Punaweb Hacked

[Midnight Rambler]

Note that if you've already clicked on the Google spam link, then even typing in the address will continue to redirect you to that site until you clear the cache and cookies.

[randomq]

Rob where are ye?

[terracore]

quote:

---

Originally posted by kalakoa

Lynx in a 24x80 Xterm configured with green text on a black background.

Now get off my lawn.

---

I remember thinking 300 baud was the fastest speed necessary, because nobody could read at 1200.

[terracore]

quote:

---

Originally posted by randomq

Rob where are ye?

---

I don't know if Rob can do anything short up upgrading to new forum software. From what I can determine this Snitz forum code was last updated 10 years ago. The hack is probably SQL injection through a known security bug that has never been fixed. If the extraneous code is removed it would reappear whenever the hacker wanted. The tough part of switching forum software is migrating all the old posts so they don't get lost (there is a lot of historical data here). Some of the forum software has migration tools to assist with this task but I remember when I did it feeling overwhelmed and wound up hiring somebody to do it for me.

[kalakoa]

up upgrading to new forum software

There's nothing wrong with the forum software, the problem is browser and/or search result hijacking.

300 baud was the fastest speed

For a brief time 450 baud was popular: the original Hayes 300 modems were clocked to the serial data stream, so they ran at whatever speed could be configured on the host UART, in some cases up to almost 600 baud. The maximum varied per individual modem because manufacturing was less precise in those days.

Then came PSK and 4PAM and 8PAM, right up to the Shannon limit...

[randomq]

Hmm. If it comes to that I'm handy with PERL and databases, so could migrate the data for free. I kinda like our low bandwidth forum though, it even works when my connection drops to 3G.

[terracore]

"For a brief time 450 baud was popular"

Also popular was using the Bell 202 protocol effectively turning a 300 baud modem into a 1200 baud modem, but being half duplex really only effective for file transfers with another user using the same modem.

"the problem is browser and/or search result hijacking"

According to isithacked.com "There is a difference of 9619 bytes between the version of the page you serve to Chrome and the version you serve to GoogleBot. This probably means some code is running on your site that's trying to hide from browsers but make Google think there's something else on the page."

[kalakoa]

Bell 202

Limited implementation back then, but still in use today for analog caller ID delivery.

make Google think there's something

Google is not necessary nor relevant for browsing Punaweb, which is to say this whole problem wouldn't exist if Google and the browsers weren't inserting themselves into the middle of people's use of the web.

[terracore]

https://sitecheck.sucuri.net/results/punaweb.org

Warning: Malware Detected

Infected with malware. Immediate action is required

http://punaweb.org/

IP address: 184.168.27.204

Hosting: GoDaddy

Running on: Microsoft-IIS 7.0

CMS: Unknown

Powered by: ASP.NET

More Details
Critical Security Risk
Known Spam Detected

http://punaweb.org/VisitingPuna/HowToGetHere.asp (More Details)

Known Spam detected: spam-seo.spammy_keywords?1.106

<span class="sitenameDescr">Reliable online pharmacy</span>

Redirects to http://rxshop-24-online.com/search.html?key=wellbutrin&lang=us


spam-seo.spammy_keywords

Description:
Web page contains spammy keywords specific to various black hat SEO campaigns (pharma spam, porn, replicas of popular brands, payday loans, etc.).

Affecting: Any web site (no specific target).

[kalakoa]

Infected with malware. Immediate action is required

I wonder how that happened?!?!?

Running on: Microsoft-IIS 7.0

Oh. Yeah. That.