Golden Sun Hacking Community
September 26, 2018, 04:48:27 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News:
 
  Home   Forum   DC Wiki Help Search Calendar Downloads Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Important announcement regarding forum malware attack  (Read 2693 times)
0 Members and 1 Guest are viewing this topic.
Atrius
Programmer Extraordinaire
Web Host

Fear my blades

Veteran Member
*

Coins: 1
Offline Offline

Gender: Male
Emblems: Website Founder
Clan Position: Creation God of Sol
Posts: 1760

« on: March 21, 2017, 12:17:47 AM »

Hey everyone, I've got some bad news and some good news.


The bad news: It's just been discovered that goldensunhacking.net was infected with malware around the end of February in 2016.

The good news: There is no indication so far that the attacker was trying to target user data, or impact normal site visitors in any way.



I'm still sifting through everything to determine the damage, but fortunately what I've analyzed so far indicates that the attacker was just using our server as a proxy.  What that means is that they were masking their IP address as our server's to access other sites.  I haven't found anything yet that would indicate regular users of the site would have been impacted by the malware, but I will keep you updated if I discover anything that indicates otherwise.



21 Mar Update

I've found code that could have been used to redirect traffic coming in specifically from the search providers Google, Yahoo, MSN, AOL, and Bing, or replace all of the links on the site with different links for traffic coming from those same search providers.  It appears to have never been configured properly though, and would not have been functioning.  So far this is the only code I've found that could have impacted normal users, but again it would have required additional set up that was not performed, and would not have been functioning.

Although there are still no indications that user data was targeted, I'm continuing my analysis of all of the site's files to make sure, and will keep you informed.  I have no estimate for when I'll get the site up and running again, making sure everything is clean is my main priority right now.
« Last Edit: April 02, 2017, 01:59:26 PM by Atrius » Logged

I'm shaking my head in general disapproval of everything
View Profile WWW
Atrius
Programmer Extraordinaire
Web Host

Fear my blades

Veteran Member
*

Coins: 1
Offline Offline

Gender: Male
Emblems: Website Founder
Clan Position: Creation God of Sol
Posts: 1760

« Reply #1 on: April 02, 2017, 02:20:28 PM »

I've completed my clean up of the Malware, I'm pretty confident that we're clean now, additionally, I've made sure we have the latest security updates installed on the forum.

I'm still not sure how it happened in the first place, it's possible the attack didn't even originate on this site.  One of the dangers of using a shared hosting environment is that things can leak over from other sites on the server.  Regardless, I'm going to be keeping a closer eye on things for a while.
Logged

I'm shaking my head in general disapproval of everything
View Profile WWW
Pages: [1]   Go Up
  Print  
 
Jump to:  

Cbox
September 07, 2018, 03:51:10 AM
Majora: Updated all three Golden Sun 2.0 mod pages with awesome new information. The 2.0 mod series has merged with a unique and exciting project currently in development for Minecraft version 1.12.2! The beautiful objects and textures from the 2.0 series of Minecraft mods will feature as part of this expansive in-development Golden Sun project, which will bring in-depth classic Golden Sun gameplay to the Minecraft experience. We will provide an official reveal in the near future.
September 03, 2018, 07:35:55 PM
Caledor: what's really impressive is that in 3 years of modding here i've yet to do a full playthrough on TLA with my own mod lol
September 03, 2018, 06:51:38 PM
Luna_blade: ho that is still impressive
September 03, 2018, 01:25:14 PM
Caledor: it's not 71 cause i often skip numbers but i think that adding up the ones balance age as well it's about 80 versions
September 03, 2018, 11:51:45 AM
Luna_blade: holy @#$% 71 versions @caledor? What have I been missing all this time?
August 02, 2018, 07:42:12 PM
Caledor: patch for TLA uploaded again cause i forgot to update descriptions for 3 shields
August 02, 2018, 01:16:14 AM
Caledor: Don't want to triple post so I'll just announce here that v1.71 is out. I updated my last post.
July 29, 2018, 12:18:00 PM
KyleRunner: Let me see...
July 28, 2018, 08:12:34 PM
Fox: What value do you see at 08000468? (Or 00000468 in hex editor)  0801319D or 08F9EE50?
July 28, 2018, 07:11:11 PM
KyleRunner: "there is an easy fix by changing a pointer back to what it was suppose to be"... Hmmm... How?
July 27, 2018, 10:11:06 AM
Fox: Bootleg*
July 27, 2018, 10:09:03 AM
Fox: There are two ROMs that can be found on the internet, one may have the MEGAROMs boot load stuff. (So not truely clean.) ... If you get a screen while booting the game and holding L+R (I think it was?), then you know you have it, and your ROM is not truely "clean"... it is unfortunate, but there is an easy fix by changing a pointer back to what it was suppose to be..
July 27, 2018, 05:10:13 AM
MaxiPower: Hello World
July 25, 2018, 11:09:23 PM
KyleRunner: Well... here's The problem that needs solving: my GSTLA translation patch only works on a clean rom, with specific CRC. 
July 25, 2018, 07:59:37 PM
Fox: I am not sure I understand? If there was such a program to "clean" a dirty ROM dump, what exactly would it do?
July 25, 2018, 12:37:42 PM
KyleRunner: Hello, guys. Could someone teach me how to "clean" a dirty Golden Sun rom dump? Is there a program or something?
July 25, 2018, 01:37:40 AM
Atrius: @Fox, yeah... I was expecting it to take 2 weeks at most...
July 25, 2018, 12:03:01 AM
Majora: Yes, I believe so. Think they were made public a while ago prior to the site issue
July 24, 2018, 08:26:45 PM
Luna_blade: is it normal that I can see all clans?
July 24, 2018, 08:25:41 PM
Luna_blade: Nice to see it is back!

Affiliates
Temple of Kraden Golden Sunrise
Powered by MySQL Powered by PHP Powered by SMF 1.1.21 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!
Page created in 0.102 seconds with 21 queries.