LJ security issue -- private posts made public

[julesjones]

***ETA: see this update from LJ re security exploit***

old news, ignore the bit below and check the official update at the link above.

This is LJ-specific, but given the cross-over audience I'm going to cross-post it to DW.

epi-lj reports:

Some of you may have noticed that weird flash objects rendering as a big hunk of whitespace are showing up on some of your recent posts. I don't know for sure what's going on, but I *suspect* it's something busted with their new, "Your Journal - Your Money" feature. I'm hoping they fix it soon. (I have not opted in to that feature. It seems to be happening on lots of journals that are eligible for the feature, even though the people have not opted in, so, to be clear, this could happen to your posts even if you do not use that feature.)

I'm just posting about it because [info]eeyorerin noticed that when it ads the objects, it also makes your post public. This could be a pretty big concern if you posted anything that you thought was going to be filtered or that you really didn't want public. I just tried this out myself, and it did indeed change the security from friends-only to public.

[info]eeyorerin reports that you can re-edit your security as long as you don't delete the flash objects, and the new security setting seems to stick. (If you remove the flash objects, it'll re-add them and re-reset your security.)

full post

Major security breach, reported in a couple of places to look like a weird bug from an interaction with ljtoys. (Gacked from brooks-moses.)

Comments

[the-magician.livejournal.com]

LJ-admin are reporting that there's an exploit in embedded media, so they have disabled it for most sites (youtube is about the first they've white-listed) and are slowly bringing more sites back online.