Quakone landing page is tripping

[talisa]

glad to see the main page got fixed again

[Solecord]

Its fixed now.

[talisa]

eyup.... its that time again

[Phenom]

Solecord! Save us!

[Nickelbawker]

its doing something weird right now

[Solecord]

You sure this is fixed, or is Google really that slow! I'm still getting the warning whn coming here and when I try to clink on any forum post.

It's fixed. I assure you it is at this time. I submitted the review request to Google on Saturday around 6:00pm CST. My understanding is the review process is manual. I'm willing to bet they don't review things on weekends either... hopefully it should be resolved by tomorrow.

[gdiddy62]

You sure this is fixed, or is Google really that slow! I'm still getting the warning whn coming here and when I try to clink on any forum post.

[MadGypsy]

Are these pages really html or php with some address bar tom-foolery? If they are php it wouldn't be hard to write your own check for planted document nodes.

Actually, I've been working on my CMS off and on and I am exactly going to make some post assembly document checker the next time I work on it. I kknow there are lots of ways to inject stuff into a site but I'm gonna make sure the uber noob way never makes it to the browser. Who knows, maybe in my work I will end up making sure lots of ways don't make it to the browser. Isn't that really the bottom line in most cases? If it doesn't make it to the browser, it never happened?

document = (document.replace(/.*<!DOCTYPE/i, "<!DOCTYPE")).replace(/</html>.*/i, "</html>");

lol, or something

[MadGypsy]

I would assume the reason they don't lift it automatically is because they assume your attackers will come right back. By making you wait a long time they are also making your attackers wait (and get bored waiting) but my method .replace() would foil the attackers from beginning to end cause it makes their attack impotent.

I mean, you had iframes OUTSIDE of the entire document. That's so sloppy and noobish that it should be some kind of automatic that shit like that gets stripped. I can't even think of a reason why my browser couldn't (wouldn't) strip that. I realize people don't really follow validation rules in most cases but when are you EVER gonna put iframes outside of the document. I'll tell you when. When you are injecting "badware" in a site. In other words never for a good reason.

[Solecord]

MadGypsy has it right... the process Google uses is kind of a joke. They have an automated system that detects malware on your site and then send you a warning email. About 15 minutes after the warning email, your site gets labeled as being malicious and that red page of doom starts showing.

The email Google sends you tells you to fix the issues and then request a review of your site. It sounds like the review process is manual... I would assume if they have an automated script that detects malware, they can have the automated script detect it's not there anymore and lift the red page of doom automatically!

[MadGypsy]

@mindz - just tell the page to ignore or it never will. I'm pretty sure that page is cached as a mother fucker til you tell it to be otherwise. I had that page yesterday. I hit ignore (not giving a fuck if solecord fixed it yet) and I have not seen the page since. I also clicked "not an attack site" but I was redirected to some page that basically said: "We aren't gonna let you do that." Summin about badware.

Google might be really good but it isn't elite. The only page that had the injection (that I found) was the landing page. By googling Quakeone (before google blocked it) I was able to navigate to other Quakeone pages via the little list google provides in the search results. Then google "stole" back all those links and replaced it with the malware message. If google is smart enough to know if you have malware, it should also be smart enough to determine where and only block results containing the offense. Actually, why can't google just fix it client side? It knows there is bad code, why can't it document.replace(badCode, "<p>malicious code was removed from this page</p>");

A google search of Quakeone still labels it as an attack site in the results.

[Syluxguy28O3]

There was malicious code injected into the server browser code file(s). It's been removed... stupid Google takes forever to review the site and lift the malware warning.

good to hear that it was fixed. god knows what would happen if peeps couldn't get there Q1.com fix!

[Solecord]

There was malicious code injected into the server browser code file(s). It's been removed... stupid Google takes forever to review the site and lift the malware warning.

[Syluxguy28O3]

as well as other pages hosted by the site. the proquake site did the same thing, and when i tried to snag a copy of proQ chrome blocked the download.

[Mindf!3ldzX]

@Solecord
Was it actually a targeted attack on the site or like an antivirus false positive thing?

whatever it is, that annoying ass red page of "omg omg danger danger" STILL is propagating my browser instead of the typical....

damnit!