Is it just me, or does the forum link send you elsewhere?

Topic: Is it just me, or does the forum link send you elsewhere? (Read 5520 times) previous topic - next topic

Is it just me, or does the forum link send you elsewhere?

June 07, 2010, 02:34:45 am

when accessing the forum from the main page http://forum.simutrans.com/ it sends me to lockerzpoints dot com.

Is it just me, or does anyone else get this problem?
I just got this when accessing the forum today. I had to go through one of the language board links from the simutrans page to get here. It wasn't happening before and I'm quite certain my PC is free of malware.

If this was the wrong section to post this, sorry. Mods feel free to move this wherever it should be. I tried to PM an admin about the issue, but PMs are disabled.

Re: Is it just me, or does the forum link send you elsewhere?

Reply #1 – June 07, 2010, 02:43:22 am

Yep, something is wrong. I sent an email to Isaac, will try to send to a few other people.

Re: Is it just me, or does the forum link send you elsewhere?

Reply #2 – June 07, 2010, 02:49:26 am

I got the report.

Please, use the address http://forum.simutrans.com/index.php while this problem is under investigation.

Re: Is it just me, or does the forum link send you elsewhere?

Reply #3 – June 07, 2010, 06:51:48 am

I can confirm it too.

Re: Is it just me, or does the forum link send you elsewhere?

Reply #4 – June 07, 2010, 07:18:26 am

Server has almost certainly been hacked, it is serving HTTP redirects when accessing that page.

Re: Is it just me, or does the forum link send you elsewhere?

Reply #5 – June 07, 2010, 03:06:47 pm

Investigating now.

Looks like VS found a .htaccess with a simple redirect. Now I'm going to have to try and decide/see if it was SMF, or someone getting the p****word, or what.

EDIT: Looks like the only two .htaccess files modified were both for this account, so either the account or the forum got hacked, looks like.

I'm going to go change the p****word for the account and hope that helps. :-|

Re: Is it just me, or does the forum link send you elsewhere?

Reply #6 – June 07, 2010, 10:56:21 pm

Hmm, if it was a hole in SMF, then I would expect the following actions to target SMF functions as well. With such a generic payload, I suspect a problem with PHP, MySQL or the underlying software.

How can we be sure that there isn't a backdoor? Comparing the RTE to a backup works to a limited extent.

Re: Is it just me, or does the forum link send you elsewhere?

Reply #7 – June 08, 2010, 02:49:19 am

better post something about this on the simutrans blog, and possibly other simutrans news sites.