🔒 Locked

Gogamer.com/Compuexpert

Started by GBGames Jul 24, 2002 at 6:25 PM 4 replies 300+ views

Original Post

Jul 24, 2002 at 6:25 PM

I got Wizardy 8 from them awhile back through an ad I found on this site. I was looking at other games that seemed to be at a great discount from the stores around me, and I found this one game...can''t remember what it was, but that''s not the point. What happened was, I was talking to my friend online through AIM, and I IMed him the URL. Now, if I were to do this while on AMazon.com, he would get the URL, but it would make it seem like he is just checking the product. When I did it from GoGamer.com, he got not only the product page, but access to my account! We tested how far it went. Basically, he can''t do anything unless he has my password...except he can change the account''s email and then claim that he forgot his password. It would send a password for the account to the new email he provided. He would then be able to get full access to my account and so would be able to access my account''s information, such as billing address among other things. Anyone else have experience with GoGamer.com? I sent an email to them, twice. The first time no one responded and the second time, they claimed that they would have it fixed by the end of the week. That was months ago, and I haven''t tried to login and see if it would do the same. Have they fixed it yet? ------------------------- (Gorgeous graphics)+(beautiful sound effects)+(symphonic music)+(no gameplay) != Good game

core

Jul 25, 2002 at 2:42 AM

quote:
Original post by GBGames
That was months ago, and I haven''t tried to login and see if it would do the same.
Have they fixed it yet

Hmm, which is quicker:
1) Waiting months to ask someone else to check, or
2) Checking it yourself.

"If people are good only because they fear punishment and hope for reward, then we are a sorry lot indeed." - Albert Einstein

GBGames

Jul 25, 2002 at 8:00 AM

B-) You're right. I was going to check it myself, but apparantly they removed my account since I couldn't login yesterday.
I should try it again though.
Of course, part of the reason for my post was to raise some awareness of this security issue. I really wanted to know if anyone else had heard anything or had similar experiences.

[edited by - GBGames on July 25, 2002 9:01:50 AM]

core

Jul 29, 2002 at 2:31 AM

I have to apologize for being rude.

While I''ve not experienced such a thing as you described, nor do I try to find vulnerabilities in websites, I believe that kinda thing is more common than all of us would like to believe.

<opinion>
Come to think of it, if I would''ve found out what you did I would not have told the webmaster a damn thing. You could be accused of being malicious in some way. And a lot of these people don''t even fix something until it''s blown up in their faces. Sure it''s always nice to help out others, but sometimes they just don''t want the help or understand how to fix it.
</opinion>

"If people are good only because they fear punishment and hope for reward, then we are a sorry lot indeed." - Albert Einstein

GroZZleR

Jul 29, 2002 at 2:46 AM

Its probably because GoGamer doesn''t use cookies, but stores your vitals inside of the URL itself.

For example, if you see this url I''m at right now..
http://www.gamedev.net/community/forums/post.asp?method=reply&topic_id=105726

You can see after post.asp, theres whats called a Query String. This tells the script some vital information, using this particular URL, we can see that..

METHOD=REPLY
So I''m replying to a topic.

TOPIC_ID = 105726
So I''m REPLYing to TOPIC 105726.

So a GoGamer URL, may look something like..

http://www.gogamer.com/products.cgi?METHOD=View&PRODUCT=1256&USERNAME=Batman&PASSWORD=Robin

So from that URL, you can see decipher that I''m viewing product #1256, under the account of Batman with the password, Robin.

Thats probably why your friend has access to your account, when you post a URL of a particular product.

GBGames

Jul 29, 2002 at 9:49 AM

Yeah I haven''t bothered trying to open an account there recently so I couldn''t study it. I figured it had something to do with the URL itself. That is pretty bad in terms of security if the password is part of the URL and so necessarily sent in plain text across the WWW.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.