1. Rapidgator has been added to our approved mandatory hosts while Uploaded as been removed. These hosts are not to be used in combination with each other unless a second approved mandatory is used. See our file host rules for more information.
    Dismiss Notice
  2. Guest - Remember that Thread Prefixes are a search tool! Click on a Thread Prefix and all threads with the same Prefix in that forum will be offered to you. To dismiss click on X >>>
    Dismiss Notice
  3. Our gif only content threads have a rule where all thumbs must be posted as a static thumbnail that does not play. Currently imagebam made a change where they no longer produce static thumbs. Therefore, please do not use imagebam, or any host, that provides live playing gifs in those specific threads. If you see your gif playing once you post, try to use a smaller thumbnail and if that does not work use a different approved host.
    Dismiss Notice
  4. Can't Log-in?. If your password is no longer accepted but the email address registered in your profile is working, use the "Forgot Your Password?" routine. However, if your registered email address is unusable, create a new temporary phun account and contact S-type.
    Dismiss Notice
  5. ATTN: Imagehost picpie is infected with the "internet security warning" redirect that tries to take users hostage with an inescapable redirect. Avoid using picpie as an imagehost.
    Dismiss Notice
  6. Too many Alerts? Why not adjust your "Alert Preferences" in your Profile Page?
    Dismiss Notice
Rapidgator & Uploaded Thread Prefixes Do not use Imagebam in GIF Content Threads Log-in issues picpie Alerts out of control?

Malware Warning

Discussion in 'About phun.org' started by cayne, Sep 17, 2012.

Page 1 of 6
  1. cayne

    cayne Guest

    Hello everybody,
    as some of you might have noticed, there are "malware warnings" popping up for some users. It seems like somebody was able to inject some malicious <iframe> code. We're investigating this situation and trying to get rid of this shit as soon as possible.

    Be assured this didn't come from us, but from some low-life "hackers" who are trying to mess with you and us.

    We are sorry for the inconveniences and will inform you as soon as we know more about this and have it removed. Thanks!
     
    cayne, Sep 17, 2012
    #1
    evil-monkey, Formula_1, Henry_Longstride and 26 others like this.
  2. cayne

    cayne Guest

    I've found the injected code and removed it, now it's time to find out how the hell this happened :<
     
    cayne, Sep 17, 2012
    #2
    JDoeson69, blump314, Ramsfan and 12 others like this.
  3. TheOne

    TheOne The President ★ ★ ★ ☆ ☆ 15 Year Member

    Joined:
    Jun 1, 2005
    Messages:
    81,756
    Likes Received:
    32,497
    got this message when I clicked on "Why the page was blocked"

     
    TheOne, Sep 18, 2012
    #3
  4. cayne

    cayne Guest

    Yeah, looks like I have Google have to review the site again. But I also need to find out how this could have happened in the first place :<
     
    cayne, Sep 18, 2012
    #4
    PlanetHendrix likes this.
  5. Beerhammer

    Beerhammer

    Joined:
    Sep 23, 2008
    Messages:
    943
    Likes Received:
    441
    Yeah, I've been getting red flags all over the place from Firefox's "Stopbadware.org" saying exactly the same thing :(
     
    Beerhammer, Sep 18, 2012
    #5
  6. Sennsational

    Sennsational BANNED ★ ★ ☆ ☆ ☆

    Joined:
    Jun 23, 2007
    Messages:
    20,867
    Likes Received:
    11,139
    Is it even safe to be on this site right now? I came here just to see what was going on with this. Every time I try open another page, the warning pops up.
     
    Sennsational, Sep 18, 2012
    #6
  7. cronus

    cronus ★ ★ ★ ☆ ☆

    Joined:
    May 31, 2010
    Messages:
    2,758
    Likes Received:
    23,523
    I am still getting this message, although i am ignoring it and browsing the site anyways :)
     
    cronus, Sep 18, 2012
    #7
  8. Sennsational

    Sennsational BANNED ★ ★ ☆ ☆ ☆

    Joined:
    Jun 23, 2007
    Messages:
    20,867
    Likes Received:
    11,139
    Yeah me too. That means we probably have an addiction :D Although I am getting the fucking message every time I change pages. It is obnoxious.
     
    Sennsational, Sep 18, 2012
    #8
  9. jdc

    jdc

    Joined:
    May 20, 2009
    Messages:
    2,156
    Likes Received:
    1,170
    Hadn't happened to me, till now. Oh well, joining the party now. :D
     
    jdc, Sep 18, 2012
    #9
  10. X-Spectre

    X-Spectre Veni, Vidi, Veni

    Joined:
    May 5, 2008
    Messages:
    9,941
    Likes Received:
    8,216
    X-Spectre, Sep 18, 2012
    #10
    Ramsfan and J3scribe like this.
  11. haydaddict

    haydaddict Smiley King ★ ★ ★ ★ ☆ 15 Year Member

    Joined:
    Nov 28, 2007
    Messages:
    74,025
    Likes Received:
    94,631
    A few minutes ago i started getting a 2nd message about another site!
    forum.phun.org contains content from pw-2.pw-1.com, a site known to distribute malware. Your computer might catch a virus if you visit this site.
     
    haydaddict, Sep 18, 2012
    #11
  12. cronus

    cronus ★ ★ ★ ☆ ☆

    Joined:
    May 31, 2010
    Messages:
    2,758
    Likes Received:
    23,523
    ah same story here brother :)
     
    cronus, Sep 18, 2012
    #12
  13. haydaddict

    haydaddict Smiley King ★ ★ ★ ★ ☆ 15 Year Member

    Joined:
    Nov 28, 2007
    Messages:
    74,025
    Likes Received:
    94,631
    Dont open new tabs...the message doesnt appear if i continue in the same tab on Chrome!
     
    haydaddict, Sep 18, 2012
    #13
    trolha555 likes this.
  14. gaphugs

    gaphugs BANNED

    Joined:
    Oct 17, 2005
    Messages:
    8,976
    Likes Received:
    10,349
    My computer does not like phun ! Unusable with the constant warnings. Who ever did this did a dirty job.
     
    gaphugs, Sep 18, 2012
    #14
  15. whoswho

    whoswho

    Joined:
    Sep 13, 2009
    Messages:
    95
    Likes Received:
    92
    Yes, even this exact page's source code contains an iframe link to this site, and is hidden on this page, so beware.

    At least be running a browser with a "noscript" type plugin.
     
    whoswho, Sep 18, 2012
    #15
  16. darkfido

    darkfido

    Joined:
    Oct 29, 2009
    Messages:
    403
    Likes Received:
    967
    Time to crab the pitchforks and torches and hunt that wee fucker down
     
    darkfido, Sep 18, 2012
    #16
    X-Spectre likes this.
  17. cayne

    cayne Guest

    I'm not sure why the browsers still show these warnings, as the code has been removed, so technically it isn't possible to catch something from browsing the forum, but it takes awhile for Google and all these virus scanners to show the changes. We're still working on this...this is horrible ://
     
    cayne, Sep 18, 2012
    #17
    X-Spectre and haydaddict like this.
  18. whoswho

    whoswho

    Joined:
    Sep 13, 2009
    Messages:
    95
    Likes Received:
    92
    Horrible indeed. Just to help, there is still an iframe link on this page from what I can see:
    WARNING: DO NOT GO TO THIS LINK
     
    whoswho, Sep 18, 2012
    #18
    X-Spectre and haydaddict like this.
  19. whoswho

    whoswho

    Joined:
    Sep 13, 2009
    Messages:
    95
    Likes Received:
    92
    UPDATE: and now that code is gone.
     
    whoswho, Sep 18, 2012
    #19
  20. cayne

    cayne Guest

    Yeah, I was looking for it...couldn't find it. Have you seen it via "show source code"?
     
    cayne, Sep 18, 2012
    #20
Page 1 of 6

Share This Page