News JPSOFT.COM Hacked

[rconn]

Somewhere between about 12am and 2am (US East Coast time) the jpsoft.com site was hacked. None of the pages were changed, but the attacker somehow managed to change the .htaccess file to redirect some pages to a malware site. We have removed the offending .htaccess and are working with our hosting provider to determine how the attacker got in.

We do not have any evidence at this point that the attacker did anything more than redirect some pages. The JP Software web store is hosted on a different server, so no account passwords or credit cards were affected. Forum passwords are kept on the jpsoft.com server, but they are encrypted and we don't have any evidence yet that the attacker accessed anything other than the .htaccess file.

We'll keep up updated as we learn more.

 

[Steve Fabian]

GOOGLE has already blacklisted jpsoft.com ! I had to get past their warning on Firefox to get here.

 

[rconn]

GOOGLE has already blacklisted jpsoft.com ! I had to get past their warning on Firefox to get here.

That happened first -- Google blocked the site & sent me an email. I fixed the problem and requested that they review & remove the blacklist, but Google doesn't say how long it'll be before they get around to a review.

 

[JohnQSmith]

Somewhere between about 12am and 2am (US East Coast time) the jpsoft.com site was hacked. None of the pages were changed, but the attacker somehow managed to change the .htaccess file to redirect some pages to a malware site. We have removed the offending .htaccess and are working with our hosting provider to determine how the attacker got in.

Glad you're on top of things. Chrome surprised me when I clicked the forum link. I was holding my breath when I clicked the "proceed anyway" link on the Google warning page.

 

[Stefano Piccardi]

Could the Most Online Users 163 top on June 1, 2012 have anything to do with the hack?

 

[Steve Fabian]

CLEARED NOW!

 

[rconn]

Could the Most Online Users 163 top on June 1, 2012 have anything to do with the hack?

Doubtful, since the hack didn't occur until 7 days later, and it was in the root of the website, not the forums.

However, the overall site & forum have been under sustained attack for the last couple of weeks, mostly from China with the occasional burst from the Ukraine. But it hadn't affected anything until this morning.

 

[dcantor]

GOOGLE has already blacklisted jpsoft.com ! I had to get past their warning on Firefox to get here.

Same for me.

 

[rconn]

Everything should be back to normal now, and I've added some additional security layers that should prevent a recurrence.

Let me know if you have any problems accessing the web site or forum.