Explicit content site opens when I enter overunity.com

[hansvonlieven]

It somehow is tied to the login. I booted up the browser as guest and the minute I logged in as me the second browser window came up. I think there are several triggers sitting on the server.

When booting up the browser, if you look at the bottom bar in firefox where it tells you what the computer is doing it very very quickly shows Russian addresses before coming up with "transferring data from overunity.com"

Perhaps it is only visible here because I have a landline, broadband might be too fast to show up.

Hans von Lieven

[AquariuZ]

Cookies are just only stored in your browser,
so the user has to clear his cookies in the browser.

What are session IDs in cookies ?

eh, yeah that´s what I meant. Everyone get rid of the .ru cookies

Do they call up automatically the sites ?

One I threw away contained a PHP sessid, this can be used for various purposes..

How could they access the template files if they just managed to use
an older script that just updated the .htaccess file ?

They probably used the spider-trap script to somehow
add their code into the .htaccess file.

The spider-trap script is now disabled,
so I am looking for a different website firewall script now.

I don´t think they had FTP access, otherwise they would have been doing
much more nasty things..

You can execute any command (i.e via PHP) when they have write access to .htaccess. (via via via) assuming you are running Apache on Linux

Please check PM for details

[hartiberlin]

Hmm,
it really must be related to Session IDs,
very strange, do not know yet this trick.

If I clear my browsers cache and cookies and
klick this link:
http://www.overunity.com/index.php?action=unreadreplies

and then press the
HOME button

Then the p.or.n site is loading...

The Home  button has some session cookie attached.

I guess I try to change the cookie, that SMF is sending,
maybe this will help ?

[hansvonlieven]

Take the browser off automatic log in. Make overunity your default homepage. close the browser.

Re-open the browser, it will come up as guest. click on login and log in and the Russian site appears in a new window. Seems to work every time.

Hans von Lieven

[AquariuZ]

Take the browser off automatic log in. Make overunity your default homepage. close the browser.

Re-open the browser, it will come up as guest. click on login and log in and the Russian site appears in a new window. Seems to work every time.

Hans von Lieven

Yes that fits what I think is going on... Did you explicitly remove your .ru cookies locally? I have not had the popup for an hour now....

They are using a server reference to the session id and may have injected some code in a handler via PHP. This should not be possible if PHP is up to date though-