Hi5 saga

Hi5 saga

Today I logon into hi5 and checked that my redirected wasn't working. "Wow! Finally they've patched the system" - I thought. I got no reply from them, but that I was already expecting...

Anyway I did some testing, and it seems that they only disallow changes on the document, such as, redirecting the page or, one that became my favourite, changing the images and the page (believe me, seeing the hi5 logo upside down is funny). The basic alert test still works, and that's not all, accessing document properties such as history and cookies is allowed, along with opening new windows.

It might not be that efficient as the redirect, but opening a new window pointing to an URL with a fake login, maximizing it and making it on top, might fool some users, not as much as the redirect but still some. Other idea is to open a new window, very small (or with a banner) that would submit the users cookie to a remote page, having the cookie someone can probably with sucess hijack for some time the session (this last one is just an idea, I did not tried it...yet).

I've written a new email to the hi5 team, the 3rd one… Probably, they'll just kick me out of their system so they don't have people complaining about security bugs. Let's see how it goes.