Golden Sun Hacking Community
January 16, 2018, 01:41:48 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News:
 
  Home   Forum   DC Wiki Help Search Calendar Downloads Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Important announcement regarding forum malware attack  (Read 1908 times)
0 Members and 1 Guest are viewing this topic.
Atrius
Programmer Extraordinaire
Web Host

Fear my blades

Veteran Member
*

Coins: 1
Offline Offline

Gender: Male
Emblems: Website Founder
Clan Position: Creation God of Sol
Posts: 1757

« on: March 21, 2017, 12:17:47 AM »

Hey everyone, I've got some bad news and some good news.


The bad news: It's just been discovered that goldensunhacking.net was infected with malware around the end of February in 2016.

The good news: There is no indication so far that the attacker was trying to target user data, or impact normal site visitors in any way.



I'm still sifting through everything to determine the damage, but fortunately what I've analyzed so far indicates that the attacker was just using our server as a proxy.  What that means is that they were masking their IP address as our server's to access other sites.  I haven't found anything yet that would indicate regular users of the site would have been impacted by the malware, but I will keep you updated if I discover anything that indicates otherwise.



21 Mar Update

I've found code that could have been used to redirect traffic coming in specifically from the search providers Google, Yahoo, MSN, AOL, and Bing, or replace all of the links on the site with different links for traffic coming from those same search providers.  It appears to have never been configured properly though, and would not have been functioning.  So far this is the only code I've found that could have impacted normal users, but again it would have required additional set up that was not performed, and would not have been functioning.

Although there are still no indications that user data was targeted, I'm continuing my analysis of all of the site's files to make sure, and will keep you informed.  I have no estimate for when I'll get the site up and running again, making sure everything is clean is my main priority right now.
« Last Edit: April 02, 2017, 01:59:26 PM by Atrius » Logged

I'm shaking my head in general disapproval of everything
View Profile WWW
Atrius
Programmer Extraordinaire
Web Host

Fear my blades

Veteran Member
*

Coins: 1
Offline Offline

Gender: Male
Emblems: Website Founder
Clan Position: Creation God of Sol
Posts: 1757

« Reply #1 on: April 02, 2017, 02:20:28 PM »

I've completed my clean up of the Malware, I'm pretty confident that we're clean now, additionally, I've made sure we have the latest security updates installed on the forum.

I'm still not sure how it happened in the first place, it's possible the attack didn't even originate on this site.  One of the dangers of using a shared hosting environment is that things can leak over from other sites on the server.  Regardless, I'm going to be keeping a closer eye on things for a while.
Logged

I'm shaking my head in general disapproval of everything
View Profile WWW
Pages: [1]   Go Up
  Print  
 
Jump to:  

Cbox
Yesterday at 07:26:16 PM
Fox: (path) 1 text=(address) char=(address) free=(address) ; << Well, closer to this... but yeah... even if I do choose to have defaults in the code, I could still use this method for overrides.
Yesterday at 07:24:28 PM
Fox: So like (path) 0 text=(address) char=(address) len=(number) ; (path) 1 free=(address) ; Or something. But that's just a quick example.
Yesterday at 06:59:14 PM
Fox: Hopefully. I was wanting to make it so you could put in the addresses/etc. as one of the arguments in the path. Hm?
Yesterday at 03:37:07 PM
KyleRunner: Nice! I hope you'll add compatibility with others games (GS1, Mario Golf and Tennis) soon.
January 14, 2018, 11:40:09 PM
Fox: Okay. Posted (in Downloads section) an initial cutdown version for now, for my text compressor. Basically to separate the code from my Editor for anyone who wants to mess with it. It only supports GS2, because I still didn't add the addresses/etc. for the other games.
January 14, 2018, 05:01:00 PM
Fox: Okay! Going to need to think how I want it to work. Initial thoughts is maybe have a number of arguments in the filepath thing. And have a number of shortcuts (files) to be used as examples. Assuming there are no problems.
January 14, 2018, 10:38:24 AM
KyleRunner: Well... I'm used to editing text ina a text editor, so... yes! Thanks in advance!
January 13, 2018, 11:38:43 PM
Fox: (Text editor = Text Document like notepad.)
January 13, 2018, 11:38:21 PM
Fox: Would you prefer during the text editing in a text editor? (Like what gstoolkit lets you do?) I could probably make a separate tool or something to compress it.
January 13, 2018, 10:10:02 PM
KyleRunner: Ok. Once I finish my Lost Age translation, I'll try a Mario Golf one. Thanks. (But I'll need help).
January 13, 2018, 10:03:17 PM
Fox: If you want to make it "permanent" (part of a hack), then you'd edit code in the ROM that writes to this location of the IDs you'd want to change. (You can find these locations by using a breakpoint debugger like SDL-H or no$gba.)
January 13, 2018, 10:00:11 PM
Fox: Reload/switch = Recommended to be done through Debug mode/warp menu, ofcourse... since doors seem to appear as if they were disabled? ; 03001238:01 and B+Start to get to warp menu.
January 13, 2018, 09:55:39 PM
Fox: @Kyle Runner = It might be, but you'd have to use the correct addresses for Mario Golf, rather than for GS2 as I have it right now. ; @raijinken = Yes. 02000454 = ID of leader. (Change this and reload/switch room you are in, enjoy.)
January 13, 2018, 02:23:29 PM
raijinken: Hey guys, is it possible to somehow change the lead character on the map? Was wondering. I remember there was a cheat to use Jenna, but what if I wanted Isaac, or Piers?
January 13, 2018, 02:10:03 PM
KyleRunner: Hey, Fox *
January 13, 2018, 02:09:37 PM
KyleRunner: Hey, is your text editor compatible with Mario Golf (GBA)?
January 11, 2018, 08:33:13 PM
Fox: But if it isn't an oversight, I still can't imagine it being that useful.
January 11, 2018, 08:28:24 PM
Fox: part, ofcourse.
January 11, 2018, 08:28:15 PM
Fox: 0200274C = Hmm... Stuff happens here when you use Cyclone around bushes. (These cause tile replacements, and setting event 0 to those tiles.) - And I guess this kept here so it can be scanned after battle. (To re-update the map.) So here is my fun thought (assuming if it is even possible, or even convenient if so.) ... Are there any events from other maps that could be disabled do to using Cyclone on bushes + Retreat glitch? I'll need to do some testing to make sure this isn't an oversight on my
January 09, 2018, 08:09:26 PM
Fox: And the chance for a Djinni battle is 50%.

Affiliates
Temple of Kraden Golden Sunrise
Powered by MySQL Powered by PHP Powered by SMF 1.1.21 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!
Page created in 0.03 seconds with 21 queries.