By voipfc on

When I search for webchick in Google all the links to webchick.net popup with a website which crashed my browser in one case, and was blocked by Norton on another.

As both machines are on different systems in different locations I suspect it is a server hack.

Can someone advise webchick to look into it. I tried to see if I could contact here through the contact form here but can't find the link.

Hopefully it wll be noticed and fixed soon.

voipfc

Comments

dnewkerk’s picture

dnewkerk commented

Yep looks like it's hacked. I went to webchick.net and it automatically tried to forward to a domain with a .ru extension. I'll mention it in IRC and someone there will certainly be able to get in touch with her.

dnewkerk’s picture

dnewkerk commented

Spoke with webchick for a few moments... she's aware of it:

webchick: yeah, basically dreamhost got hacked and all their ssh passwords were vailable in plaintext. sigh. I've been into git and reverted that a couple of times, but it keeps coming back, and I've no time to deal with it properly
webchick: i need to just move to a decent host that doesn't do stupid crap like that

voipfc’s picture

voipfc commented

Then she should disable the site in the Dreamhost panel. The Dreamhost hack occurred and was announced ages ago and lots of Drupal users are going to access the site and probably get infected as a result. Surely this requires greater urgency on her part.

jlhs’s picture

jlhs commented

Unfortunately didn't know about this thread (Visted the webchick site today) and now am worried about viruses etc (That will teach me for being on a windows computer instead of linux, never know when a hacked server is just around the corner when surfing the web).

The main webchick domain name goes to a URL that is not from the webchick site, it goes to one with a russian domain name.

Changing the name servers in the webchick.net domain name from

ns1.dreamhost.com
ns2.dreamhost.com
ns3.dreamhost.com

To anything else would take the danger away, then it wouldn't matter how stuffed and hacked dreamhost is, the domain wouldn't be pointing there anymore.

dnewkerk’s picture

dnewkerk commented

I could be mistaken, but I think it's been fixed since about a day after this initial post. I visited a few days ago, and today as well and saw no signs of the malware anymore. Are you still seeing something on your end?

jlhs’s picture

jlhs commented

Hi David,

Not really in a hurry to visit for a while,

The name servers are still

Name Server: NS1.DREAMHOST.COM
Name Server: NS2.DREAMHOST.COM
Name Server: NS3.DREAMHOST.COM

Dreamhost may (Hopefully???) have got their act together and cleaned out all all their systems with a fine toothed comb with a knowledgeable security expert and put in defensive measures and plugged holes, but I have no certainty of that, that is just what I would like them to do...