Linux Format forums

Re: weird cookies from this site

M-Saunders — Mon Jan 12, 2009 10:16 am

Author: M-Saunders

Posted: Mon Jan 12, 2009 10:16 am

Hi all,

Someone has gained access to the HTML behind one of the PostNuke advertising blocks, and is using it to drive traffic to another website. I've found the culprit now and have put things in place to (hopefully!) stop this happening again. Apologies for the hassle -- just remove your .ru cookies and it should be smooth sailing from here!

Mike

Re: weird cookies from this site

RedWillow — Mon Jan 12, 2009 8:56 am

Author: RedWillow

Posted: Mon Jan 12, 2009 8:56 am

M-Saunders wrote:

if anyone sees anything else odd, please let me know!

Here's odd. In Ubuntu I'm getting one hit per page visited for my '*.ru' adblocking rule in Adblock Plus in Firefox. In MacOS X Leopard (Firefox set up the same) I'm getting no hits. I noticed this the other day, but I've only tested MacOS and Linux side-by-side just now. In fact my observation of the hits stopping in my last post may have been because I was using my Mac.

I'd noticed (on the Mac) last Wednesday or Thursday that the *.ru hit count had gone down to zero by itself (about a week ago I was getting hits in MacOS as well) which is odd in itself.

What on Earth is going on? Anyone willing to try this out in Windows? I'm not!

Edit: by the way, the forum clock is slow (again).

Re: weird cookies from this site

RedWillow — Sat Jan 10, 2009 3:15 pm

Author: RedWillow

Posted: Sat Jan 10, 2009 3:15 pm

Mm, yes. The 'hits' that Adblock Plus was showing for the filter '*.ru' stopped yesterday (?and the day before?), but they've started up again today. About a hundred hits today so far.

Mike, can you give us some more information when you're back in the office? Is this sinister or just irritating? Is there anything users need to do beyond the various things suggested in the thread?

Re: weird cookies from this site

Dutch_Master — Sat Jan 10, 2009 2:14 pm

Author: Dutch_Master

Posted: Sat Jan 10, 2009 2:14 pm

I still see traffic from .ru domains when (re)loading an LXF page, including, but not limited to:

catalogsearcheasy.ru
subcatalogue.ru
go.richtraffic.ru
advertcatalogue.ru
directorysearch.ru
poshars.ru

I suggest it might be wise for Future Publ. to implement some sort of 'code of conduct' for their advertisers: no known scam countries are allowed, on punishment of a very high fine...

Re: weird cookies from this site

Dutch_Master — Thu Jan 08, 2009 4:48 pm

Author: Dutch_Master

Posted: Thu Jan 08, 2009 4:48 pm

LOL!

Re: weird cookies from this site

Marrea — Thu Jan 08, 2009 3:59 pm

Author: Marrea

Posted: Thu Jan 08, 2009 3:59 pm

M-Saunders wrote:

I think I've found the culprit
M

1sf?

Re: weird cookies from this site

towy71 — Thu Jan 08, 2009 2:21 pm

Author: towy71

Posted: Thu Jan 08, 2009 2:21 pm

Now we're all agog in anticipation of you telling us what is/was going on

Re: weird cookies from this site

M-Saunders — Thu Jan 08, 2009 11:32 am

Author: M-Saunders

Posted: Thu Jan 08, 2009 11:32 am

I think I've found the culprit -- if anyone sees anything else odd, please let me know!

M

Re: weird cookies from this site

M-Saunders — Mon Jan 05, 2009 10:06 am

Author: M-Saunders

Posted: Mon Jan 05, 2009 10:06 am

Hi all, thanks for investigating this. I'll talk to our ad people and see if I can find out what's going on.

And happy new year!

M

Re: weird cookies from this site

kpmilburn — Tue Dec 30, 2008 10:17 pm

Author: kpmilburn

Posted: Tue Dec 30, 2008 10:17 pm

I find a good companion to NoScript is CookieSafe, it provides more fine grained control than the blanket accept or reject of cookies, or third party cookies..

Re: weird cookies from this site

lok1950 — Sun Dec 28, 2008 11:07 pm

Author: lok1950

Posted: Sun Dec 28, 2008 11:07 pm

I would not be surprised if one of the sub-contractor's in the the ad chain got there server hacked as the behavior we are seeing fits.Would not want to work in that shop when the e-mails start to fly

Enjoy the Choice

Re: weird cookies from this site

Rhakios — Sun Dec 28, 2008 9:50 pm

Author: Rhakios

Posted: Sun Dec 28, 2008 9:50 pm

Not really the point if they're not supposed to be there in the first place.

I've just set Opera to its most promiscuous mode and while I am picking up some cookies from .ru domains, they don't seem to be the same as the ones towy is getting. Hmm, just refreshed the page and got two more from other domains. Definitely something odd, they don't seem to be related to any other advertsing content I can see on the front page.
Also, I have emptied Opera of all cookies, then clicked on each ad to see what new cookies are being offered. It's only when loading pages from the LXF site itself that I pick up the .ru cookies, but oddly, not the blog page . I don't like it at all.

Re: weird cookies from this site

lok1950 — Sun Dec 28, 2008 6:16 pm

Author: lok1950

Posted: Sun Dec 28, 2008 6:16 pm

As george said NoScript. does the trick

Enjoy the Choice

Re: weird cookies from this site

george84 — Sun Dec 28, 2008 5:03 pm

Author: george84

Posted: Sun Dec 28, 2008 5:03 pm

NoScript..... as recommended by LXF! That's why I have it installed.

Re: weird cookies from this site

ethernet — Sun Dec 28, 2008 3:56 pm

Author: ethernet

Posted: Sun Dec 28, 2008 3:56 pm

A lot of these things seem to be out of the direct control of the LXF folk but rather come down to Future, whether it be the dodgy manhood drug adverts (two of them!) in the mag a while back or these cookies, or the Windows ads on the site. Don't mind too much as, like george84, am running NoScript.