OkcTalk hacked?

[Snowman]

Well, Pete, I dropped and recreated the bookmark, but darned if its not still coming up. So I opened up a fresh browser window, hand-typed the URL, and got it again, so I can tell you that I get the "Invalid forum" from a bookmark that takes me to:

http://okctalk.com/

If I prefix the okctalk.com with "www.", it routes correctly. Hope that helps!

-SoonerDave

This makes it seem even more like a caching issue. Neither recreating the bookmark, nor creating a new browser window would clear the browser cache. Plus different canonical names for the same site are treated nearly like different sites by the browsers.

[SoonerDave]

This makes it seem even more like a caching issue. Neither recreating the bookmark, nor creating a new browser window would clear the browser cache. Plus different canonical names for the same site are treated nearly like different sites by the browsers.

Understand that the bookmark is not related to caching. I was seeing what was being returned for a query for the given URL, and didn't want to rely on what the bookmark might be sending behind the scenes.

And I see this behavior on three different computers and one Android phone, inside and outside my local network.

As one other level of curiosity, I just performed an network trace on a browser request for "okctalk.com", and the response is a 301 - Moved Permanently to "http://www.okctalk.com/forums". The same packet also shows an explicit X-Cache MISS from squid's cache (on my firewall).

The netmon trace is consistent with what Chrome reports as the information from its own cache:

http://okctalk.com/
HTTP/1.0 301 Moved Permanently
Date: Tue, 15 Jan 2013 05:15:13 GMT
Server: LiteSpeed
Location: http://www.okctalk.com/forums/
Content-Type: text/html
Content-Length: 413
X-Cache: MISS from [my-firewall-name-removed]
Via: 1.0 [my-firewall-name-removed]:800 (squid/2.7.STABLE9)
00000000: 32 01 00 00 03 08 00 00 97 9d 8a 21 e3 31 2e 00 2..........!.1..
00000010: e7 d1 8d 21 e3 31 2e 00 f1 00 00 00 48 54 54 50 ...!.1......HTTP
00000020: 2f 31 2e 30 20 33 30 31 20 4d 6f 76 65 64 20 50 /1.0 301 Moved P
00000030: 65 72 6d 61 6e 65 6e 74 6c 79 00 44 61 74 65 3a ermanently.Date:
00000040: 20 54 75 65 2c 20 31 35 20 4a 61 6e 20 32 30 31 Tue, 15 Jan 201
00000050: 33 20 30 35 3a 31 35 3a 31 33 20 47 4d 54 00 53 3 05:15:13 GMT.S
00000060: 65 72 76 65 72 3a 20 4c 69 74 65 53 70 65 65 64 erver: LiteSpeed
00000070: 00 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 3a .Location: http:
00000080: 2f 2f 77 77 77 2e 6f 6b 63 74 61 6c 6b 2e 63 6f //www.okctalk.co
00000090: 6d 2f 66 6f 72 75 6d 73 2f 00 43 6f 6e 74 65 6e m/forums/.Conten
000000a0: 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d t-Type: text/htm
000000b0: 6c 00 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 l.Content-Length
000000c0: 3a 20 34 31 33 00 58 2d 43 61 63 68 65 3a 20 4d : 413.X-Cache: M
000000d0: 49 53 53 20 66 72 6f 6d 20 xx xx xx xx xx xx xx ISS from _______
000000e0: 65 00 56 69 61 3a 20 31 2e 30 20 xx xx xx xx xx e.Via: 1.0 _____
000000f0: xx xx xx 3a 38 30 30 20 28 73 71 75 69 64 2f 32 ___:800 (squid/2
00000100: 2e 37 2e 53 54 41 42 4c 45 39 29 00 00 00 00 00 .7.STABLE9).....
00000110: 98 26 ac d9 0b 2e f4 db 2a c8 63 84 4e 6d 9a dc .&......*.c.Nm..
00000120: 0f 00 00 00 31 39 39 2e 31 39 33 2e 32 34 35 2e ....199.193.245.
00000130: 32 31 37 00 50 00 217.P.


So, unless I"m missing something pretty fundamental, something on the okctalk.com side sure seems to be sending a 301 downstream, and the redirect URL is the one that causes the "Invalid Forum" message...

[Larry OKC]

I was geting the Google Malware Danger Alert late last week. At first when I followed the link with the explanation, it said that they had tested x number of pages but nothing was found (so I don't understand why there was a warning label). I decided not to do it since I was on a work computer (on my break) and tried again from home (both Macs, running different versions of System X, using Firefox). Over the weekend, the warning message/link stated they had found maleware on the site. Tried today (Wed) and no such messages so I presume all is well again in the OKCTalk universe. Thanks Pete!

On edit, before this happened I noticed the ability to format text (bold etc) or "quote" things was missing completely but is back now

[Head]

I can type in a title for a new thread on Midwest City/Del City, but then I can't enter any text for the message body. WTF?

[BoulderSooner]

there are still some issues okctalk.com directs to a mal site .. and the weather thread does as well

[venture]

I can type in a title for a new thread on Midwest City/Del City, but then I can't enter any text for the message body. WTF?

I've noticed that when editing a post.

there are still some issues okctalk.com directs to a mal site .. and the weather thread does as well

Hmm. Not getting that at all. Have you cleared cache?

[Pete]

We are working on the editing / new thread problem as I'm having it as well.

Hopefully will be resolved soon.

[Jim Kyle]

I'm unable to send any private messages; the Subject and Message fields are hidden on the dialog page and only the To and Title textareas are visible. Is this associated with the editing problem?

[Pete]

Yes.

Should have this all cleared up soon.

[flintysooner]

The mobile style is different and more or less useless now for me on IOS 6

[Lauri101]

Ditto to flintysooner

[Pete]

Okay, looks like we have the problem solved in terms of adding new threads and writing PM's.

Please let me know if you are still experiencing problems.


Also, the mobile style works fine for me on my iPhone. If it still doesn't look right on your end, please provide specifics.


Thanks.

[flintysooner]

Also, the mobile style works fine for me on my iPhone. If it still doesn't look right on your end, please provide specifics.

On my iPhone 5 - Safari - iOS 6.02 - in Mobile Style - the message display is normal but when the right arrow link is selected a little box comes up with "loading" and the little loading icon spins and spins. Often for me the next page never displays at all and the loading icon spins forever or until I get tired of it. This may have to do with the length of a thread but I can't say that is always true. If the next page does appear it kind of slides over rather than the old behavior and it never goes to the hash.

On Safari on Windows 7 the mobile style works fine by the way.

[Pete]

I cannot get this problem to replicate on my iPhone 4 and iOS 6.0.1.

Works perfectly fine for me.

[flintysooner]

I cannot get this problem to replicate on my iPhone 4 and iOS 6.0.1.

Works perfectly fine for me.

I cleared history and cookies and performed a hard reboot of iPhone 5 including clearing all tasks from memory. All now appears to be working as it was before.

[Pete]

Great! Glad to hear it.

[venture]

*digs for another major issue to cause Pete a few more gray hairs*

j/k

Thanks for all the hard work recently.

[Lauri101]

Pete - the mobile site on IPhone is functioning properly now - was able to post fine. Echoing Venture - thank you so much for getting this mess cleared up!

[Jim Kyle]

Pete, have we been hit again? I just tried to get to the Weather thread from What's New and it went off-site to a php script that showed only "ok" on the screen...

EDIT: The Weather thread is OK -- it's "What's New?" itself that returns "http://effect.home.pl/parts/dtd.php" as the result of any search...

[BBatesokc]

Pete, have we been hit again? I just tried to get to the Weather thread from What's New and it went off-site to a php script that showed only "ok" on the screen...

EDIT: The Weather thread is OK -- it's "What's New?" itself that returns "http://effect.home.pl/parts/dtd.php" as the result of any search...

Yeah, when I click "what's new" I get redirected to an "ok" screen also.

[SoonerDave]

Same here - think we've been hit again

Nearly every link I tried went to the "home.pl" site with "ok" on the browser, just happened to get this link that took me directly to this particular thread.

EDIT: Important note: I pulled apart the source on the "ok" page, and there's clearly some Javascript being pulled in, trying to do something on the client. Looks like it tries to launch Flash or display an image file, either of which are vectors for what's called a "buffer overrun" attack by constructing a specially formatted image file that has potentially malevolent code in it. Now, I'm not seeing any evidence of anything installed on my box, but just be aware of what might be going on when that "OK" page hits.

[Pete]

Working on it.

Looks like it's contained to threads accessed through the "what's new" tab.

[Jim Kyle]

That's my impression also.

I understand that vBulletin has a number of vulnerabilities and I see that the copyright notice at the bottom of each page shows 2008 as the most recent year. Do you have any alternatives? It's obvious that somebody is intent on pwning the site...

EDIT: FWIW, I run Linux here, xubuntu to be exact, and so am a bit more resistant to infection than are Windows users. I'll be glad to help troubleshoot if there's any way I can assist, Pete...

[Pete]

Should be fixed now.

Please advise if you have any other problems.

[Roger S]

I'm still having issues with the Bike Bar thread if I try and view it from the New Posts page.