Forum hacked

[Wilbert]

There was a thread in the subsection indicating that the forum is hacked (script stealing passwords and things like that). The thread is gone for some reason. So better not to log in and wait for an announcement of the administators on this matter.

In any case if you logged in yesterday, you should change your password.

[sneaker_ger]

Do you have contacts to the admin(s)? More specifically, are they aware there is a problem?

[wonkey_monkey]

Well that's just even more extremely suspicious, and suggestive of continuing abuse of a mod's login.

The announcement posted by tebasuna51's account, which appears to be an attempt at injecting a password-stealing script (and which breaks forum indexes), and which prompted the now-deleted thread, has recently been edited to say "maintenance" instead of "test". It still contains the attempt at injecting the malicious script, although this is likely to fail in most, if not all, reasonably modern browsers. The text of the announement now reads "We are working on the indexing issues now and doing basic maintenance".

Seems pretty clear that tebasuna51's account has been compromised. He did still post normally once, earlier tonight, after the announcement was first posted, suggesting his password hasn't been changed and that he wasn't aware of anything at that time.

I've PM'd him along with a few other mods (including Doom9 and Swede).

I take it you can't take the forum offline, Wilbert? Or post an announcement to push the dodgy one off?

---------

It's also possible that more basic access has been gained by someone, in order to subvert the code and inject the script attempt into the announcements, which are then genuine. But if that was the case I would hope that tebasuna51, or whoever is doing the announced "basic maintenance", would have taken the forum offline.

[Wilbert]

Do you have contacts to the admin(s)? More specifically, are they aware there is a problem?
No, and i don't know.

I take it you can't take the forum offline, Wilbert? Or post an announcement to push the dodgy one off?
No i can't. I made a new announcement and deleted the other one.

[wonkey_monkey]

Cool, that has fixed the forum index problem for now and removes the immediate threat (which as I say, is unlikely to hurt anyone unless they're using a very old browser). Unfortunately it may reoccur until we know that tebasuna51's account is secure.

[lvqcl]

"New Posts" link still shows that announcement and nothing else.

[wonkey_monkey]

In "New Posts" I see Wilbert's announcement followed by the dodgy one. Everywhere else I just see Wilbert's.

[Wilbert]

"New Posts" link still shows that announcement and nothing else.
I can't remove this one.

I sent tebasuna51 a mail asking whether he has access to his account and to change his password. If he doesn't respond i guess i should ban him or something.

[sneaker_ger]

Ban him before he bans you?

[Wilbert]

Ban him before he bans you?
Damn, i'm not authorized to ban him because he is not a normal user ;(

edit: I striked him a few times. Now his account is suspended. Apologies tebasuna51!!

[BetA13]

so, should i change my password? is it save to change it NOW?

greetings..

(hopes everything goes well here on the Doom9)

[sneaker_ger]

First thing you should do if you have the same password on other sites is to go to those other websites and change the passwords there (one unique password per site). This is especially true for important stuff like e-mail accounts (gateway to almost all other websites because of the "password forgotten" feature), banking, paypal, ebay etc.

Since this isn't the first doom9 incident I would treat doom9 as kinda "open", i.e. assume everything you type here (passwords, e-mail-address, private messages) is open to others. Don't re-use the same password for multiple websites.

[BetA13]

no prob, i have a diff. for everyone.. :)

but thanks fo rthe calrification... :)

[FranceBB]

I noticed that the Indexing wasn't working, so I started using the manual search and I even replied to a topic.
I thought it was some sort of maintenance until I saw this.
Anyway, it's sad to see that there are people who are willing to hack this community to get a few quids from PayPal or God knows what.
I consider Doom9 as the "StackOverflow" of the encoding and it's really sad to see a programmer damaging a forum that helps programmers...


(which as I say, is unlikely to hurt anyone unless they're using a very old browser).


Very old? Like IE8? Or just like Chrome 54? Or maybe even just Firefox 52.9.1ESR?
I'm just wondering, 'cause I did browse the forum while it was infected, but I was using Chrome 72, however I'm pretty sure that there are people using older browsers.

[foxyshadis]

I noticed that the Indexing wasn't working, so I started using the manual search and I even replied to a topic.
I thought it was some sort of maintenance until I saw this.
Anyway, it's sad to see that there are people who are willing to hack this community to get a few quids from PayPal or God knows what.
I consider Doom9 as the "StackOverflow" of the encoding and it's really sad to see a programmer damaging a forum that helps programmers...



Very old? Like IE8? Or just like Chrome 54? Or maybe even just Firefox 52.9.1ESR?
I'm just wondering, 'cause I did browse the forum while it was infected, but I was using Chrome 72, however I'm pretty sure that there are people using older browsers.

Think IE6. Even IE8 won't let you put a script element in an a element.

I saw things earlier, and I didn't even want to log in. Now I see it's a very specific, very broken script kiddie hack, I shouldn't have worried.

[sneaker_ger]

Was the script even running in any browser? It looked like the <script> tag wasn't closed correctly or something like that. I guess the forum's HTML filter worked almost correctly and he didn't find any way to make it work (it shouldn't break the list of threads so there seems to still be some error). And it seemed that at least from my PC the external .js wasn't even reachable. So I agree that this time probably nothing really happened, no passwords stolen etc.

I hope the admins can kinda limit mod rights to not let this happen again so easily, e.g. no global announcements. And revoke mod rights of mods no longer active.

[Wilbert]

Bummer. Somehow he changed the announcement after i suspended him ?????? That's not good. I removed his again. I don't even understand how this is possible.

[sneaker_ger]

He's in the "currently active users" list so maybe the suspending didn't really work (because of mod status)?

[Wilbert]

Yes i guess so. Although the controle panel says he is suspended

[filler56789]

He's in the "currently active users" list so maybe the suspending didn't really work (because of mod status)?

Being listed as a currently active user is 'normal'. A temporary suspension doesn't stop a user from logging in. Some minutes ago, vBulletin said tebasuna51 was *private messaging*. This is what should not be happening at all.

[wonkey_monkey]

Was the script even running in any browser? It looked like the <script> tag wasn't closed correctly or something like that. I guess the forum's HTML filter worked almost correctly and he didn't find any way to make it work (it shouldn't break the list of threads so there seems to still be some error). And it seemed that at least from my PC the external .js wasn't even reachable. So I agree that this time probably nothing really happened, no passwords stolen etc.

I think the <script> tag was deliberately left unclosed in order to circumvent filters (whether or not that works I have no idea, and I'm not about to start experimenting!).

It should be relatively trivial to add code to VBulletin to look for <(whitepsace)script and refuse to post anything containing it.

Ideally all < and > should be converted to &lt; and &gt; but that might cause issues with code blocks, depending on how they are implemented (they should be implemented white white-space:pre; and a monospace font rather than the <pre> tag).

[sneaker_ger]

Being listed as a currently active user is 'normal'. A temporary suspension doesn't stop a user from logging in. Some minutes ago, vBulletin said tebasuna51 was *private messaging*. This is what should not be happening at all.
It shows "private messaging" even if you are only viewing PMs.

[filler56789]

It shows "private messaging" even if you are only viewing PMs.

I know. But it seems you don't know that here on doom9 the suspended users are not allowed to access their private messages, not allowed to access their User CP, etc.

[sneaker_ger]

I see.

[SeeMoreDigital]

Just noticed Swede's post (https://forum.doom9.org/announcement.php?f=&a=61)...

Out of interest, if somebody is able to steal your password for this forum, what's the worst thing that can happen?

[FranceBB]

Out of interest, if somebody is able to steal your password for this forum, what's the worst thing that can happen?

I think that the first thing hackers are gonna try is to check whether you use the same password for your email or not and then get the control of the email.
Once they've got that, they are gonna try to log into your bank account using a proxy or Tor etc.
If they manage to get access to your bank account, your bank is still gonna send you an alert about someone trying to log-in using an unknown device from a different location compared to your, but since they have access to your email, they can unlock themselves, make a transfer using a third party transfer service from currencies (Dollars, Pounds, Euros etc) to cryptocurrencies (Bitcoint, LiteCoin, Monero etc) and get away with it.

Worse case scenario: you lost your money.
Best case scenario: you manage to get a refund from the bank, but the hacker still receives the money.

That's why they do it, I think.
It's all about the money, which is sad, actually...

[Sparktank]

Every time I visit my bookmark, I have to sign in again.

Even, when I check "Remember Me". Or whatever the site uses.

I changed my password the last time because it was suspicious.
But seeing as this time around, it's a unique password, I don't feel the need to change it right away.

I use CCleaner, but I don't tell it to clean cookies from doom9, or other advanced settings through CCEnhancer).
I've never had to sign in twice using CCleaner/CCEnhancer before.

SO, I posit the script the hacker is using is forcing users to sign in again for any new passwords, if they opted to change theirs.
Which, I did, about twice now.

Something's still going on.
A music forum I was active with that used old vBulletin standards was vulnerable to repeated attacks before.
And they ended up paying the ransom demands to get Admin access back to the forum.
The attempts here have only been for passwords, it seems.

Count yourselves, lucky.

[Sparktank]

:O !!!!!

It doesn't matter if I use CCleaner or not!!
When I close the site and re-open from a bookmark, it asks me to log in again!

It shouldn't do that between sessions, unless I've instructed Firefox (Nightly - updated as needed every time I open it) to do so.
I rarely open FF in "Safe Mode" with Add-ons Disabled.

My settings don't erase nor clear cache between opening/closing sessions.

So this is definitely something odd with the forum.
Something is still intervening between my PC and the forum address.

To add to it:
When I click on my bookmark, it goes to HTTPS and not just HTTP.
I know that, forever, that the secure certificate for HTTPS has always been... not favored by FF standards.
So I finally accepted.
But if the the HTTPS can be hacked liked that, wouldn't that mean every action I take on Firefox that has addons like "HTTPS Everywhere" would be affected, no matter what?

If you guys updated to most current vBulletin, what would that take on aver of most active users to donate?
Or for plans?
I'd consider donating on a big chunk per year for enhanced security.

If this places dies, I got nowhere else to look to for help.
VideoHelp, sure. But not nearly as sophisticated. :'( Don't let us die.

EDIT: :OO

Even if I don't sign out and just hit "New Posts", it still asks me to sign in!!

:( I don't know if I should say I email notifications on topics I'm very interested in...
Who knows how deep this conspiracy goes...

[sneaker_ger]

You're the only one reporting the cookie problem. Maybe CCleaner corrupted your cookie file somehow with the selective deleting. I had a similar problem with CCleaner and Opera in the past (and stopped using it after that). I'd try without CCleaner and completely reset/deleted cookies.

[SeeMoreDigital]

I can't say I've had many problems with CCleaner and Google Chrome...

[StainlessS]

If on FireFox, check that your password got updated.
Menu/Options/Privacy & Security/Logins & Passwords/Saved Logins/
And click on Show Passwords.

[filler56789]

https://forum.doom9.org/announcement.php?f=45

the timestamp is:

23rd February 2019 until 9th March 2019 0_0

Therefore, something is still wrong.

[nevcairiel]

He posted an announcement on the 23rd (actually says 24th for me, $timezones), the day it happened, set it to last for two weeks until the 9th of March. Seems fine to me?

[filler56789]

^ Hummm, I didn't know that the forumware was that flexible, regarding announcement posts at least :o

Thanks for well-informing the uninformed :)

[r0lZ]

What is the current status of the forum ? Still under pressure ? Is it safe to log in now ? Should we change our passwords (even if they are uniquely used here) ?

[foxyshadis]

What is the current status of the forum ? Still under pressure ? Is it safe to log in now ? Should we change our passwords (even if they are uniquely used here) ?

As far as we can tell, no passwords were ever stolen, redirected, or anything like that, because the script kiddie who tried was utterly incompetent, and vBulletin sanitized his feeble attempt. Small blessings.

Swede, the forum admin/hoster, has disabled the ability for mods to use HTML at all (an oversight that wasn't caught when HTML was generally disabled; vBulletin 3 wasn't exactly secure by default), looked over the account activity, and decided that the hack didn't go any further than that. I haven't changed my password, but I also didn't try to log in during that time. Out of an abundance of caution, it might not be a bad idea just to rotate passwords in general, but as far as we can tell no passwords or accounts were actually compromised other than that one.

[foxyshadis]

I think the <script> tag was deliberately left unclosed in order to circumvent filters (whether or not that works I have no idea, and I'm not about to start experimenting!).

It should be relatively trivial to add code to VBulletin to look for <(whitepsace)script and refuse to post anything containing it.

Ideally all < and > should be converted to &lt; and &gt; but that might cause issues with code blocks, depending on how they are implemented (they should be implemented white white-space:pre; and a monospace font rather than the <pre> tag).

vBB does actually have a filter that converts <script ...> to <script ..., which is why it wasn't closed. There are ways around it, but our new friend wasn't up to the job.

You'd have to be browsing the internet with something like IE6, or a modern browser in IE6-compatible mode, for it to work; in that case you probably get hacked left and right every day.

[filler56789]

There was a thread in the subsection indicating that the forum is hacked (script stealing passwords and things like that). The thread is gone for some reason.

That thread was started by me. And I would like to know the reason why it was hidden by a moderator (OR by the administrator?) :confused:

(and also why it remains hidden)

[sneaker_ger]

I guess the hacker hid it so users wouldn't be warned.

[nevcairiel]

This thread appeared only a short time after, so its rather pointless now anyway.

[Wilbert]

That thread was started by me. And I would like to know the reason why it was hidden by a moderator (OR by the administrator?) :confused:

(and also why it remains hidden)
Just to be clear. Your thread was deleted by the hacker, not by us. It was already gone when i logged in.