Attention: AVG Virus alert on EEVblog.com! - Page 1
Forum section: electronics / general

author: CarlG
author_rank: Regular Contributor
timestamp: December 30, 2012, 09:49:29 pm
content: Hi all, my anti-virus program (AVG) indicates the HTML/Framer virus on EEVblog.com and also EEVblog.com/episodes pages. Not on the EEVblog.com/forum page...so far. Haven't checked the others.Anybody else to confirm this?//C

author: JoannaK
author_rank: Frequent Contributor
timestamp: December 30, 2012, 09:58:48 pm
content: To me it looks like something definitely is Broken. Not sure what.

author: CompuHacker
author_rank: Newbie
timestamp: December 30, 2012, 10:02:51 pm
content: Confirmed. Something has gone horribly wrong with EEVblog.com and eevblog.com/wiki/, I think someone is trying and possibly not finished hijacking the site.

author: CarlG
author_rank: Regular Contributor
timestamp: December 30, 2012, 10:03:37 pm
content: I sent an email about it to Simon (global moderator) since I see he's online, hoping he can fix it.

author: marshallh
author_rank: Unknown
timestamp: December 30, 2012, 10:07:37 pm
content: CSS/stylesheets are broken for me on the main site, since I have adblock I may not be seeing whatever iframe virus is on there

author: CompuHacker
author_rank: Newbie
timestamp: December 30, 2012, 10:10:09 pm
content: Quote from: marshallh on December 30, 2012, 10:07:37 pmI'm pretty sure the exploit currently in use is broken, regardless of adblock or noscript.I wouldn't visit the site anyway for the time being.

author: McMonster
author_rank: Frequent Contributor
timestamp: December 30, 2012, 10:14:40 pm
content: Stop panicking, it is most likely just a broken ad that is interfering with the loading of the website. I'm not a web guru, but I'd blame webcreationsgroup.com if you asked me.

author: Unknown
author_rank: Unknown
timestamp: December 30, 2012, 10:18:29 pm
content: Quote from: marshallh on December 30, 2012, 10:07:37 pmUsed to be like that for me a while back. Back to normal for the last few weeks. No alerts.

author: Unknown
author_rank: Unknown
timestamp: December 30, 2012, 10:50:04 pm
content: In my browser, all CSS and JS and image files redirect to http:// ftp.webcreationsgroup.com/payment/rel.php. I find this suspicious. rel.php returns just 'ok' with an HTML content type. It may be able to return malicious code depending on user agent or other conditions. I would take eevblog.com off line until this issue was investigated and fixed (both the issue at hand and the way 'they' got in).

author: mariush
author_rank: Super Contributor
timestamp: December 30, 2012, 10:59:05 pm
content: That rel.php acts as a redirect script ...When the browser tries to access it, it just says the content moved somewhere else and feeds your browser another url, which can contain malicious code ( something that targets Java or Flash or some other vulnerability in browser plugins or in the browser itself)So it's most likely a hack of the website, automated or not.

author: PeterG
author_rank: Frequent Contributor
timestamp: December 30, 2012, 11:06:22 pm
content: A quick google returned the following.http://labs.sucuri.net/?details=ftp.webcreationsgroup.comIt seems webcreationsgroup has been compromised not eevblog.Regards

author: jancumps
author_rank: Unknown
timestamp: December 30, 2012, 11:09:35 pm
content: not panicking or complaining, but confirming that I get that same warning wgen going to eevblog.com. Not when I go to eevblog.com/forum/

author: Matje
author_rank: Regular Contributor
timestamp: December 30, 2012, 11:43:04 pm
content: Quote from: CarlG on December 30, 2012, 09:49:29 pmCan't confirm. Wouldn't expect to be able to either.Just use a proper browser, with proper protection measures, and it will be quite difficult to harm you. For reference, Firefox with Request Policy and Noscript will do the job quite well. Having something like Privoxy in front of it all helps too. Oh, and do not use Windows, although the setup mentioned above will do quite well on Windows too. ;-)OTOH, something like AVG doesn't really help, just see the researchers opinions on that...

author: EEVblog
author_rank: Unknown
timestamp: December 31, 2012, 12:09:36 am
content: I see nothing wrong at all in Chrome, and my AVAST web scanner shows no alertsDave.

author: EEVblog
author_rank: Unknown
timestamp: December 31, 2012, 12:11:26 am
content: OK, I do get the webcreations group URL and blank page with "ok" when trying to go into admin, but only some of the time.I have no idea who webcreations group areDave.

author: raymohi
author_rank: Newbie
timestamp: December 31, 2012, 12:11:49 am
content: Quote from: EEVblog on December 31, 2012, 12:09:36 amWith the webcreations script removed.

author: EEVblog
author_rank: Unknown
timestamp: December 31, 2012, 12:26:04 am
content: It's obviously a Wordpress hack/exploit, so most likely won't affect this forum.Head penguin, Alan Garfield is taking a look!Dave.

author: Sionyn
author_rank: Frequent Contributor
timestamp: December 31, 2012, 12:38:20 am
content: yeah simple cheepo redirectlikely after google juice or pay up else random scam

author: raymohi
author_rank: Newbie
timestamp: December 31, 2012, 12:40:06 am
content: This is what you get for using FTP.

author: Sionyn
author_rank: Frequent Contributor
timestamp: December 31, 2012, 12:45:01 am
content: its fixed now congrats dave

author: nardev
author_rank: Unknown
timestamp: December 31, 2012, 12:57:03 am
content: Wordpress requires constant attention. Kids gets exploits and with simple googling + scripts they make big mess online.I had horrible experiences before, thankfully i didn't have any issues in past year (after few security fixes) and i made simple bash backup script that runs every awhile, making backup of files and db.

author: vk6zgo
author_rank: Super Contributor
timestamp: December 31, 2012, 03:08:36 am
content: I tried to look at EEVblog # 86,but got,first,a page with a lot of crap search items at the bottom,& the webcreations group URL at the top.Every other attempt gives me the webcreations group URL & "OK".All the other EEVblogs work OKThis was with Firefox-------went to IE,no problems!

author: EEVblog
author_rank: Unknown
timestamp: December 31, 2012, 03:27:56 am
content: It should be fixed now I think, thanks to resident EEVblog NinjaPenguin Alan GarfieldAny issues should be cache related I suspect.Dave.

author: nardev
author_rank: Unknown
timestamp: December 31, 2012, 04:39:06 am
content: Quote from: vk6zgo on December 31, 2012, 03:08:36 amIE is so stupid, you would not even notice that you are being hijacked

author: Mechatrommer
author_rank: Super Contributor
timestamp: December 31, 2012, 04:59:35 am
content: Quote from: EEVblog on December 31, 2012, 03:27:56 amWTF! who the hell?

author: SeanB
author_rank: Super Contributor
timestamp: December 31, 2012, 05:02:33 am
content: @ alangarf on twitter, he is not terribly active here, more behind the scenes making Majics............. He is fascinating though to follow.

author: EEVblog
author_rank: Unknown
timestamp: December 31, 2012, 06:07:07 am
content: Quote from: SeanB on December 31, 2012, 05:02:33 amand on Youtube:https://www.youtube.com/user/randomgarfieldDave.

author: SeanB
author_rank: Super Contributor
timestamp: December 31, 2012, 06:26:03 am
content: Another feed added on YT................

author: Nvidiot
author_rank: Newbie
timestamp: December 31, 2012, 07:46:53 am
content: I can confirm that that ftp url was serving me an exploit about 8 hours ago. It was a java-based exploit that fired up a full-screen program demanding me to pay so it would unlock my pc again. Thankfully I could remove said virus fairly easily.The main eevblog page seems to be fixed but the links to the individual episodes and the episode list at least still redirect to that ftp page that now just says "ok", so it is not quite fixed yet.

author: xDR1TeK
author_rank: Contributor
timestamp: December 31, 2012, 07:49:57 am
content: Quote from: PeterG on December 30, 2012, 11:06:22 pmMust agree with PeterG, only if eevblog benifits from webcreationsgroup services for something.

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: December 31, 2012, 08:11:34 am
content: Quote from: Nvidiot on December 31, 2012, 07:46:53 amtried clearing your cache? I haven't seen any issues since it got looked at.

author: alangarf
author_rank: Newbie
timestamp: December 31, 2012, 10:19:13 am
content: Quote from: EEVblog on December 31, 2012, 06:07:07 amHa! That made me smile. Thanks Dave.

author: G7PSK
author_rank: Super Contributor
timestamp: December 31, 2012, 11:24:29 am
content: Hi was the EEVBlog servers attacked or taken over last night as I could not get in due to Norton blocking it due to a mass attack or was this just Norton throwing a wobbly. I have a screen grab of the report which I am attaching.

author: Bored@Work
author_rank: Super Contributor
timestamp: December 31, 2012, 12:01:50 pm
content: https://www.eevblog.com/forum/chat/attention-avg-virus-alert-on-eevblog-com!/

author: Thor-Arne
author_rank: Unknown
timestamp: January 01, 2013, 10:20:37 am
content: Quote from: G7PSK on December 31, 2012, 11:24:29 amI had the exact same notice here, it was ok again after 10-15 minutes.

author: Sionyn
author_rank: Frequent Contributor
timestamp: January 01, 2013, 10:26:31 am
content: there been some major bugs in cpanel recently XSS ive cleaned a few machines for friends reticently maybe this is how dave password was stolenhttp://thehackernews.com/2012/12/cpanel-and-whm-multiple-cross-site.html

author: ttp
author_rank: Regular Contributor
timestamp: January 01, 2013, 11:11:11 am
content: I normally download the videos due to my patchy internet access. Since few days I'm unable to do it. Normally I right-click on download link and "Save link as" (in Firefox), now it comes up with cnt.php file instead of m4v video. Still happening right now, I have cleared cache and restarted the laptop. Don't remember exactly when it started but the first one I couldn't download was episode 404.

author: Sionyn
author_rank: Frequent Contributor
timestamp: January 01, 2013, 01:05:23 pm
content: G7PSK are you using IE ?if so using another browser would decrease your likely hood of being compromised by browser drive by.also consider using notscript or noscript most exploits use javascript to propagate.wonder what the user browser and os stats are

author: Astroplio
author_rank: Regular Contributor
timestamp: January 01, 2013, 01:15:22 pm
content: Quote from: ttp on January 01, 2013, 11:11:11 amHi there,you should try using this plugin with firefoxhttp://www.bestvideodownloader.com/works just fineGeorge

author: lewis
author_rank: Frequent Contributor
timestamp: January 01, 2013, 01:19:48 pm
content: Downloading episodes does not work for me in Google Chrome - I get redirected to 'archiwumzprasy.com/cnt.php' even though the <a href> in the page source points to eevblog.com. The site is Polish. This is the link in the source - it redirects to the weird site for me:http://www.eevblog.com/podpress_trac/web/2586/0/EEVblog406-Keithley480picoammeter-640x360.m4vDave, there's some malicious code hiding on your server somewhere!Clicking on either download link...........gets me redirected to here......That's not right!

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 01, 2013, 01:38:56 pm
content: I see that too. Sounds like someone needs to do a thorough search of the web stuff.edit: Wiki and images don't seem to have a problem like they did the other day.

author: SLJ
author_rank: Frequent Contributor
timestamp: January 01, 2013, 01:51:09 pm
content: Symantec is also giving a warning and blockinghttp://theamphour.com/

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 01, 2013, 01:52:11 pm
content: Quote from: SLJ on January 01, 2013, 01:51:09 pmConfirmed. Redirects to hxxp:// coopmatrix.it / clicker.php (edited to prevent clicking)

author: Sionyn
author_rank: Frequent Contributor
timestamp: January 01, 2013, 02:01:07 pm
content: yes and it dose nothing take a look at the html

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 01, 2013, 02:05:49 pm
content: Quote from: Sionyn on January 01, 2013, 02:01:07 pmsafe than sorry, for all we know these clicks are generating money for the bad guys.

author: SeanB
author_rank: Super Contributor
timestamp: January 01, 2013, 02:17:29 pm
content: Seems to be a targeted attack against IE and windows....... I look at the link and get the download.

author: lewis
author_rank: Frequent Contributor
timestamp: January 01, 2013, 02:37:12 pm
content: Quote from: SeanB on January 01, 2013, 02:17:29 pmWhat are you using? I (very quickly) tried the Change HTTP Request Header addon for Chrome and couldn't get a result from Linux or Mac.

author: bitwelder
author_rank: Super Contributor
timestamp: January 01, 2013, 02:52:48 pm
content: With my standard Firefox on Linux, I do get the OK result from the archiwum* website, but when I copy&pasted the URL and asked to download in command line with wget, I can download the real m4v file.Then I fired up wireshark (network traffic analyzer) and I see when the web browser sends the GET request to download the file to eevblog.com site, eevblog.com answers with a 301 error code (i.e. file moved permanently) and it redirect to the weird Polish site.To me, it sounds something fishy ON eevblog.com.

author: G7PSK
author_rank: Super Contributor
timestamp: January 01, 2013, 04:49:13 pm
content: Quote from: Sionyn on January 01, 2013, 01:05:23 pmI am using Chrome and Firefox I wont have IE on any computer apart from not being safe I don't like it.

author: ModemHead
author_rank: Frequent Contributor
timestamp: January 01, 2013, 05:32:20 pm
content: From what I can see, any eevblog.orgURL redirects to the archiwum... Polish site if the referer header contains the string 'eevblog', but operates normally if it doesn't.Code:Worf% wget --referer='http://foobar.eevblog.baz' 'http://eevblog.org/'--2013-01-01 12:29:00-- http://eevblog.org/Resolving eevblog.org... 74.220.201.97Connecting to eevblog.org|74.220.201.97|:80... connected.HTTP request sent, awaiting response... 301 Moved PermanentlyLocation: http://archiwumzprasy.com/cnt.php --2013-01-01 12:29:01-- http://archiwumzprasy.com/cnt.phpResolving archiwumzprasy.com... 213.192.69.61Connecting to archiwumzprasy.com|213.192.69.61|:80... connected.HTTP request sent, awaiting response... 200 OKLength: 2 [text/html]Saving to: “cnt.php”100%[==========================================================>] 2 --.-K/s in 0s2013-01-01 12:29:02 (355 KB/s) - “cnt.php” saved [2/2]Worf% wget --referer='http://foobar.eevblxg.baz' 'http://eevblog.org/'--2013-01-01 12:29:13-- http://eevblog.org/Resolving eevblog.org... 74.220.201.97Connecting to eevblog.org|74.220.201.97|:80... connected.HTTP request sent, awaiting response... 200 OKLength: 3478 (3.4K) [text/html]Saving to: “index.html”100%[==========================================================>] 3,478 --.-K/s in 0.007s2013-01-01 12:29:14 (513 KB/s) - “index.html” saved [3478/3478]Worf%

author: JoannaK
author_rank: Frequent Contributor
timestamp: January 01, 2013, 05:38:43 pm
content: Quote from: justanothercanuck on January 01, 2013, 02:05:49 pmWhat makes me wonder how this problem was first discovered (check amongst first page) mainly byt brand new users. Ok. I was there too, but for me it was mainly due convinient timing.

author: Sionyn
author_rank: Frequent Contributor
timestamp: January 01, 2013, 06:16:31 pm
content: look what ModemHead didflow the packet stream their not making any money through click though what so everthe only thing i can see they might be trying game their google rank using dave google juice they seem to have done a bad job of it or dave managed locked them out before they did any major damage.

author: SeanB
author_rank: Super Contributor
timestamp: January 01, 2013, 06:44:04 pm
content: Looks like it is a link to another compromised site ( Polish newspaper, probably has a exploited hole that was used to serve this attack) that probably will either do a driveby attack or will redirect you to another site that will do that. Probably running an unpatched version of Apache so that is why the machine has been infected. 9 other instances on that poor machine, most likely all are affected as well, but they have no ranking at all, so they are likely already being blocked in Google searches.

author: lewis
author_rank: Frequent Contributor
timestamp: January 01, 2013, 06:47:55 pm
content: Quote from: ModemHead on January 01, 2013, 05:32:20 pmYes it looks like they're checking the referrer header and cookies - if you click this link from here:http://www.eevblog.com/podpress_trac/web/2586/0/EEVblog406-Keithley480picoammeter-640x360.m4vyou get the redirect, but if you copy and paste into a new browser window after clearing cookies, (I pasted into IE and got the M4V download!) it does NOT redirect. Bastards!This might explain why some users appear not to be getting the problem.Maybe they're harvesting IPs?

author: GeoffS
author_rank: Unknown
timestamp: January 02, 2013, 12:44:49 am
content: The moderators can't help with this one, only Dave has the necessary magic keys

author: ModemHead
author_rank: Frequent Contributor
timestamp: January 02, 2013, 12:58:43 am
content: In case my earlier point was missed, it appears the eevblog.orgserver is doing the re-directing. The apache config or .htaccess has been compromised? From my vantage point, I see no unusual behavior from the eevblog.comserver. Although I did come to the party a bit late...

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 02, 2013, 03:07:52 am
content: Happens on both of them for me.

author: ttp
author_rank: Regular Contributor
timestamp: January 03, 2013, 11:46:51 pm
content: Is it still redirecting tohttp://ar*sy.com/cnt.php? It does for me but I wonder if its something leftover in my system.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 03:15:59 am
content: Quote from: ModemHead on January 02, 2013, 12:58:43 amThe bastards also hacked the index.html on eevblog.orgFixed.Dave.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 03:17:49 am
content: My virus detector says it's JS:Iframe-XJ in the .html fileOnce again, they must have got in via FTP.Dave.

author: vk6hdx
author_rank: Regular Contributor
timestamp: January 04, 2013, 03:31:33 am
content: http://www.eevblog.org/videoseems to be redirecting also.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 03:41:57 am
content: Quote from: vk6hdx on January 04, 2013, 03:31:33 amNo idea how they are doing that. There is nothing in that subdirectory but video files.Dave.

author: Nirios
author_rank: Regular Contributor
timestamp: January 04, 2013, 03:52:57 am
content: Quote from: EEVblog on January 04, 2013, 03:41:57 amI get the same redirect to cnt.phpI would check your apache config it may have changed if they gained root. Or could have been added via the apache .dot files. There are plenty of apache modules that do URL rewriting before the request makes it to the file system level.

author: nardev
author_rank: Unknown
timestamp: January 04, 2013, 05:29:00 am
content: Dave,re-install, protect it properly, export/import data and create new location on server for your webpage... it's easier job than trying to fix problem...

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 04, 2013, 05:39:03 am
content: Quote from: EEVblog on January 04, 2013, 03:15:59 amCleared my cache and gave it a go, and I still get the bad site. Did they do it again?

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 06:57:58 am
content: Quote from: EEVblog on January 04, 2013, 03:17:49 amAnd you have FTP why?

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 07:02:06 am
content: Quote from: Monkeh on January 04, 2013, 06:57:58 amBecause I'm an idiot apparentlyDave.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 07:03:12 am
content: Is anyone else getting redirects to the main blog page when clicking on forum threads?I have got this a few times in Chrome today, and a browser restart fixes it.Not sure if it's related to the hack or not.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 07:03:31 am
content: Quote from: EEVblog on January 04, 2013, 07:02:06 amHey, you said it.If they never compromised the machine properly, it's probably a .htaccess.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 07:25:07 am
content: Quote from: Nirios on January 04, 2013, 03:52:57 amAll I see is one handler (see pic)No idea what this is for or if it was there before.Delete it?Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 07:26:26 am
content: That's for PHP. If you're using PHP, you need that.You're looking for an actual file here, and it'll be 'hidden'.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 07:33:56 am
content: Quote from: Monkeh on January 04, 2013, 07:26:26 ameevblog.com doesn't have one in cPanel, not sure why it's needed on my other sites.QuoteWere would it be?There are files but video files in eevblog.org/videoDave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 07:35:20 am
content: Quote from: EEVblog on January 04, 2013, 07:33:56 amIt would be anywhere in the directory tree down from there, but most likely right there in the video directory. It's called .htaccess and probably won't be displayed using FTP or a web panel.

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 04, 2013, 07:40:21 am
content: Quote from: EEVblog on January 04, 2013, 07:33:56 amIt'll be in "/video/" or possibly just "/" (.htaccess files get inherited), wherever those files are stored on your webserver... Since it's a dot file, you might not be able to access it from a web-based interface.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 07:51:46 am
content: Quote from: justanothercanuck on January 04, 2013, 07:40:21 amThere are no .htaccess files in the root directory or the video directory.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 07:57:08 am
content: How are you checking?

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 08:05:51 am
content: Quote from: Monkeh on January 04, 2013, 07:57:08 amcpanel web file managerAnd yes, the check box for displaying hidden files is checked.I cannot get SFTP access on this server yet.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 08:07:03 am
content: Well, much as I dislike cPanel, I don't think even they can get that wrong.If there's no .htaccess, the server has been further compromised. Reimage it.

author: nardev
author_rank: Unknown
timestamp: January 04, 2013, 08:15:49 am
content: I didn't propose "re-install" solution just for fun...I struggle with wordpress for years... There is possibly solution but you will never be sure.. Especially the way you are trying to fix it...even don't have proper shell access ... Can't search files to see if there is some strange script laying somewhere for ssh connection etc...

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 08:21:16 am
content: Think I found the redirect, in the DNS zone editor!74.220.201.97 is the hacker site.Guess I just delete these...Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 08:25:15 am
content: Quote from: EEVblog on January 04, 2013, 08:21:16 am... No, 74.220.201.97 is yours.You change that and eevblog.org vanishes from the face of the internet.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 08:26:37 am
content: Quote from: Monkeh on January 04, 2013, 08:25:15 amSo it seems. Scrap that.My virus scanner popped on on that IP I thought.Dave.

author: BravoV
author_rank: Super Contributor
timestamp: January 04, 2013, 08:33:38 am
content: Dave, though I don't know crap about fixing this problem nor helping you, just a tiny reminder, please guard & check all the time to make sure the Sagan's "donation link" is not hacked or tampered.

author: PeterG
author_rank: Frequent Contributor
timestamp: January 04, 2013, 08:36:50 am
content: Quote from: BravoV on January 04, 2013, 08:33:38 amDitto.Regards

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 08:46:14 am
content: Found it!.htaccess file in the root directory of my shared server, not eevblog.org, so probably effected all my sites on that server.QuoteDave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 08:50:46 am
content: What a fabulous Apache config CPanel must have generated to allow that. And people pay money for that thing.Time to get some solid passwords and dispose of FTP. Permanently.

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 04, 2013, 08:52:23 am
content: Excellent find! Glad you got it. Shame we never found out their intentions, but I guess that's not important.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 08:53:05 am
content: Quote from: justanothercanuck on January 04, 2013, 08:52:23 amWe all know what their intentions were: Making money.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 08:54:11 am
content: I've removed the code, but still redirects for me. Probably need a cache flush or something.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 08:54:41 am
content: Quote from: EEVblog on January 04, 2013, 08:54:11 amYes, it's your browser cache.

author: nardev
author_rank: Unknown
timestamp: January 04, 2013, 09:52:57 am
content: Quote from: EEVblog on January 04, 2013, 08:46:14 amThat was the first thing i pointed out on twitter... you sad it's ok...Now you have another problem, are you 100% sure that they can't use same backdoor to hijack it again?

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 10:10:46 am
content: Quote from: nardev on January 04, 2013, 09:52:57 amI was not looking in the root directory of the shared server, just eevblog.orgQuoteI have changed my password and will not use FTP again.No idea if that's good enough.Dave.

author: grumpydoc
author_rank: Super Contributor
timestamp: January 04, 2013, 10:15:23 am
content: QuoteDoes that mean you've disabled the server?

author: JoannaK
author_rank: Frequent Contributor
timestamp: January 04, 2013, 10:16:30 am
content: Just a quick question.. Is that Cpanel (and whatver tools you have like use, like Wordpress?) up to date. Those systems tend to have bugs in them and way too often these tools have not been kep up to date.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 10:20:12 am
content: Quote from: grumpydoc on January 04, 2013, 10:15:23 amYou can't do that on shared web cpanel server that I am aware of.But if I change my password, and never use an FTP client again, how can they intercept my password again?Dave.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 10:20:46 am
content: Quote from: JoannaK on January 04, 2013, 10:16:30 amYes.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 10:28:29 am
content: Quote from: EEVblog on January 04, 2013, 10:20:12 amYou're assuming they intercepted a password rather than exploited a bug in an unknown FTP server you cannot control.

author: GeoffS
author_rank: Unknown
timestamp: January 04, 2013, 10:37:16 am
content: I only ever use ssh to access my cpanel based servers to upload data.Not perfect, but better than ftp.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 10:38:29 am
content: Quote from: GeoffS on January 04, 2013, 10:37:16 amHow is it not perfect? There is no more secure way to remotely access a server, and performance on modern equipment is not an issue.

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 04, 2013, 11:03:48 am
content: Even if he switches from FTP to SSH, it won't help him if they're brute-forcing his password. I get on average 15-20 hosts per day trying to crack my root password. Ain't gonna happen though, as I've turned root login off.

author: vk6hdx
author_rank: Regular Contributor
timestamp: January 04, 2013, 11:17:45 am
content: Quote from: EEVblog on January 04, 2013, 08:46:14 amAll good now for me Dave, no more redirects happening after a browser restart.

author: madires
author_rank: Super Contributor
timestamp: January 04, 2013, 11:29:23 am
content: Quote from: EEVblog on January 04, 2013, 10:20:12 amBasic rule of security: disable all unused services. FTP servers are known for security holes. If your ftp daemon runs standalone disable it via the start script (initd). If it's run by inetd disable its entry in the inetd configuration file. Those management panels are nice to use but limited (and a security hole also).In case you need some user accounts for file transfers (no shell access) you could use scponly (ssh based).

author: madires
author_rank: Super Contributor
timestamp: January 04, 2013, 11:37:25 am
content: Quote from: justanothercanuck on January 04, 2013, 11:03:48 amDon't use passwords easy to guess! SSH dictionary attacks are quite common. Just need to feed the ssh logs into awk to get the current list used :-) BTW: you can use key based authentication only with ssh if you like.

author: vk6zgo
author_rank: Super Contributor
timestamp: January 04, 2013, 11:41:17 am
content: Interestingly,following the above shenanigans,Firefox decided it would be a lovely idea to present EEVblog in "huge" format.I didn't ask it to do this--it just suddenly happened.Both IE & Google Chrome presented the page normal size.Going back to "default" on Firefox restored it to normal-----no further problems.

author: grumpydoc
author_rank: Super Contributor
timestamp: January 04, 2013, 11:44:45 am
content: QuoteIf it's a shared service, no - but you should talk to the sysadmins about dropping FTP sitewide and replacing it with something secure such as ssh/scp.If you already have ssh access using public/private key pairs is much more secure than passwords. Disable passwords in the ssh demon if you can.If it's a virtual server you should have full control over your environment.TBH I don't believe many passwords are intercepted - yes it's a theoretical risk but you really need access to an ISP's routers so it's probably too much work for the average hacker. Bugs in applications are the usual route in.

author: Unknown
author_rank: Unknown
timestamp: January 04, 2013, 12:17:50 pm
content: Quote from: vk6zgo on January 04, 2013, 11:41:17 am + [ 0 ] to reset.Don't drink & Browse. LOL

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 12:28:23 pm
content: Quote from: Monkeh on January 04, 2013, 10:28:29 amI've been informed that is the most likely scenario, and it's likely no coincidence they hacked all three of the FTP servers I have used lately, eevblog.com, eevblog.org, and theamphour.comIt seems no other sites have been affected where I have not used the FTP.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 12:30:41 pm
content: Quote from: EEVblog on January 04, 2013, 12:28:23 pmOr they could have brute forced it.If they intercepted it, they did it over wireless or compromised your machine or router. Time to tackle security at every device you own.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 12:31:07 pm
content: Quote from: justanothercanuck on January 04, 2013, 11:03:48 amUnlikely. The password scored a 100% on the security rating thingoi.e. mixed letters, case, numbers, and symbols.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 04, 2013, 12:37:33 pm
content: Quote from: EEVblog on January 04, 2013, 12:31:07 pmHow many characters?I'd hesitate to use passwords at all for a site this large (and this isn't even very big.. no offence, I'm sure you know it's a niche market).As I said, time to do an audit of everything: Change your wifi passwords, check your router, go over Windows-based (.. I'm guessing that's basically all your machines, actually) boxes with a fine-toothed comb.

author: SeanB
author_rank: Super Contributor
timestamp: January 04, 2013, 12:40:15 pm
content: If possible can you not change the default FTP port to another random port, and block the standard port in your firewall on the server. Not doing much other than making it a lot harder, as a quick scan will miss it unless they try all 64k ports one after another, which most will not do, they just look for a FTP that responds then try it.Noises about not standard etc, but is is a little more secure through being more obscure. My ISP gives me a FTP access but it is locked to a very small IP range that the home DSL will tend to jump through. Does make it need a phone call if it wanders outside the range, but a lot more secure.

author: Unknown
author_rank: Unknown
timestamp: January 04, 2013, 01:13:15 pm
content: Firewalls implement special hacks to make the horrible protocol called FTP work. I wouldn't be surprised if these stop working if you move FTP to an alternative port. Why would you jump through hoops to keep using a deprecated and insecure protocol?

author: nardev
author_rank: Unknown
timestamp: January 04, 2013, 01:37:53 pm
content: Quote from: EEVblog on January 04, 2013, 10:10:46 amNO! IT's rarely that they hijack your password. They mostly look into web srcipt, in this case wordpress + wordpress plugins vulnerability.In my experience, this is what usually happen:1. You installed some plugin or template or what ever in your wordpress.2. If you didn't take certain precautions protecting wordpress, things like protecting certain directories from being accessed directly, if you didn't hide your wordpress version etc.. KIDS searching for exploits can easily find or make scripts to hijack web site.3. Often the way to hijack is to upload simple php file with script, through existing hole in some wp plugin and when they call that script it initiate reverse ssh connection.Many times i found such scripts since i resell shared hosting and i'm constantly dealing with that.I'll try to post examples of what i have found later on...

author: madires
author_rank: Super Contributor
timestamp: January 04, 2013, 01:44:58 pm
content: Quote from: EEVblog on January 04, 2013, 12:31:07 pmSeems to be a perfect password. And just used for your server?

author: nardev
author_rank: Unknown
timestamp: January 04, 2013, 01:50:37 pm
content: Quote from: madires on January 04, 2013, 01:44:58 pmI guarantee you, password has nothing to do with this! 100%If they had your ftp password, they would first make sure that they can get access any time they want.Don't be so naive.

author: madires
author_rank: Super Contributor
timestamp: January 04, 2013, 01:52:29 pm
content: Quote from: nardev on January 04, 2013, 01:37:53 pmAnd the process of finding vulnerable sites and placing malware is fully automated. Have a look at your apache logs and you'll see how those bots scan for stuff with known security issues. Web 2.0 is a security nightmare :-(

author: madires
author_rank: Super Contributor
timestamp: January 04, 2013, 01:56:19 pm
content: Quote from: nardev on January 04, 2013, 01:50:37 pmI fully agree. Just wanted to give a hint to use a different password for each site/server/service or whatever.

author: nardev
author_rank: Unknown
timestamp: January 04, 2013, 01:57:44 pm
content: This can help in most cases but ONLY with non hijacked installation!http://wp.tutsplus.com/tutorials/security/20-steps-to-a-flexible-and-secure-wordpress-installation/That is why i said, re-install your wordpress and create new web location on server.

author: Nirios
author_rank: Regular Contributor
timestamp: January 04, 2013, 05:09:26 pm
content: Quote from: EEVblog on January 04, 2013, 08:46:14 amGlad you found it. mod_rewrite can sometimes very useful but it can also do some really nasty stuff.FTP is not unsafe. If your shared hosting company doesn't offer SSH (or charges too much for it) there is no reason why you can't continue to use FTP. As long as you use complex passwords and change them every 6 months and don't use FTP across unencrypted wireless, you are fine. Sniffing passwords is rarely done because it requires the attacker to be in the routing or switching path. It is much easier for a script kiddie to use the latest wordpress or various plugin exploit.

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 08:47:26 pm
content: Quote from: nardev on January 04, 2013, 01:37:53 pmHow did they get into eevblog.org then?No Wordpress there, just a HTML file and a subdirectory.Dave.

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 04, 2013, 09:17:28 pm
content: I can almost guarantee you it was brute-forced, but the only way to know would be to get the FTP auth logs, and hope they haven't been tampered with by the person who got into the server(s).

author: EEVblog
author_rank: Unknown
timestamp: January 04, 2013, 10:22:38 pm
content: Quote from: justanothercanuck on January 04, 2013, 09:17:28 pmThat doesn't explain how they got into the AmpHour server also at the exact same time, which uses an entirely different password.The only common thing seems to be my use of FTP on three sites.Dave.

author: nardev
author_rank: Unknown
timestamp: January 04, 2013, 11:46:07 pm
content: Quote from: EEVblog on January 04, 2013, 08:47:26 pm1. i forgot to pu "no" int that sentence. It should be "NO! It isn't ..."2. I tried to explain one of procedures what they do...It seems to you that it's just html files.. but.. it isn't like that..In some cases, people looking for free templates and one they download and install them, there is simple callback script that sends email or http request to certain place where kids can pick it and find your web site with backdoor that you actually installed.Than they just call their script which do what ever they want, usually they establish ftp/ssh connection backwards, they don't need any password for that!

author: EEVblog
author_rank: Unknown
timestamp: January 05, 2013, 07:48:56 am
content: Quote from: nardev on January 04, 2013, 11:46:07 pmIt is on eevblog.orgThere is one index.html file, and one subdirectory with just video files in it.Nothing else, no wordpress, no templates, no .htacess, nothing.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: January 05, 2013, 07:53:20 am
content: Quote from: EEVblog on January 04, 2013, 10:22:38 pmWhich means the only reasonable way for them to have captured the passwords is by compromising your home or work network.

author: Unknown
author_rank: Unknown
timestamp: January 05, 2013, 01:14:22 pm
content: My money is on a trojan/virus collecting stored passwords that were stored unencrypted. I believe Dave was using FileZilla? Based onthis bug report, I would never store important passwords there. Use a real password manager like KeePass.I have handled a similar case a few years. A server of a client offering shared hosting was compromised. Malware was being uploaded to different customer accounts. My conclusion after examining the server was that this was because they had access to the FTP passwords, most likely harvested from the computer of owner of the company (who was the only one with access to all the different accounts). The owner disagreed and hired another expert, and ended up reinstalling his computer and installing a bunch of virus scanners. I believe he was also using FileZilla.

author: Monkeh
author_rank: Super Contributor
timestamp: January 05, 2013, 01:22:34 pm
content: Yes, despite the excellence of Filezilla as a client, the author is most stubborn on this matter.

author: Alana
author_rank: Frequent Contributor
timestamp: January 05, 2013, 01:58:56 pm
content: I'd check Dave's home computers with something like thishttp://www.safer-networking.org/mirrors16/Boot to "safe mode with network acess", download, update, scan. From what was said here there may be a good chance there is a virus/trojan on one of those machines.Spybot is good because it provides "immunize" tool that blocks all the usual malware servers on browser and hosts file level. For me first and quite reliable line of defense.And for spybot - i'd not trust spybot2.0 yet - i dislike antiviruses or antimalware programs that use cloud computing. You do not know what is actually going on there...

author: G7PSK
author_rank: Super Contributor
timestamp: January 05, 2013, 05:08:43 pm
content: Could it have done with a photo or a GIF that Dave has taken up recently or perhaps something else from an already compromised computer or net work.

author: justanothercanuck
author_rank: Frequent Contributor
timestamp: January 05, 2013, 09:44:56 pm
content: Quote from: Alana on January 05, 2013, 01:58:56 pmSSD and MBAM aren't as good as they used to be several years ago. If the machine doesn't have MSE (or if something slips past it), I run MBAM, because it still picks up a few things. After that, I try Microsoft's MRT (which is a stripped down MSE, go figure)... If it still won't go away, I try Sophos Anti-Rootkit. Failing all of those, just reinstall the thing, it's not worth the hassle of running all these programs, when a reinstall takes a few hours vs a few days of screwing around with removal tools.

author: vk6zgo
author_rank: Super Contributor
timestamp: January 06, 2013, 09:31:04 am
content: Quote from: Uncle Vernon on January 04, 2013, 12:17:50 pmThe interesting thing,Unc, was that only EEVblog got the "huge" treatment--everything else was OK!Easy enough to fix,true,but still it looks like it was associated with the original happening.

author: madires
author_rank: Super Contributor
timestamp: January 07, 2013, 12:24:56 pm
content: Quote from: EEVblog on January 05, 2013, 07:48:56 amIf you run several websites on the same server all can be compromised if only one has a security hole. There are solutions to prevent an intruder to access the other document directories, but they slow down the web performance and add complexity. Another problem is the dimissed save-mode feature of php. It allowed to lock down dangerous functions/features to protect a shared server (especially access to the filesystem outside the webspaces).

author: Sionyn
author_rank: Frequent Contributor
timestamp: February 21, 2013, 12:27:28 pm
content: interesting article about software as service to sell crimeware and exploits to criminals to compromise websites for profitsunsurprisingly there is no honour amongst thieves

author: SeanB
author_rank: Super Contributor
timestamp: April 04, 2013, 06:59:15 pm
content: Just look at the current issue of Security now, describes Dave's issues to a "T".http://twit.tv/show/security-now/398and listen/watch it