Another long-time CB developer using backdoors: cbbotdev

[smoker919]

The app is called rolling notifier and it is again access to the limitcam that proves vulnerable. The author of this app (cbbotdev) is very unsophisticated and makes mistakes in other parts of the code, but he still nonetheless sets it up so that an alt account (clickdickpic) is silently given access to the limitcam when it enters a room running the app.

A screenshot of the app code showing the backdoor routine:

 

[cbhours]

they should really add required permissions for limit cam

 

[punker barbie]

Hello @smoker919 For assistance with Chaturbate, please contact support@chaturbate.com

 

[smoker919]

Hello @smoker919 For assistance with Chaturbate, please contact support@chaturbate.com

@punker barbie I don't want to be pugnacious, but the last time I submitted a report on an app with a backdoor -- in April -- I got no response from CB Support and you didn't reply to the thread here even though I tagged you multiple times. This is why I didn't tag you this time but just made this thread as a public service. I'm more than happy to try for a reset if you wish; the previous thread is here.

 

[NaomiNSFW]

they should really add required permissions for limit cam

I just suggested this a couple days ago to Chaturbate staff in a meeting. Apparently better control over Limitcam shows is planned. Idk if it will be in only V3 apps though and I don't have a timeline for completion. Hopefully the easy changes get implemented soon.

I also mentioned the following with help from Smoker:

• Automatically labelling apps with the "Limitcam" category if they add Limitcam users anywhere in the code. Helps spot malicious apps that may be hiding backdoors
• That banning a single user often doesn't work if they have alt-accounts attached.
• I think they're working on a better way to report apps I don't know what format that will take but a button with common reasons for reporting apps seems like a good idea.
• Always sending a notification showing who has been added to a Limitcam show so a Performer knows.

 

[omni]

Maybe I'm too far removed and maybe customer support staff turnover is fast-food frequent...but it seems there are *many* **significant** safety/security issues at CB that are being either slow-walked or not moved at all towards the front of the line for being addressed and/or rectified.

From afar, but having an idea of how long many issues have been raised by the community of users/creators/coders, it's disheartening to watch.

 

[Garduskippa]

• Always sending a notification showing who has been added to a Limitcam show so a Performer knows.

Log in red to chat if a user is added but no tokens is spended.

 

[Vixxen81]

Log in red to chat if a user is added but no tokens is spended.

Red is for moderators.

 

[Garduskippa]

Red is for moderators.

i mean white on a red background

 

[Vixxen81]

i mean white on a red background
View attachment 103815

Nice I like it.

 

[smoker919]

I'm going to plug my own apps here because I don't think any other apps do this:

The ticket and hidden show components in my apps do two-level security checks to make sure that the only users viewing the shows are the ones that were added by that app, and any users who are detected having access to the limitcam from other apps are alerted to the broadcaster. I'll reuse an image from another thread here as an example:

 

[cbhours]

I'm going to plug my own apps here because I don't think any other apps do this:

Think theres at least one, i remember seeing a screenshot a while back about mentioning unexpected viewers.

 

[smoker919]

Think theres at least one, i remember seeing a screenshot a while back about mentioning unexpected viewers.

Might have been my screenshot from here, but if not please share if you find it.

 

[cbhours]

Might have been my screenshot from here, but if not please share if you find it.

H

Post in thread 'Not paid for ticket show, emailed support over 2 weeks ago but haven’t heard back from CB . Please advise'

Feb 8, 2024

They said that I must have not cleared my queue: which cannot be the case because we never had that many people in a show before, or had those same viewers in a show before. I have pictures of everything. They responded and gave that only input- but that’s not what could have happened. We’ve been ignored ever since. I’ve attached pictures for reference

• HayleyAndJay

 

[smoker919]

H

Post in thread 'Not paid for ticket show, emailed support over 2 weeks ago but haven’t heard back from CB . Please advise'

Feb 8, 2024

They said that I must have not cleared my queue: which cannot be the case because we never had that many people in a show before, or had those same viewers in a show before. I have pictures of everything. They responded and gave that only input- but that’s not what could have happened. We’ve been ignored ever since. I’ve attached pictures for reference

• HayleyAndJay

This sounds to me like a ticket show app that doesn't clear the limitcam access list properly. I know this is true of several V1 ticket show apps that rely on the app being turned on and off for ticket shows rather than fully maintaining their state, and the limitcam state, internally.

 

[smoker919]

Just to note: cbbotdev did remove the backdoor from the app cited here but then removed the entire app.