Let me quickly add a few words about the code that the hacker put on the homepage (actually it turns out it was also on a few more index.html pages on the site, like the Reviews/ start page).
We were fortunate to have a few white hack hacker types and some malware professionals take a look at what the code placed on the page was trying to do (thanks everyone on our irc channel -- #donationcoder on efnet).
Basically the code was some obfuscated javascript that simply opened a page on a far away site, which attempted to trigger some exploits in older versions of Internet Explorer. It looks like it was some version of something called
icepack/mpack, which believe it or not is a product that people SELL AND BUY for the explicit purpose of hacking computers.
The code was designed to try various tricks on people who were using Internet Explorer. I actually tried in a virtual machine to let it infect me and it was a bit difficult since by default, the latter versions of Internet Explorer (v7 and on) have some pretty reasonable steps that try to warn you that something strange is happening and ask you if you want to install activeX components, etc. But if you had an old version of Internet Explorer you may have been at risk -- please run an antivirus check to be sure.
I cannot tell you how distraught and angry i was when i found out that someone had put this code on our homepage. I felt like I had let down the visitors to this site. If i don't seem contrite enough at the moment, it's only because in the last 4 days since the server was down i have gradually calmed down from a state of hyperventilation. The only thing now to do is go forward and work at making the site more secure. Thanks to everyone on our IRC channel who put up with me freaking out, and who helped analyze the attack, and especially to DC member Jazper who alerted us about the initial intrusion so quickly so that we had the site wasn't exposed for more than an hour or so.
A few things to note about the code they added to the page that should give you some pause while surfing:
- The only thing they did to the page was add 1 line of javascript.
- That is enough to open a page on another site which can begin delivering you attempted exploit code designed to trick your browser into downloading and installing a virus.
- There is nothing special about it being on our server -- anyone who owns any site could put this code on their page without having to hack anything.
- In other words, the owner of any site on any page you ever visit could put code like this on their page to try to infect you. It's just plain simple javascript. No one needs to hack a site to put this code on their own created pages.
- What this means is that you should expect that if you do even a little bit of regular surfing, you need to be aware how important it is to have up-to-date software installed -- keep your browsers updated to latest versions, be on the lookout for announcements about possible security risks, have a good antivirus.
- Listen to your browser -- all new versions of IE and firefox will alert you if a site is trying to open and run some executable or active X. If you get an unexpected pop-up question on a site asking if you want to run some addon or something, say no unless you know exactly what it's for.
Recent Posts
