Reported Attack Page! THE RED SCARE

[Jarhead]

Thanks a bunch Jonas22, I thought I would never get back here!

[Hiroy]

Dryish:

I updated some various security related software on the server; not much to do with apf directly.

As for whether we'll be targeted in the future, my understanding of this (based on the attack vector and the nature of the attack) is that nobody particularly said "Let's attack APF, they're jerks."; it was just a botnet scanning for sites that might be vulnerable to exploits. It is likely we'll be targeted in that way in the future, since:

1. vbulletin has a large install base
2. many of these sites get lots of hits
3. many of these sites have inexperienced or non-technical administrators
4. vb is written in php which attracts novice developers
5. and is not straightforward to deploy securely

The attack worked by uploading php files as an avatar and then visiting /customavatar/(uploaded-script).php. This is kind of a pathetically simple attack which should not work on any software written after 2001, but vBulletin did not check the type of file being uploaded. That's still not the whole attack, though; it was my lack of understanding of the way vb is working that led me to not make exceptions for directories that would receive user uploads; though in my defence I don't believe this was ever mentioned in the installation docs.

...

...

...

So it was a Mystery Crash. Gotcha

For the people in this thread who do not know me, I am a programmer from NYC, and I have been part of the KF and AP IRC communities for ~8 years. I manage (and pay for) the server that APF runs on, and I am a nice guy.

We met on on IRC before but it's nice getting a bit of backgound. Thanks for clearing up the the scare. With this, we should be back to the regular amount of online users a day in no time.

[BartArt]

For the people in this thread who do not know me, I am a programmer from NYC, and I have been part of the KF and AP IRC communities for ~8 years. I manage (and pay for) the server that APF runs on, and I am a nice guy.

And that is all just excellent!

[bran-chan]

The User x-mag in the One Piece collectibles thread has a malicious virus in his sig. My avg keeps freaking out and I can't go to that page or when I go to post an advance reply it does the same. It's on page 72. Can someone do something about his sig?

[Urouge]

I'm guessing he changed it already, but next time just report the post.

[bran-chan]

I couldn't get to the post. I couldn't even load the page AVG kept shutting it down.

[Onepiece$]

MEH...........................meh

[No Maam]

MEH...........................meh

Okay, what the heck were you trying to say ?

[Riddler]

Uhh, I guess I can post this here: Just now when I entered the site and looked through the new posts, some weird russian pop-up thing turned up. When I tried to close it, it took me to some weird site that i immediately closed, too. So, anybody else having that? Just me?

[Tsukishima]

Uhh, I guess I can post this here: Just now when I entered the site and looked through the new posts, some weird russian pop-up thing turned up. When I tried to close it, it took me to some weird site that i immediately closed, too. So, anybody else having that? Just me?

I had it, but now it seems to be OK.

[Gekko135]

It's sporadic, but has happened to me several times. Not sure what to do, but given the content of the pop up, it should be addressed.

[1Cocktail4u]

I had it, but now it seems to be OK.

16 char of this here too.

[Nia]

I never had anything like this happen to me. But then again, I never had any warnings pop up either - or anything at all, for that matter.
Maybe my FireFox is just really lazy.

[Mastello]

Yeah same problem here, several times today I've got some pop-up windows full of porn to my screen while browsing the forums. Even though I'm using my Android phone. Not so pleasant surprise...

[Gekko135]

Word to the wise, don't click on the pop up's "close" button. It's just a disguised link. Just exit out of the page and move on.

[Riddler]

Had it again right now when I clicked on Notifications to see Tsukishimas quote.

Word to the wise, don't click on the pop up's "close" button. It's just a disguised link. Just exit out of the page and move on.

Yeah, exactly! I did that when it first came up, I hope I don`t have some stupid virus on my Laptop now.

[Gokuyuske]

Just happened to me too.

[Kirjava444]

I had it happen just now as well.

[No Maam]

Nothing on my end. Probably gonna leave for a bit then.

[Gekko135]

Put the kids to bed early, i'm gonna browse AP forums!