Originally shared by Jeroen Wiert Pluimers
Originally shared by Jeroen Wiert Pluimers
This weekend, the Embarcadero web site was hacked by AnonCoders. Not once (see also G+ link and DelphiPraxis link and image) but at least twice (see also G+ link and image and Delphi Praxis link and image) where the initial hacked simple text “Hacked By…
http://wiert.me/2016/03/14/delphi-disable-or-change-your-welcome-page-to-not-use-the-embarcadero-site-as-that-site-has-been-hacked-twice-this-weekend
This weekend, the Embarcadero web site was hacked by AnonCoders. Not once (see also G+ link and DelphiPraxis link and image) but at least twice (see also G+ link and image and Delphi Praxis link and image) where the initial hacked simple text “Hacked By…
http://wiert.me/2016/03/14/delphi-disable-or-change-your-welcome-page-to-not-use-the-embarcadero-site-as-that-site-has-been-hacked-twice-this-weekend
easier still to just right mouse click and close the welcome screen (ok until the IDE is next restarted I guess)
ReplyDeleteBrian Hamilton then you are too late if any malicious code has executed.
ReplyDeleteAny official response from Embarcadero anywhere?
ReplyDeleteI always disable the whole Welcome Page packet.
ReplyDeleteDarian Miller not found it yet.
ReplyDeleteWelcome Page plugin by Daniel Wolf is here https://www.danielwolf.eu/blog/2015/1507-delphi-xe8-moderntheme-anpassen
ReplyDeleteIlya S if I read the German forum correctly, that's not the most recent version. The most recent version is linked from my English article or from the German forum link in my article.
ReplyDeleteThe most recent version - Seattle only! - can be found in my blog, yesterday I updated the download. Link is the same as before. So the same file can be found in the forums and in the blog.
ReplyDeleteThank you both! Please excuse my ignorance, the link to the different project wuppdiStyler was given. Right links to the wuppdiWP are
ReplyDeletehttps://www.danielwolf.eu/blog/2015/1653-delphi-xe8-willkommensseite-anpassen
https://www.danielwolf.eu/blog/2015/1668-meine-vorstellung-einer-willkommens-seite
Daniel Wolf is source available?
ReplyDeleteDarian Miller Jim McKeeth has posted a couple of comments on the following threads:
ReplyDeletehttps://plus.google.com/103246155735524926641/posts/S8NMDPnF1Nu
https://plus.google.com/+RickWheeler75/posts/c2NEWBqkvRs
That's as closes as I have seen to an official response. These comments do nothing to allay my concerns.
David Heffernan Thanks for the links.. I responded to Jim on one of those. If his response is all we are getting as an official response...then that's just ridiculous.
ReplyDeleteWhatIf same https://labsblog.f-secure.com/2016/03/15/lenovo-startpage-pushed-angler/ would be done with Embarcadero web site?
ReplyDeleteIsn't it nice that embedded IWebBrowser2 would not get IHttpSecurity.OnSecurityProblem request if you don't "navigate to about:blank" first? https://marc.durdin.net/2016/03/dont-forget-to-navigate-to-aboutblank-when-embedding-iwebbrowser2/ via Marc Durdin
After I explained the security vulnerability to a client, they immediately disabled the welcome page package. They were startled about not having received a statement from Embarcadero by email.
ReplyDeleteJeroen Wiert Pluimers Any theory on why wouldn't they send out notification? I have to assume that one is "coming soon" and they are just gathering data. It comes across as negligent not to perform some sort of public informative action and follow up with some sort of corresponding corrective/preventative action. Jim McKeeth forwarded my questions about the incident to Brandon Shopp yesterday morning. No response yet. Perhaps some discussion could be had on the possible negative ramifications that could result in a compromised welcome page. What damage could possibly be inflicted if running the IDE as an Admin and a malicious entity was in control of the content being displayed? I'm assuming these hackers didn't realize they had a front door into a million+ desktops through this welcome page entry point.
ReplyDeleteJim McKeeth said that his posts here on G+ were the official announcement.
ReplyDeleteDavid Heffernan I completely reject his logic. Your website can't get hacked twice in a weekend and some simple comment on a G+ conversation seen by very few cannot possibly serve as official announcement.
ReplyDeleteDarian Miller Not Jim's fault. I'm sure he would be following instructions.
ReplyDeleteRobert Horbury-Smith I don't care who's fault it is and I'm not blaming Jim. I simply expect a proper response and I reject their current approach. I'll be more vocal as time goes on.
ReplyDeleteDarian Miller Darian, I agree with you. What I should have said is that we should be hearing from the "Decision Makers". NOT the poor dudes left holding the can.
ReplyDeleteFYI: Future versions will no longer have the banner pulled from the website on the start page.
ReplyDelete