Poe.xyz.is; suspected cause for compromised accounts?

It's just web analytics.
Just viewing a website can't compromise your computer unless you:
1) Have a plugin with security vulnerabilities (flash is notorious for this... but java and others also have problems sometimes).
2) Enter information on the website (common with phishing websites).
3) Download an executable file from the website and run it.

"

Zalm wrote:

"

sage2050 wrote:

ive been using it since the day it opened and haven't been hacked. im sure if it was malicious someone who knows what they're talking about would have said something by now.

Same...I've been using this site, and even have it on my favs since I saw it posted. I have yet to be hacked. I will continue to use this site until someone shows me concrete evidence that it is a hacking site.

Something concrete like having to sign into my account on this site. Which you dont have to so...it searches the fucking forums for you, idiot.

I was using that site and got hacked up til 3 hours ago. I didn't think much of it pouring over the source code initially, but, sites that use java I am always leery about. Again, I don't claim to know what I am talking about. Just trying to find out, why and other seemly competent individuals also were compromised.

"

Zalm wrote:

Something concrete like having to sign into my account on this site. Which you dont have to so...it searches the fucking forums for you, idiot.

Err just because a site doesn't ask you directly for your username and password that doesn't mean it can't contain something malicious. No reason to call someone an idiot because you don't know what you're talking about.

"

PSGMud wrote:

I was using that site and got hacked up til 3 hours ago. I didn't think much of it pouring over the source code initially, but, sites that use java I am always leery about. Again, I don't claim to know what I am talking about. Just trying to find out, why and other seemly competent individuals also were compromised.

Yet here you are, making over zealous claims that this site is suspected to cause account compromise? I'd like to see an external source to the acclaimed suspicion. Or at least GGG claim that they suspect this. Not you, you are not GGG so you cant claim that its malicious and under suspicion.

"

RandallPOE wrote:

"

Zalm wrote:

Something concrete like having to sign into my account on this site. Which you dont have to so...it searches the fucking forums for you, idiot.

Err just because a site doesn't ask you directly for your username and password that doesn't mean it can't contain something malicious. No reason to call someone an idiot because you don't know what you're talking about.

True, but you have to have some input to make the malicious entity work, such as downloading something, inputting something or accessing something while its working. Unless you have no security, in which I'm surprised you can even access half the internet with no type of security.

this is a pretty flimsy accusation

Just for general information since this is vastly misunderstood:

Java is not the same as Javascript

The vulnerabilities you hear about Java are not related to the Javascript language as well.

As far as making claims against this site, you could at least compared the script they use (hosted on the site's domain) to see if it was updated.

"

Zalm wrote:

"

PSGMud wrote:

I was using that site and got hacked up til 3 hours ago. I didn't think much of it pouring over the source code initially, but, sites that use java I am always leery about. Again, I don't claim to know what I am talking about. Just trying to find out, why and other seemly competent individuals also were compromised.

Yet here you are, making over zealous claims that this site is suspected to cause account compromise? I'd like to see an external source to the acclaimed suspicion. Or at least GGG claim that they suspect this. Not you, you are not GGG so you cant claim that its malicious and under suspicion.

How exactly am I being zealous? I have said, "I don't know" many occasions in this thread. It has custom code from what it appears. I am just asking questions and investigating. Chill out.

http://nationalcybersecurity.com/back-door-added-to-piwik-analytics-software-installer-following-site-compromise/

Piwik isn't known for its security either.

"

kaeus wrote:

As far as making claims against this site, you could at least compared the script they use (hosted on the site's domain) to see if it was updated.

Do you know of a means to obtaining that script?

Javascript can't really do much, hijack your poe session at most. Java and flash can upload files from your PC ( config file, with hashed PW ). I am a daily user of the site and was not hacked so far, hope it stays that way.