Malicious attack on BG Forums and how to protect yourself

[Izzy]

http://img171.imageshack.us/img171/1609/wtfbggg1.png

This just popped up within the past 6 hours.


admin edit:

Update your flash player here. http://www.adobe.com/shockwave/download ... moid=BUIGP

admin edit 2: See my posts (Sonomaa) in this thread.
viewtopic.php?p=1097569#p1097569

[Kimkytaru]

Glad I'm surfing on BG at work ><

[Budonez]

This should get fun...

[Demosthenes11]

lol was just thinking same thing
me thinks is a bad joke

[Toksyuryel]

[Cow_k]

Dear lord it's the apocalypse T_T

[Suiram]

Much less than 6 hours, one hour or less but I didn't notice it until about 5-10 minutes ago, myself. I happened to have another tab open from before it appeared, which was an hour ago as I type this. http://img72.imageshack.us/img72/3843/bgiframe2pm0.jpg

[Izzy]

C:\Documents and Settings\Izzy>tracert 204.13.69.12

Tracing route to 204.13.69.12 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.1.1
  2     8 ms     9 ms     7 ms  10.41.128.1
  3    16 ms     6 ms     8 ms  dstswr1-vlan2.rh.nyk2ny.cv.net [67.83.220.161]
  4     *        *        *     Request timed out.
  5    69 ms    12 ms   209 ms  rtr4-tg10-3.wan.hcvlny.cv.net [64.15.4.33]
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8    17 ms    14 ms    21 ms  te9-2.mpd03.jfk02.atlas.cogentco.com [154.54.5.2
09]
  9    21 ms    18 ms    25 ms  te2-4.mpd01.bos01.atlas.cogentco.com [154.54.5.2
49]
 10    39 ms    39 ms    36 ms  te3-2.mpd01.ord01.atlas.cogentco.com [154.54.6.1
54]
 11    50 ms    48 ms    48 ms  te3-4.mpd01.mci01.atlas.cogentco.com [154.54.7.1
85]
 12    88 ms    85 ms    86 ms  te2-2.mpd01.sfo01.atlas.cogentco.com [154.54.6.3
8]
 13    85 ms    85 ms    83 ms  te7-4.mpd01.sjc01.atlas.cogentco.com [154.54.6.1
34]
 14    90 ms    87 ms    85 ms  vl3497.mpd01.sjc05.atlas.cogentco.com [154.54.6.
74]
 15    88 ms    84 ms    96 ms  managed-solutions-group.demarc.cogentco.com [38.
102.194.158]
 16     *        *        *     Request timed out.
 17    84 ms    82 ms    89 ms  204.13.69.12

Trace complete.

[Rajwa]

http://www.malwaredomainlist.com lists that IP address as a Trojan downloader and exploit.

[nithyan]

The iframe contains a flash exploit which can infect you regardless of if you're using firefox or IE.
As long as you're using the latest (9.0 r124) version of the flash player, you won't get infected from it.

But eep at BG getting hacked too now.

[Apelila]

So the layout for the forums just changed drastically for me after blocking that IP range.

[Valkrish]

main forums changed a lot now.

[Kimkytaru]

layout of my forum is changing randomly since I saw that post.

[Izzy]

Sono is changing skins to find one that's not compromised I think.

[Zekyr]

The forum has decided it wanted to display in a new style while changing pages in some other thread. How odd.

EDIT: Ah, thank you Izzy.

[Olo401]

Did a lookup on Internic.. Nameserver not found.

btw.. Firefox w/ NoScript ftw How the hell did they manage to get an iframe plopped in here?!

[Rajwa]

With the "current" "arrow" theme (idk if thats its real name), the iiframe seems to be gone.

[gamben0]

Reverse lookup on domaintools.com gives domains hosted on that IP-- whois:

Domain Name: AM-FF.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: DNS1.NAME-SERVICES.COM
Name Server: DNS2.NAME-SERVICES.COM
Name Server: DNS3.NAME-SERVICES.COM
Name Server: DNS4.NAME-SERVICES.COM
Name Server: DNS5.NAME-SERVICES.COM
Status: clientTransferProhibited
Updated Date: 16-aug-2007
Creation Date: 16-aug-2007
Expiration Date: 16-aug-2008

Registrant from HK, China

[Zekyr]

So sorry for not understanding what the first post is drawing attention to, but what's happening?

I use the standard FF + ABP + NoScript (no java, iframes, etc) and I didn't notice anything different with the forums.

Trying to reread what's in the main post, did a malicious iframe pop up on the forums trying to grab passwords or something?

[Olo401]

This is a really bad thing.. if these guys can hack into pHpBB there's gonna be a lot of individual linkshell pages that could become vulnerable.