Recent Journal Exploits

Q. What happened?

Starting around 05:45 PST on Wednesday 15th June, we started to receive reports of "Journal Exploits" doing the rounds and we began to investigate them.

It quickly became apparent that someone had crafted a link behind the bit.ly URL-shortening service that caused people who visited it to post a journal on deviantART.

The content of the journal was sometimes an insulting message directed towards the journal's owner.  Other times, it was a copy of the link itself, making it more likely that more people would see it and click on it, causing the exploit to propagate further.

We quickly deployed a temporary fix that blocked the bit.ly URL at our outgoing link page, to prevent people from clicking on the link if they saw it in someone's journal. While this wasn't a comprehensive fix, it was one that we could deploy within 10 minutes of the matter coming to our attention, while we worked on a full solution.

The simple explanation of the problem being exploited is that the link was crafting a hidden form submit to your journal page. Because it was submitted by your web-browser, it appeared to be you submitting a journal via the normal process, and so would be posted under your name.

This is what's known as a "confused deputy" attack, and we have protection against it as part of our standard suite of security tools. Unfortunately the journal submission process wasn't utilizing it.

Once the problem was diagnosed we added the missing protection to the journal, tested and then deployed it approximately 2 hours after the exploit came to our attention.

We then began the process of cleaning up the journals that were added during the attack.

Q. How many people were affected?

The first journal to have been posted via this exploit appears to have been at 23:50 PST on Tuesday 14th June, some 5 hours before the matter was brought to our attention.

During the 7 hours the exploit was active, just over 2300 journals were posted via it.

Q. Should I change my password? Are my personal details at risk?

You don't need to change your password and your personal details were not exposed in any way.

At no point was your account integrity compromised or your password available to the attacker.

The nature of the vulnerability was strictly limited to being able to prefill a journal form and act as if you had clicked on "submit" within your browser.