Amibay Hacked?

FOL · 11 May 2012, 23:34

It appears amibay has been hacked, anyone going there should scan for malware / viruses.

Web Attack: Malicious Website Accessed dsyoylhbg.usa.cc (146.185.255.235, 80),dsyoylhbg.usa.cc/d/404.php?go=1

Im guessing they have worked out by now its been hacked.

scrappysphinx · 12 May 2012, 00:07

You can still access Amibay if you go directly to a thread or post and then click the new posts button but the main homepage has been attacked and contains some redirct or java exploit or something along those lines.

Click here to read the thread

rockape · 12 May 2012, 01:08

Hi,

I tried logging into Amibay using an A1200 and got:

"Unable to add cookies, header already sent.
File: /homepages/1/d277227762/htdocs/amibay/forum/index.php(1) : eval()'d code
Line: 7"

Regards, Michael

aka rockape

jabsy · 12 May 2012, 01:13

I just checked and NOD32 popped up with:

12/05/2012 8:42:35 AM HTTP filter file http://ysavlxaw.usa.cc/main.php?page=c69bd02e93e6957c JS/Kryptik.NN trojan connection terminated - quarantined Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe.

Bastards.

prowler · 12 May 2012, 01:33

@rockape, jabsy:

There was already an EAB thread started on this subject. I have merged them.

I.Did · 12 May 2012, 09:55

Quote:

Originally Posted by scrappysphinx

You can still access Amibay if you go directly to a thread or post and then click the new posts button but the main homepage has been attacked and contains some redirct or java exploit or something along those lines.

Click here to read the thread

I'm not a member over at Amibay. What I get using your link is the reg. screen. Guess they are still working on it, the poor guys

ElectroBlaster · 12 May 2012, 13:16

Brilliant! So thats where my little bug came from! ZoneAlarm came up with this:

Exploit.JS.Pdfka.fof

This happend late last night/early hours of the morning and mainly because I tend to leave the machine running with certain pages up and just forget about it if im busy.

Why would anyone hack Amibay??? disgruntled kid? somebody jealous?

DDNI · 12 May 2012, 14:50

Quote:

Originally Posted by ElectroBlaster

Brilliant! So thats where my little bug came from! ZoneAlarm came up with this:

Exploit.JS.Pdfka.fof

This happend late last night/early hours of the morning and mainly because I tend to leave the machine running with certain pages up and just forget about it if im busy.

Why would anyone hack Amibay??? disgruntled kid? somebody jealous?

Hmmm top three suspects.

Bill McEwan
Hans (doomy)
Some moobunny moron

Outside guess CUSA

Leffmann · 12 May 2012, 15:46

It's a widespread attack all over the Internet, Amibay hasn't been specifically targetted.

desiv · 12 May 2012, 15:46

Quote:

Originally Posted by ElectroBlaster

Why would anyone hack Amibay??? disgruntled kid? somebody jealous?

Apparently it's not just Amibay and it's not just Amiga sites...

Life on the Internet....

desiv
(Actually, life on the Internet is generally very kual; this just happens..)

discomeats · 12 May 2012, 17:34

Quote:

Originally Posted by DDNI

Hmmm top three suspects.

Bill McEwan
Hans (doomy)
Some moobunny moron

Outside guess CUSA

But surely Doomy would use a non detectable milspec attack using nasa gear

1time · 12 May 2012, 18:43

http://www.classicamiga.com/ is down.

Getting
Exploit:Java/CVE-2012-0507.BB
Exploit:JS/BLACOLE.DG

spannernick · 12 May 2012, 18:46

If you have tapatalk on you phone you can access the site fine ..

12 May 2012, 19:27

Sorry to post this here guys but since many of Amibays members are present here I have only this site as a means of contacting people.

It appears that Amibay has disappeared from the interwebs

www.amibay.com

Anyone know what's up? It has been down since this morning and now appears to have disappeared altogether.

lilalurl · 12 May 2012, 19:40

Hacked it seems:
http://eab.abime.net/showthread.php?t=64277

johnim · 12 May 2012, 19:46

not down just use a link from thead
http://www.amibay.com/showthread.php?t=29442

not the main page

fitzsteve · 12 May 2012, 19:46

Don't click on the link in post 1 as the index page is forwarding to a virus ridden link, you can still access Amibay via all other url's, just the index page is affected by this hack.

This link will give you new posts:

http://www.amibay.com/search.php?searchid=2178832

Steve.

keitha1200 · 12 May 2012, 19:49

Noticed that lastnight

Gee I can think of hundreds of other sites which deserved to be hacked! but amibay!!!

Suspects:

Crayons USA lack the technical knowledge!
Bill's too busy cutting out coupons from the newspaper
The others??? watching the Disney channel?

johnim · 12 May 2012, 19:50

Sadly a lot of sites have been targeted over the last few days - those that are running VB forum / Joomla and other CMS systems

The attack was at a site root level and has modified some of the templates of the site (namely the index.html) and injects a small line of code that uses a Jscript redirect to the place you were sent.

Please be advised my friend that this site attempts to install MalWare onto ones Windows PC.

Please check your system, and ensure that your JavaScript settings are secure.

Jimbo · 12 May 2012, 20:10

Quote:

Originally Posted by johnim

Sadly a lot of sites have been targeted over the last few days - those that are running VB forum / Joomla and other CMS systems

The attack was at a site root level and has modified some of the templates of the site (namely the index.html) and injects a small line of code that uses a Jscript redirect to the place you were sent.

Please be advised my friend that this site attempts to install MalWare onto ones Windows PC.

Please check your system, and ensure that your JavaScript settings are secure.

Yeah my antivirus (microsoft security essentials) went mental and stuck stuff into quarantine from classicamiga and amibay websites when I tried to load said pages.

11 May 2012, 23:34	#1
FOL PSPUAE DEV Join Date: Nov 2006 Location: Wales / UK Age: 45 Posts: 5,999	Amibay Hacked? It appears amibay has been hacked, anyone going there should scan for malware / viruses. Web Attack: Malicious Website Accessed dsyoylhbg.usa.cc (146.185.255.235, 80),dsyoylhbg.usa.cc/d/404.php?go=1 Im guessing they have worked out by now its been hacked.

12 May 2012, 01:08	#3
rockape Registered User Join Date: Feb 2010 Location: Lincolnshire, England. Age: 75 Posts: 167	"Amibay Hacked Beware ! " Hi, I tried logging into Amibay using an A1200 and got: "Unable to add cookies, header already sent. File: /homepages/1/d277227762/htdocs/amibay/forum/index.php(1) : eval()'d code Line: 7" Regards, Michael aka rockape

12 May 2012, 19:27	#14
AmiNeo Posts: n/a	AMIBAY down? Sorry to post this here guys but since many of Amibays members are present here I have only this site as a means of contacting people. It appears that Amibay has disappeared from the interwebs www.amibay.com Anyone know what's up? It has been down since this morning and now appears to have disappeared altogether. Last edited by AmiNeo; 12 May 2012 at 19:33.

12 May 2012, 19:49	#18
keitha1200 Registered User Join Date: Feb 2012 Location: Tayside Posts: 181	Noticed that lastnight Gee I can think of hundreds of other sites which deserved to be hacked! but amibay!!! Suspects: Crayons USA lack the technical knowledge! Bill's too busy cutting out coupons from the newspaper The others??? watching the Disney channel? Last edited by keitha1200; 12 May 2012 at 19:59. Reason: didn't realise it was a www attack

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
EAB hacked? No!	oRBIT	project.EAB	13	18 January 2012 22:47
DungeonMaster 2.0 (hacked for HD) with KS 3.1	Gaula92	support.Games	10	08 October 2011 16:13
BBOAH Hacked?!?!	Fingerlickin_B	Amiga scene	8	14 November 2008 18:25
Dream17 hacked	squirminator2k	Amiga scene	8	07 September 2008 10:22
Amiga.com hacked !	RCK	Amiga scene	34	29 December 2002 01:01

12 May 2012, 00:07	#2
scrappysphinx Registered User Join Date: Jan 2008 Location: Nottingham Age: 39 Posts: 480	You can still access Amibay if you go directly to a thread or post and then click the new posts button but the main homepage has been attacked and contains some redirct or java exploit or something along those lines. Click here to read the thread

12 May 2012, 01:13	#4
jabsy Yeah Hup! Join Date: May 2006 Location: Australia Age: 54 Posts: 345	I just checked and NOD32 popped up with: 12/05/2012 8:42:35 AM HTTP filter file http://ysavlxaw.usa.cc/main.php?page=c69bd02e93e6957c JS/Kryptik.NN trojan connection terminated - quarantined Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe. Bastards.

12 May 2012, 01:33	#5
prowler Global Moderator Join Date: Aug 2008 Location: Sidcup, England Posts: 10,300	@rockape, jabsy: There was already an EAB thread started on this subject. I have merged them.

12 May 2012, 13:16	#7
ElectroBlaster Junior Member Join Date: Mar 2002 Location: Exeter, Devon, UK Age: 49 Posts: 1,705	Brilliant! So thats where my little bug came from! ZoneAlarm came up with this: Exploit.JS.Pdfka.fof This happend late last night/early hours of the morning and mainly because I tend to leave the machine running with certain pages up and just forget about it if im busy. Why would anyone hack Amibay??? disgruntled kid? somebody jealous?

12 May 2012, 15:46	#9
Leffmann Join Date: Jul 2008 Location: Sweden Posts: 2,269	It's a widespread attack all over the Internet, Amibay hasn't been specifically targetted.

12 May 2012, 18:43	#12
1time Amiga Lover Join Date: Jan 2010 Location: Stockholm / Sweden Age: 46 Posts: 612	http://www.classicamiga.com/ is down. Getting Exploit:Java/CVE-2012-0507.BB Exploit:JS/BLACOLE.DG

12 May 2012, 18:46	#13
spannernick Retro Nuts Join Date: Aug 2004 Location: London/UK Age: 53 Posts: 1,184	If you have tapatalk on you phone you can access the site fine ..

12 May 2012, 19:40	#15
lilalurl Global Moderator Join Date: Aug 2001 Location: France Posts: 3,289	Hacked it seems: http://eab.abime.net/showthread.php?t=64277

12 May 2012, 19:46	#16
johnim Amibay Mod/Staff Join Date: Jun 2010 Location: birmingham uk Age: 48 Posts: 1,019	not down just use a link from thead http://www.amibay.com/showthread.php?t=29442 not the main page

12 May 2012, 19:46	#17
fitzsteve Professional slacker! Join Date: Jul 2009 Location: Kent, UK Age: 44 Posts: 6,683	Don't click on the link in post 1 as the index page is forwarding to a virus ridden link, you can still access Amibay via all other url's, just the index page is affected by this hack. This link will give you new posts: http://www.amibay.com/search.php?searchid=2178832 Steve.

12 May 2012, 19:50	#19
johnim Amibay Mod/Staff Join Date: Jun 2010 Location: birmingham uk Age: 48 Posts: 1,019	Sadly a lot of sites have been targeted over the last few days - those that are running VB forum / Joomla and other CMS systems The attack was at a site root level and has modified some of the templates of the site (namely the index.html) and injects a small line of code that uses a Jscript redirect to the place you were sent. Please be advised my friend that this site attempts to install MalWare onto ones Windows PC. Please check your system, and ensure that your JavaScript settings are secure.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)