Gibberlings3 forum hacked?

[psyko_nevro]

I think the forum has been hacked.

 

I noticed a few days ago that when you come to the forum from a google search, instead of seeing the forum you visit an url4short.info.

 

 

Various spaming websites are opened following this link. Just test yourself, search "Question/Suggestion: post-Sarevok in EET" in google, then click on the first result. This happens to me on Firefox, Chrome, Internet explorer. Maybe valuable information, it happens when coming from google, but I quickly tested on Bing (microsoft search) which brought me straight to the forum.

 

I thought initially it was my computer, so I didn't pay attention. But I've just seen a post on Spellhold that convinced me your website has been hacked:

http://www.shsforums.net/topic/60216-gibberlings3-the-harmful-site/

 

 

 

 

[CamDawg]

When I Google that term, that thread pops up--following the link takes me directly to the thread.

 

On a first pass, I'm not seeing anything unusual on the forums or Javascript that would make me suspicious.

[lynx]

Looks more likely that your machine has been infected, hacked, altered.

[DavidW]

I’ve seen that page a few times recently myself, though I’ve never paid enough attention to know how to reproduce it

[Mike1072]

Thanks for the report. I believe I've located and fixed the problem for now. If you're interested in the details, check out this page.

[jastey]

Thank you very much for your quicl work on this!

 

Does this might include any problem of users' compter being infested?

[Mike1072]

Anyone who noticed the redirect can take some comfort that the problem was on the forums, rather than malware on their machine or a malicious browser addon.

 

Assuming users didn't do anything dangerous on the redirected site (e.g. downloading and running a file), they should be fine.

[Jarno Mikkola]

Looks more likely that your machine has been infected, hacked, altered.

Right, or a known security software notes a fault in the site code and proceeds to give the software users a notice in their browser. Care to guess which one this was ?

[khelban12]

Anyone who noticed the redirect can take some comfort that the problem was on the forums, rather than malware on their machine or a malicious browser addon.

 

Assuming users didn't do anything dangerous on the redirected site (e.g. downloading and running a file), they should be fine.

I noticed it too but couldn't find the cause. The first time was some weeks ago. I have a bookmarks folder with fora and news site i visit everyday so that i can quickly use "open all in tabs". So everytime i happened to see the ff tab with url4short, i had many opened tabs and i couldn't pinpoint from what site i opened it.

 

I researched it a bit and found that it is a malware but like lynx i thought it is my machine that is infected. I couldn't find anything wrong with my firefox profile and since it occurred very infrequently (and since i use a different profile for banking and tax stuff) i dismissed it as not important

 

kudos to psyko for reporting it and to Mike for fixing it.

Edited November 5, 2018 by khelban12