This looks like a spam bot command and control center. Highly doubt this is what the author thinks he stumbled into.<p>Edit: biggest giveaway besides the add user page asking for a session and csrf token is the "failing accounts" and fail logs, which the spammer likely uses to figure out which accounts have been banned from posting or throttled.
Pretty sure that is not Pinterest:<p>* The admin looks way too trivial for a site of that magnitude<p>* Pinterest is built with Django which comes with a secure auth framework included that stores passwords hashed and salted<p>* Why would Pinterest refer to their own users as "Pinterest users"?<p>Looks more like a Pinterest spam bot to me.
Last time I checked, Pinterest is built on Django. They would explicitly need to go out of their way to store password insecurely.<p>Also, the fact that the form in your screenshot ask for csrf token and session id is very odd.<p>I'd argue that you found something that wasn't built by Pintest but instead someone's tool for controlling and managing multiple Pinterest accounts.
Really interesting but not pinterest getting hacked. This is simply an admin interface to spam pinterest.<p>CSRF token and sessionid is probably needed to create an account directly because by default django has CSRF protection built in and maybe in order to hit the create account page you need to manually grab it.
Hey everyone, I'm the author of that post. Needless to say, I was wrong and ya'll were right. I made a follow-up entry in case anyone is interested: <a href="http://www.jontsai.com/security/2013/05/12/pinterest-wasnt-hacked/" rel="nofollow">http://www.jontsai.com/security/2013/05/12/pinterest-wasnt-h...</a><p>As I mention there, there was still a minute possibility that even if this didn't belong to Pinterest, it could have been an internal tool for a small team or an employee hack day/side project that got accidentally exposed.
oops. The elastic IP reuse problem is actually pretty interesting/funny because I've seen a few scenarios.<p>The easiest one is cross site scripting sourced from a recently de-comissioned elastic IP. Its easy, really easy in fact. So much so that its been done more than once (duh).<p>Its been used for phishing, except the IP wasn't hijacked or misused, it was just reused by someone who was attentive enough to wonder what all that HTTP traffic was about.<p>Its been used for "shocksiting", where all of a sudden, your favorite AWS hosted website redirects to one of the more famous shocksites, serves an ad and makes them money.
I won't share any of the links here, they're easy to find.<p>This current pinterest problem is pretty bad, I just checked the date on my machine and its 2013 so nobody with any sense should be storing unencrypted passwords. Even ROT13 would be better than nothing...
<a href="http://www.quora.com/Pinterest/Why-does-Pinterest-store-passwords-in-plaintext/answer/Tracy-Chou?srid=hLJt&share=1" rel="nofollow">http://www.quora.com/Pinterest/Why-does-Pinterest-store-pass...</a><p>Q: Why does Pinterest store passwords in plaintext?<p>A: Tracy Chou, software engineer at Pinterest - "We don't."