Amibay Hacked?

[FOL]

It appears amibay has been hacked, anyone going there should scan for malware / viruses.

Web Attack: Malicious Website Accessed dsyoylhbg.usa.cc (146.185.255.235, 80),dsyoylhbg.usa.cc/d/404.php?go=1

Im guessing they have worked out by now its been hacked.

[scrappysphinx]

You can still access Amibay if you go directly to a thread or post and then click the new posts button but the main homepage has been attacked and contains some redirct or java exploit or something along those lines.

Click here to read the thread

[rockape]

Hi,

I tried logging into Amibay using an A1200 and got:

"Unable to add cookies, header already sent.
File: /homepages/1/d277227762/htdocs/amibay/forum/index.php(1) : eval()'d code
Line: 7"

Regards, Michael

aka rockape

[jabsy]

I just checked and NOD32 popped up with:

12/05/2012 8:42:35 AM HTTP filter file http://ysavlxaw.usa.cc/main.php?page=c69bd02e93e6957c JS/Kryptik.NN trojan connection terminated - quarantined Threat was detected upon access to web by the application: C:\Program Files\Mozilla Firefox\firefox.exe.

Bastards.

[prowler]

@rockape, jabsy:

There was already an EAB thread started on this subject. I have merged them.

[I.Did]

Originally Posted by scrappysphinx

You can still access Amibay if you go directly to a thread or post and then click the new posts button but the main homepage has been attacked and contains some redirct or java exploit or something along those lines.

Click here to read the thread

I'm not a member over at Amibay. What I get using your link is the reg. screen. Guess they are still working on it, the poor guys

[ElectroBlaster]

Brilliant! So thats where my little bug came from! ZoneAlarm came up with this:

Exploit.JS.Pdfka.fof

This happend late last night/early hours of the morning and mainly because I tend to leave the machine running with certain pages up and just forget about it if im busy.

Why would anyone hack Amibay??? disgruntled kid? somebody jealous?

[DDNI]

Originally Posted by ElectroBlaster

Brilliant! So thats where my little bug came from! ZoneAlarm came up with this:

Exploit.JS.Pdfka.fof

This happend late last night/early hours of the morning and mainly because I tend to leave the machine running with certain pages up and just forget about it if im busy.

Why would anyone hack Amibay??? disgruntled kid? somebody jealous?

Hmmm top three suspects.

Bill McEwan
Hans (doomy)
Some moobunny moron

Outside guess CUSA

[Leffmann]

It's a widespread attack all over the Internet, Amibay hasn't been specifically targetted.

[desiv]

Originally Posted by ElectroBlaster

Why would anyone hack Amibay??? disgruntled kid? somebody jealous?

Apparently it's not just Amibay and it's not just Amiga sites...

Life on the Internet....

desiv
(Actually, life on the Internet is generally very kual; this just happens..)

[discomeats]

Originally Posted by DDNI

Hmmm top three suspects.

Bill McEwan
Hans (doomy)
Some moobunny moron

Outside guess CUSA

But surely Doomy would use a non detectable milspec attack using nasa gear

[1time]

http://www.classicamiga.com/ is down.

Getting
Exploit:Java/CVE-2012-0507.BB
Exploit:JS/BLACOLE.DG

[spannernick]

If you have tapatalk on you phone you can access the site fine ..

[AmiNeo]

Sorry to post this here guys but since many of Amibays members are present here I have only this site as a means of contacting people.


It appears that Amibay has disappeared from the interwebs


www.amibay.com


Anyone know what's up? It has been down since this morning and now appears to have disappeared altogether.

[lilalurl]

Hacked it seems:
http://eab.abime.net/showthread.php?t=64277

[johnim]

not down just use a link from thead
http://www.amibay.com/showthread.php?t=29442

not the main page

[fitzsteve]

Don't click on the link in post 1 as the index page is forwarding to a virus ridden link, you can still access Amibay via all other url's, just the index page is affected by this hack.

This link will give you new posts:

http://www.amibay.com/search.php?searchid=2178832

Steve.

[keitha1200]

Noticed that lastnight Gee I can think of hundreds of other sites which deserved to be hacked! but amibay!!!

Suspects:

Crayons USA lack the technical knowledge!
Bill's too busy cutting out coupons from the newspaper
The others??? watching the Disney channel?

[johnim]

Sadly a lot of sites have been targeted over the last few days - those that are running VB forum / Joomla and other CMS systems

The attack was at a site root level and has modified some of the templates of the site (namely the index.html) and injects a small line of code that uses a Jscript redirect to the place you were sent.

Please be advised my friend that this site attempts to install MalWare onto ones Windows PC.

Please check your system, and ensure that your JavaScript settings are secure.

[Jimbo]

Originally Posted by johnim

Sadly a lot of sites have been targeted over the last few days - those that are running VB forum / Joomla and other CMS systems

The attack was at a site root level and has modified some of the templates of the site (namely the index.html) and injects a small line of code that uses a Jscript redirect to the place you were sent.

Please be advised my friend that this site attempts to install MalWare onto ones Windows PC.

Please check your system, and ensure that your JavaScript settings are secure.

Yeah my antivirus (microsoft security essentials) went mental and stuck stuff into quarantine from classicamiga and amibay websites when I tried to load said pages.

[Merlin]

The home page has been repaired now.

It's a variant of the Blackhole Exploit that's doing the rounds. It messes up the home page then tries to download malware using Javascript.

We've removed the malicious code, so everything's back to normal now.

[prowler]

Thanks for the update, Merlin!

As this thread has served its purpose, and I've had to remove some trolling, I'm closing it now.