FYI - SailNet Hacked

[Yachts66]

When trying to open a PM here (at SailNet.com) my firewall software issued the following:

Safe Browsing

Diagnostic page for sailnet.com

What is the current listing status for sailnet.com?

Site is listed as suspicious - visiting this web site may harm your computer.
Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 469 pages we tested on the site over the past 90 days, 8 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-09-08, and the last time suspicious content was found on this site was on 2010-09-08.Malicious software includes 8 exploit(s). Successful infection resulted in an average of 1 new process(es) on the target machine.
Malicious software is hosted on 2 domain(s), including blamesslek.com/, ratsix.com/.
This site was hosted on 2 network(s) including AS20021 (LNH), AS14492 (DATAPIPE).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, sailnet.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

• Return to the previous page.
• If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.

So what's going on??

Thomas

[capn_billl]

A spammer hacked the site?? I have talked to a moderator of another public forum that had several hacking attacks. One was successfull enough that the site had to be stopped while the malware was removed from the server. The moderator had to restore the site from a previous copy that lost several days of postings. Contact the moderator of the site in question as they may not be aware, (but probably are). of the attempt. And may be working on a fix.

[GordMay]

When trying to open a PM here, on CF, your firewall softwarewarns you about SN?
Interesting.

EDIT: for clarity, the OP was talking about opening a PM on SailNet, not CF. --- Hud

[capn_billl]

After several attacks the moderator had to disable ALL guest posting. And auto account signups. Each new member had to be manually audited with no posting priviledges until vetted.

[Yachts66]

Thank you.

Thomas

[speakeasy]

Happened at sailnet this am, same message. Wouldn't allow access at all in firefox, but would in chrome and ie, then IE began the same message warning and limited access. Maybe google is having a little nervous breakdown. So much power in the hands of one gen x company. Me oh my. I didn't get a warning here in firefox today tho', yet.

[rebel heart]

I remember when the guys that ran sailnet got into a big argument and the site was offline for what, six months?

[Pblais]

I didn't get a warning here in firefox today tho', yet.

We've not been hacked. Never is the operative history. It's not taken for granted.

Web browsers are perfect targets to direct virus infected files with. There is a new Mozilla released recently to fix a lot of problems. Any Mozilla based browser user should update now! No browser is really safe. Apple is now faced with a handful of problems. Browsers are the target of virus developers make no mistake.

It emphasizes that you need a decent anti virus application with web protection that get regular updates or you just can ever be sure. You don't expect bigger sites that seem very on top of it to ever get hacked. For a long time the porn sites and other less well run sites were targets because the people that came there surfed from place to place a lot and the admins were not very good.

It's at a new level now and it's almost impossible to say who can not get hit. We are lucky Andy has a few other boards and has a solid infrastructure set up but it still takes day to day efforts to keep a site in a top secure state.

We hope Sailnet can clean up the problem and get back to being online and safe again soon.

[jerrymc]

I checked this out after reading the posts & yes, I got a warning page, as well. If you read the "Why was this page blocked", you'll find this statement:

"This site was hosted on 2 network(s) including AS20021 (LNH), AS14492 (DATAPIPE)."

It seems that sailnet.com is hosted on the same network where a number of possibly hacked &/or malicious sites reside, so Google has taken it upon themselves to just block every site on the sub-net (network). Sorta like using a sledge hammer to kill a fly, in my opinion, but whatever.

It does NOT appear that sailnet has been hacked or is hosting malware, but unfortunate to be a client of a hosting company that has other clients on the same network that are guilty of suspicous behaviour

[DeepFrz]

I picked up a couple of Trojans a few weeks ago. Have no idea where they came from, but I know for sure it was not porn sites. Security Essentials cleaned them up but I had to reinstall a few software packages as the update software for them would not work(Java for one). Yesterday I had to delete and reinstall Adobe Flash. I don't know why for sure but it just stopped working. It would not work properly until I reinstalled Firefox, which was at the latest level. So I'm not sure if Adobe Flash was corrupted or if Firefox was the problem, or both. Pain.

[Caribsailors]

There's Porn on the Internet?!

[rebel heart]

Yeah I dunno, this sounds rather damning:

Of the 469 pages we tested on the site over the past 90 days, 8 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-09-08, and the last time suspicious content was found on this site was on 2010-09-08.

[avb3]

I had the misfortune of having a number of my websites on a server that was infected. IN fact, some of my pages had javascript running on them that pointed to some porn and I am not sure what other sites.

What was worse, when I contacted the admin they suggested it was my issue... not theirs. I won't go into the long and short of it, but I quickly moved my websites, even though I still had up to 6 months left on a contract. No problems since then.

I take these warning seriously. The best way to avoid them if your on a shared server is to run a VPS or dedicated one. If your site is big enough, it is not a huge investment, although it does require more technical skills.

[Yachts66]

Oh kewl, well you lost me after the second paragraph, so I guess that means I'm not a techie any more. Where's DOS when you need it?

Regards,

Thomas

[Andy R]

I feel bad for them. We have been through hacks and it's a very difficult situation to resolve. Hopefully they will turn off their site ASAP and work through the issues so no unnecessary computers are infected and be back up and running soon.