Unwanted Google Ads started appearing in threads on our forum this morning. Is the a hacker or what?

Pondboss Forum

Yeah, we've got the same thing in ours. I thought it was simply because we hadn't updated, but since you're running 7.5.6p2, I can only assume it's not just unpatched versions...

I don't have time to really dig into this for a few hours, but so far in my cursory overview it doesn't look like any of the static files have been altered (at least the mod dates haven't been changed...)

Personally I was hoping to roll back to backup, but it looks like the ads pre-date last night's backup and I don't want to roll back and lose an entire day if possible.

I kind of thought that it might be malicious code stuck into the templates, but I'm just not seeing any indication that it is...

One interesting tidbit is that ads aren't showing up in our restricted forums, so obviously it couldn't be a site wide template modification.

OK, I found a .js file in our files directory that was being included in all new posts.

I've still got to get to the bottom of this, but it looks like the same google ad customer hit both of our sites.

google_ad_client="ca-pub-9610313674109446"

On your site, try getting rid of the http://forums.pondboss.com/templates/xx.js file.

That'll be a quick fix, but not a permanent one.

The ads are showing up in most all of our old threads as well. Also some signatures have the same problem.

I did report the abuse to google...

It does look like that file is still there on your site. Is there a reason you haven't removed or renamed it?

Just thought I'd pop in here, this appears to be a pretty large scale hack as they are targeting a large number of sites. At least 5 that I know of. Unsure of actual exploitable issue just yet, but since it seems to be happening on even patched versions, there is definitely some type of security issue they have found.

All the ones I have found have been an ads.js file, and it's either been in the gallery directory or in the templates/default directory.

Good to know Rick. Let me know if there is any info I can get to you about ours.

It's actually inserting the script call into the database as well, so when you pull up a post, the script call will be in there even after the exploit has been removed. What is odd on this part is its only putting it into the POST_BODY field, not the POST_DEFAULT_BODY, so it doesn't seem it's being inserted via the normal add post method.

I'd also check your forum/includes directory...on 4 of the sites there has been an exploit script in there, title of 2011.php