Golden Sun Hacking Community
November 18, 2017, 05:37:03 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News:
 
  Home   Forum   DC Wiki Help Search Calendar Downloads Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Important announcement regarding forum malware attack  (Read 1694 times)
0 Members and 1 Guest are viewing this topic.
Atrius
Programmer Extraordinaire
Web Host

Fear my blades

Veteran Member
*

Coins: 1
Offline Offline

Gender: Male
Emblems: Website Founder
Clan Position: Creation God of Sol
Posts: 1756

« on: March 21, 2017, 12:17:47 AM »

Hey everyone, I've got some bad news and some good news.


The bad news: It's just been discovered that goldensunhacking.net was infected with malware around the end of February in 2016.

The good news: There is no indication so far that the attacker was trying to target user data, or impact normal site visitors in any way.



I'm still sifting through everything to determine the damage, but fortunately what I've analyzed so far indicates that the attacker was just using our server as a proxy.  What that means is that they were masking their IP address as our server's to access other sites.  I haven't found anything yet that would indicate regular users of the site would have been impacted by the malware, but I will keep you updated if I discover anything that indicates otherwise.



21 Mar Update

I've found code that could have been used to redirect traffic coming in specifically from the search providers Google, Yahoo, MSN, AOL, and Bing, or replace all of the links on the site with different links for traffic coming from those same search providers.  It appears to have never been configured properly though, and would not have been functioning.  So far this is the only code I've found that could have impacted normal users, but again it would have required additional set up that was not performed, and would not have been functioning.

Although there are still no indications that user data was targeted, I'm continuing my analysis of all of the site's files to make sure, and will keep you informed.  I have no estimate for when I'll get the site up and running again, making sure everything is clean is my main priority right now.
« Last Edit: April 02, 2017, 01:59:26 PM by Atrius » Logged

I'm shaking my head in general disapproval of everything
View Profile WWW
Atrius
Programmer Extraordinaire
Web Host

Fear my blades

Veteran Member
*

Coins: 1
Offline Offline

Gender: Male
Emblems: Website Founder
Clan Position: Creation God of Sol
Posts: 1756

« Reply #1 on: April 02, 2017, 02:20:28 PM »

I've completed my clean up of the Malware, I'm pretty confident that we're clean now, additionally, I've made sure we have the latest security updates installed on the forum.

I'm still not sure how it happened in the first place, it's possible the attack didn't even originate on this site.  One of the dangers of using a shared hosting environment is that things can leak over from other sites on the server.  Regardless, I'm going to be keeping a closer eye on things for a while.
Logged

I'm shaking my head in general disapproval of everything
View Profile WWW
Pages: [1]   Go Up
  Print  
 
Jump to:  

Cbox
November 16, 2017, 09:44:44 AM
Fox: Very quiet month.
November 11, 2017, 04:16:27 AM
tino_animate: Hello everyone. Ive just recently replayed Golden sun and TLA. I got really inspired and I'm interested in creating a prequel of Golden Sun. Unfurtunatly i know bery little on how to do it bit im willing to learn how. I need a few people to help me. I'm sure we can create a very well story based on what we know of the games. Anyone interested?
October 16, 2017, 09:57:26 AM
AZVRE: Im pretty okay, what about you?
October 16, 2017, 01:17:14 AM
Fox: I think the nine is doing a cirno on me, though... Anyway, how is everyone doing today?
October 16, 2017, 01:12:20 AM
Fox: onesixtwo*
October 16, 2017, 01:12:00 AM
Fox: Okay... Meanwhile... ah... 162 being a number that has made itself known to me.... I look at the relationships of the numbers.... 162  1+6+2 = 9 ; onesizetwo = alphabetical order = 9 characters ; Distance apart analysis: os = 4 = 1[6][2] , st = 1 = [1]6[2] , ot = 5 = [1][6]2 ; ost = original sound track?
October 15, 2017, 06:31:17 PM
AZVRE: ah okay :D i thought i caused some trouble
October 14, 2017, 07:49:16 AM
Fox: Oh i know... You were messing with yours, and the description says mine. It's kind of a funny bug. :P
October 13, 2017, 08:18:31 PM
AZVRE: I did not edit your profile tho. Just to erase that confusion ^^"
October 12, 2017, 04:49:56 AM
Fox: e.g. this art = http://forum.goldensunhacking.net/Themes/Jupiter/images/catbg.gif (etc.)
October 12, 2017, 04:48:58 AM
Fox: I have a question: Where did the art for the headers come from? (Like the backgrounds to each of these things... "Affiliates", etc... Asking just incase it inspires me to do something... but if Charon made it, then that's cool too.
October 11, 2017, 04:23:02 AM
FoxWas thinking about having something for the editor anniversary, but I believe I had to change my mind....
October 10, 2017, 12:58:36 PM
Fox: That's alright. ;       @AZVRE's profile: "Current Activity:  Editing the profile of Fox." ...Eh... That looks weird.
October 07, 2017, 11:45:16 PM
Atrius: Sorry about that, the auto bot detection is still working, but it also requires an admin to visit the site regularly.
October 04, 2017, 04:17:40 AM
Fox: Yeah, it does bring a small amount of activity. Not good quality activity, but it's still activity, nonetheless.  Now if we can get them to randomly post pictures and vdeios!
October 04, 2017, 02:10:48 AM
Majora: If nothing else, I like how they're copying the content of real posts at random. Interesting to see how they adapt to seem more authentic
October 03, 2017, 08:29:38 PM
Fox: medico6601 = Most likely another bot. :(
September 26, 2017, 03:32:24 PM
Fox: by ten* Excuse me.
September 26, 2017, 03:32:12 PM
Fox: Oh yes... Also multiply all levels by two. (So actually, an adept will have levels of 54, 3, 2, and 1, rather than 5, 0, 0, 0.... if going by those.)
September 26, 2017, 03:29:07 PM
Fox: ...I mean the theory also saves space on the Status Screen.

Affiliates
Temple of Kraden Golden Sunrise
Powered by MySQL Powered by PHP Powered by SMF 1.1.21 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!
Page created in 0.042 seconds with 21 queries.