Odd chatbox message

by marlamin1 February 24th 2011, 8:26 am

Spoiler:

This message keeps popping up whenever my members or I try to type something in my site's chatbox. I was wondering if it was legit or if it was a hacker attempting to gain our member's usernames and passwords...

Any insight would be appreciated.

by Sanket February 25th 2011, 9:58 am

Your forum url? Does it happen for all browsers?

by marlamin1 February 25th 2011, 1:28 pm

www.thebleachworld.darkbb.com

Browser: Google Chrome

I just tried it in another browser (Internet Explorer) and did not receive the message, however I doubted that the other two members who corroborated my findings both used the same browser as me (Google Chrome) so I just tried it again on my original browser. Once again, no message...

I don't think it was some one time thing because I've been checking periodically to see if it was fixed and as of 2:00AM Eastern last night it was still giving me the message.

I feel that this problem will arise again in the future so I am going to keep my chatbox disabled until I know what happened and if it was supposed to do that or not...

by samthelost February 25th 2011, 1:52 pm

Yeah we got the same message and now someone's hacked our forum.

by marlamin1 February 25th 2011, 4:08 pm

Thank god I'm paranoid then! Razz

The message first appeared when this new user I was suspicious of joined my chatbox. Any chance some new person joined your site recently as well samthelost? If so it may be related...

by samthelost February 25th 2011, 4:10 pm

marlamin1 wrote:Thank god I'm paranoid then!
The message first appeared when this new user I was suspicious of joined my chatbox. Any chance some new person joined your site recently as well samthelost? If so it may be related...

Well we get quite a lot of new users, but apparently it came up when someone joined the chatbox.

by marlamin1 February 25th 2011, 4:11 pm

Any clue what the email they used to register or the IP address were? I could see if it matches our suspect...

by samthelost February 25th 2011, 4:12 pm

I have no idea sorry. We've lost all access to our site and whoever hacked it put it in maintenance.

by marlamin1 February 25th 2011, 4:13 pm

Have you tried the utilities to regain access? Or aren't you the founder?

by samthelost February 25th 2011, 4:13 pm

marlamin1 wrote:Have you tried the utilities to regain access? Or aren't you the founder?

Nope i'm not the founder, we're waiting on forumotion to try and get our site back.

by marlamin1 February 25th 2011, 4:15 pm

Well best of luck to you and your forum. I just hope we can start using our chatbox again soon without having to worry about meeting the same fate. Though if we were to get hacked, I have access to the founder account so I could easily revert to a previous backup but that's a b!tch to do...

by ToTheFuture February 26th 2011, 4:57 pm

Another similar issue? Oh dear, now I'm scared. How do you gain access to the founder account? Or is it just if you're the person who originally created the site?

by Sanket February 26th 2011, 5:10 pm

Yes the one who originally created the site.

by ToTheFuture February 26th 2011, 5:29 pm

So then reverting to a previous backup would mean...?
Sorry I don't know anything, I'm still adjusting. Razz

And is there any way that forumotion would be able to stop the hacker? He/she seems to be causing a lot of havoc recently. Shocked

by marlamin1 February 26th 2011, 5:56 pm

Yeah, they should be able to do something. Hence why I'm here Razz

We need teh anti-hacking squad to roll in nao

by Artemis February 26th 2011, 10:18 pm

Hello all, I am another concerned member of the bleach world forum.

I would like to make a note that if you follow the address that is given in the pop up message you get a site that is hosted by T35 Web Hosting holding with a few links at the top but otherwise blank. Also when upon first entering the site you get the same message as the one marly posted up in the first place.

I would of gotten a screen shot but my Malware software closed it shortly afterward.

****!!!!!IMPORTANT!!!!!

Do not do as I did and follow that link, I am running Malware scan on my main comp, and it has found a few trojan viruses and a keylogger. So in theory, who ever this person is, set it so when you get the dialog box it likely tags you.

Thought I should give you guys a heads up.

by Artemis February 26th 2011, 11:08 pm

by marlamin1 February 27th 2011, 4:22 am

Told you not to f*ck with it Arty...

by Jophy February 27th 2011, 6:55 am

Artemis wrote:Hello all, I am another concerned member of the bleach world forum.

I would like to make a note that if you follow the address that is given in the pop up message you get a site that is hosted by T35 Web Hosting holding with a few links at the top but otherwise blank. Also when upon first entering the site you get the same message as the one marly posted up in the first place.

I would of gotten a screen shot but my Malware software closed it shortly afterward.

Artemis wrote:!!!!!IMPORTANT!!!!!

Do not do as I did and follow that link, I am running Malware scan on my main comp, and it has found a few trojan viruses and a keylogger. So in theory, who ever this person is, set it so when you get the dialog box it likely tags you.

Thought I should give you guys a heads up.

May I remind you that double/triple posting isn't tolerated unless separated by 24 hours (Use the edit button)

by ToTheFuture February 28th 2011, 2:30 am

Now I'm paranoid, because some odd member appeared, claming to be one of the Maori in New Zealand! That's fairly odd to me... And he/she's sending odd chatbox messages too and acting cryptic. I know it's probably nothing, but still...

EDIT:
The member goes by the name of "Te Rama", and keeps insisting he's not a hacker, though I never mentioned anything about it... I am quite literally paranoid, so this is making me slightly weirded out.
Would it make any difference if I closed the chatbox?

by Mio-chan February 28th 2011, 2:45 am

Sounds like someone injected code into the chatbox. I've seen it done before, but not for evil purposes. I guess someone found out this bug...

If FM needs to fix this bug, talk to Jalokim. He can refer you to the right person.

by ToTheFuture February 28th 2011, 3:21 am

I doubt it's a bug... the person who posted this and another group of people who commented got their forum hacked!

by Mio-chan February 28th 2011, 5:01 am

ToTheFuture wrote:I doubt it's a bug... the person who posted this and another group of people who commented got their forum hacked!

I'm saying the reason this was caused is a security loophole within the iframe. You can inject code into it. I've seen it done. That's what I mean by bug. The pop up is by a hacker who is trying to gain control of forums by having people input their password in the popup. The data is then sent to the hacker himself. The reason this happens is the security loophole with that chat, thus, a "bug". And a severe one indeed if it were to be used en masse.

by kirk February 28th 2011, 7:07 am

Edit kirk.
striked out due to the fact i have gotten mixed up and html will not work in the chat.

samthelost wrote:I have no idea sorry. We've lost all access to our site and whoever hacked it put it in maintenance.

are you at least a admin, just put /admin at the end of your forum link and you can get into the admin panel that way.

As for the rest of this stuff, trying clearing the messages in the chat, then disable it for a couple hours and reinstall it, and if you feel it's a certain member doing this then either ban them from the chat or just plain ban them,, but be sure it is someone doing it first.

to me it just seems like an error on forumotions end? dunno.
i was working on the mag earlier and the server went down for a while.

Some times whack things happen when for a couple days after new updates, so i am sure if it is something due to that forumotion will get everything straight tomorrow,ember they do not work on the weekends, well actually it's Minda now.

And if anyone else is having this problem or experiencing this, please post here so we can try to figure out whats going on.
I would not necessarily automatic assume it's hackers, so lets not go freaking everyone out until we can determine and rule out what is happening.

Info added
Oh just to add this, if you are a forum founder then you can log into utilities and fix try using fix html bugs, or you can also disable the html on the forum and go into the chat and see if there is a code in there, you can try hitting archives to see if that brings up any code.

But you know it could be just someone fabricated a this whole thing and added the link in the code and just want people to click the link.

But i dont want to get a head of our self's, we will have to wait to see what typlo says or if he has to pass it on to the techs to investigate

by ToTheFuture February 28th 2011, 9:08 pm

pimentel2 wrote:
ToTheFuture wrote:I doubt it's a bug... the person who posted this and another group of people who commented got their forum hacked!

I'm saying the reason this was caused is a security loophole within the iframe. You can inject code into it. I've seen it done. That's what I mean by bug. The pop up is by a hacker who is trying to gain control of forums by having people input their password in the popup. The data is then sent to the hacker himself. The reason this happens is the security loophole with that chat, thus, a "bug". And a severe one indeed if it were to be used en masse.

Oh, that's what you mean. I had to do that before on an old non-fm made-by-self website I had, but not with passwords.

by marlamin1 March 1st 2011, 2:54 am

Just to update, I still have my chatbox offline. I'm waiting to see if any kind of tech support has or will be seeing to this key logger, or whatever it is that has been inserted into my chatbox's code, and how to prevent it from happening again...

by marlamin1 March 7th 2011, 7:21 pm

Bumping this topic so it doesn't get forgotten about. I constantly check this thread for any new information on whatever it was I experienced... Also it's been several days since my last post so as per my understanding the double post is allowed...

by -17emon.KiD- March 8th 2011, 3:08 am

wow thats weird never happen to me no matter what browser i used

by kirk March 8th 2011, 4:27 am

well html codes do not work in the chat,
I was getting mixed up with adding youtube tags and had youtube work in there before.

Are you still getting this message, and what do yous mean by a bug in the iframe? an iframe will not work in the chat either.

by marlamin1 March 8th 2011, 4:31 am

A couple people experienced it since it was reactivated by another admin but it's not showing up now. I just hope it's fixed and one of my more derpy staff members doesn't fall for it should it ever reappear... I don't want to go through another revert. I had to with a hacker only a few months ago...

The problem kinda just went away, it wasn't ever solved, so I'm not sure if you want to mark this as a problem solved thread...

Odd chatbox message

Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message

Re: Odd chatbox message