BadPhorm - When good ISPs go bad! :: Forums :: Phorm Discussion :: Phorm Past and Present
 
<< Previous thread | Next thread >>
sysip.net javascript infections from 2006
Moderators: Jim Murray, narcosis, felixcatuk, Sammy
Author Post
Frank Rizzo
Mon Mar 03 2008, 10:29AM
Registered Member #75
Joined: Sun Mar 02 2008, 06:49PM
Posts: 25
 If you want to see a couple of examples of the sysip.net / javascript exploit of 2006 look here:

http://www.pwcforums.co.uk/wiz/forum_posts.asp?TID=10375&PN=2

and here:

http://www.raisingkids.co.uk/forum/display_topic_threads.asp?ForumID=72&TopicID=17698&PagePosition=1&ThreadPage=2

I'll comment on the Raising Kids messageboard. Take a look at the postings by Nyrak. That person's PC had an exploit which would try and inject javascript code into every message that person posted.

If the messageboard was not setup the way it is (to not parse javascript) then anyone reading that messageboard would run the javascript file from sysip.net

This is not going to be the way Phorm runs in the future, and it is not what happened with BT DNS in the summer of 2007. But this is the kind of sneaky things that they were doing (as 121media) in the Autumn of 2006.

[ Edited Mon Mar 03 2008, 10:46AM ]
Back to top
Mel
Sat Mar 08 2008, 09:39PM
Registered Member #137
Joined: Sat Mar 08 2008, 06:00PM
Posts: 4
 There's a better example here, http://www.experts-exchange.com/Programming/Languages/Scripting/JavaScript/Q_22012205.html

Helpfully someone posted the content at the time of http://ntp.sysip.net/tag/2.js

note the line o.adsrv = "dns.sysip.net";

[ Edited Sat Mar 08 2008, 09:41PM ]
Back to top
 

Jump:     Back to top
Syndicate this thread: rss 0.92 Syndicate this thread: rss 2.0 Syndicate this thread: RDF
Powered by e107 Forum System