Site security WARNING

[ojisan]

Thank you, Tincon.
Despite our differences of opinion, we are all in this together.

[ILVH8RS]

Hope you guys don't mind a newbie commenting on this.

I checked out his site and I couldn't find malicious code. I checked the source code on both his image repo and the parent site.

That said, while rievera.bewegundm looks like just a normal image repo, the parent site bewegundm looks extremely suspicious. It looks like some sort of wordpress site. Running the blog posts through a translator shows that it's all advertisement spam. Furthermore, the site is written in German but WHOIS shows the domain is registered to someone in China.

Disclaimer: I have no background in NetSec so hopefully someone who does work in the field can come in here to explain. If I had to venture a guess though, it looks to me like he's trying to spam hits to his site where he either gets money on clickthroughs or on people buying what he's peddling. Not infecting people with malicious code, but not kosher either.

Some pics to show examples so y'all don't have to visit his site:

Aprreciate some one checking this out but I have absolutely no idea wtf your saying here....lost me at the word code. I know absolutely squat about these types of things but whats with the Honeymoon in Thiland post?

[ILVH8RS]

^ and yes thats a CGN smiley....

[12voltguy]

I don't remember ever clicking on a smiley.

I


You don't have to, your browser automatically loads them. If this keeps up, it may be worth not allowing external image links (require the image to be uploaded/attached here). But I'm not sure how dangerous this code really is. Something is up for sure though.

Don't click on links you don't know or trust. Simple!

NOT so simple!

[r31ncarnat3d]

Aprreciate some one checking this out but I have absolutely no idea wtf your saying here....lost me at the word code. I know absolutely squat about these types of things but whats with the Honeymoon in Thiland post?

Just spammy stuff trying to sell you things. I don't work in NetSec but my guess is he's a spammer trying to sell stuff, and that linking to his site will get him clickthroughs which means more money for him.

I think it's just a less annoying (although just as bad) version of people spamming you with Viagra and timeshare emails.

[jben]

I was wondering why Avast kept telling me there was malicious content on some threads last night.

[TheBest]

Here's another one: http://www.calguns.net/calgunforum/s...postcount=7641

Links from "wissensde.com".

[numpty]

Aprreciate some one checking this out but I have absolutely no idea wtf your saying here....lost me at the word code. I know absolutely squat about these types of things but whats with the Honeymoon in Thiland post?

Ditto!

[The Gleam]

Here's another one: http://www.calguns.net/calgunforum/s...postcount=7641

Links from "wissensde.com".

Wait; your telling me there are pages/post with harmful smileys, then tell me to click on that link to a page/post with a harmful smiley? Ummm.. no.

Or does one have to actually click on the smiley for the malware to be ingested? I don't think I've ever clicked on a smiley for any reason. Why would you?

[TheBest]

Wait; your telling me there are pages/post with harmful smileys, then tell me to click on that link to a page/post with a harmful smiley? Ummm.. no.

Or does one have to actually click on the smiley for the malware to be ingested? I don't think I've ever clicked on a smiley for any reason. Why would you?

No, you don't need to click on it at all. Just loading the JPG can launch malware. The malicious code is in the EXIF data that's downloaded and read for every image.

[The Gleam]

No, you don't need to click on it at all. Just loading the JPG can launch malware. The malicious code is in the EXIF data that's downloaded and read for every image.

Crazy! Never would have thought. So this could happen randomly; this could have ALREADY happened! I can't recall which threads I might have simply clicked, read, and with little interest - vacated.

[epilepticninja]

Yee?