Recent Hackings: The whole story

[Blabj]

Just now the windower IRC channel has been contacted by a member of the FFXIAH.com staff team, this is what he had to say:

(18:48:30) • Joins: Jaerik ([email protected])
(18:48:42) (Jaerik) Hey folks.
(18:48:53) (Jaerik) This is Jae, I run FFXIAH.com with Matt and Cliff.
(18:49:10) (Jaerik) Just wanted to clear up what we've managed to figure out so far, for the record.
(18:49:17) (Frost[wirk]) neato
(18:49:37) (Frost[wirk]) Hi Jae, anyway to verify your credentials?
(18:49:47) (Jaerik) Sure, gimme just a sec.
(18:50:41) (Jaerik) Hit ffxiah.com main page in English, yellow box on the left.
(18:51:02) (Jaerik) Just changed it temporarily.

(18:51:10) (Frost[wirk]) lol
(18:51:12) (Frost[wirk]) kk
(18:51:15) (Frost[wirk]) go on
(18:52:08) (Frost[wirk]) so what do you know? You checked your adds? found anythign in em?
(18:52:13) (Jaerik) About a week ago, in an effort to avoid any sort of perceived relationship with RMT sites, we decided to try dropping Google AdSense and moving to a more controlled, targetted, professional ad network.
(18:52:38) (Jaerik) Tribal Fusion picked up the site. They're very mainstream with a good reputation and reputable business contacts. And the revenue increase from using them would allow us to drop RMT ads from the site.
(18:52:38) (+blabj) I read that on your advertising page.
(18:53:03) (Jaerik) Unfortunately, it seems that some of the ads that were placed had Doubleclick-style cookie tracking in them to try and figure out who was hitting the site.
(18:53:11) (Jaerik) In order to feel out the market for the transition.
(18:53:30) (Jaerik) Some very stringent antivirus programs out there can report these cookies as hacking attempts.
(18:53:54) (Jaerik) There *was* actually one ad, on the tower space in the right page frame, that was running one of those smarmy "Your computer may be infected, click here to download blah blah" ads.
(18:54:02) (Jaerik) We ruthlessly squashed it after only a day or two.
(18:54:34) (Jaerik) We're doing our best to try and figure out which ads are being placed and cherry-picking only the ones we know to be safe.
(18:55:08) (Jaerik) At the same time, there's been an enormous simultaneous push from mainland China using fake 3rd party bot/cheat utilities to steal POL passwords.
(18:55:40) (+Emelyn) I just heard about all this today... I still don't understand how people lost there accounts unless they physically d/l something
(18:55:46) (Jaerik) The method to crack the hashed password saved for POL is kinda becoming common knowledge, so a lot of people are getting hacked either that way, or via keylogger.
(18:55:56) (Slakr) I still see gil sites on ffxiah.com site
(18:55:56) (Jaerik) There's also a campaign targetting wiki-based FF sites.
(18:55:58) (Frost[wirk]) Em, it was a IE exploit
(18:56:21) (Jaerik) What they're doing is changing some of the links on wiki-related sites to point to sites that exploit IE vulnerabilities to remote code execute and steal passwords.
(18:56:40) (+Emelyn) I haven't used IE in years... there are unpatched exploits in it this big?
(18:56:46) (Jaerik) Yeah Slakr, we're trying to transition but this whole "ffxiah.com hacked my password" outcry is kinda screwing things up.
(18:56:56) (Yekyaa) well, fist time in three weeks that the RSS feed has loaded properly
(18:57:11) (Slakr) I can understand
(18:57:24) (Jaerik) Anyway, just wanted to kinda set the record straight 'cuz someone tipped me off that you were discussing it here. =)

(Some time later)

(18:58:35) (+Emelyn) So your theory is a "bad" ad exploited IE to download some program which cracked the SE/POL password hash and emailed it to RMT/hackers?
(18:58:45) (Frost[wirk]) but idk, it looks liek the admins of somepage gave up in october
(18:59:02) (Frost[wirk]) Em, it's likely a Keylogger atm
(18:59:04) (Jaerik) That's one of the ways, Emelyn. It seems to be kind of a perfect storm of hacking right now. There's a huge push by hackers in the past week or so.
(18:59:22) (Jaerik) Lots of links to "bots" and "utilities" posted all over FF sites that keylog or send the password hash.
(18:59:35) (Jaerik) People altering links on wiki-based sites to point to webpages that exploit vulnerabilities, etc.
(18:59:36) (+Emelyn) Still wouldn't a user have to initiate the keylogger d/l in some way?
(18:59:44) (Frost[wirk]) have you been fuckign with the virus/trojan to see how it activaes/triggers/ports/destinations?
(18:59:52) (+blabj) Not really, Javascript can do a lot of nifty things Emelyn
(19:00:00) (Jaerik) No, some of the unpatched bugs in IE still allow remote code execution even without clicking anything.
(19:00:05) (Jaerik) Just by visiting a page.
(19:00:42) (+Emelyn) I wasn't aware IE had so many unpatched flaws still

(19:00:57) (Frost[wirk]) I still love SE's comment, "If you have a keylogger on your system I suggest you change your password"
(19:00:58) (Jaerik) Problem is most people don't patch/update regularly. =/
(19:01:19) (Slakr) I patch up myself all the time
(19:01:31) (Jaerik) Is that actually SageSundi?
(19:01:38) (Frost[wirk]) no lol
(19:01:42) (+Emelyn) As I've seen elsewhere lol, Firefox+Adblock+Noscript = No/little Problems
(19:01:46) (Jaerik) Didn't think so. =p
(19:01:50) (+Emelyn) lol no
(19:02:29) (+Emelyn) This kind of think is what drives the masses to use ad blocking software, which in turn hurts websites >.<
(19:02:42) (Frost[wirk]) you think you can sue the shit out of your ad service for allowing them to host said viruses?
(19:03:02) (radiumsoup) don't bite the hand that feeds
(19:03:20) (Jaerik) We actually have pretty crazy security built into ffxiah.com, just because no matter how much you tell people not to, out of laziness a lotta people will use their POL account names/passwords to register for the site.
(19:03:32) (Frost[wirk]) When the hand that feeds makes more money in a lawsuit than they cost you in one...
(19:03:39) (Jaerik) Even though we have big red messages on signup saying NO NO NO.

More ground breaking news as it happens. Remember, you heard it here first, on QCDN!

Edit: Disabled smilies in post.
Edit: Added some more chat, makes for an interesting read yes?

 

[Fellina]

Now I'm especially glad I opted to swap to Firefox about a year ago.

 

[Kurgon]

So are they saying just viewing the ad can execute script or clicking on it and going to another page will cause the infection?

 

[Dowzer]

So are they saying just viewing the ad can execute script or clicking on it and going to another page will cause the infection?

Yep, without even clicking it. Some Wiki entries have been changed to direct you to a page that will also cause infection.

 

[Dancingweapon]

fuck me.... nothing on the web is safe anymore... I might switch to firefox... Thanks for posting this here Rep up.

 

[Dowzer]

fuck me.... nothing on the web is safe anymore... I might switch to firefox... Thanks for posting this here Rep up.

Might!? ..................

 

[Kurgon]

I use Firefox, scan with AVG and Ad-Aware everyday and run Hijackthis at least once a month. Nothing has shown up but I will run a search for the specified files anyways. I do visit ffxiAH, somepage, and alla. Nothing wierd has happened but better safe than sorry.

 

[Pelori]

Hell not only am I using Firefox only now, is there anyway to get rid of IE off a PC completely? I just wanna be rid of that program.

 

[Tyrath]

Man I use firefox except it stopped working on my laptop last week -_-

 

[Rappa]

Is that your browser window? If so, all that crap at the top makes me sad, well except for the GameFAQs links. Those are awesome.

 

[CmdrFly]

Hell not only am I using Firefox only now, is there anyway to get rid of IE off a PC completely? I just wanna be rid of that program.

No. It's not tied into Windows, it's practically infused. Some libraries in IE are actually used for Windows Explorer, not vice-versa as it should be. This may have changed in IE7 but I know IE6 was absolutely non-removable, and the best you could do is just delete the shortcuts to it.

 

[neophytal]

No. It's not tied into Windows, it's practically infused. Some libraries in IE are actually used for Windows Explorer, not vice-versa as it should be. This may have changed in IE7 but I know IE6 was absolutely non-removable, and the best you could do is just delete the shortcuts to it.

ie7 is totally infused, especially in vista

 

[Dancingweapon]

Might!? ..................

Are you saying "Might" to the fuck me or changing to firefox :wacko:

 

[Dowzer]

Seriously switch to Firefox or Opera, asap.^^

 

[Blabj]

Is that your browser window? If so, all that crap at the top makes me sad, well except for the GameFAQs links. Those are awesome.

Haha, you have no idea how useful the HTML Web Developer toolbar is for making websites :nyam:

And yeah, lots of links, I middle click the folders to open them all in one, especially for the FFXI bookmarks, opens up all the forums I'm a member of, and other sites like wiki and ffxiah. (heh)

 

[Tyrath]

Seriously switch to Firefox or Opera, asap.^^

Help me fix my firefox ;( It wont work on my laptop. Only thing I can tell might be causing it is everytime I turn it on it says "OSCheck could not be started"

I'm on stupid vista :|

 

[Blabj]

Another post, to secure yourself from the virus completely (complete peace of mind) take the following steps.

1. Download Firefox.
2. Get Adblock Plus.
3. And Filterset.G Updater.
4. ?????
5. Profit!

I have followed these instructions and used FFXIAH.com daily for the past month and I haven't been infected.

 

[Rappa]

Haha, you have no idea how useful the HTML Web Developer toolbar is for making websites :nyam:

I know a thing or two about coding complex websites I've never used any developer tools on GF though. I probably should but I'm just too set in my ways to learn anything new, lol.

 

[Dowzer]

Help me fix my firefox ;( It wont work on my laptop. Only thing I can tell might be causing it is everytime I turn it on it says "OSCheck could not be started"

I'm on stupid vista :|

I wish I knew, I'm not familiar with Vista. In fact a friend recently bought a new laptop with Vista and I can't get his FF to work without being choppy. :\

 

[Xalioniaf]

Seriously switch to Firefox asap.^^

Removed unnecessary crap.