1

I stumbled onto a hacked site a short while ago. Firefox blocked Flash from running, but are there any other vectors I should be concerned about? I'm pretty sure I had an account on the forum in question; does that change anything?

As of posting this, the site in question is still hacked. Some searching turned up that people were trying to contact the site owners about it at least 5 days ago.

I also have a screenshot of the page and a url, but if it really is potentially dangerous to visit, it's probably best not to send people there.

2 Answers2

1

There are a variety of other vectors that can be used, Java and Javascript based ones being the other most common ones, but also images and other vectors.

  • If you're worried, shut off the computer you're worried about, right now. Malware can't do anything when it's powered off, whether it's a virus, ransomeware, or anything else.

    • If you're truly worried, shut off everything on the same network.

  • Regardless of your worry level, if you share passwords with the hacked site and any other site, change them all immediately from a computer not connected to the one you're worried about.

    • And after that particular site is up and claiming to be unhacked, change your password there to something long and cryptographically random - don't give that site any hints as to your other passwords.

  • If you're worried, then run several different offline, bootable/live/livecd/rescue antivirus/antimalware products

    • Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly. I'd recommend:

      • at least one of AVG and Avira (or both)

      • at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.

      • Comodo Rescue Disk (it advertises rootkit scanning, too)

      • Pick another couple of your favorites.

    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.

    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

After all of this, once you're fully online again

  • Make sure your OS is patched, and stays patched.

  • Make sure your antivirus is patched and up to date, and stays that way

  • Make sure your firewall is patched and up to date.

    • Consider something a serious like pfSense, which is legally free software, and can run on an old computer with a couple of network cards, a small, low power fitlet PC, a pfSense store device, or other machines as your firewall.

      • And then look at the Snort or Suricata plugins for IDS/IPS funcitonality, which have a great chance of blocking threats as they're coming in.

        • Note that these packages require quite a bit of tuning to balance protection and convenient usability, they are NOT plug and play. They are, however, very powerful.

  • Make sure your browsers are patched, and stay patched

  • For Firefox in particular, try the following addons:

    • Noscript

    • Policeman

      • This plug allows you to choose specific content types (images, scripts, etc.) to be allow only from site A to site B, specifically, though it does allow more and less specificity for each site.
Anti-weakpasswords
  • 9,980
  • 2
  • 25
  • 53
  • I would like to add that how worried you should be strongly depends on what version of Firefox you are running and with what settings. For instance, in modern version of Firefox with default settings Java does not run without explicit user permission. But of course, even with an updated browser you are never completly safe. – Anders Feb 15 '16 at 14:22
0

There are some exploits (for example the aurora exploit) that could inject malicious programs into the client's computer, but those are more rare than attacks through plugins like Flash or Java. There are many different browsers and most exploits can only target one at a time. With Java or Flash, however, it is easier to target many different platforms. Since you did not interact with the website (like run Flash, download software, copy and paste links), it is pretty unlikely that you were hacked. Still, run an antivirus program just to make sure everything is fine.

Edit: As long as you don't use the forum password for anything else, you should be fine. Most passwords are stored as hash anyways, so there shouldn't be too much to worry about.

user5740529
  • 53
  • 5