ALERT! FreewareBB shutting down. And with a warning from Marko?

[40hz]

Just received this in my morning e-mail. If it's on the level (and I'm guessing it is) it's both saddening and somewhat disturbing news:

>From: FreewareBB <[email protected]>
Date: January 8, 2015, 6:00:01 AM EST
To: 40hz *********************
Subject: FreewareBB Closing Down


 FreewareBB

 40hz,


 Unfortunately, it would appear the new owners of FreewareBB are intending on closing down the site, and even worse, it would appear they intend to use the good name of FreewareBB to trick and potentially scam people.   Unfortunately, I am powerless to stop this as the sale has now been completed and the person who bought the domain has only just told me his intentions and I am sending you this mail to merely inform you of their intentions and advise that you change all your passwords on your email accounts and if you have ever subscribed to the yearly payment to support FreewareBB then change your PayPal passwords also.   I do not believe there is any risk to you or your associated accounts, because your payments and passwords would be encrypted but given the information I have available to me I would advise you perform these actions as a matter of precaution.



 I can only apologize unreservedly for any inconvenience caused as I never imagined a sale would result in such a devious plan.



 As the site will likely be offline shortly, please respond to this message via our Facebook site which still belongs to us : https://www.facebook.com/freewarebb



 Kind Regards Marko

Going to the website, this notice is currently posted:

ALERT! FreewareBB shutting down. And with a warning from Marko?


Since I don't do Facebook I can't do much to follow up directly with Marko on this.

Any DoCo Facebookers want to visit to lend their moral support plus report back on anything of significance?

Thx!

[Joe Hone]

I used to frequent FreewareBB but after a false alarm having to do with the site closing down I stopped. Freewaregenuis lurched toward stagnation in a similar fashion. It really is too bad because I found both sites to be valuable resources.

[KynloStephen66515]

Latest Update from the Facebook Page:

Freewarebb
14 hrs ago (09:58GMT) ·
Please be aware that FreewareBB has been sold and unfortunately it appears the intentions of the new owners are extremely devious and they intend on potentially using the good name of the site to trick and scam people. If you have any questions or concerns, please address them here because the site itself will likely be taken offline shortly. I can only apologise for any inconvenience caused but I never imaged the site being used in this way. Regards, Marko

[TaoPhoenix]

Latest Update from the Facebook Page:

Freewarebb
14 hrs ago (09:58GMT) ·
Please be aware that FreewareBB has been sold and unfortunately it appears the intentions of the new owners are extremely devious and they intend on potentially using the good name of the site to trick and scam people. If you have any questions or concerns, please address them here because the site itself will likely be taken offline shortly. I can only apologise for any inconvenience caused but I never imaged the site being used in this way. Regards, Marko

-Stephen66515 (January 08, 2015, 06:35 PM)

I guess it's an important case example.

This is why they drag lawyers into things! I can see other sites getting sales contracts where the sold name/other can't be used in certain ways.

[rgdot]

Someone is responsible for the site itself but doesn't own the url? 

[TaoPhoenix]

Someone is responsible for the site itself but doesn't own the url? 

-rgdot (January 08, 2015, 11:19 PM)

Well, to me it sounded more like he retained a copy of the code, but someone bought the domain name, and now plans to shut the existing site and replace it with something scammy.

It sounds like it's brewing into a minor tragedy. :  (

[Deozaan]

I really don't get it. Why sell the site at all if you still want control over what happens to it? Once you've sold it, it's no longer your baby. Let it go.

Not to mention that I supposed it's possible that the new owner could sue Marko for disparaging him or for encouraging people to give it a poor rating when there's no evidence that it's being (or going to be) used for a scam.

[KynloStephen66515]

I really don't get it. Why sell the site at all if you still want control over what happens to it? Once you've sold it, it's no longer your baby. Let it go.

Not to mention that I supposed it's possible that the new owner could sue Marko for disparaging him or for encouraging people to give it a poor rating when there's no evidence that it's being (or going to be) used for a scam.

-Deozaan (January 09, 2015, 12:16 AM)

It's too early to tell, and (for me at least) the site is small enough for it to be negligible even if the reports are to be the truth.

From what has been said so far, this looks far too strange to be true, and seeing as he still has full control of the site and it's functions...if it has been proven (by whatever evidence he may have), then why can he simply not return the money and dispute the sale...He certainly seems to be "bothered" about it enough to basically push people as far away from the website as possible...so...take that in whatever form you want to take it.

[40hz]

Ok, this is starting to get soap opera surreal...

This morning, going to the FreewarBB FB link produces this:

ALERT! FreewareBB shutting down. And with a warning from Marko?

And going to the website shows this on the landing page,

ALERT! FreewareBB shutting down. And with a warning from Marko?

If this is a genuine pissing match, it's already getting ugly.

If it's all just an elaborate put-on...I really don't know what to think - or what the game is...

---------------------

UPDATE: FB page is back. That weirdness must have been my browser acting up.

[wraith808]

I really don't get it. Why sell the site at all if you still want control over what happens to it? Once you've sold it, it's no longer your baby. Let it go.

Not to mention that I supposed it's possible that the new owner could sue Marko for disparaging him or for encouraging people to give it a poor rating when there's no evidence that it's being (or going to be) used for a scam.

-Deozaan (January 09, 2015, 12:16 AM)

It's too early to tell, and (for me at least) the site is small enough for it to be negligible even if the reports are to be the truth.

From what has been said so far, this looks far too strange to be true, and seeing as he still has full control of the site and it's functions...if it has been proven (by whatever evidence he may have), then why can he simply not return the money and dispute the sale...He certainly seems to be "bothered" about it enough to basically push people as far away from the website as possible...so...take that in whatever form you want to take it.

-Stephen66515 (January 09, 2015, 01:21 AM)

If the domain has not been re-pointed, then though he doesn't have control of the domain, he does still have control of what the domain is pointed to.  He didn't sell them his servers, he sold a domain name.

[40hz]

I've actually seen something similar to this go down with a former client. She wanted to get out of a line of business she was  in. So she sold her website to somebody else who promised (with the best of intentions) to continue in her stead. About a year later, the new owner was approached by a buyer who offered a very substantial amount of money (I understand it was something like $10k) for the domain name. And the new owner took it.

Shortly after that, the new buyer started playing games and trading on the goodwill the site had built up over the years. My client said she'd be just as inclined as anybody to forget about it since it's no longer her site. But she still sees her name occasionally being blasted by somebody for what's going on six years after she sold the domain. And because she has other online businesses, she feels she needs to politely respond to those posters. "It's a reputation management issue. You can't just let that take care of itself." as she put it.

So just because a site is no longer yours doesn't mean your name and what you originally built up is no longer associated with it.

[TaoPhoenix]

Well, in the name of "Security Research", I decided to try getting us some more to work with.

And in the spirit of the Gemini twins of Confusion and Fair Game, the only "fair" Facebook address I could decide upon ... was themselves! (For varying definitions of "themselves".) Colored pills and rabbit holes, here we come!

(My numbering is a little arbitrary, I just think better when I can partition off stages of a project.)

Set 1
1a. Top level site:
http://www.freewarebb.com/
Formerly honorable site, now host to ... "stuff". This is a first attempt to look at what "stuff" is.

1b.
Then there's "this" graphic again. I have added a couple of notes.


Notice that in the instructional address to copy, Ms M's name is mis-spelled ... in that classic conundrum "who is smart enough to get the "you're" abbreviation right, then mis-spell a name in an instructional graphic?

Also, the graphic calls for "http://" and facebook pages run (sorta?) secure at https://

1c. So we decide to "click here to start hacking". Like I mentioned cross category about the archive.org new game libraries, we have an "emblazon" problem. This isn't some weird site like hackfacebookpass.net, is it? Oh wait, sorry for the spoiler, yes it is.

But the front end is a "quietly" famous site. So what owner is either going to leave that there for more than a week, or maybe our law enforcement types don't care about open source software, but maybe with a memo from the RIAA, since the *signature example the scammer could think of was a musician*, you'd think they'd like to at least have a beat officer call Ms. Minogue and ask her to have coffee and check if things are okay. It's where you don't know which of three things to do a double-facepalm over.  

1d. So clicking on that gives you the following excerpt of a page:


1e. So now we see that FreewareBB is now nothing but a 3-screen "jump page", likely to be discarded like a snake skin later. The "real" scam page is for now at http://www.hackfacebookpass.net/. So let's go over there.

Set 2. So what are the guts of this op?

2a. Putting in "themselves", we get this:


2b. Okay, so now it's squawking about an Auth code. The first time you try to go get one, it yells at you for having Adblock on. So I turned it off for this.

2c. "Click here to get an Auth code" leads you to this:
http://href.li/?http...nate.org/donate.html
.li is Lichtenstein. A somewhat newer player in the "country code for sale" business.
It resolves to this:
http://ossdonate.org/donate.html

2d. It brings up "complete an offer to get your code".


I don't need gift cards. But I feel so sad and left out I have not played the authentic (maybe?!) Angry Birds more than three times. So I will try to do that offer. And I'll resume next post, because by now we see this rabbit hole has a few warrens (but not Diane Warren) and at least a couple of rabbits in it! (But not Eddie Rabbitt.)

[TaoPhoenix]

Set 3
So going for Angry Birds goes here.
http://www.downloadp..._sub4=&aff_sub5=

I'm not sure what downloadpilot is, but it sounds "more legit" as a software tracked downloader, rather than anything this guy churned up himself. More pics:



Okay, now we get this:


So now we have a bit of a poker game going on. Is it a virus, or a tracked downloader?
On the theory that anything short of Cryptowall won't kill me, I have to push just a little further!

Next we get this. So okay, it's looking to install a bunch of junkware, but they look quasi familiar. Clicking "custom" doesn't always do everything, but let's try it.


Okay, the next section is stuff you gang already know (sort of? Aka presuming it actually did X and not Y!). It tries to install stuff, I just clicked "skip". (Sometime later I'll have to check to see if it shadow installed, but let's just say for now.)

Here's a completion screen of some kind (with another type of shaky ad!)

[TaoPhoenix]

So something with a big Y on it but labeled Angry Birds appears.
Now we visit France!

YappyZ seems to be one of those encapsulating Flash game sites.



ALERT! FreewareBB shutting down. And with a warning from Marko?

And somewhere under here is something at at least looks like Angry Birds:


A portion of AngryBirds / DecentLookingClone


So I played a game of Angry Birds. I have now played it four times in my life. No sign of a code though - it says "offer not completed".

So that's as far as I can take it. But at least y'all have the next steps of what all it wants to do. It's def sneaky, but still seems to be playing "by slippery rules" like accepting a Platypus as both a mammal and an egg laying animal.

[40hz]

If the domain has not been re-pointed, then though he doesn't have control of the domain, he does still have control of what the domain is pointed to.  He didn't sell them his servers, he sold a domain name.

-wraith808 (January 09, 2015, 08:22 AM)

Huh? When you own the domain name you get to select where DNS sends it. And when somebody buys an existing website, they often will purchase the existing host site as well since the original owner may still be obligated to continue paying on it until the end of their contract with the host provider. This is common in those "under new management" situations where the buyer has an understanding with the seller that they intend to continue the site pretty much as is. It worked out well for Tux Machines when Sue Linton sold her popular FOSS news site to the owners of TechRights.

[Stoic Joker]

If the domain has not been re-pointed, then though he doesn't have control of the domain, he does still have control of what the domain is pointed to.  He didn't sell them his servers, he sold a domain name.

-wraith808 (January 09, 2015, 08:22 AM)

Huh?

-40hz (January 09, 2015, 02:14 PM)

I think he means if the new owner hasn't updated the DNS records then having access to the old(/current) hosting account -(or just Admin level access to the relevant CMS)- would give one free reign to play.

[40hz]

If the domain has not been re-pointed, then though he doesn't have control of the domain, he does still have control of what the domain is pointed to.  He didn't sell them his servers, he sold a domain name.

-wraith808 (January 09, 2015, 08:22 AM)

Huh?

-40hz (January 09, 2015, 02:14 PM)

I think he means if the new owner hasn't updated the DNS records then having access to the old(/current) hosting account -(or just Admin level access to the relevant CMS)- would give one free reign to play.

-Stoic Joker (January 09, 2015, 02:32 PM)

Oh. Ok.

[wraith808]

If the domain has not been re-pointed, then though he doesn't have control of the domain, he does still have control of what the domain is pointed to.  He didn't sell them his servers, he sold a domain name.

-wraith808 (January 09, 2015, 08:22 AM)

Huh?

-40hz (January 09, 2015, 02:14 PM)

I think he means if the new owner hasn't updated the DNS records then having access to the old(/current) hosting account -(or just Admin level access to the relevant CMS)- would give one free reign to play.

-Stoic Joker (January 09, 2015, 02:32 PM)

Exactly.

[40hz]

If the domain has not been re-pointed, then though he doesn't have control of the domain, he does still have control of what the domain is pointed to.  He didn't sell them his servers, he sold a domain name.

-wraith808 (January 09, 2015, 08:22 AM)

Huh?

-40hz (January 09, 2015, 02:14 PM)

I think he means if the new owner hasn't updated the DNS records then having access to the old(/current) hosting account -(or just Admin level access to the relevant CMS)- would give one free reign to play.

-Stoic Joker (January 09, 2015, 02:32 PM)

Exactly.

-wraith808 (January 09, 2015, 02:54 PM)

Ignore me. I'm denser than usual today.

[superboyac]

If the domain has not been re-pointed, then though he doesn't have control of the domain, he does still have control of what the domain is pointed to.  He didn't sell them his servers, he sold a domain name.

-wraith808 (January 09, 2015, 08:22 AM)

Huh?

-40hz (January 09, 2015, 02:14 PM)

I think he means if the new owner hasn't updated the DNS records then having access to the old(/current) hosting account -(or just Admin level access to the relevant CMS)- would give one free reign to play.

-Stoic Joker (January 09, 2015, 02:32 PM)

Exactly.

-wraith808 (January 09, 2015, 02:54 PM)

Ignore me. I'm DeNSer than usual today.

-40hz (January 09, 2015, 03:39 PM)

Indeed.

[tomos]

Impressive journey, Tao.

[TaoPhoenix]

Impressive journey, Tao.

-tomos (January 09, 2015, 04:13 PM)

Thank you!

For completeness it would be interesting to confirm if all/most of the offers "do not complete", which would just make make the "hack facebook" a dumb "chocolate cake lure" just to run the downloader ads.

But wait! More news is developing! They have earned themselves a Set 4!

4a.
http://www.hackfacebookpass.net/
"Cloudflare Ok. Website offline"!?

(A variant of) Whois produces:
https://www.whois.net/
hackfacebookpass.net

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Domain Name: HACKFACEBOOKPASS.NET
Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: KARA.NS.CLOUDFLARE.COM
Name Server: NORM.NS.CLOUDFLARE.COM
Status: clientTransferProhibited
Updated Date: 10-dec-2014
Creation Date: 10-dec-2014
Expiration Date: 10-dec-2015

>>> Last update of whois database: Fri, 09 Jan 2015 22:30:46 GMT <<<

Which is like SEVEN MINUTES AGO. (Aka just now, limited only by my assembling this post!)

4b. So now I went back to the top to fill in a couple of gaps. (In particular I wanted to see how stupid the "hack" graphic script might have been.) Instead, FreewareBB is *down*!

This time the Whois looks a bit less helpful.

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Domain Name: FREEWAREBB.COM
Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Name Server: NS1.SOFTLAYER.COM
Name Server: NS2.SOFTLAYER.COM
Status: ok
Updated Date: 31-dec-2014
Creation Date: 26-sep-2007
Expiration Date: 26-sep-2016

>>> Last update of whois database: Wed, 31 Dec 2014 13:12:42 GMT <<<

So the guy must have basically just yanked the servers from the web and is thinking about what to do next.

4c.
"Cloudflare/other 'claims there is no cached version available' (at wherever)", but since all this is happening at a good clip today, here is a Google Cache copy of that page.
http://webcache.goog...mp;ct=clnk&gl=us

4d.
Google Cached versions do apparently keep certain links "live". The "click here to hack" link has a starting address of:
http://www.freewareb..._is_my_password.html

That apparently also used to go to a (legit?) password security informational service, and they re-wrote that link as well to be the "hack script" link. Looking at Google Cache produces this older content that used to be there. (The new one from today is of course down with everything else when they yanked it.)
http://webcache.goog...mp;ct=clnk&gl=us

4e.
Just one of the previous DC threads on this, exactly two years ago in Jan 2013.
https://www.donation...x.php?topic=33786.10

4f.
It looks like the former owner was involved and helping!
https://www.facebook.com/freewarebb
"Freewarebb
2 hrs (ago)

Looks like it's 1-0 to me "

I wonder if he was clever enough to put any post-sale clauses in his sales contract, whereupon "using the site for a crime" might have invalidated the sale. Those "Windows Drivers" are "weasel-able", but "click here to break a Facebook password" is a whole other animal! Especially since (again, that facepalm-which brand of stupid was he), his *other* example of who to hack was ... wait for it ... Mark Zuckerberg!! So, maybe the RIAA is lazy, and Ms. Minogue didn't yet get a call from Joe at the police, but you better bet Mark Z's Friendly Borg Henchman Hugh (remember, the nice Borg? Mark Z gave him a nice new job to work on content!    ), who reported that a formerly rather obscure but honest site was now showcasing cheap Hack Facebook scripts... Mark Z though his chain of command said "Oh. That's bad news to hear about them. Boss? How would you like me to destroy this guy? Should I press the blue button with yellow spots, the turquoise button with green stripes, or just dump a tractor trailer of free pizzas in his yard and organize a Teenage Mutant Ninja Turtle costume party?"

I jest, gentle spoofing and all that. But it would be cool if Facebook occasionally lent a hand to help a little guy when someone is dumb enough to say "Hey look! A Hornet's nest! Maybe it's a pinyata and if I hit it hard enough with a bat, I can get candy!"

So ends Chapter 1, for now!!

Let's see what happens next! I expect a couple days of smoke and Like-able hornets to be involved for a few days!

[SeraphimLabs]

I see you learned a few things about how websites work Tao.  Lot of people don't realize just how much info you can pick out of someone's web setup just by poking around at information that is already public in order to make everything run smoothly.

There's a good chance that the hack site went down because supporters of the original site are upset about what happened and either attacked it directly to try and kill it, or because you literally saw the transition taking place and they didn't do it right- it resulted in a period where the DNS was pointed to an IP that no longer had a server under it.

This whole situation is downright sad, and just a solid reminder that there are some really bad people out there.

[TaoPhoenix]

I see you learned a few things about how websites work Tao.  Lot of people don't realize just how much info you can pick out of someone's web setup just by poking around at information that is already public in order to make everything run smoothly.

There's a good chance that the hack site went down because supporters of the original site are upset about what happened and either attacked it directly to try and kill it, or because you literally saw the transition taking place and they didn't do it right- it resulted in a period where the DNS was pointed to an IP that no longer had a server under it.

This whole situation is downright sad, and just a solid reminder that there are some really bad people out there.

-SeraphimLabs (January 09, 2015, 06:22 PM)

... or some combo of all that. I still think it would be cool if Facebook helped and said so in a press release.

I learned a couple of things, but a good chunk of it I already knew, but wanted to try to just do some legwork and save people some time just to see where it was all going. I haven't seen that particular "scam engine" before, so that was educational.

"Something" is back up "and will launch soon", but I would still like that TV-Episode "closing monologue" to finish out the story.

[TaoPhoenix]

Well, it's back up. So my notes stand mostly as is.

Someone wanna check and report in on the "hack page"?

To me it looks indeed like it might just be silly graphics going all "whee whizzy!"
There's a few other things there, but it looks pretty light for a high powered hack engine.
--------

<link href="_layout/style.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="jquery-1.7.1.min.js"></script>
<script language="javascript" type="text/javascript">
<!--
var total = 31;
var iteration = 0;
var attempt = 0;
function showProgress()
{
   var url = document.location + '?ajaxRequest=true&total=' + total.toString() +
      '&iteration=' + iteration.toString() + '&attempt=' + attempt.toString();
   $.ajax({
      url: url,
      cache: false,
      dataType: "json",
      success: function(data)
      {
         updateProgress(data);
      }
   });
}

function updateProgress(data)
{
   attempt = data.attempt;
   $('#progressBar').width(data.percentComplete);
   $('#information').html(data.information);
   iteration++;
   if( iteration <= total )
   {
      timeOut = setTimeout(showProgress, 1000);
      updateCombinations();
   }
   else
   {
      $('#status').html('Status: <font color="green"><strong>Complete!<strong></font>');
      $('#unlockcode').show();
   }
}

function updateCombinations()
{
   if( iteration <= total )
   {
      $('#attempt').html(attempt++);
      counter = setTimeout(updateCombinations, 1);
   }
}

function validateAuthCode()
{
   var url = document.location + '?validateAuthCode=' + $('#authCode').val();
   $.ajax({
      url: url,
      cache: false,
      success: function(data)
      {
         alert(data);
      }
   });
}
-->
</script>

---------------