This is a mobile optimized page that loads fast, if you want to load the real page, click this text.

Possible Security Threat on JRef?

Pachipro

JREF Resident Alien
Rest in Peace
Joined
19 Jan 2005
Messages
1,972
Reaction score
232
FYI. While checking the link for "Who's Online" I clicked on a link that either a guest or a spider was viewing. My intrusion detection system notified me that someone was trying to get into my computer.

This is the information:

Whether this is serious or not I do not know. But according to Symantec it is. I was unable to use my back button as when I did I was informed that it was directing me to the attacking IP address. I had to completely shut down windows and re-boot my computer. I am also told that I have a malicious script in my temporary internet files.

Can anyone explain this to me?
 
This problem seems to be related to unpatched versions of Internet Explorer and the way it reacts to certain JPG files. There are ways for hackers to embed code into some picture files but most files that give this error are not hacks. Please make sure your system is patched by using Windows Update.

More info

=> Symantec Security Center
 
Q]And what is the lesson to be learned here, class?

A]Use any browser other than IE!

(Sorry, Mr. Gates! .... but you're gonna have to do something soon .......!)

ﾆ淡ﾆ停?｡ﾆ停?
 
I use FireFox - so is my machine likely to be at risk also, or is it only IE that was made at risk? :?
 
Kinsao said:
I use FireFox - so is my machine likely to be at risk also, or is it only IE that was made at risk? :?
Click to expand...
MS IE is filled with bugs etc..Why do you think they almost have an update every 5 minutes
 
By looking at that picture in your sig. Kinsao, it looks like you are already at risk
 
Index said:
By looking at that picture in your sig. Kinsao, it looks like you are already at risk
Click to expand...

You don't think Kouji-san is manly? I don't think he'd be best pleased..... :box:
 
Luckily I was not affected by this intruder as my Symantec security software stopped it. The "malicious script" message I got was because of the Symantec Security software preventing my providers "desktop doctor" from accessing my computer. I ran a virus scan and am clean and was not affected.

I hope everyone is using some kind of protection as I am attacked by trojan horses from China and Korea at least 2-3 times a week!
 
Pararousia said:
I have my entire computer wrapped in latex.
Click to expand...

So ... your PC has a latex fetish .... ?

Hmmmm! ....... Methinks that's a little too much information, Pararousia .....!

ﾆ淡ﾆ停?｡ﾆ停?
 

You won't get any attack from eupedia.jref.com. This is just the Europe Photo Gallery, and all the photos uploaded there must be approve to appear. I suppose that you got this warning message when reading a thread with pics attached from the gallery (like the one about European vs Japanese architecture). These are my pictures, so there is no risk at all.
 
thomas said:
This problem seems to be related to unpatched versions of Internet Explorer and the way it reacts to certain JPG files.
Click to expand...

There was a security vulnerability reported last year (CAN-2004-0200), for which a security update was released. The earlier issue explicity dealt with JPEG files and shouldn't be confused with this similar sounding exploit.

The vulnerability Maciamo is talking about is related to the Color Management Module in Microsoft Windows (all versions from '98 onwards), which loads when it is required to process certain profile data of both image and non-image files. It is a Windows vulnerability which affects a wide range of files (not just JPEG) and is not limited to Internet Explorer. Downloading the patch mentioned earlier in the thread will fix this problem.

However, given that many users are not well versed in securing their PCs, I would suggest that as a responsible site, JREF should isolate and remove any files that may exploit this vulnerability as quickly as possible.
 
Thanks for the information folks !! Now I have some outside evidence for what my son (Junior in highschool here in Nagano, Japan, majoring in electronics--it's a tech school) has been telling me from Summer. . .
Me: "Sho...I really think there's something wrong with your PC, this IE doesn't always work right."
Sho: "Nobody who knows anything about computers uses that...IE is no good."
Me: "But at the office I never have any problems with it at all...."
Sho: "But it's still just no good. Use Opera."
Me: "Sho, you're only a highschool student, can you really say that?"
[the above quotes are 80% accurate] (this is just for a joke, here)

I'll keep my eyes open. Thanks Pachipro, and all !!
 
The number of exploits in non-IE browsers (particularly Firefox) has been growing significantly in recent times. This is an inevitable consequence of any high profile software once it starts to gain significant market share. Your browser is a personal choice and while personally I do not use IE, many IT professionals do. It's not true to say that "nobody who knows anything about computers" uses it. However it does have more than its fair share of vulnerabilities, and it's slower and more bloated than some more recent releases from competitors.

These days, it is (sadly) the responsibility of all internet users to ensure that they monitor and take whatever measures possible to secure their PC. While the real villains are the virus/malware writers, if you leave the front-door of your house open when you go out, and return to find someone has stolen your DVD player, you only have yourself to blame. The same is true for protecting your PC. A significant proportion of internet traffic is now taken up by 'zombie PCs' infected with some form of malicious software. Things would run a lot faster for everyone if the owners of these PCs paid more attention to their personal security.
 
Silverpoint said:
However, given that many users are not well versed in securing their PCs, I would suggest that as a responsible site, JREF should isolate and remove any files that may exploit this vulnerability as quickly as possible.
Click to expand...

What do you mean by removing those files ? Removing all the pictures from the Japan Gallery and Europe Gallery ? That won't happen.
 
Kinsao said:
You don't think Kouji-san is manly? I don't think he'd be best pleased..... :box:
Click to expand...

But I like your avatar
 
Maciamo said:
What do you mean by removing those files ? Removing all the pictures from the Japan Gallery and Europe Gallery ? That won't happen.
Click to expand...

You need to check your files (images predominantly) and make sure they are safe. If that means all of them need to be removed then yes, that's what you should do. However I find that extremely unlikely.
 
RockLee said:
MS IE is filled with bugs etc..Why do you think they almost have an update every 5 minutes
Click to expand...

why do you use IE, when you have to update it every 5 minutes :?
 
Thank you Index.

Which browser do you guys think is the best? FireFox is quite good but I am still aware that as it becomes more popular there is also the chance of problems. Also, I am puzzled as to why the majority of public computers (at least in the UK) and office computers seem to use IE when it is so vulnerable. Do businesses have better protection from these problems somehow? :?
 
Kinsao said:
You don't think Kouji-san is manly? I don't think he'd be best pleased..... :box:
Click to expand...

To be perfectly honest, I thought it was a girl.
 
mikecash said:
To be perfectly honest, I thought it was a girl.
Click to expand...

If you could view smilies, I'd be using a lot of the 'lol' smilies here. But I'll spare you, because I'm nice like that. Please... don't tempt me to direct you towards a crotch photo... it's a very nice picture......... *happy smilie here*

Kouji sometimes dresses like a woman, but it never looks very convincing on him - he really is too manly... it makes him look like an unsuccessful drag queen.

Offtopic - me? Never!
 
 
lastmagi said:
I always thought the VK artists intentionally tried to dress androgynously as part of their art, and maybe as a means to remove conventional concepts of masculinity/femininity.
Click to expand...

You are right and that is true. But Kozi is no longer a member of a VK band and hasn't been for a few years - Eve of Destiny is a "normal" goth band (hence white makeup and unusual clothes). And his solo-ness isn't anything especially VK. My avatar, however, dates from his Malice Mizer/VK time (chosen because I am female and I have no particular wish to mislead anyone by my avatar into thinking I am a guy! )
 
Pachipro said:
Can anyone explain this to me?
Click to expand...
Norton claims there are no false positives for this signature. I think they are wrong. If you compare the known ICC exploit code to the sRGB IEC61966-2.1 Color Space Profile you will find that the resulting binary data are nearly identical.
Two suggested ways to avoid this problem:
  1. Content creators should remove embedded color profiles from images on their sites. This also reduces file size. ...OR...
  2. Windows users should remove Norton products from their PCs and replace them with better free alternatives.
 

Then they'd have to ban signatures... Lemme give you some lessons i've learned about internet security that may help you out.

1. Don't trust Symantec for anythign.

2. Don't trust Mcafee for anything.

3. You need at least 3 types of antivirus (not 3 programs for AV, but 3 types) for adware, spyware, and malware.

4. Anything can be done through image files, HTML files, and such. Wether or not a hacker could succeed in their attempt depends on how the progam being used handles data. The "Jpeg of death" hack can still work with the update, but it won't automatically execute the code inside, so the file is now harmless for Windows people who have the update. For other OSes (such as mac or linux or Minuet (sp?)) might still have this vulnerability.

5. Software firewalls can be penetrated, best to get a hardware one. (Note: Routers come standard with hardware firewalls.)

That's all i can think of at the moment.
 
You must log in or register to reply here.

Similar threads

Obsolete JREF Blogs
2
Replies
26
Views
12K
yumeitsumo
JREF Earthquake/Tsunami Donations
2
Replies
33
Views
13K
Tsuyoiko
Goodbye JREF
2 3
Replies
61
Views
10K
miki78
  • Locked
jref friends
Replies
5
Views
8K
Damicci
Finally: JREF Chat!
2
Replies
49
Views
8K
cacawate
Menu
Log in
Register
Cookies are required to use this site. You must accept them to continue using the site. Learn more…