Download denied - Progressive Rock Music Forum

It looks like this problem has finally been fixed (although more testing is needed to be sure).

No, I know how to behave in the restaurant now, I don't tear at the meat with my hands. If I've become a man of the world somehow, that's not necessarily to say I'm a worldly man.

I've never seen such a thing happen. Confused

Download denied? what download?

Microsoft Edge is not a good browser IMO, even google chrome has gotten worse.

Try Mozilla Firefox (although it collapsed for me once a few years back) and a new(er) browser called Brave.

^ it does not seem to be PA fault for what's going on there. I think your browser is stuck on some weird ads, trackers and the likes.

Originally posted by I prophesy disaster

I prophesy disaster wrote:

^ This is the only site where it happens. And there was another topic started by wiz_d_kidd reporting something similar: Intrusion Detected from PA. That topic referred to the same website, but I think the difference might be due to different security software. It is the security software that is producing the notifications.

I had some problems a few months ago, but it was my antivirus that didn't let me see any album pages because of "phishing". I solved the problem but it took me a little while.

I prophesy disaster wrote:

^ This problem is only occurring on the forum pages, not on the database pages. But it does occur every time I click on any link in the forum.

How did you solve your problem (if it isn't too involved to say)?

I played with the antivirus settings, trial and error. I got it right in the end.

I don't use Google chrome for PA anymore.

^And the "PROG ROCK GUIDES" and "FAQ" links.

No, I know how to behave in the restaurant now, I don't tear at the meat with my hands. If I've become a man of the world somehow, that's not necessarily to say I'm a worldly man.

^ VPN server in London –> "Download denied" notification.

VPN server in Sydney –> "Download denied" notification.

So, it appears that the problem is with the VPN.

Edited by I prophesy disaster - September 23 2022 at 15:56

No, I know how to behave in the restaurant now, I don't tear at the meat with my hands. If I've become a man of the world somehow, that's not necessarily to say I'm a worldly man.

It seems that many users, myself included, have had similar issues. I've spent considerable time digging into the source of the problem. The upshot is that ProgArchives appears to have been hacked!

Back in August, I began getting warnings from Norton Antivirus about a malicious activity (i.e. intrusion detections) when I visit the "Forums", or "Prog Rock Guides" pages. But it doesn't happen on the "About Us" page, or the main page.

The problem is that the HTML code for the Forums and Guides pages (and probably others) contains malicious javascript that looks like this:

<script src="https://new2sportnews.com/progarchives.js" type="d597b4f971c3864a4c6a613f-text/javascript"></script>

The referenced site, new2sportnews.com, has the appearance of the Nigerian version of The Guardian website. However, it is a bogus web site. It was created in Jan 2021 and had no content until Jun 2022, and the content (according to the internet's Wayback Machine) has not changed since then.

The javascript that is stored at that site (i.e. https://new2sportnews.com/progarchives.js) and is being executed unconditionally by Progarchives, is highly obfuscated to hide its function. I ran it through an "unobfuscator" and confirmed that the script redirects the user to a site called "advertising-cdn.com" which attempts to download a file to the user's computer. The nature of the file is unknown. It could be password stealing, keystroke interception, or other nefarious functions.

I also checked Progarchives using the Wayback Machine and determined that it was clean as of July 19th. Sometime after that is when the system was hacked. Users, myself included, began experiencing problems around Aug 7th.

After an update to my Norton Antivirus, it started completely blocking my access to the forums because I couldn't stop it from executing the malicious javascript. I could disable javascript entirely, but then I could not post or vote in polls. My solution was to install the NoScript add-on to Firefox, and disable scripts specifically for new2sportnews.com. That seems to have worked, as least for now.

The target site, advertising-cdn.com, which contains the dowloader script appeared to be a valid site at first, but now it is gone. The hackers could be working on a different attack.

I've contacted PA admins through every means possible. Thanks to Ian (aka Nogbad the Bad) for forwarding private messages that I sent him on Progressive ears. I also contacted the site owners/admins thru GoDaddy, but so far no one has responded.

I hope that our site admins fix this infection before its users are seriously attacked. There is no valid reason that the HTML code for this site should be executing a javascript on a bogus website!

To check for yourself, look at the page source HTML (in Firefox right-click anywhere on a page and select "View Page Source"), then search for new2sportnews.com. If you find it, you've confirmed that the site has been hacked and can potentially cause serious harm to its users (if it hasn't already).

“I don’t like country music, but I don’t mean to denigrate those who do. And for those who like country music, denigrate means to ‘put down.'” – Bob Newhart

Edge developer tools are throwing up an error on that web page. I'm not an expert on this, but that suggests to me that the script is not being executed however that would be the case if the web site is not longer there, but it does leave PA open to future attacks, I would guess.

Presumably this is a fairly simple code change to remove references to that script from the code? Can you tell which pages are impacted?

Post Reply	Page 12 >