Forum Security Alert.

[xode]

It looks like hackers are attacking websites by inserting malicious javascript into the script (program) files for various web programs including the SMF forum software which runs this site.  Details are at:

http://community.godaddy.com/godaddy/the-latest-information-on-compromised-sites/

http://community.godaddy.com/godaddy/whats-up-with-go-daddy-wordpress-php-exploits-and-malware/

Please post any unusual activity that you see on this site to this thread.

[DCS]

User Giorgio sent me a PM that looks like spam.  It's titled "My webinar" and the contents are:

If you are interested please feel free to contact me

https://newworldpro.webex.com/newworldpro/ldr.php?AT=pb&SP=MC&rID=41756912&rKey=dfac9ab1a441c7f5

[God-Father]

Me too.

[xode]

User Giorgio sent me a PM that looks like spam.  It's titled "My webinar" and the contents are:

If you are interested please feel free to contact me

https://newworldpro.webex.com/newworldpro/ldr.php?AT=pb&SP=MC&rID=41756912&rKey=dfac9ab1a441c7f5

What the link here lead to didn't look so hot, so Giorgio is now in the Null Posters group (i.e. basically a guest that can receive but not send personal messages and that can look at but not do anything to his profile).

[BigCowboy]

I got it too....

-BigCowboy

[roadhawk]

I don't see anything weird on my end and no PM....

[xode]

I don't see anything weird on my end and no PM....

Please let me know immediately if you ever do see anything unusual.  The hosting provider has created a tool to check if a site is infected, and I had them check this forum and it was clean.  Unfortunately, however, SCP's forum got hit.

[go4reward]

Yes, but our forum is back after the clean up, see link:
http://forums.go4reward.com/site-news-feedbacks/we-are-back!/msg3636/#msg3636

Watch out for PHP file changes as a group, the change will have the following signature at the top as:
<?php /**/ eval(base64_decode("aWYoZnVuY3Rpb25fZXhpc..........

If you don't have those, you should be fine.

xode: added url and /url tags to fix the above link; apparently a "!" will cause a link to end with it unless these tags are used.

[xode]

Yes, but our forum is back after the clean up, see link:
http://forums.go4reward.com/site-news-feedbacks/we-are-back!/msg3636/#msg3636

Watch out for PHP file changes as a group, the change will have the following signature at the top as:
<?php /**/ eval(base64_decode("aWYoZnVuY3Rpb25fZXhpc..........

If you don't have those, you should be fine.

xode: added url and /url tags to fix the above link; apparently a "!" will cause a link to end with it unless these tags are used.

My next question is: how (with details) are these hackers able to change those PHP files?