Post by: Paddy on January 28, 2009, 12:06:03 PM
The situation is this - everyone but Chris' wife can get to his site, http://www.chriskleeman.com with no problems whatsoever. When she attempts to get there, she gets a Google malware warning. But the malware warning references an IP number that is NOT Chris' (an ASO hosted site, like this one) but an IP owned by notorious spam/phisher/cybercriminal hosts hostfresh.com from Hong Kong.
When either Chris or I use Google's webmaster tools to check out Chris' site, there is no problem whatsoever. When she does it - again, all sorts of problems reported and again, the IP number is one that belongs to hostfresh.com, not ASmallOrange.
Needless to say, Chris' site is clean. The only thing I can think of is that Chris' wife's Macbook is infected with the DNS Changer trojan, although as far as I know this is the only problem she's had. She has flushed the cache etc.; and the problem happens at both school and at home, so it's not the router. We're a bit stumped at this point.
See both images to see what Google reports for the IP that ISN'T Chris'. (Chris' IP is 207.210.105.84)
Post by: RNKIII on January 28, 2009, 12:26:00 PM
I get the same warning message when I click on the link provided in the post above.
Did NOT go any farther than that and cancelled out!!!
Bob K. rnkiii
Post by: Paddy on January 28, 2009, 12:34:27 PM
What IP address did you see in the malware warning? (Yes, please click on it again.
)Note - it's highly unlikely that there is anything there that would be a problem on a Mac. I just get a blank page when I go to either of the IPs and there is nothing in the source code for either page.
Post by: RNKIII on January 28, 2009, 12:49:15 PM
Bob K. rnkiii
Post by: Paddy on January 28, 2009, 02:03:07 PM
It has now been removed. I still don't know HOW it got there - along with the pureftpd file that was stuck in the public_html folder. I'm hoping ASO can tell me how this happened and how to prevent it, but no word from them so far.
I'm going to look through the rest of the pages to make sure there is nothing else lurking.
BTW - when I went to the site on my MBP instead of the MacPro, I got the warning too.
Post by: jcarter on January 28, 2009, 02:09:02 PM
Jane
Post by: RNKIII on January 28, 2009, 02:09:21 PM
Bob K. rnkiii
Post by: Paddy on January 28, 2009, 02:15:34 PM
Post by: chriskleeman on January 28, 2009, 02:22:27 PM
QUOTE(Paddy @ Jan 28 2009, 03:15 PM) <{POST_SNAPBACK}>
Yeah - I've gotten rid of the *&^^% javascript that was the cause of all this. But the question remains...how did it get there to begin with? A server security hole? I'm awaiting ASO's response.
Gone now from my wife's MacBook Paddy, that did the trick! We're both home today hunkered down for this snowstorm, so the computers have been humming along off and on all day.
Yes, the question is, indeed, how did it get there?
And why Bob and Michelle's computers? 
Thanks Paddy!
Chris K
Post by: tacit on January 28, 2009, 02:33:17 PM
The problem isn't actually with "chriskleeman.com". The problem originated with "sciencepunk.com".
The IP address 116.50.15.25 is being used for "shared hosting," meaning that more than one Web site lives on that IP address. This is actually very common; most low-cost Web hosting services use shared hosting. It's a system where many Web sites--from several hundred to, in some cases, a thousand or more--are all stored on the same server and all live on the same IP address. When you get a shared hosting account, your Web site is stored on a Web server along with other sites.
The advantage of shared hosting is that it's cheap, because the hosting company does not need to buy one server computer for each site they host. (Dedicated server hosting, where your Web site is the only site stored on a server, is far more expensive; typically starting at twelve times the cost per month of shared hosting, and with high-bandwidth Web sites can easily be a hundred times the cost per month or more.)
The disadvantage of shared hosting is that if one Web site has a security problem, it can affect other Web sites on the same server.
chriskleeman.com and sciencepunk.com (and many other sites) all live on the same server. On January 20, sciencepunk.com was hacked by Russian organized crime. The hack allowed them root access to the server, which allowed them to then place malicious code on every Web site on that server, including chriskleeman.com. Since the Google malware warning blacklist lists sites by IP address, and since the hackers had breached every site living on that address, chriskleeman.com was blacklisted.
sciencepunk.com was running an outdated, insecure version of WordPress, which is how the hack occurred.
There is a lesson in here for everyone running any kind of software on a Web server: it is absolutely vital that anyone running software such as WordPress, UBBthreads, phpNuke, phpBB, Forumer, or any other server-side program to be absolutely religious about keeping track of updates and installing them as soon as they come out. A person who fails to do so is at high risk of being hacked. The hackers don't even have to know about your site; they use automated tools that scan the internet automatically to search for outdated versions of popular server-side software.
Post by: jcarter on January 28, 2009, 02:37:33 PM
I was curious about this too.
Its turned to rain here, pouring, and its one holy mess, because its all ice under it.
Jane
Post by: Xairbusdriver on January 28, 2009, 03:11:49 PM
Anyway...
The site seems to be working fine now except for the pictures of Chris. Is he supposed to be that ugly?!
Post by: Paddy on January 28, 2009, 03:16:15 PM
As I noted - 116.50.15.25 IS NOT Chris' IP address. That IP belongs to hostfresh.com - a notorious Hong Kong spam/criminal host. chriskleeman.com and sciencepunk.com are NOT hosted by the same host. chriskleeman.com is hosted by A Small Orange - the same host that this site uses.
There was some sort of redirect going on as far as I can tell; I did find a javascript that had been injected into the index page for the site. It has now been removed. I still don't know how it got there, and that is worrying. Chris' IP is not on any blacklists that I checked
I also found a pureftpd. file (with a bunch of numbers after it) that I KNOW I didn't put on the site. It was in the public_html folder and I've removed that too. PureFTPD is an ftp server - I don't know what this file actually was since it had no extension and opening it in TextEdit just yielded a lot of gibberish, though the word "iTunes" showed a couple of times in the first block of text at the top. It was 880Kb or so.
I just got a response from ASO, which really wasn't all that helpful. He didn't provide any info on the how or why and simply suggested updating any software we were running. We're NOT running any software, other than PHP, which is the very latest version. No blogs, no forums, no MySQL... He also suggested we change the password(s) - no problem, but is that all we can do?
GRRRR....
Post by: Paddy on January 28, 2009, 05:52:36 PM
And the pureftpd file was nothing to worry about - ASO use pureftpd and that was in fact some sort of temporary file that gets put there while FTPing is going on. I'm not sure why it was so persistent, but not going to expend any more mental energy on it.
Post by: tacit on January 31, 2009, 02:55:47 PM
QUOTE(Paddy @ Jan 28 2009, 09:16 PM) <{POST_SNAPBACK}>
Tacit, I'm not sure whether your explanation actually applies.
As I noted - 116.50.15.25 IS NOT Chris' IP address. That IP belongs to hostfresh.com - a notorious Hong Kong spam/criminal host. chriskleeman.com and sciencepunk.com are NOT hosted by the same host. chriskleeman.com is hosted by A Small Orange - the same host that this site uses.
There was some sort of redirect going on as far as I can tell; I did find a javascript that had been injected into the index page for the site. It has now been removed. I still don't know how it got there, and that is worrying. Chris' IP is not on any blacklists that I checked
As I noted - 116.50.15.25 IS NOT Chris' IP address. That IP belongs to hostfresh.com - a notorious Hong Kong spam/criminal host. chriskleeman.com and sciencepunk.com are NOT hosted by the same host. chriskleeman.com is hosted by A Small Orange - the same host that this site uses.
There was some sort of redirect going on as far as I can tell; I did find a javascript that had been injected into the index page for the site. It has now been removed. I still don't know how it got there, and that is worrying. Chris' IP is not on any blacklists that I checked
Right you are. Mea culpa; the redirect was happening so fast I was seeing 116.50.15.25 as the Web site's address. Oops!
QUOTE(Paddy @ Jan 28 2009, 09:16 PM) <{POST_SNAPBACK}>
I also found a pureftpd. file (with a bunch of numbers after it) that I KNOW I didn't put on the site. It was in the public_html folder and I've removed that too. PureFTPD is an ftp server - I don't know what this file actually was since it had no extension and opening it in TextEdit just yielded a lot of gibberish, though the word "iTunes" showed a couple of times in the first block of text at the top. It was 880Kb or so.
PureFTP is the FTP server used by the ISP. When you upload a file, PureFTP uploads it to a temporary file, then at the end of the upload renames the temporary file to the correct name. You will see those PureFTP files any time you do an upload that gets interrupted.
QUOTE(Paddy @ Jan 28 2009, 09:16 PM) <{POST_SNAPBACK}>
I just got a response from ASO, which really wasn't all that helpful. He didn't provide any info on the how or why and simply suggested updating any software we were running. We're NOT running any software, other than PHP, which is the very latest version. No blogs, no forums, no MySQL... He also suggested we change the password(s) - no problem, but is that all we can do?
GRRRR....
GRRRR....
Hackers are using brute-force dictionary attacks against Web sites, looking for FTP passwords, so that's a good place to start. My FTP passwords use a combination of upper and lowercase letters and numbers.
Post by: Paddy on January 31, 2009, 03:35:52 PM
Our new password is also a combination of upper and lower case letters and numbers. I typically do that now with most sites I administer.
Post by: Xairbusdriver on January 31, 2009, 07:10:50 PM
I'm no expert but it would seem their security measures should have help keep this kind of thing from happening. Or did I misunderstand that other sites on the same server were affected by the malware placed on one of the first site?
Post by: Paddy on January 31, 2009, 08:37:14 PM
So, just to recap in case anyone is muddled: the hackers broke into Chris' site and placed some javascript on Chris' home page which appeared to do nothing more than redirect to a site called sciencepunk.com which is hosted by a Hong Kong ISP who are notorious for turning a blind eye to scammers and having lousy security. The sciencepunk.com web site was compromised by the hackers as well; it was running out of date blog software with security holes. Whatever the hackers did to the sciencepunk.com web site caused the Malware warning in Google to pop up whenever you attempted to go to Chris' site - because of course, you were immediately redirected to the malware-infested site on the server in Hong Kong. The owner of sciencepunk.com has now revamped his site (no mention of being hacked, however) and the javascript has been removed from Chris' site. ASO don't know how the hackers got into Chris' site, but I think the best guess is via a brute force attack (the password wouldn't have been found in any dictionary).
Interesting stats on passwords and how long it takes to crack them:
http://lastbit.com/rm_bruteforce.asp
Kinda makes you think, doesn't it?
Post by: chriskleeman on February 01, 2009, 02:05:03 AM
Chris K
Post by: Xairbusdriver on February 01, 2009, 01:59:07 PM
Post by: Mayo on February 01, 2009, 02:24:27 PM
Password length: 12 characters
Speed: 500,00 passwords/second
One computer undertaking the brute force attack
My password contains: Characters in lower case, characters in upper case, digits and common punctuation.
Estimated time required to crack my password: 1,733,781,599 years
Hmmm... That seems secure enough to me!
Post by: Xairbusdriver on February 01, 2009, 02:49:11 PM
And besides, are those human or 'computer' years?!
Post by: Mayo on February 01, 2009, 03:07:07 PM
I received a free license months ago via MacWorld Mac Gems. I can't say that I understand the upgrade info window that appeared when I started up 1Password, but all seems to be working well after importing my Keychain and Web Confidential data...
I never bothered to configure 1Password because it seemed like too much trouble. But now that I am using DEVONagent, NetNewsWire and sometimes Firefox, being able to utilize 1Password's cross-browser functions is a real plus. I often find myself opening Web sites in Safari that I originally navigated to in NetNewsWire simply because the auto-fill functions were tied to Safari. 1Password will save me from performing multiple steps and I may even stop using Web Confidential once I figure out how 1Password works.
QUOTE
are those human or 'computer' years?
I believe that they are "dog" years...
Post by: Paddy on February 01, 2009, 04:38:54 PM
Chris' new password has the same criteria as yours, Mayo. Think we should be reasonably safe from the brute force guys now, though of course, that length of time is the longest possible time it would take to crack the PW, not the shortest!
I use 1password too - very handy.
I should probably change some of my other passwords, though. Sigh.
Post by: Mayo on February 01, 2009, 05:36:21 PM
The MacGems license was for 2.4x versions but it was extended to 2.5x. Since 1Password is now at 2.9x an upgrade is required to use a later version than 2.5.13.
So I have the current version (2.9.8) running on my iMac and 2.5.5 on my MBP...
So 1Password users: is it worth it to spend $39.95-15% to upgrade?
Paddy, on most Web sites I use the same common word because I do not perceive there to be a reason anyone would want to post comments under my name, etc. I allow the auto-fill function to work on those Web sites. Financial Web sites, encrypted files, etc. get more secure passwords.
I don't allow auto-fill on those Web sites because I let the Apple Keychain open automatically upon start-up; I need to figure out how this works in 1Password. (I must admit that my understanding of how Keychains work is lacking...)