Mapcore Trojan

[Wunderboy]

http://www.channelregister.co.uk/2008/0 ... continues/

http://it.slashdot.org/it/08/01/24/1930207.shtml

To quote from the first article:

The sites host malicious javascript that is spontaneously created and randomly named only after a visitor hits the home page. That's unlike any other mass infection most researchers have seen before. Usually, infected sites merely host pointers to attacker-controlled servers, which in turn are used to host malware with static file names.

The innovative technique is much more than an academic curiosity. Because the rogue code does not exist on any server until an end user visits it, the javascript remains invisible to site administrators. The randomness also prevents most antivirus programs from detecting the javascript.

[Sa74n]

am i the only one experiencing loong downtimes of the mapcore boards? i only once got a trojan/malware warning browsing the forums and that was while using IE. never got anything in ff.

but anyhow, is the trojan thingie connected to the downtimes? it's been atleast once every day in the last 2 weeks or so that i was unable to connect to mapcore.

[Thrik]

I don't think it's connected. The host just seems to be delivering exceptionally poor service.

We simply need to get the forums moved to a new host. I've already demonstrated that I can do it in about 15 minutes, but for some reason it's taking weeks upon weeks to get anything done. I don't know where the administrative roadblock is, but it's demonstrating a large lack of care and respect for the community in my opinion. People are probably being infected with trojans because the site has not been moved yet, for pete's sake.

As I said on the last page: I know people are busy, but if there's no time for being able to respond to critical community problems within a day or two then perhaps it should be handed over to someone who can respond and act within a day or so like me. (I'm saying this publicly because nothing seems to happen when talk happens privately.)

[Ginger Lord]

/vote Thrik '08

[dux]

/vote Thrik '08

[Thrik]

Seeing as everyone probably wants a status update:

Mojo told me last weekend he was buying new hosting and would try to move the forum there that weekend. I said he should let me know if he needs any help with anything seeing as I had successfully moved the forums to my own quality hosting for testing previously.

Not only did that weekend pass without the promised move, but now a second weekend has passed too. The forum has suffered dozens of hours of general downtime since (it's been down for entire days on a couple of occasions), and people are still being infected by the virus.

In my opinion this kind of thing shouldn't be allowed to go on for even a few days, and I would put time aside to fix it. If you haven't got the time to work on it Mojo and are only willing to do so on weekends, you should really consider giving it to someone who can as it's become downright negligent to keep treating the forums as an absolute last priority.

I seriously shudder to think of all the professionals who have come here from work computers and had virus messages flashing up, permanently turning them away and tainting the name of MapCore. The fact that it's not been dealt with after six weeks is basically a joke, and I've long since lost my patience hoping that someone will display some responsibility and move the forums.

It really pains me to see the forum down for days at a time and infested with viruses, with no apparent action being taken to stop it. It might sound like I'm being overly dramatic, but that is the actual reality of what's going on here. The members who have visited for the first time during the past six weeks will probably never return, and I know for a fact from talk on IRC that regulars have stopped visiting too.

What makes it even worse is that if the virus isn't turning people away, the fact that the forums are down for 40% of the week is.

The forums need moving and they need moving now. If you haven't got the time to deal with this within days Mojo, please do the right thing for MapCore and let someone who can take care of the technical side of things like myself deal with it. It's not like I'd want to take away your admin access or anything, and you'll always retain control of the domain name.

Simply pointing the name servers towards another host is sufficient and does not transfer any control of the domain to that host; if the name servers are ever changed again, that host loses any and all coordination with the domain. If the name servers were changed I could literally have a complete copy of MapCore up just as quickly as I got my test installation up.

[-Stratesiz-]

I've been annoyed by the slow pace ever since I started investigating the source of the problem. That was over a month ago. As I said previously, this is really, really embarrassing for mapcore and bad for its image.

[dux]

Hell's going to freeze over before anything gets fixed?

[D3ads]

I just tried the forums on IE and I got a message up saying 'Hacking tool detected and neutralised' from my anti-virus yet on Firefox I get nothing.. really odd.

[Sindwiller]

I've stumbled over this. Dunno how much it has to do with our case. Might be good to take it into account.

EDIT: False alarm?

[-Stratesiz-]

Any progress?

[Thrik]

No.

Is the trojan still coming up for you? The downtime at least seems to have stopped.

[Sentura]

i still get it sporadically

[Deathy]

Don't get it anymore... clean for me. (Avira Antivir, Firefox)

[-Stratesiz-]

I just got it twice now! For God's sake it can't take this long to fix the issue!