Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


Forums › Desktop computing › Is Trade Me spreading virus again? (updated: metservice)
View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8

wjw

wjw
174 posts

Master Geek
+1 received by user: 5


  #508425 18-Aug-2011 11:21
Send private message

Looks ok to me



Ragnor
8279 posts

Uber Geek
+1 received by user: 585

Trusted

  #508427 18-Aug-2011 11:23
Send private message

That's my understanding of it, what ad network was the metservice using?

It's using openx now but not sure if that was what they were using before or whether they switched in a new system.

freitasm
BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41070

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #508429 18-Aug-2011 11:24
Send private message

I know the software in use was OpenX and seeing they applied an update then I believe it was in house.








Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 



Ragnor
8279 posts

Uber Geek
+1 received by user: 585

Trusted

  #508436 18-Aug-2011 11:29
Send private message

I see, I bet some butts are getting kicked for that sql injection fail.

DonGould
3892 posts

Uber Geek
+1 received by user: 164


  #508459 18-Aug-2011 11:45
Send private message

freitasm: Folks, on request of MetService I have created this blog post: http://www.geekzone.co.nz/freitasm/7776

Could you please check that the information is correct or closer to what we know, and if there's anything else we can add or change please send me a PM so I can update it?

I guess there will be quite a few readers on that so it would be good to get it as easier as possible for people to follow.

Thanks!


Nice.  Can I suggest dropping a link on NZNog?


D




Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

freitasm
BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41070

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #508461 18-Aug-2011 11:46
Send private message

Yes, not a problem.




Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

 
 
 
 

Shop now for Lego sets and other gifts (affiliate link).
DonGould
3892 posts

Uber Geek
+1 received by user: 164


  #508462 18-Aug-2011 11:49
Send private message

freitasm:
DonGould: So far I've read that AVG and MSE aren't stopping it.


Try Norton Power Eraser and let us know: http://security.symantec.com/nbrt/overview.aspx?lcid=1033

 


Thanks FM, now my problem is I don't know if I've actually got an issue any more to even be checking for.  I note two MSE updates in the past 24 hours.

But MSE is a bit strange.  I did a full scan a month back and it picked up a virus in an old back up.  I did a scan yesterday and it picked up the same virus in a slightly different part of the old back up.  So I'm left wondering why MSE didn't pick up the same issue in both locations the first time?




Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

DonGould
3892 posts

Uber Geek
+1 received by user: 164


  #508465 18-Aug-2011 11:51
Send private message

freitasm: Yes, not a problem.


Sorry, does that mean you're going to or you'd like me to?

Also should we contact the http://www.auscert.org.au people directly and ask them for comment?  They post updates on issues on AuNOG but not NZNog I don't think.


D




Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

freitasm
BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41070

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #508470 18-Aug-2011 11:54
Send private message

You do it please.

No need to contact auscert I think.

I've contacted Microsoft New Zealand for comments on MSE working/not working in this case. Waiting for a reply.




Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

DonGould
3892 posts

Uber Geek
+1 received by user: 164


  #508494 18-Aug-2011 12:13
Send private message

freitasm: You do it please.   - Done

No need to contact auscert I think.  - Ok

I've contacted Microsoft New Zealand for comments on MSE working/not working in this case. Waiting for a reply.   - Nice




Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

DonGould
3892 posts

Uber Geek
+1 received by user: 164


  #508506 18-Aug-2011 12:27
Send private message

freitasm: Back on topic folks...


Yes sorry FM - http://www.geekzone.co.nz/forums.asp?forumid=50&topicid=88576 for anyone interested in bantering the tin foil hat stuff.




Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

 
 
 
 

Shop now on Samsung phones, tablets, TVs and more (affiliate link).
MetServiceComms
51 posts

Master Geek
+1 received by user: 16

Trusted
Metservice

  #508590 18-Aug-2011 14:23
Send private message

Hi guys - we've had an enquiry regarding what implications this may have to iPads; I'm thinking no Java, no problems? Would be great to hear what you think - we really appreciate you all wading in on this issue!

Thanks
Jacqui




General Manager Corporate Affairs
Meteorological Service of New Zealand Ltd

freitasm
BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41070

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #508591 18-Aug-2011 14:26
Send private message

Hello Jacqui. I wouldn't expect this to be of any consequence on iPad, iPhones and other smartphone mobile platforms.





Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

Jarno
270 posts

Ultimate Geek
+1 received by user: 50


  #508598 18-Aug-2011 14:46
Send private message

So this was not an IE-specific expoit, but would have affected all browsers with Java installed?

deltadelta
21 posts

Geek
+1 received by user: 7


  #508679 18-Aug-2011 18:06
Send private message

To see what it does I fed it some fake credit card numbers that pass validation.

When you try and pay, it connects to 91.226.212.37 and then gets redirected to https://secure.fastbillingonline.com/payment/?... to take the credit card details.

I won't publish the whois results of the IP here, but it does resolve to the Ukraine; the billing site has a US registrant.

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8
View this topic in a long page with up to 500 replies per page Create new topic








Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Updates »

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.








RSS feeds
Main feed
Forums feed
Copyright
©2002-2026 Geekzone®
Site features
Geekzone BI dashboard
Geekzone Badges
Geekzone Status Page

 

Site Information
Subscribe to Geekzone
Privacy Statement
Forum Usage Guidelines (FUG)
Advertising
Trademark and copyright