[Security/Bug Report] Auto-upvote occurs for certain Users/Posts by primus

View this thread on: hive.blog | peakd.com | ecency.com

steemit · @primus · Jul 17 '16

$4.34

[Security/Bug Report] Auto-upvote occurs for certain Users/Posts

<html>
<p>All STEEM users - please check - are you upvoted this @h3h3 <a href="https://steemit.com/vapenaysh/@h3h3/is-steemit-ready-for-the-vape-naysh-invasion">Is Steemit Ready For The Vape Naysh Invasion</a> post?</p>
<p>I definitely do not upvoted or ever visited/read this topic, but <a href="https://steemd.com/@primus">found my vote on blockchain</a>.</p>
<p>This occured immediately after posting my first comment today on Steemit.com</p>
<p>As <a href="https://steemd.com/@h3h3">you can see</a>, this post gathers new upvotes every minute:&nbsp;</p>
<p><img src="https://s32.postimg.org/l13ckczr9/20160717_1.png" width="760" height="565"/></p>
<p>I suppose all this upvotes are auto-generated through steemit.com site vulnerability. In addition, I suppose all this voters were compromised, at least their posting WIF keys and [possible] owner keys.</p>
</html>

👍 tuck-fheman, xeroc, ash, kingscrown, acidsun, tinfoilfedora, primus, stephencurry, moch-yusuf, lehard, dasha, bacchist, pigeons, usefree, sigmajin, freeflowbc, baharoba, granin, rolik, yuhhans, satorus, bitcoinuserx, kirill7, nysemax, sunnyray, nastrom, serg999, spbalexpiter, nazar, samu-paha, goodluck, shikulm, fishborne, nippel66, ardina, kottai, mianeri, warplat, alexander1, qonq99, streak, dimniki198, bitlord

`author`	primus
`permlink`	security-bug-report-auto-upvote-occurs-for-certain-users-posts
`category`	steemit
`json_metadata`	{"tags":["steemit","steemd","security"],"users":["h3h3"],"image":["https://s32.postimg.org/l13ckczr9/20160717_1.png"],"links":["https://steemit.com/vapenaysh/@h3h3/is-steemit-ready-for-the-vape-naysh-invasion","https://steemd.com/@primus","https://steemd.com/@h3h3"]}
`created`	2016-07-17 12:07:54
`last_update`	2016-07-17 12:07:54
`depth`	0
`children`	7
`last_payout`	2016-08-24 13:07:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	3.354 HBD
`curator_payout_value`	0.989 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	868
`author_reputation`	7,242,011,333,909
`root_title`	"[Security/Bug Report] Auto-upvote occurs for certain Users/Posts"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	143,480
`net_rshares`	1,946,911,341,209
`author_curate_reward`	""

properties (23)vote details (43)

voter	rshares	pct
xeroc	560,201,579,219	100%
tuck-fheman	807,638,099,600	100%
ash	291,680,714,994	100%
acidsun	73,990,661,593	100%
nastrom	143,939,548	100%
kingscrown	75,706,664,482	100%
pigeons	3,758,686,927	100%
tinfoilfedora	61,843,932,145	100%
bitcoinuserx	325,745,986	100%
moch-yusuf	9,279,053,958	100%
sunnyray	161,785,528	100%
usefree	2,919,419,427	100%
primus	15,346,589,974	100%
bacchist	8,539,406,998	100%
dasha	8,933,711,748	100%
freeflowbc	1,331,617,467	100%
baharoba	901,719,136	100%
lehard	9,038,346,096	100%
kirill7	247,321,550	100%
rolik	491,456,506	100%
sigmajin	2,306,420,667	100%
ardina	43,236,966	100%
warplat	29,657,833	100%
granin	655,612,175	100%
serg999	129,285,454	100%
nysemax	236,428,946	100%
mianeri	33,472,030	100%
stephencurry	9,292,883,956	100%
yuhhans	466,151,927	100%
satorus	411,391,758	100%
nippel66	71,505,883	100%
spbalexpiter	119,142,406	100%
bitlord	2,337,956	100%
qonq99	11,731,910	100%
streak	8,354,223	50%
kottai	41,578,374	100%
fishborne	92,022,043	100%
dimniki198	6,837,834	100%
samu-paha	112,526,563	100%
goodluck	112,381,198	100%
shikulm	111,275,733	100%
nazar	112,634,467	100%
alexander1	24,018,025	100%

@ash · Jul 17 '16

great job primus! 

those accounts forgot to change their posting key password, it's still alarming but not as crucial

👍 warplat

`author`	ash
`permlink`	re-primus-security-bug-report-auto-upvote-occurs-for-certain-users-posts-20160717t161116003z
`category`	steemit
`json_metadata`	{"tags":["steemit"]}
`created`	2016-07-17 16:11:15
`last_update`	2016-07-17 16:11:15
`depth`	1
`children`	3
`last_payout`	2016-08-24 13:07:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	118
`author_reputation`	286,803,743,324,398
`root_title`	"[Security/Bug Report] Auto-upvote occurs for certain Users/Posts"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	147,464
`net_rshares`	29,657,833
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
warplat	0 B		29,657,833	100%

@primus · Jul 17 '16

Uh, yes. But is there any way to change the password on steemit.com site now?

It's more then 600+ affected users.

👍 pigeons, warplat

`author`	primus
`permlink`	re-ash-re-primus-security-bug-report-auto-upvote-occurs-for-certain-users-posts-20160717t161505200z
`category`	steemit
`json_metadata`	{"tags":["steemit"]}
`created`	2016-07-17 16:15:54
`last_update`	2016-07-17 16:15:54
`depth`	2
`children`	2
`last_payout`	2016-08-24 13:07:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	114
`author_reputation`	7,242,011,333,909
`root_title`	"[Security/Bug Report] Auto-upvote occurs for certain Users/Posts"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	147,557
`net_rshares`	3,714,645,016
`author_curate_reward`	""

properties (23)vote details (2)

voter	weight	wgt%	rshares	pct	time
pigeons	0 B		3,684,987,183	100%
warplat	0 B		29,657,833	100%

@ash · Jul 17 '16

@ned said it'll be enabled later this day

👍 warplat

`author`	ash
`permlink`	re-primus-re-ash-re-primus-security-bug-report-auto-upvote-occurs-for-certain-users-posts-20160717t161728753z
`category`	steemit
`json_metadata`	{"tags":["steemit"],"users":["ned"]}
`created`	2016-07-17 16:17:30
`last_update`	2016-07-17 16:17:30
`depth`	3
`children`	1
`last_payout`	2016-08-24 13:07:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	41
`author_reputation`	286,803,743,324,398
`root_title`	"[Security/Bug Report] Auto-upvote occurs for certain Users/Posts"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	147,590
`net_rshares`	29,657,833
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
warplat	0 B		29,657,833	100%

1 reply

@masongrey · Jul 17 '16

It looks like i "up voted" this scumbag gross. It would be sick if we actually got h3h3 on here though

👍 iino2ii

`author`	masongrey
`permlink`	re-primus-security-bug-report-auto-upvote-occurs-for-certain-users-posts-20160717t210246651z
`category`	steemit
`json_metadata`	{"tags":["steemit"]}
`created`	2016-07-17 21:02:51
`last_update`	2016-07-17 21:02:51
`depth`	1
`children`	0
`last_payout`	2016-08-24 13:07:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	102
`author_reputation`	36,699,006,859
`root_title`	"[Security/Bug Report] Auto-upvote occurs for certain Users/Posts"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	153,135
`net_rshares`	0
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
iino2ii	0 B		0	100%

@satorus · Jul 17 '16

Thank you! I found myself ... Remind please: how to change the keys?

👍 warplat

`author`	satorus
`permlink`	re-primus-security-bug-report-auto-upvote-occurs-for-certain-users-posts-20160717t163747203z
`category`	steemit
`json_metadata`	{"tags":["steemit"]}
`created`	2016-07-17 16:37:42
`last_update`	2016-07-17 16:37:42
`depth`	1
`children`	1
`last_payout`	2016-08-24 13:07:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	68
`author_reputation`	177,467,123,098
`root_title`	"[Security/Bug Report] Auto-upvote occurs for certain Users/Posts"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	147,974
`net_rshares`	29,657,833
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
warplat	0 B		29,657,833	100%

@vl248 · Jul 17 '16 (edited)

Check this one on how to update your keys
https://steemit.com/steemit-guides/@pfunk/your-steem-account-is-worth-money-how-to-secure-it-with-a-new-owner-key-to-keep-it-yours-forever

👍 satorus

`author`	vl248
`permlink`	re-satorus-re-primus-security-bug-report-auto-upvote-occurs-for-certain-users-posts-20160717t170611431z
`category`	steemit
`json_metadata`	{"tags":["steemit"],"links":["https://steemit.com/steemit-guides/@pfunk/your-steem-account-is-worth-money-how-to-secure-it-with-a-new-owner-key-to-keep-it-yours-forever"]}
`created`	2016-07-17 17:06:15
`last_update`	2016-07-17 17:06:45
`depth`	2
`children`	0
`last_payout`	2016-08-24 13:07:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	180
`author_reputation`	1,516,425,134,719
`root_title`	"[Security/Bug Report] Auto-upvote occurs for certain Users/Posts"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	148,508
`net_rshares`	411,391,758
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
satorus	0 B		411,391,758	100%