Chris_Sav
Administrator
Posts: 600
Threads: 202
Joined: Jan 2018
Reputation:
0
|
RE: Riskware Warnings
It's Malwarebytes Premium (paid version), not the browser, that is throwing up the warnings, does it on my PC with Firefox and 'erself's PC on Edge which has never used the forum before.
Firefox debugger shows an external script
https://new2-sport-news.com/ttwebsite.js (dashes inserted to prevent the link working)
on new2sportnews being run close to the menu bar after PM's. at the top of the page on the forum
I've downloaded that script from new2sportnews but don't know enough javascript to know what it does for certain, but it does appear to replace things!!
External script could do anything when run on your PC so I find this very worrying but safe in the knowledge that Malwarebyes Premium is stopping it running on my PC
Malwarebytes also stops direct loading of the new2sportnews site as being unsafe.
Wish someone were about with access to the forum code to prove I'm worried about nothing
Laurel Bank II Marshal, Classic TT & Manx GP
|
|
29-07-2022, 09:08 AM |
|
Chris_Sav
Administrator
Posts: 600
Threads: 202
Joined: Jan 2018
Reputation:
0
|
RE: Riskware Warnings
Thanks for posting, I certainly find it strange that no one else has seen the warnings. To repeat though it's not Firefox or any other browser, I have the paid version of the anti-malware programme Malwarebytres and it is that throwing up the warning on both machines I have it installed on. Also I do not get it on any other site I normally visit.
It looks like a known MyBB vulnerability on a couple of versions ago
https://blog.sonarsource.com/mybb-remote...ion-chain/
Explains it. I cannot tell what version the forum is on, but Malcolm's illness may mean it's not the latest with the fix.
The debugger (F12 on Firefox) shows me the script in the forum header.
<!-- </div> in header_welcomeblock_member and header_welcomeblock_guest -->
<script src="https://new2sportnews.com/ttwebsite.js"></script>
No external script should ever be run on this or any site, hence my worry.
new2sportnews is a known dodgy Nigerian site.
Just wish we had a moderator with code access, I have tried Benjiesdad who was the last mod to log on two years ago but he cannot help.
Laurel Bank II Marshal, Classic TT & Manx GP
|
|
02-08-2022, 06:43 PM |
|
|