Site Feedback Open forum for discussion of this site. Post your kudos or criticism so that we can continually improve service to the new MINI community.

Reported attack

Thread Tools
 
Search this Thread
 
  #51  
Old 10-13-2010, 03:46 AM
fishbert's Avatar
fishbert
fishbert is offline
6th Gear
Join Date: Jul 2008
Location: Ohio
Posts: 1,174
Received 13 Likes on 8 Posts
Originally Posted by Norcal_Cyclist
It was a false positive based on hueristics, UNLESS NAM was hacked which I doubt. IE nor FF aren;t detecting anything, they are relying on a 3rd party to determine the relative security of a website.

Case in point performa Google search on NAM and use a link, you'll get the warning in IE FROM Google, not IE. However you can copy and paste the link and it will work fine since Google is no longer involved.
you are only guessing, and there are a lot of holes in your logic.
your IE "case in point" also doesn't have any bearing on the issue.

the most likely cause is a malicious ad on the ad network NAM uses. but that is also just a guess.

Originally Posted by daflake
Rumor has it that NAM was hacked and some malicious code was injected into their scripts.
just rumor, nothing more.

disappointed that guesses and rumor are all we have to go on, though. been a few days now and we are still patiently waiting for an official explanation from NAM. doesn't give much confidence.
(you'd think they'd be more open and transparent with the users about something like this, eh?)
 

Last edited by fishbert; 10-13-2010 at 03:53 AM.
  #52  
Old 10-13-2010, 04:40 AM
Porthos's Avatar
Porthos
Porthos is offline
OVERDRIVE
iTrader: (8)
Join Date: Feb 2009
Location: None yours!
Posts: 6,455
Received 13 Likes on 11 Posts
I heard it was a government conspiracy to bring down the MINI community.
 
  #53  
Old 10-13-2010, 05:12 AM
daflake's Avatar
daflake
daflake is offline
6th Gear
Join Date: Sep 2005
Location: Laurel MD
Posts: 3,925
Likes: 0
Received 2 Likes on 2 Posts
Originally Posted by fishbert


just rumor, nothing more.
Yes it is, but as you said, I wouldn't simply dismiss the warning as a "false positive". Something happend to get them blacklisted which was my point.

As for NAM, they should let folks know what happened as it really can affect everyone that visits the site.
 
  #54  
Old 10-13-2010, 07:40 AM
Bigprfed22's Avatar
Bigprfed22
Bigprfed22 is offline
6th Gear
iTrader: (2)
Join Date: Jun 2010
Posts: 2,308
Likes: 0
Received 5 Likes on 5 Posts
just disable the setting, i am getting it now as well. I dont know what i would do with out it!
 
  #55  
Old 10-13-2010, 08:03 AM
Xeraux's Avatar
Xeraux
Xeraux is offline
4th Gear
iTrader: (1)
Join Date: Dec 2009
Location: Atlanta, Georgia
Posts: 404
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by fishbert

disappointed that guesses and rumor are all we have to go on, though. been a few days now and we are still patiently waiting for an official explanation from NAM. doesn't give much confidence.
(you'd think they'd be more open and transparent with the users about something like this, eh?)
Oh, god. Really?

Maybe they don't know exactly what caused it. Maybe they're working hard on tracking it down. Maybe there's really nothing to report.

Transparent, indeed.

Unless you're an Alliance member, I really can't see what you've got to complain about. You're not paying anything to use this site and the site owners don't owe you anything.
 
  #56  
Old 10-13-2010, 08:22 AM
ran-o-matic's Avatar
ran-o-matic
ran-o-matic is offline
4th Gear
Join Date: Jul 2009
Posts: 378
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Xeraux
Oh, god. Really?

Maybe they don't know exactly what caused it. Maybe they're working hard on tracking it down. Maybe there's really nothing to report.

Transparent, indeed.

Unless you're an Alliance member, I really can't see what you've got to complain about. You're not paying anything to use this site and the site owners don't owe you anything.
You didn't really say the vast majority of contributors to this site simply don't matter, did you? I think I'll pay my way with some content:

What happened when Google visited this site?
Of the 721 pages we tested on the site over the past 90 days, 9 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-10-11, and the last time suspicious content was found on this site was on 2010-10-11.
Malicious software includes 3 exploit(s).

Malicious software is hosted on 7 domain(s), including 4safe.in/, overskka.co.cc/, isteemps.co.cc/.

4 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including crabbeyroad.com/, 4safe.in/, isteemps.co.cc/.

This site was hosted on 2 network(s) including AS13897 (CDC1), AS25973 (MZIMA).
In any event, you're probably right in that the cause for the Google blacklist might not be easy to ID. Nine total pages our of 721 crawled could be the same bad ad on several pages or it could by a specific post made to several threads.
 
  #57  
Old 10-13-2010, 08:33 AM
ran-o-matic's Avatar
ran-o-matic
ran-o-matic is offline
4th Gear
Join Date: Jul 2009
Posts: 378
Likes: 0
Received 0 Likes on 0 Posts
One other thing - Google's crawl algorithm is know only to them, but they crawled the site twice (on Sunday and then again on Monday) and found baddies both times. They seem to have put crawling again on a back burner.
 
  #58  
Old 10-13-2010, 08:53 AM
fishbert's Avatar
fishbert
fishbert is offline
6th Gear
Join Date: Jul 2008
Location: Ohio
Posts: 1,174
Received 13 Likes on 8 Posts
If the cause wasn't easy to ID, then why has NAM said they already asked for reconsideration. Seems clear they know the cause, but even if they didn't, they could at least say that.

And regarding "just disable it"... that's not a smart move at all, as discussed previously. If you want to be reckless with your browser, fine; but advocating that to everyone else is nothing short of irresponsible.
 
  #59  
Old 10-13-2010, 09:26 AM
Xeraux's Avatar
Xeraux
Xeraux is offline
4th Gear
iTrader: (1)
Join Date: Dec 2009
Location: Atlanta, Georgia
Posts: 404
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by ran-o-matic
You didn't really say the vast majority of contributors to this site simply don't matter, did you? I think I'll pay my way with some content:



In any event, you're probably right in that the cause for the Google blacklist might not be easy to ID. Nine total pages our of 721 crawled could be the same bad ad on several pages or it could by a specific post made to several threads.
No. I didn't say they didn't matter, I said they're not owed anything by site owner/management.
 
  #60  
Old 10-13-2010, 09:35 AM
booktrout's Avatar
booktrout
booktrout is offline
3rd Gear
Join Date: Sep 2009
Posts: 260
Likes: 0
Received 0 Likes on 0 Posts
Not a False Positive.
My Norton log had a lot of activity since 10/3, they got in and changed some settings on my PC and it would not stay in sleep mode. Then last Friday the intrusion attacks began, one every 5 minutes or so from about 4 different URLs. I re-booted with the system disc and that restart seemed to fix it. And what about "gRay rAvEn", someone got in and changed his "NAM fav's" to show the logo of Motoring Underground.

I had been shopping for an anti-sway bar and clicked adds on the page, that is probably where I got the stuff.

I'm on my phone now and I don't want to go through that again. I guess I should have been using FF or Chrome insted of ie.
 

Last edited by booktrout; 10-13-2010 at 09:51 AM.
  #61  
Old 10-13-2010, 09:46 AM
MotorMouth's Avatar
MotorMouth
MotorMouth is offline
6th Gear
Join Date: Sep 2004
Location: Mililani,Hawaii
Posts: 3,821
Likes: 0
Received 1 Like on 1 Post
Originally Posted by Bigprfed22
just disable the setting, i am getting it now as well. I dont know what i would do with out it!

one time I couldn't open an e-mail because my anti-virus program kept saying it is a virus. I really wanted to open that e-mail so I uninstalled my anti-virus program so I could open the e-mail. pesky anti-virus program.
 
  #62  
Old 10-13-2010, 10:00 AM
daflake's Avatar
daflake
daflake is offline
6th Gear
Join Date: Sep 2005
Location: Laurel MD
Posts: 3,925
Likes: 0
Received 2 Likes on 2 Posts
Originally Posted by Xeraux
Oh, god. Really?



Unless you're an Alliance member, I really can't see what you've got to complain about. You're not paying anything to use this site and the site owners don't owe you anything.

Excuse me? I visit this site and trust that they are not infecting my computer with rogue scripts. As a non-Alliance member I have a LOT to complain about.
 
  #63  
Old 10-13-2010, 11:08 AM
beken's Avatar
beken
beken is offline
6th Gear
Join Date: Nov 2004
Location: Delta BC, Canada
Posts: 1,203
Received 21 Likes on 15 Posts
NAM was also being blocked by Safari and Opera browsers. Good to see the issue appears to be resolved.

I hope motorers went out driving instead of banging on their computers while this was going on.
 
  #64  
Old 10-13-2010, 11:30 AM
JumpingJackFlash's Avatar
JumpingJackFlash
JumpingJackFlash is offline
6th Gear
Join Date: Apr 2009
Location: Yorktown, VA
Posts: 1,361
Likes: 0
Received 4 Likes on 4 Posts
Still not resolved. Might also want to check the amount of traffic coming and going to NAM. Seems to be loading slower and slower.
 
  #65  
Old 10-13-2010, 12:05 PM
MotorMouth's Avatar
MotorMouth
MotorMouth is offline
6th Gear
Join Date: Sep 2004
Location: Mililani,Hawaii
Posts: 3,821
Likes: 0
Received 1 Like on 1 Post
Originally Posted by beken
Good to see the issue appears to be resolved.

FF is still blocking.
 
  #66  
Old 10-13-2010, 01:48 PM
Mysticeti's Avatar
Mysticeti
Mysticeti is offline
3rd Gear
Join Date: Jun 2010
Location: Southern NH
Posts: 158
Received 0 Likes on 0 Posts
What's up with the malware warning?

http://www.google.com/safebrowsing/d...nmotoring.com/

Not good.
 
  #67  
Old 10-13-2010, 01:59 PM
korby's Avatar
korby
korby is offline
6th Gear
Join Date: Mar 2007
Location: South Orange County
Posts: 3,735
Likes: 0
Received 0 Likes on 0 Posts
Owner should fix it .
 
  #68  
Old 10-13-2010, 02:02 PM
Capt_bj's Avatar
Capt_bj
Capt_bj is offline
OVERDRIVE
Join Date: Jul 2006
Location: Melbourne, FL
Posts: 7,040
Received 281 Likes on 237 Posts
I don't get this warning and this issue is posted in the wrong place
 
  #69  
Old 10-13-2010, 02:14 PM
Eric_Rowland's Avatar
Eric_Rowland
Eric_Rowland is offline
OVERDRIVE
iTrader: (3)
Join Date: May 2003
Location: Santa Cruz, CA
Posts: 13,374
Received 43 Likes on 38 Posts
Originally Posted by Norcal_Cyclist
It was a false positive based on hueristics, UNLESS NAM was hacked which I doubt. IE nor FF aren;t detecting anything, they are relying on a 3rd party to determine the relative security of a website.

Case in point performa Google search on NAM and use a link, you'll get the warning in IE FROM Google, not IE. However you can copy and paste the link and it will work fine since Google is no longer involved.
Not a false positive. My Avast identified overskka.co.cc (identified earlier in the thread) as malware a few days before Firefox blocked NAM as a 'reported attack site'.
 
  #70  
Old 10-13-2010, 02:16 PM
BGR Alex's Avatar
BGR Alex
BGR Alex is offline
2nd Gear
Join Date: Oct 2010
Posts: 65
Likes: 0
Received 0 Likes on 0 Posts
I get this warning.
 
  #71  
Old 10-13-2010, 02:26 PM
daflake's Avatar
daflake
daflake is offline
6th Gear
Join Date: Sep 2005
Location: Laurel MD
Posts: 3,925
Likes: 0
Received 2 Likes on 2 Posts
There is already a thread on this...

https://www.northamericanmotoring.co...ed-attack.html

If you have IE you will not get an error. Why? Because Microsoft does not use this service. Thus they let you drive right to the site that could possibly infect your PC. FF and Safari users are warned which is what you are seeing. According to Drew (moderator) they have corrected the problem and are waiting for Google to remove them from the blacklist.
 
  #72  
Old 10-13-2010, 03:05 PM
Xeraux's Avatar
Xeraux
Xeraux is offline
4th Gear
iTrader: (1)
Join Date: Dec 2009
Location: Atlanta, Georgia
Posts: 404
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by daflake
Excuse me? I visit this site and trust that they are not infecting my computer with rogue scripts. As a non-Alliance member I have a LOT to complain about.
Oh, good grief.

I guess I need to be very, very specific. They're working on it. The site owners don't owe us a play-by-play, hour-by-hour dialogue of what exactly is happening. They're not keeping mum because they're hiding something. It's not a conspiracy. They're losing money because people can't get here. The ad servers aren't serving up as many page views, people aren't clicking on the ads. That's costing them money that's needed to keep the site open and free. It's in their best interests to get this sorted out as quickly as possible.

They'll update us when they feel it's necessary and productive.
 
  #73  
Old 10-13-2010, 05:05 PM
daflake's Avatar
daflake
daflake is offline
6th Gear
Join Date: Sep 2005
Location: Laurel MD
Posts: 3,925
Likes: 0
Received 2 Likes on 2 Posts
Originally Posted by Xeraux
Oh, good grief.

I guess I need to be very, very specific. They're working on it. The site owners don't owe us a play-by-play, hour-by-hour dialogue of what exactly is happening. They're not keeping mum because they're hiding something. It's not a conspiracy. They're losing money because people can't get here. The ad servers aren't serving up as many page views, people aren't clicking on the ads. That's costing them money that's needed to keep the site open and free. It's in their best interests to get this sorted out as quickly as possible.

They'll update us when they feel it's necessary and productive.
Don't snap at me because I responded to your poorly written post. It was very clear what you said. Next time read what you write before you post it.

As for the rest, I never said that they owed us an explanation but it would be nice to know what is going on as peoples computers might be infected. Do they owe us a play by play? No, but they do need to tell us what exactly users might be facing and let them know if there is a possibility that their machines need some TLC.
 
  #74  
Old 10-13-2010, 05:13 PM
ZippyNH's Avatar
ZippyNH
ZippyNH is offline
6th Gear
iTrader: (1)
Join Date: Sep 2009
Location: Southern NH
Posts: 12,605
Likes: 0
Received 34 Likes on 34 Posts
Originally Posted by daflake
Yes it is, but as you said, I wouldn't simply dismiss the warning as a "false positive". Something happend to get them blacklisted which was my point.

As for NAM, they should let folks know what happened as it really can affect everyone that visits the site.

The exploit/hack that was done to this site is an issue related to the software platform that this site runs on. Other sites, including another Mini site, that use a similar software platform has also been attacked, hacked, and subsequently patched in the past few weeks.
It is just dumb bad luck if the site a webmaster runs gets inspected by the Google web crawler before your site gets flagged...here, being a large site, that must be frequently indexed by Google, it was checked, mostly likely a couple times in short succession, perhaps as the techs were already working on fixing it.
The management at "the other site" that had a similar issues knows this stuff happens...no software is perfect...patches get applied, and sometimes folks find a "zero day exploit", an un-patched, newly discovered flaw, and take advantage of it. Crap happens...crap gets fixed, and you security umbrella works as a buffer to help+protect you and your computer.
Keep you computer patched, up to date, and if a site has an unknown issues, be-careful...
Remember, Firefox and chrome was just tring to protect you...more than IE ever did!! As with any safeguard, it takes a few days to verify all has been set right, and ensure there is no threat.


Edit: I would like to state that in all my research, about 90% says this type of attack is mainly an attempt to steal Add revenue....IT USUALLY DOES NOT have the pages installing "bad software"...it is still possible..but most reports of this attack..going back to FEBRUARY has to theft of advertising revenue. The Software support people do recommend that users change passwords, since the installer of the hack did gain unauthorized access to deep portions of the software...and anything was possible.
Thanks Matt, AKA DR O for tracking down the support sites, and a few useful threads to add the ones I had found!!
 

Last edited by ZippyNH; 10-18-2010 at 02:02 PM.
  #75  
Old 10-13-2010, 05:38 PM
burley's Avatar
burley
burley is offline
6th Gear
iTrader: (4)
Join Date: Jul 2007
Location: Chicago/NE Iowa
Posts: 1,840
Received 69 Likes on 53 Posts
Still getting the warnings... pretty annoying.
 


Quick Reply: Reported attack



All times are GMT -7. The time now is 11:53 AM.