GWPA is hacked!!!

Hello all, GPWA,

your Forum is hacked.....

go to google and search gpwa.... you get this

https://www.gpwa.org/forum/images/im...rch-google.png

Klick on Forum.... and you get this....

https://www.gpwa.org/forum/images/im...mages/gpwa.png

is only on the first load of your forum, after this it will set a cookie to your pc and all is fine. The second vbull forum i saw is hacked with the same tool.

Good job!
A very smart hack.

Best possible solution: Disabling register_globals and or initializing $vbseo_crules, $seo_replace_inurls at the start of vbseo.php.

Leopold

Thanks for the post! I will have our IT department look into it.

I had this, was a VBSEO exploit...

Quote:

---

Originally Posted by Roulette Zeitung

Good job!
A very smart hack.

Best possible solution: Disabling register_globals and or initializing $vbseo_crules, $seo_replace_inurls at the start of vbseo.php.

Leopold

---

Just disabling register_globals should fix this hack. No hardcoding required. ;)

So much hacking these days... :yikes:

Better be super careful these days.

Quote:

---

Originally Posted by Anthony

Thanks for the post! I will have our IT department look into it.

---

Good Afternoon,

5 days later and nothing happened.
IT department: "Please do not disturb" https://www.gpwa.org/forum/images/im..._sleep_107.gif

For your information: GPWA threads in Google search engine results are also affected!

So don't be surprised, if the hit counter is going down.

For example enter in your Google search box

gpwa fernanda liar

and click on the (GPWA) result(s).

You will be redirected away from GPWA if you don't have the GPWA cookie for that thread.

Leopold

Quote:

---

Originally Posted by Roulette Zeitung

Good Afternoon,

5 days later and nothing happened.
IT department: "Please do not disturb" https://www.gpwa.org/forum/images/im..._sleep_107.gif

For your information: GPWA threads in Google search engine results are also affected!

So don't be surprised, if the hit counter is going down.

For example enter in your Google search box

gpwa fernanda liar

and click on the (GPWA) result(s).

You will be redirected away from GPWA if you don't have the GPWA cookie for that thread.

Leopold

---

Very interesting

Anthony,

You deal here with a lot of personal data, so this issue is very serious! Is not only a matter of "IT department look into it".

A Public anouncement should be made with the results of the forensic analysis.

What is the extension of the hack? What data was exploited? What is the attack vector? Why members are not informed right away about the data breach as soon you have aknowlege? (at least on January 19th).

Thanks for undestanding.

Avast antivirus already blocks gpwa

https://www.gpwa.org/forum/images/im...om/S5cpbOE.png


Deletion link for this image
http://imgur.com/delete/FzlMMXQDqy6RRZh

Should I be scanning my computer for any suspicious files?

"Should I be scanning my computer for any suspicious files?"

There is no need for it. The hack is a redirector.
The target is not your computer. As long as you don't click anything on the filestore website, you can sleep well.

Leopold

The problem continues today.

I 'm really disappointed about that a forum like this after 6 days not in a position to fix the hack. it takes only 3 minutes to resolve this problem.

Quote:

---

Originally Posted by Roulette Zeitung

Good job!
A very smart hack.

Best possible solution: Disabling register_globals and or initializing $vbseo_crules, $seo_replace_inurls at the start of vbseo.php.

Leopold

---

The hack is actually quite insidious, and we have been urgently investigating it since it was reported. As a note, we did have register_globals disabled, so that was not the attack vector.

The hack employed a number of obfuscation techniques, including only being in force when the visit to the GPWA website originated from a search engine. And using domains to attempt hide that there was any hack at all, such as fetching javascript code from the domain google-analvtics.com rather than google-analytics.com (v in the domain name rather than y).

We still have not fully gotten to the bottom of how the site was hacked, but we do know complete details of the payload that is being served. In the meantime we are going to migrate the GPWA website to a more newly built web server that is configured so it is more invulnerable to attack. That migration is currently planned to take place tomorrow (Monday) morning starting at 8am eastern time.

Michael

I have now made a post regarding the GPWA website migration planned for tomorrow (Monday) morning.

You can see it here:

New GPWA database and forum servers being deployed.

Michael

The migration to new servers has now been completed. So hopefully we are cured now and have no more virus.

Michael

Quote:

---

Originally Posted by MichaelCorfman

The migration to new servers has now been completed. So hopefully we are cured now and have no more virus.

Michael

---

Thanks Michael. Hope to see you again at LAC.

Quote:

---

So hopefully we are cured now and have no more virus.

---

Virus is still there!!

misanthrope,

I too run avast and usually browse the gpwa with Firefox but I have NOT seen any warnings from avast.

It could be warnings from other pages that take a while to load if you have other tabs open.

If at any time you have a way you can recreate this, let me know so I may investigate further.

Rick


Edited to add: I too was able to recreate the above by following the link in from a google search so I will make Anthony and Michael aware right away so Alan can look into it.