links to cityjournalist.info

[Denniss]

I'm browsing with Firefox and the noscript add-on. I noticed a new site on the list I have never seen before - cityjournalist.info
For some reason it only pops up in forum sections with the blue background like AoD or Hoi3 but not in Victoria2 (red background).

Is this link intentional or some kind of infection ?

 

[safferli]

Interesting, I use DeepOceanEdited for all my forums, and I get the citiinfo scripts (also blocked by noscript) on all forums, including the V2 one. Has to be something with the blue forum style.

 

[Nikolai]

http://forum.paradoxplaza.com/forum/showthread.php?555109-Odd-script-in-paradox-forum

Seems malicious judging from the info in that thread.

 

[Denniss]

Any update on this?
It's still popping up

 

[Kallocain]

I found the script in the template and removed it, so this should be solved now.

 

[Denniss]

Infection seems to be back, noscript pops up with the site betamarket.info - but not everywhere. I've seen it in AoD, Hoi2, Hoi2DD but not in Hoi3 or V2.

EDIT: Please check all board styles as a citijournalist link is still present in NewBlue and vb4 blue styles, the other reported above is in deep ocean edited

 

[unmerged(105596)]

I'm getting betamarket.info on this very thread. Thank god for NoScript!

 

[Denniss]

Change to NewBlue forum style and you get citijournalist.info instead.
Paradox nees to work on the board software again, they should think about going away from the customized version based on an older VB release to a more recent VB release without that many modifications.
There must be a security hole somewhere in the software and they need to track down and fix it - not every script kiddie or hacker just places some ad links.

 

[hito1]

Again?! Could Paradox please take a more firm position on this problem?

 

[s1234567890m]

I'm getting betamarket.info on this very thread. Thank god for NoScript!

this

 

[Denniss]

Is someone already investigating this ?

 

[Kallocain]

We found the guy. Do you think we should report him to the police? I'm thinking of doing that.

 

[s1234567890m]

are you allowed to say how they were doing it?

Edit: police yes do that

 

[unmerged(105596)]

are you allowed to say how they were doing it?

Edit: police yes do that

"Hi forumites,

this is how you infect our forums with malicious porn links:

..."

Not A Very Good Idea.

 

[s1234567890m]

"Hi forumites,

this is how you infect our forums with malicious porn links:

..."

Not A Very Good Idea.

more like they would have fixed the hole...

 

[Nikolai]

We found the guy. Do you think we should report him to the police? I'm thinking of doing that.

Absolutely. Send the police on him.

 

[Kallocain]

I'm not going to discuss how we found or (hopefully) stopped the hacker, but I can say that the matter is reported to the police now, so hopefully we can stop this one from harming us and other sites in the future.

 

[^_AC_^]

Good job!

 

[hito1]

Thank you!

 

[Teurlinx]

I'm not going to discuss how we found or (hopefully) stopped the hacker, but I can say that the matter is reported to the police now, so hopefully we can stop this one from harming us and other sites in the future.

Good news, was the scope of the intrusion limited to re-directs (for us users). Or was it something more?