CSGO Lounge big security exploit

[91wow]

Sorry if this is not the right place for this or if I can post this at all, if so feel free to move this or delete it. 

 

CSGO lounge, the big betting and trading website for Counter-Strike: Global Offensive with an average traffic of 594,351 people per day seems to not really care about the security of its users. As to quote the OP from reddit;

 

 

 

Told them about these, was ignored, so here you go XSS on their weird linkfilter thing; seriously, it's apparently amateur hour over there. Checks Referer though... but links in trade comments are automatically URL-ified, so that works. Click a weird-looking link in a trade? I now control your Lounge account. I can then sniff your protection code and watch for trade requests, and grab your items when you go to place a bet (adding you from a fake bot, indistinguishable from the real ones) or make you swap teams on a bet. Or, they don't check that the OpenID realm is csgolounge.com, so you can use OpenID logins for other sites and get into accounts that way. Finally... they can't afford SSL? Seriously?

 

What this means for anyone who uses it, well you can click on a link, lets say it looks like or similar to another CSGOLounge link, well now, as the OP said "I have control of your account" as this person, /u/iamncla from reddit can show what the website has been like for quite some time now (Here's link as he is saying stuff that I can't really explain myself, someone much smarter than I am please put what he says in layman's terms for some of us http://www.reddit.com/r/GlobalOffensive/comments/2hy21z/csgolounge_doesnt_care_about_your_security/ckxbzp7) CSGO lounge is just not really caring about its users, this is a big deal as not only is a very large competition coming up in November and their traffic will jump massively (Last year it went from around 200K People a day to 700K within 3 hours) they will see Millions of dollars in skins, This, if not taken care of will have huge amounts of lawsuits put onto them. This is a warning now, for anyone who uses CSGO Lounge, be very, very careful on what you click on, What I suggest you do is, click on the traders name and send them a trade offer as this will take you to steamcommunity website, nothing else. This is the safest way to trade, and as for links on the website, just don't click on any of them, if you want to see screenshot, click on their name and go to their steam profile. 

 

 

Sorry if this is really badly laid out, a bit scrambled and sometimes goes off topic, I wanted to write this fast to get back to work on school stuff, sorry if its not meant to be here, but I thought you people who might use the website would like to know whats happening here. 

[Jerakl]

My reaction "What's CSGO Lounge?"

[DirkaFat]

My reaction "What's CSGO Lounge?"

Second sentence of the original post: "CSGO lounge, the big betting and trading website for Counter-Strike: Global Offensive with an average traffic of 594,351 people per day"

[NinjaStyle013]

I use CSGOLounge and its terrible cant wait for an alternative

[Polyvalent]

Thanks for this information, thats the last time I follow a link in a trade on csgolounge.

[91wow]

My reaction "What's CSGO Lounge?"

As I said, it is the largest betting website right now for CSGO items, they also run one for TF2 and DOTA, its to bet and trade items.

[Notree]

cs go lounge is safe. Just don't click links you don't know. Same goes with every site on the internet ever lol

[Fulgrim]

My reaction "What's CSGO Lounge?"

A site where you can basically bid weapon skins on ESL matches for CSGO.

[Jerakl]

As I said, it is the largest betting website right now for CSGO items, they also run one for TF2 and DOTA, its to bet and trade items.

 

 

Second sentence of the original post: "CSGO lounge, the big betting and trading website for Counter-Strike: Global Offensive with an average traffic of 594,351 people per day"

 

 

A site where you can basically bid weapon skins on ESL matches for CSGO.

 

 

I knew after I read the article 

 

That was my reaction before I read it

[91wow]

I use CSGOLounge and its terrible cant wait for an alternative

csgoloot.com is trying to compete with CSGO Lounge, they have trading set up so far and they are working on the betting part of the website, they also have a shop being set up to buy those supper rare items worth more than what valve market allows, much safer than CSGO Lounge does with a P2P service, this has a bot as a middle man that takes item A and the money and trades them accordingly. 

[91wow]

cs go lounge is safe. Just don't click links you don't know. Same goes with every site on the internet ever lol

Well, as the link shows, the user had two screen shots talking to one of the people in charge of the website. he said that he was able to do some simple things like changing the buttons on the site, this means that he could also maybe change what they redirect to.  

[icotulookin]

I came across this thread trying to figure out myself about the glitches of CSGO Lounge.  I heard Faceit now owns it?  Faceit is terrible and rumor has it they are using every means possible to scrape up money to pay out to players for the end of season 1.  Things are popping up all over the place though.  I saw n0thing ( a professional csgo player) with a name tag on his knife that said playESGN.com  I looked at that site and it's just a construction page that talks about some upcoming Million dollar LAN event in Las Vegas betting on games and other stuff.  Who knows.  All I know is half the time I can't get a bet placed on CSGO lounge because bots are down.  Hope someone comes out with something better.  ESEA sucks and is milking it's community before it dies out, Cevo always sucked and Faceit.... worst league, casters, website, functions all around mess ever.  

[91wow]

I came across this thread trying to figure out myself about the glitches of CSGO Lounge.  I heard Faceit now owns it?  Faceit is terrible and rumor has it they are using every means possible to scrape up money to pay out to players for the end of season 1.  Things are popping up all over the place though.  I saw n0thing ( a professional csgo player) with a name tag on his knife that said playESGN.com  I looked at that site and it's just a construction page that talks about some upcoming Million dollar LAN event in Las Vegas betting on games and other stuff.  Who knows.  All I know is half the time I can't get a bet placed on CSGO lounge because bots are down.  Hope someone comes out with something better.  ESEA sucks and is milking it's community before it dies out, Cevo always sucked and Faceit.... worst league, casters, website, functions all around mess ever.  

Faceit does not own CSGO Lounge. Faceit is a heavy sponsor of CSGO Lounge. This means that EVERY game (within CSGO Lounge rules and regulations) will be up for betting. People thought that ESEA bought CSGO Lounge a while back as every game from ESEA Invite and Playoffs where up on the sight, turns out ESEA got a large amount of views and revenue from the sight, so they advertised them. 

 

Also, if you live in the US, or close to Amsterdam try out CEVO Pugs, its like ESEA but a bit more reliable. Also, CSGO has been getting teased for MLG 2015 events, this means more people and programs will pick it up!