my-page-de.info (Project Euler was hacked!)

[rlindley]

[updated edit by euler]Project Euler has now moved from the vulnerable servers at servage.net to a more secure server with a different host (duoservers).[/edit]

[original edit by euler]I've edited this post to let members know that Project Euler was hacked. I am doing my best to check and remove any further hacks, but I would ask members to be vigilant and report anything suspicious here. Our current hosts (servage.net) know about this but are incapable of doing anything about it. I am currently test driving a new host provider with the view of moving Project Euler.[/edit]


I noticed that when browsing projecteuler.net that my browser kept trying to access my-page-de.info when I would hit my back button, then it would hang for a few seconds. I thought I had a virus or hijacker or something, but my computer checked out clean. So I tried it on another computer and the same thing is happening. Anyone else experiencing the same thing? Google says that my-page-de.info is possibly a harmful site, but I couldn't find much info on it. Do both my computers have the same virus or something?

I have not noticed it happening on mathschallenge.net or anyplace but projecteuler.net.

[edit] I first posted this in "recreational" by mistake, so I moved it here.

[hk]

Tried it after your post.
Got the same problem as you once. But now its over again.
I don't think you have a virus.

[euler]

Thank you for bringing that to my attention. The website had been hacked and there was a nasty piece of Javascript code injected into the main index.php page. It uses an "iframe" hack which most modern browsers should block. But if your browser is vulnerable it was redirecting you to the website you mentioned and then attempts to install a trojan on your machine.

I've temporarily removed the malicious code, but it seems that the problem is due to sloppy security with our current hosts, servage.net, so I expect the hackers to do it again. I have had a long running dispute with servage over mathschallenge.net being repeatedly hacked on an almost daily basis. Servage failed on every occasion to deal with the matter effectively so I have moved mathschallenge.net to a different host. Surprisingly no hack attacks yet!

If I am satisfied that the new hosts provide a secure server environment I will migrate Project Euler across.

All I can do in the meantime is keep checking and removing any further code injections. If anyone notices anything similar or suspicious could they please let me know.

[hk]

Mc Afee site advisor warned me not to go any further.

[rlindley]

This is my second attempt at this post. The first try somehow went in the bit bucket.

Yes, the problem seems to be gone and projecteuler.net responds very quickly now. Much quicker than even before I noticed the problem.

I'm running Windows XP with IE7. I don't think that the script it was trying to run was ever successful, but I'm not sure. I ran AdAware, Spybot and Microsoft's free online virus checker before I made my first post and none of them found anything. Is there something more I should do to see if I have been infected? Is there something special to look for?

Now is the time for a donate button. I'd certainly give something to help fund the cost of a dependable server. Then maybe we could get some of the old functionality back as well. Let's see, I figure I've learned way more here than I would have by taking a couple of college number theory/computer science/discrete math/etc. courses. What would that cost today? (On second thought, I can't afford it. I'm retired.) ([edit] I mean I can't afford the cost of a couple of college courses nowadays. But I'll give what I can to support PE.)

[euler]

I didn't get time to analyse the nature of the hack fully, but the usual trick is to embed an iframe on the page which tries to run a piece of malware on the remote website. As the iframe is invisible it looks like Project Euler requests that you install a plug-in. As long as you didn't see this request and "accept" then you need not worry about being infected.

[Tommy137]

I'm running Windows XP with IE7. I don't think that the script it was trying to run was ever successful, but I'm not sure. I ran AdAware, Spybot and Microsoft's free online virus checker before I made my first post and none of them found anything. Is there something more I should do to see if I have been infected? Is there something special to look for?

Did the same things here and didn't find anything.

As I didn't see a request to install a plug-in I think the IE blocked it anyway.

[quilan]

I noticed that when browsing projecteuler.net that my browser kept trying to access my-page-de.info when I would hit my back button, then it would hang for a few seconds.

Let this be a lesson learned: this is why I never leave/close PE.

[euler]

Project Euler has moved away from servage.net to a different host (duoservers), who fortunately take security very seriously.

[rlindley]

I notice that, for problem 114 at least, the "printer friendly document" link takes me to the home page instead of the document.

[Tommy137]

Maybe that's why PE is offline at the moment.

Argh!

[euler]

@rlindley: fixed!

@Tommy137: When the server was changed the DNS records needed to be changed and this takes time as all the servers throughout the world are updated. This can take anything up to 48 hours (worst case scenario), but most likely will be pointing you at the new server within 24 hours. In the meantime you should be able to download a PDF of all the current problems to be getting on with, but I hope it resolves for you shortly and you have access to the website proper.

[JohnMorris]

Everything looks good from here.

Will the new provider let you turn back on some of those CPU intensive features you had to switch off with the old ones?

[euler]

We'll see. In the short time we've been with the new hosts it has become apparent that the previous hosts (servage.net) lied about the bandwidth usage. Our new hosts have a much more accurate system which not only reports bandwidth and traffic, but also reports details of CPU/memory usage and the number of MySQL queries on an hour by hour basis. I'll carefully monitor these statistics and if I find that we're regularly below our quota I'll look into restoring some of the previous features.

[guana]

It's great to hear you got a new server. Often I couldn't access the site because of an MySQL error. Hopefully this fixes that!