this site has been hacked

[1ntCobra]

The latest redirect I see on my iPhone in chrome is a page asking me to install Hulu. It mentions the iTunes Store. I just close out the page without clicking on it. The redirect opens a new page in chrome and the club Cobra page is still there after I close out the redirect page.

I wonder if this is somehow related to whatever site is supplying the advertisements to club Cobra.

[twobjshelbys]

Originally Posted by 1ntCobra

I wonder if this is somehow related to whatever site is supplying the advertisements to club Cobra.

I have been asserting that for close to a month. It only happens here.

[1ntCobra]

Originally Posted by twobjshelbys

I have been asserting that for close to a month. It only happens here.

Well if the problem is with the company that supplies the advertisements maybe Brent should contact them to see if they can stop the problem advertisements. If they cannot do it, then perhaps find a different company that can supply advertisements that are not potentially harmful.

[1ntCobra]

My latest redirect took me to the iTunes website. The URL looked like it was trying to take me to a specific app, but it did not work. Perhaps the app was removed from iTunes.

[twobjshelbys]

Originally Posted by 1ntCobra

Well if the problem is with the company that supplies the advertisements maybe Brent should contact them to see if they can stop the problem advertisements. If they cannot do it, then perhaps find a different company that can supply advertisements that are not potentially harmful.

The difficulty is finding which of the ads is the culprit...

[EM-0785]

Showed my IT guy my cell popups, his thoughts follow:

He said it’s coming from the site, malicious code likely through a valid or bogus site ad. This code is written to target mobile phones/devices.

One way to verify is go into ‘desktop mode’ from your phone, the site should work fine. Many phones do that by clicking the three vertical dots at top right and selecting to view in desktop mode.

If it pops up on your phone, close your browser using phone controls not screen controls presented. It’s important to avoid clicking links, including links triggered by clicking a bogus ‘X’ presented on screen for close out.

Often new advertisers come to sites to place malicious code, but it can also come through valid ads, unknown to that company.

He thinks it needs to be stopped at the forum site level. If not already resolved it may take someone like him to do a quick forensics/repair (just like us changing oil. ☺).

Fwiw…Best of luck. Brent

[Texasdoc]

I'm still getting new window pop-ups on my phone and my iPad. Only happens on this site. I've reset my advertiser's ID on all devices but it still happens.

[Blas]

Not sure if this is the fix... but I like many others have the auto-fill passwords on my iPad and iPhone. I deleted the Club Cobra password from the Safari browser on my iPad, cleared my cookies and history and then relogged in and saved my password info again. No pop ups so far on the iPad. iPhone still gets them..... Maybe this is the answer???? Time will tell......
Blas

[twobjshelbys]

Originally Posted by Blas

Not sure if this is the fix... but I like many others have the auto-fill passwords on my iPad and iPhone. I deleted the Club Cobra password from the Safari browser on my iPad, cleared my cookies and history and then relogged in and saved my password info again. No pop ups so far on the iPad. iPhone still gets them..... Maybe this is the answer???? Time will tell......
Blas

I doubt it. I took a factory reset Nexus 7 (working on it for my daughter) and it happened first time...

[joyridin']

I cleared everything out. History, passwords, cookies, and it still pops up randonly. We can assume that by now, nobody cares to fix the issue, so if you do not want to see the hijacking, stop visiting the site.

[Blas]

Did you erase your stored password and login? Then clear history and cookies. Then re-login and save your password again?

[twobjshelbys]

Originally Posted by Blas

Did you erase your stored password and login? Then clear history and cookies. Then re-login and save your password again?

I'm not sure who you were asking, but I did a FACTORY RESET. That erases EVERYTHING!!!!!

It is not anything to do with anyone's handheld unit. The problem resides HERE.

[EM-0785]

I don’t know exactly what it takes to identify the issue, if the site. Perhaps isolating ads by temp removing one at a time and testing user impact. Can ask my IT guy for thoughts. Also, happy to fund 1 hour on my IT company’s time to review/scope the process to assess steps to remedy.

Our lead ran his own IT business, works well with smaller companies and individuals, and is a cool car guy. The company has a handful of competent IT folks who collectively have seen much and can resolve most.

Just one reason I assume it’s important for users to support this site financially. I know there’s a balance involved, chicken and egg. It still costs some money to do things right, hard to consistently operate if on a shoestring.

I do plan to become a supporter, set out to sign up recently, then identified a question on support levels. Will get back to it, least I can do for the advice, entertainment, and common passion. I digress…Brent

[YerDugliness]

I am now getting redirected upon login with my iPhone 6S...this just started recently.

Dugly

[Blas]

Oh well, back to getting pop ups..... I tried to help.....

[mrmustang]

Alright boys and girls, when I am wrong, I'm wrong, and man enough to admit it, yesterday, on my Iphon6 (fully patched and updated), I got three different redirects to nefarious 3rd party websites, and 1 that redirected me to "taptalk". Catn't say why it never happened before, but it has now happened to me, forcing me to not surf CC while on my Iphone......Does not happen to our sister site Clubhotrod.com, just clubcobra......


So for those that I ignored early on, I humbly apologize,


I have sent out an email to Brent (as a mod on CHR), explained everything in detail. Hopefully he will be able to get to the bottom of this. In my mind, it may require that he finally update the forum software to a later revision, or turn off some of the income generating features that may be running in the background, or both.

Ball is firmly in his court, only time will tell.


Bill S

[Blas]

Respectfully.... First now to Brent?

[Al G]

Bill,
While it's nice that you admit you were wrong it would have been better if you believed all of us who have been reporting this problem. It's not a real problem until you experience it?

[mrmustang]

Originally Posted by Al G

Bill,
While it's nice that you admit you were wrong it would have been better if you believed all of us who have been reporting this problem. It's not a real problem until you experience it?

When this thread started, and all throughout it's being brought up to the top, I attempted to experience the same thing, on multiple platforms, using multiple browsers. When I could not, I then chalked it up to either user error, browser error, or hacking due to clicking on an email, seemingly from a friend (I clean more of my friends and families computers because of this one).......

Now that I have finally experienced it for myself, using the same up to date, fully patched Iphone, I've been able to send more data to Brent for him to consider and to scratch off the list of past considerations as I have listed above.

Yet, strange, as it does not happen on any of the sister sites, at all, which as mentioned earlier (either here or in email to Brent), only differs by version of the software (3.8.0 here and Club Chopper, vs 4.1.3 on CHR)

Bill S.

[twobjshelbys]

Originally Posted by mrmustang

Yet, strange, as it does not happen on any of the sister sites, at all, which as mentioned earlier (either here or in email to Brent), only differs by version of the software (3.8.0 here and Club Chopper, vs 4.1.3 on CHR)

Bill S.

Do you share advertisers?

I'll assert, for the umpteenth time, that the source of the corruption is not resident on this site but on one of the sites linked from this site, most like an off site advertisement content. It is unusual for ads to have their HTML resident here, instead being accessed by a link to that content. Look there first. Taking away all ads and adding them back a few at a time might help zero in on which one(s) are the culprit.

Once again, simply clicking on ads from a Windows PC won't do any good. You have to examine their sources and look for specific behaviour based on a comparison of the browser type (it is sent when a link is opened). They are looking for specific mobile platforms.

Note: I cite the ads because they are not constant - vendor ads seem to rotate, so to get redirected you have to (1) be on a mobile platform when viewing and (2) hit the variable content in the right cycle. It's always possible that there is some other algorithm like a time clock or something else. I looked at cookies and didn't see anything obvious would be used to only do it every n'th time or something like that.

Of course if you remove all offsite links, and the problem still happens, then the hack is in local content. But the first step would be to scrub all the local HTML for paths that are specific to a mobile browser. Also don't preclude any "server" things like .asp's from being the source, and if those are binaries with dates that look wrong replace them.

Wasn't this site moved to a new server during the last crunch? Could this problem have been planted then?