Forum hacked?

[webnsn]

Yes some times we are also facing same time, just black page..

[Dotcomdotcom]

Chrome, Mozilla Mcaffee is blacklisting / warning on the site.

I assume they are coming up 1-2 days late regardless if there is a virus right now on the site?

[wacnstac]

Tapatalk please address how this vulnerability was exploited in your software and what steps you are taking to make sure it never happens again.

[Dotcomdotcom]

FYI this is also happens on non Tapatalk sites.

[wacnstac]

I thought the exploit was in Tapatalk.

[Dotcomdotcom]

It has happen on both tapatalk and non tapatlk vbullrtin sites.

[yellowpeter]

Hello forum owners,

More information about this exploit can be found here:

http://www.tapatalk.com/forum/showthread.php?p=11665#post11665

Let us know if you have any issue - we are standing by to help out.

[kmike]

To be fair, I can't see any evidence in the posted information that the intruder got in via tapatalk. Having some directory at 777 mode doesn't automatically gives everyone access to write to it. For one, the clientscript directory or the attachments directory is most likely mode 777, too, but that doesn't mean the site is vulnerable.

[dstephan]

It seems Tapatalk themselves are down now. What's the easiest way to disable this app until this is resolved?

[beishe8]

Disable it in the ACP.

[yellowpeter]

It seems Tapatalk themselves are down now. What's the easiest way to disable this app until this is resolved?

Our website was down for 3 hours for server memory issue. And is restored since then.

[Fred Weiss]

Hello forum owners,

More information about this exploit can be found here:

http://www.tapatalk.com/forum/showthread.php?p=11665#post11665

Let us know if you have any issue - we are standing by to help out.

I just clicked the link you supplied in that post that begins:

To check if you site is infected, this specific post instructs how to find and remove the inflection:

and received a warning that it was infected. Specifically the virus name is exploit javascript obfuscation (type 1332).

[R1lover]

Add another site that was compromised from tapatalk... running 4.1.x, 1 hour after the admin logged in with tapatalk, someone from amsterdam logged in with his info and inserted an iframe script into the header tempaltes. This forum owner never used tapatalk in the last 6 months, first login with it... and his info was compromised.

Removed tapatalk from all sites...