunity to fight for freedom! Thanks.

I am sorry for my bad english – please, correct that text and copy it. Thank you!

Way to go with the retarded comment, considering this will only show up on the clients webpage that’s using a specially crafted URL.

And the “ultimate power” ramblings, you really shouldn’t lie about your level of expertise as you get made to look stoopid like now.

As in you pwned yourself.

i agree…

it doesn’t show up on anyone else’s machine but your own when you do this. i wouldn’t fix it.

BTW I found another XSS in all MPAA’s movie rating sites. While RIAA was filtering keywords in their search box (using a case-sensitive search), here is no verification at all.
This bug can be used to get fake ratings for a movie or to get ratings for a movie that is not in their database or that doesn’t even exist.
Example for TorrentFreak TV episode 10: http://img209.imageshack.us/img209/6150/ratings1.gif . You wouldn’t download a car.

Well done Vektor!!!

I hope many more will follow his example.

I mean… props to Vektor for discovering the XSS and all but this is hardly worth any news (let alone two news in a few days).

A lot of sites are vulnerable to XSS and you have to send a specially crafted URL to the site to see something like in the screenshot.

This is not something a regular visitor will see so this probably won’t have any effect… In most cases the site admins/coders don’t even bother to fix something like this (although they probably should).

poor babies cant stop a outdated html flaw.

The type of flaw found, XSS (for cross-site scripting), is USUALLY (with some major exceptions) a minor vulnerability that is unlikely to cause any real damage, especially on websites like these. They do not cause any damage to the server and do not change what is displayed to normal website viewers. They are usually easy to fix and I’d guess more than half of all websites have an XSS hole somewhere. They’ve been caught and corrected on google.com, microsoft.com, fbi.gov, cnn.com, ebay.com, yahoo.com, apple.com… actually, it’s hard to think of anywhere there hasn’t been an XSS flaw.

So considering the fact that this 1) happens to just about every site 2) has no ill effects and 3) is easy to fix, maybe this doesn’t deserve a story?

Totally Agreed!..

Not a real attack ..just bad programmer who didn’t check the code coming in.

this is script kiddie stuff. get a life.

RT
anonymity.ru.tc

I mean look at the free advertising the MPAA will get in the press thanks to having the TF info up.

I think TF should sue and demand they say sorry in public.

childish maybe but the MPAA would hate it :-)

They should all rot in hell…

Whether or not the sites of the industries we all know and hate are vulnerable to cross-scripting isn’t a huge deal, know what I mean?

It’s a neat little thing, but I hope that nobody ends up citing this as evidence that the RIAA will lose this general battle. (There’s hardly a shortage of THAT around here.)

Also I personally think that vandalism doesn’t do much to advance the cause. We must be honorable criminals, as twisted and evil as we are. =)