Possible exploit on GS forum

[roligov]

Hi,

Every now and then I would search for something in google and 1 of the results would be a link to a topic on GunSite. I would then click and and be redirected to MyFileStore.com with a "File Not Found". At first I thought it was one of my chrome plugins messing me around, but I opened an incognito window and tested and I get the same result. IE did the same. I did some googling and think I have found the answer, the forum is being exploited. This is a thread explaining the exploit: http://club.myce.com/f20/vbulletin-m...e-them-332219/

To confirm please try the following:
1. Open Chrome Incognito session or the equivalent in Firefox or IE (In Private Browsing Session).
2. Go to Google.com
3. Type the following birchwood casey lead remover and polishing cloth site:gunsite.co.za
4. Click the first result which should take you through to gunsite.co.za
5. Observe the redirect to http://myfilestore.com/download.php?id=8524c90a

Please post if you experience the same. That is all.

Thanks,

[PistolBoy]

This myfilestore.com thing has happened to me too.

[Lian]

have also had a couple searches for gunsite popup with a random download site.

[Slaaibak]

Access to the web page was blocked by ESET NOD32 Antivirus. The web page is on the list of websites with potentially dangerous content.

[roligov]

Yeah had that once with nod while testing my findings. Close Incognito window and repeat, should take you through to myfilestore.com. Cool that confirms the forum is being exploited. Can a moderator please escalate to the site admins, thanks!

[DRD]

Thought it's just me.

[CZ Fan]

Hi,

Every now and then I would search for something in google and 1 of the results would be a link to a topic on GunSite. I would then click and and be redirected to MyFileStore.com with a "File Not Found". At first I thought it was one of my chrome plugins messing me around, but I opened an incognito window and tested and I get the same result. IE did the same. I did some googling and think I have found the answer, the forum is being exploited. This is a thread explaining the exploit: http://club.myce.com/f20/vbulletin-m...e-them-332219/

To confirm please try the following:
1. Open Chrome Incognito session or the equivalent in Firefox or IE (In Private Browsing Session).
2. Go to Google.com
3. Type the following birchwood casey lead remover and polishing cloth site:gunsite.co.za
4. Click the first result which should take you through to gunsite.co.za
5. Observe the redirect to http://myfilestore.com/download.php?id=8524c90a

Please post if you experience the same. That is all.

Thanks,

Ditto

[OCP]

Yup - also had it happen to me from more than 1 browser/device.

[HadEnuf]

This myfilestore.com thing has happened to me too.

Me too - but I am sure I was searching from within GS, not doing a Google search of GS.

[roligov]

Maybe you were doing the google search from within GS? The search bar in the top right?