Jump to content


Photo

Malware redirects 2013-04-24 and following


  • Please log in to reply
46 replies to this topic

#1 Admin

Admin

    The FPN Admin Team

  • Admin

  • PipPipPipPipPipPipPip
  • 475 posts

Posted 25 April 2013 - 23:22

Dearest Members & Visitors to the little Fountain Pen Nut house on the digital prairie,

As you may have noticed, we had some weird behaviour on FPN with unfortunate redirects for some, to sites we don't particularly want to mention. This appeared to affect mostly members from the US, the UK and Australia, and in most cases people logging in from an iPhone, iPad or Mac, although people accessing FPN from search engine results sometimes also seemed to be affected.

We decided to turn the board offline, and carry out a very thorough investigation as to the possible causes. The appearance this behaviour had was that of a root kit infestation, i.e., a virus or trojan on the server itself. This was rather strange, as we do scans every day for this, and our security is rather tight and high.

Extremely thorough and deep scans learned that there was no infection on our server, and neither were any of the files stored on FPN infected in any way. To make doubly sure, we also investigated all 6700+ files of the board software manually, to see if no unexpected additions were made to the code. While we are at it, we also rather agressively deleted any stuff still remaining from previous software versions, and checked if any security measure to prevent anybody from accessing the server, software and files in an unauthorized way were still in place as they were supposed to - they were.

Amnyway, all of these actions proved that we were absolutely and squeaky clean.

Next step was to check the database for problems. This also proved to be clean.

Considering the type of problem encountered, we have put the board software upgrade forward now, even if this means losing some functionality of the board temporarily. The new software is capable of dealing with this type of attack very effectively, while our current software can't.

What we will temporarily lose, is our beautiful skins. We will do our utmost, however, to get those back as quickly as possible.

 

Yesterday we found out, thanks to some very thorough and clever tricks carried out by the server hosting team, that there appeared to be two DNS servers for our domain, one hosted here on our own server, which is the way it has been set up from the beginning, and recorded as such with our domain registrar, and a second server, active from April 23, which was pointing to the malevolent site. With the aid of our registrar we could resolve this, but unfortunately it meant that we were offline again for a while.

 

The domain registrar security team is investigating how this could have happened, and what can be done about it. Essentially this was a compromised DNS server, so it is something that should not have happened, but unfortunately did. We'll leave it at that for now, as it can't happen again with the actions taken by the registrar team.

 

Anyway, enjoy the new FPN, FPN in a diffferent outfit as it were ;).

Warm regards,
The FPN Admin Team


This account is unmanaged.
Please direct questions and comments to FPN Admin email, or directly to admin Wim (wimg).
 
Thank you very much in advance.
 
Warm regards,
The FPN Admin Team

#2 Force

Force

    Fergus

  • Member - Gold

  • PipPipPipPipPipPipPipPipPipPip
  • 3,660 posts
  • Location:The Real Garden of England
  • Flag:

Posted 27 April 2013 - 14:28

Excellent work and well done team :)



#3 stevekolt

stevekolt

    Rare

  • Member - Gold

  • PipPipPipPipPip
  • 184 posts
  • Location:WV
  • Flag:

Posted 27 April 2013 - 14:32

Thanks for all your hard work...it is much appreciated!



#4 Pen Nut

Pen Nut

    "You open one safe door and another one closes"

  • Member - Gold & Supporter

  • PipPipPipPipPipPipPipPipPipPipPip
  • 5,457 posts
  • Location:Manchester UK
  • Flag:

Posted 27 April 2013 - 14:34

Cold turkeyed to death here !!!!!! Well done to all involved in getting 'my family' back together


My heart says English, my head says Japanese, my hand holds German (pens, cars or beer ?)

 

" I spend 95% of my income on pens..........the rest I just waste " 


#5 Pen Nut

Pen Nut

    "You open one safe door and another one closes"

  • Member - Gold & Supporter

  • PipPipPipPipPipPipPipPipPipPipPip
  • 5,457 posts
  • Location:Manchester UK
  • Flag:

Posted 27 April 2013 - 14:36

not posting ?


My heart says English, my head says Japanese, my hand holds German (pens, cars or beer ?)

 

" I spend 95% of my income on pens..........the rest I just waste " 


#6 Rowbo

Rowbo

    Extremely Rare

  • Member - Gold

  • PipPipPipPipPipPip
  • 369 posts
  • Location:Mansfield UK
  • Flag:

Posted 27 April 2013 - 14:37

I was starting to get the shakes from being deprived of my regular dose .... Thank you for fixing it.


You don't know what you need until you realise you haven't got it.

#7 arandur

arandur

    Rare

  • Member - Gold

  • PipPipPipPipPip
  • 176 posts
  • Flag:

Posted 27 April 2013 - 14:37

I am quite glad you were able to find the cause of the issues, as well as fix them. Good work.


Built from Ink and Tea: A Blog about Lego, Fountain Pens, and...Tea! - Now with more fountain pen modification guides!

Posted ImagePosted ImagePosted Image


#8 inkstainedruth

inkstainedruth

    Donor Pen

  • Member - Gold

  • PipPipPipPipPipPipPipPipPipPip
  • 4,820 posts
  • Flag:

Posted 27 April 2013 - 14:42

Thanks for your valiant efforts!  It's been quite a siege. :gaah:  You guys rock! :notworthy1:

I do have one question though -- what are the odds of getting the different skins back anytime soon?  I've gotten so used to mine that looking at the pages seem very weird to me now (and it''s also taking a little while to get used to the new formatting).

Ruth Morrisson aka inkstainedruth


"It's very nice, but frankly, when I signed that list for a P-51, what I had in mind was a fountain pen."

#9 thedeacon

thedeacon

    We are the people our parents warned us about...

  • Member - Gold

  • PipPipPipPipPipPip
  • 317 posts
  • Flag:

Posted 27 April 2013 - 14:44

Great job and thanks for the hard work.  I'm proof that even a Noob can experience withdraw!


"If you laugh, you think, and you cry, that's a full day. That's a heck of a day. You do that seven days a week, you're going to have something special."-Jim Valvano

 

"Some people spend an entire lifetime wondering if they made a difference in the world.  But, the Marines don't have that problem."-Ronald Reagan


#10 SheilaM

SheilaM

    Parrot Wrangler

  • Member - Gold

  • PipPipPipPipPipPip
  • 299 posts
  • Location:Seattle, WA
  • Flag:

Posted 27 April 2013 - 14:48

Many, many thanks to you, Wim, and the FPN team for this gargantuan effort on our behalf! Hope you all can get a break now...
"Expect a most agreeable letter, for not being overburdened with subject (having nothing at all to say), I shall have no check to my genius from beginning to end." --Jane Austen

Posted Image
My blog: Does This Pen Make Me Look Fat? Twitter: @penfatness Instagram: sheilamcl Pinterest: SheilaM

#11 mirosc

mirosc

    I love the smell of ink in the morning

  • Member - Gold

  • PipPipPipPipPipPipPipPipPip
  • 2,233 posts
  • Flag:

Posted 27 April 2013 - 14:47

the positive sideeffect is that we can be sure to have a great new board with all current security.

And it looks really clean and nice.

 

You have done outstanding work, thank you for all the work, the efforts, the sleepless nights and the time away from your family.

You really make sacrifices for FPN.

Thank you.


Greetings,
Michael

#12 mhguda

mhguda

    Vulpenfanaat

  • Member - Gold & Supporter

  • PipPipPipPipPipPipPipPipPip
  • 1,539 posts
  • Location:Curaçao
  • Flag:

Posted 27 April 2013 - 14:56

Thanks very much FPN admin team for sticking with this, and all the hard work you've done to make our favorite pen board safe and active again for all the fp nuts out there...

Hopefully this time the fix will stick!


a fountain pen is physics in action...

#13 reprieve

reprieve

    And how does the sun even fit in the sky?

  • Member - Gold

  • PipPipPipPipPipPipPipPipPip
  • 2,939 posts
  • Location:Deep in the belly of a whale

Posted 27 April 2013 - 15:06

FPN is looking all wonky for me. It looks normal when I am logged out, but when I log in, it is in some sort of different view or skin or something. I can't figure out how to reset it.

#14 hari317

hari317

    Classic

  • Member - Gold

  • PipPipPipPipPipPipPipPipPipPipPipPip
  • 12,034 posts
  • Location:Mumbai, INDIA
  • Flag:

Posted 27 April 2013 - 15:11

Hi Wim, Glad to see that FPN is back online. good job.



#15 vikrmbedi

vikrmbedi

    Vintage

  • Member - Gold

  • PipPipPipPipPipPipPip
  • 428 posts
  • Location:new delhi
  • Flag:

Posted 27 April 2013 - 15:15

keep up the good work... :) glad to see fpn back online.



#16 wimg

wimg

    Stip Etruria nut :)

  • Admin

  • PipPipPipPipPipPipPipPipPipPipPipPip
  • 18,870 posts
  • Location:Maastricht, Netherlands, EU
  • Flag:

Posted 27 April 2013 - 15:19

 

not posting ?

 

You need to clear browser cache and temp files, preferably on a blank page, close your browser, and then restart it, in order for the browser to load the newer version of javascript the new software is using.

 

Also, some browsers do indeed show some weird behaviour - in IE 9 some buttons do not appear to work well. I always used Opera already every so often, because that has a very clean interface with relatively little overhead, and I find that that seems to work best so far (tried all the big name browsers :)).

 

HTH, warm regards, Wim


the Mad Dutchman
laugh a little, love a little, live a lot; laugh a lot, love a lot, live forever


#17 wimg

wimg

    Stip Etruria nut :)

  • Admin

  • PipPipPipPipPipPipPipPipPipPipPipPip
  • 18,870 posts
  • Location:Maastricht, Netherlands, EU
  • Flag:

Posted 27 April 2013 - 15:31

FPN is looking all wonky for me. It looks normal when I am logged out, but when I log in, it is in some sort of different view or skin or something. I can't figure out how to reset it.

That should be fixed now, I've reset the skin you selected I think, to the current one. The IP.Board pre 3.2 skin was available in the Theme selection menu as a remnant of the upgrade, but it doesn't work with  the current version of the board software - I have disabled it completely now, so that can't happen again ;).

 

Also, please do clear browser cache and temp files as mentioned above. It is an absolute must.

 

HTH, warm regards, Wim


the Mad Dutchman
laugh a little, love a little, live a lot; laugh a lot, love a lot, live forever


#18 Flounder

Flounder

    Forum Moderate

  • Member - Gold

  • PipPipPipPipPipPipPipPipPip
  • 1,703 posts
  • Location:Glasgow, Scotland

Posted 27 April 2013 - 15:32

It does sound like a terrific amount of work sorting all this out.

Yay to pen-related FPN!

Nay to the forbidden sight of a young lady's name-it-not!


Latest pen related post @ flounders-mindthots.blogspot.com : Blu Tack: A Fab Fountain Pen Diagnostic and Servicing Tool


#19 wimg

wimg

    Stip Etruria nut :)

  • Admin

  • PipPipPipPipPipPipPipPipPipPipPipPip
  • 18,870 posts
  • Location:Maastricht, Netherlands, EU
  • Flag:

Posted 27 April 2013 - 15:33

Thanks for your valiant efforts!  It's been quite a siege. :gaah:  You guys rock! :notworthy1:

I do have one question though -- what are the odds of getting the different skins back anytime soon?  I've gotten so used to mine that looking at the pages seem very weird to me now (and it''s also taking a little while to get used to the new formatting).

Ruth Morrisson aka inkstainedruth

Hi Ruth,

 

We do hope to do one a month, the first one maybe taking more time, provided we get the time to do them ;). This means that if we are lucky, the work can start probably about half May :D.

 

Warmest regards, Wim


the Mad Dutchman
laugh a little, love a little, live a lot; laugh a lot, love a lot, live forever


#20 sasaul

sasaul

    Stv

  • Member - Gold

  • PipPipPipPipPip
  • 169 posts
  • Location:New York
  • Flag:

Posted 27 April 2013 - 15:34

FPN Admin Team, and all who helped in the effort to restore FPN to us, a very big thank you for your efforts.

 

Steve



#21 reprieve

reprieve

    And how does the sun even fit in the sky?

  • Member - Gold

  • PipPipPipPipPipPipPipPipPip
  • 2,939 posts
  • Location:Deep in the belly of a whale

Posted 27 April 2013 - 15:35

 

FPN is looking all wonky for me. It looks normal when I am logged out, but when I log in, it is in some sort of different view or skin or something. I can't figure out how to reset it.

That should be fixed now, I've reset the skin you selected I think, to the current one. The IP.Board pre 3.2 skin was available in the Theme selection menu as a remnant of the upgrade, but it doesn't work with  the current version of the board software - I have disabled it completely now, so that can't happen again ;).

 

Also, please do clear browser cache and temp files as mentioned above. It is an absolute must.

 

HTH, warm regards, Wim

 

 

Thank you.



#22 LagNut

LagNut

    Mint

  • Member - Gold & Supporter

  • PipPipPipPip
  • 52 posts
  • Location:Northern California
  • Flag:

Posted 27 April 2013 - 17:45

FPN team,

 

Thanks much.  I have an idea of what sort of work level you folks went through - not fun, not easy, high stress (for me, I hate having to work where I have to check every foothold, and carefully consider each move)... 

 

I do appreciate it, and hope the donate button is supplying enough revenue to cover this.  This is real work, and "clean the septic fields" work. 

 

Thanks much,

Mike



#23 welch

welch

    Donor Pen

  • Member - Gold

  • PipPipPipPipPipPipPipPipPipPip
  • 3,067 posts
  • Location:New York, NY
  • Flag:

Posted 27 April 2013 - 18:13

Well done, all. I'm in the computer biz, and have a sense of how much work this required.


Don't take any job that requires new clothes.

#24 welch

welch

    Donor Pen

  • Member - Gold

  • PipPipPipPipPipPipPipPipPipPip
  • 3,067 posts
  • Location:New York, NY
  • Flag:

Posted 27 April 2013 - 18:13

Unintentional repeat post. Board s/w not smoothed out yet, apparently, but so what? FPN is back.


Edited by welch, 27 April 2013 - 18:16.

Don't take any job that requires new clothes.

#25 Bugmerc

Bugmerc

    Mint

  • Member - Gold

  • PipPipPipPip
  • 72 posts
  • Flag:

Posted 27 April 2013 - 19:14

Thanks for all the hard work and I'm sure the sleepless nights. It is much appreciated, glad we are all back together.

 

Chris


InkDropLogoFPN2.jpg

 


#26 Bugmerc

Bugmerc

    Mint

  • Member - Gold

  • PipPipPipPip
  • 72 posts
  • Flag:

Posted 27 April 2013 - 19:15

Thanks for all the hard work and I'm sure the sleepless nights. It is much appreciated, glad we are all back together.

 

Chris


InkDropLogoFPN2.jpg

 


#27 RMN

RMN

    Museum Piece

  • Moderators

  • PipPipPipPipPipPipPipPipPipPipPip
  • 7,764 posts
  • Location:the Netherlands
  • Flag:

Posted 27 April 2013 - 19:17

Do we really need Java? I have no Java on one of my machines, used to work well with FPN.

 

D.ick


Freedom exists by virtue of self limitation. :


#28 Huntsman

Huntsman

    NOS (New Old Stock)

  • Member - Gold

  • PipPip
  • 21 posts
  • Location:West Coast.
  • Flag:

Posted 27 April 2013 - 19:54

Nice to see you back online. Sorry you had to go through all that.



#29 Lorna Reed

Lorna Reed

    Voluntary Verger

  • Member - Gold

  • PipPipPipPipPipPipPipPipPip
  • 1,737 posts
  • Location:Coventry, England
  • Flag:

Posted 27 April 2013 - 21:42

Huge thanks to everyone involved in this gargantuan task of putting things right. Much appreciated!


Whatever is true,whatever is noble,whatever is right,whatever is pure,whatever is lovely,whatever is admirable - if anything is excellent or praiseworthy - think about such things.
Philippians 4.8

#30 Russ

Russ

    Antique

  • Member - Gold

  • PipPipPipPipPipPipPipPipPip
  • 1,799 posts

Posted 27 April 2013 - 22:24

THANK YOU for all this hard work.  I utterly respect and appreciate all y'all.  :bunny01: