Comment by archgoon

The article is a bit sparse on details of the actual attack; Was the original site not over https? Or was the attacked site storing session cookies in insecure cookies?