TVBARN.COM: How They Hacked That Site

To return to the last page:
Use the "Back" button on your browser.
To return to the main TV Barn page:
Click here or on the Barn logo.

And the winner is: Gervase. Mr. Lay-Around-and-Make-Comments-About-the-Women Gervase. He's your big winner, or so it would appear.

Now for the background. A young Canadian named Caplock went fishing on the CBS Web site, not doing anything illegal, when he stumbled upon the incriminating information. Caplock's Web site explains what he did, and I've tried to offer a version below that might be better understood by the non-technically inclined. I'm inclined to think Caplock is right on the money, because his story reminds me of so many hacks I've seen before — careless operator errors exploited by someone with too much time on their hands.

Take a look at the "Tribal Council History" page on the "Survivor" Web site. It's arranged like a scorecard, with images of each of the contestants who have been voted off the show already entered in the gray grid. Notice the shiny red "X" in the top left corner of each picture.

Pulling up the HTML source for that page — jeez, why didn't I think of this? — we find the following image tags:

(NOTE: I've lost the images. AB 9/28/02)

See the pattern? All the images used for the Tribal Council scorecard are named exactly the same way: First name of contestant plus underscore key (_) plus the letters "VH" plus the .gif suffix. (GIF is a format commonly used for image files such as photos.)

So what Caplock did was simply start substituting the first names of contestants still on the island and submitting them as URLs to the Web site. Here's what he got back:

(NOTE: I've lost the images. AB 9/28/02)

Voila. The only contestant without an "X" next to his mug, the one whose place appears reserved for the far-right column of the Tribal Council scorecard, is Gervase.

* * *

How could CBS's Web gurus make such a boneheaded mistake — assuming, of course, that it isn't simply an elaborate ploy to call more attention to the show? It's easier than you might think. Last year, you may recall that the name of the Chicago Cubs' next manager was leaked accidentally after an intrepid reporter at the Chicago Tribune found the press release with Don Baylor's name on it at the Cubs Web site.

* * *

It's too soon to say whether's Caplock's intrepid work will wind up affecting the ratings for "Survivor." A poster to the Slashdot site said a similar security hole was exposed during the first year of the show's Swedish version, "Expedition Robinson." Obviously that didn't stop "Expedition" from becoming a huge hit and begetting "Survivor." In the end, this accidental spoiler may simply turn out to be further grist for CBS's over-hyped hype mill. After all, aren't you curious how a knucklehead like Gervase managed to win the $1 million prize?

* * *

UPDATE 7/19/00: CBS reportedly has fixed the Gervase photo, leaving us to wonder whether the Eye is quietly covering its tracks or applying the finishing touches to an elaborate ruse.

UPDATE 7/20/00: The reports were wrong. Follow the original URL and you still get Gervase.

UPDATE 7/21/00: Remarkably, or maybe predictably, CBS allowed a brief clip of a sparsely attended tribal council to grace the opening sequence of Wednesday's "Survivor." The picture suggests a scene at the end of episode 12, when the field is winnowed down to four finalists. The four persons shown are Gervase, Rudy, Colleen and Sean. In the 13th and final episode of "Survivor," — which will be two hours or possibly even three hours long and will air Aug. 23 — the four will be reduced to two and then a tribal council consisting of the previous seven cast-offs will decide the $1 million winner. Sure looks like that winner is our Teflon-coated YMCA instructor.

UPDATE 8/2/00: Nope! It's not Gervase. Read it all here.

(7/17/00)

Copyright ©2000 Andy Ihnatko. May not be redistributed without permission. Studio PR types wishing to send Andy tapes, promotional clothing, or high-end video gear in hopes of securing a positive review are advised that such efforts are futile, but they're free to try to determine how high Andy's price actually is. Mail any and all pelft to Box 279, Norwood, MA 02062. He already has a subwoofer for his home-theater but could probably use a good pair of casual slacks.