Home | Community | Message Board
You are not signed in.
Sign In New Account
Forum Index Search Posts Trusted Vendors Highlights Galleries FAQ User List Chat Store Random Growery

MagicBag Grow Bags
This site includes paid links. Please support our sponsors.

Feedback and Administration > Website Announcements and Feature Feedback
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Welcome to the Shroomery Message Board! You are experiencing a small sample of what the site has to offer. Please login or register to post messages and view our exclusive members-only content. You'll gain access to additional forums, file attachments, board customizations, encrypted private messages, and much more!

MagicBag.co Shop: Certified Organic All-In-One Grow Bags by Magic Bag

Jump to first unread post Pages: 1 | 2 |  [ show all ]
Reported attack site?
    #16030036 -

I just tried to bring up this website (shroomery.org) and AVG informed me that this is a "reported attack site". I don't see any malware coming from the forums, what's going on?

Extras: Filter Print Post Top
Re: Reported attack site? [Re: setb]
    #16030060 -

Firefox is also blocking it based on Google listing shroomery.org as a malware site.

Note that I reported Luddite's link here:

http://www.shroomery.org/forums/showflat.php/Number/16020191#16020191

yesterday as linking to a malware site. If your system and browser are not up to date on all current security patches, simply visiting Luddite's link will infect your machine and turn it into a spam zombie.

No downloading or running of any programs is required. Just visiting the page and immediately leaving without clicking anything is enough to infect you.

I confirmed this in a secure sandbox VM. I visited that link then closed the browser. Two seconds later I monitored dozens of outgoing network connections from new zombie processes that intentionally don't show up in the task list.

That link may have been found by the Google spider and blacklisted us. It also infected every shroomerite who followed the link without active and up to date anti-virus software running on their system. :shrug:


--------------------
Republican Values:

1) You can't get married to your spouse who is the same sex as you.
2) You can't have an abortion no matter how much you don't want a child.
3) You can't have a certain plant in your possession or you'll get locked up with a rapist and a murderer.

4) We need a smaller, less-intrusive government.

Extras: Filter Print Post Top
Re: Reported attack site? [Re: Diploid]
    #16030076 -

:asianofapproval:

Extras: Filter Print Post Top
Re: Reported attack site? [Re: Nullface]
    #16030078 -

nignore this warning.. :flowstone:


--------------------

Extras: Filter Print Post Top
Re: Reported attack site? [Re: orison]
    #16030108 -


Extras: Filter Print Post Top
Re: Reported attack site? [Re: Diploid]
    #16030112 -

Diploid said:
Firefox is also blocking it based on Google listing shroomery.org as a malware site.

Note that I reported Luddite's link here:

http://www.shroomery.org/forums/showflat.php/Number/16020191#16020191

yesterday as linking to a malware site. If your system and browser are not up to date on all current security patches, simply visiting Luddite's link will infect your machine and turn it into a spam zombie.

No downloading or running of any programs is required. Just visiting the page and immediately leaving without clicking anything is enough to infect you.

I confirmed this in a secure sandbox VM. I visited that link then closed the browser. Two seconds later I monitored dozens of outgoing network connections from new zombie processes that intentionally don't show up in the task list.

That link may have been found by the Google spider and blacklisted us. It also infected every shroomerite who followed the link without active and up to date anti-virus software running on their system. :shrug:


Yeah, that was pretty screwed up of him to post that. Perhaps he didn't know though :shrug:. Anyway, that could be the cause of the warning.

Extras: Filter Print Post Top
Re: Reported attack site? [Re: setb]
    #16030126 -

Thanks for the post and the feedback, I thought I screwed myself downloading a shroom pic zip file.

Extras: Filter Print Post Top
Re: Reported attack site? [Re: setb]
    #16030129 -

Yup, just got the same message from Firefox.


--------------------
Put America to sleep with warm milk and clichés.

Extras: Filter Print Post Top
Re: Reported attack site? [Re: BothHands]
    #16030137 -

I've seen it done on other forums. He knew what he was doing. I would have banned him if I was a mod, but whatever. :smirk:

Extras: Filter Print Post Top
Re: Reported attack site? [Re: Nullface]
    #16030164 -

I just got the same blocking message after reloading the site. I looked at the diagnostic page and didn't see anything unusual, so I ignored the warning. Upon reloading, I see there is a new script trying to load with the site which is coming from dewtkw.dyndns-server.com.


--------------------
:dragon:

Extras: Filter Print Post Top
Re: Reported attack site? [Re: Dragonaut]
    #16030218 -

Dragonaut said:
I just got the same blocking message after reloading the site. I looked at the diagnostic page and didn't see anything unusual, so I ignored the warning. Upon reloading, I see there is a new script trying to load with the site which is coming from dewtkw.dyndns-server.com.


I see that too. Thank go for noscript.

Extras: Filter Print Post Top
Re: Reported attack site? [Re: setb]
    #16030333 -

Same thing from Chrome, "warning this website contains malware which could be harmful to your computer."


--------------------

Extras: Filter Print Post Top
Re: Reported attack site? [Re: setb]
    #16030336 -

My antivirus seperate from my browser is actually reporting that it "blocked such and such an attack" whenever I visit the front page. I assume it's just making shit up though.

Extras: Filter Print Post Top
Re: Reported attack site? [Re: audiophoenix]
    #16030351 -

Well I think it's time for a reformat...


--------------------
"We are the Universe experiencing itself." -Unknown

Extras: Filter Print Post Top
Re: Reported attack site? [Re: setb]
    #16030354 -

I just received the reported as attack site warning for shroomery.org.    have never had it before.  it is the only site I have used in days.


--------------------
https://files.shroomery.org/files/06-17/635734999-earth.jpg

Extras: Filter Print Post Top
Re: Reported attack site? [Re: setb]
    #16030378 -

setb said:
Dragonaut said:
I just got the same blocking message after reloading the site. I looked at the diagnostic page and didn't see anything unusual, so I ignored the warning. Upon reloading, I see there is a new script trying to load with the site which is coming from dewtkw.dyndns-server.com.


I see that too. Thank go for noscript.


I'm interested in this.  How do I see if I have weird scripts running?

Can anyone tell us if it's related to this incident?  Is it benign?


--------------------
Put America to sleep with warm milk and clichés.

Extras: Filter Print Post Top
Re: Reported attack site? [Re: BothHands] * 2
    #16030389 -

it is a bit interesting that it is happening on April 1st.:sherlock:


--------------------
https://files.shroomery.org/files/06-17/635734999-earth.jpg

Extras: Filter Print Post Top
Re: Reported attack site? [Re: Dragonaut]
    #16030464 -

Dragonaut said:
I just got the same blocking message after reloading the site. I looked at the diagnostic page and didn't see anything unusual, so I ignored the warning. Upon reloading, I see there is a new script trying to load with the site which is coming from dewtkw.dyndns-server.com.


I got the warning as well, but noscript is not showing any other scripts running other than shroomery.org.:shrug:


--------------------
You're breathing so I guess you're still alive
Even if signs seem to tell me otherwise.

Extras: Filter Print Post Top
Re: Reported attack site? [Re: carnage11]
    #16030529 -

I'm also seeing that det30t.dyndns-server.com is now being blocked as well.


--------------------
:dragon:

Extras: Filter Print Post Top
Re: Reported attack site? [Re: Dragonaut]
    #16030759 -

Guys, this is a very serious attack, it isn't BS and it isn't your anti-virus reporting something false.

Somehow shroomery has been compromised (whether it be intentional or not) and a java exploit has been placed into shroomery's source code.

The code that will do the damage to your PC is stored on a third party site, and when you load shroomery, your browser attempts to run this java archive package.

Here are just a couple of the places the nefarious code is attempting to run from:

det30t.dyndns-server.com/de/epphpkjgdgruppsklfpidpgggeuppuil.jar
derw6r.dyndns-server.com/de/epphpkjgdgruppsklfpidpgggeuppuil.jar
devr3v.dyndns-server.com/de/epphpkjgdgruppsklfpidpgggeuppuil.jar
deblrb.dyndns-server.com/de/epphpkjgdgruppsklfpidpgggeuppuil.jar

ESET Smart Security 4 quarantines the connection immediately for me, however if you've got a lesser antivirus/antimalware (or worse, you have none) than it's likely you're already infected.

Please, do NOT open any of those URLs, or you risk infecting your PC.

It has nothing to do with linking to another "bad" site or linking to a site that has trojan on it.

Google has listed shroomery as an attack site (google shroomery if you don't believe me).  Google won't do that simply because a website has linked to another site that is an attack site, they do it when the site itself is the SOURCE of the attack.

Since somewhere in shroomery's source code is one of the above .jar files (or at this point, it could be named anything, as it is being changed constantly), that means that shroomery itself is the source of the attack (whether they put the code there or not).

As a webmaster by trade, everything above I've said is not false, and hopefully you guys will take what I'm saying seriously.

I've had websites of mine hacked and have had malicious code hidden in my legitimate code before...and this is what happens.

Edited by crazyflex (04/01/12 09:28 PM)

Extras: Filter Print Post Top
Jump to top Pages: 1 | 2 |  [ show all ]

MagicBag.co Shop: Certified Organic All-In-One Grow Bags by Magic Bag

Feedback and Administration > Website Announcements and Feature Feedback
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Similar ThreadsPosterViewsRepliesLast post
* Post deleted by Papaver Anonymous 1,570 12 08/28/03 03:18 AM
by firstrays
* Trip Report Forum? whiterastahippie 1,834 6 10/24/02 10:05 PM
by whiterastahippie
* Another DDOS attack I take it?
( 1 2 all )		 Bi0TeK 3,615 23 03/30/04 10:15 PM
by Ripple
* ddos attack? still going on? www.shroomery.org/forums/login ZippoZM 927 1 06/22/04 02:55 PM
by Ythan
* Other Trip Reports ShroomStrider 1,630 6 09/25/02 01:40 PM
by ShroomStrider
* Trip Reports windex 2,164 7 06/29/02 09:55 AM
by windex
* Re: Trip report updates BrAiN 1,825 4 10/17/98 06:41 PM
by Anonymous
* How long for trip report to be logged into database? 3eyedgod 1,097 5 08/14/03 11:41 PM
by Strumpling

Extra information
You cannot start new topics / You cannot reply to topics
HTML is disabled / BBCode is enabled
Moderator: Ythan, Thor, Seuss, geokills
2,621 topic views. 0 members, 9 guests and 4 web crawlers are browsing this forum.
[ Show Images Only | Sort by Score | Print Topic ]
Search this thread:

Copyright 1997-2026 Mind Media. Some rights reserved.

Generated in 0.043 seconds spending 0.01 seconds on 16 queries.