Nasty link appears in profile seemingly spontaneously

Nasty link appears in profile seemingly spontaneously

by Paul Nijbakker -
Number of replies: 9

Hello all,

One of my students reported that when he tried to change his profile picture, a link to an Australian sex site appeared spontaneously in the Web page box. I saw the site, but omitted to copy the address. surprise I deleted the link and it hasn't come back, so far.

Has anybody had a similar experience? (If not, I must assume that the student has been pulling my leg smile).

Oh, we use version 1.3.4 in our pilot.

Rgrds, Paul.

Average of ratings: -
In reply to Paul Nijbakker

Re: Nasty link appears in profile seemingly spontaneously

by David Scotson -

There's a good chance the student's browser has been hijacked by spyware/adware, particularly assuming that they are using the infamous combination of Windows and Internet Explorer.

Spyware and Adware often do things like changing your homepage and search links to the address of porn sites and although I've not heard of this exact behaviour it does fit their general behaviour.

I'd suggest running Spybot and adaware on the machine to clear anything out.

To prevent these kinds of things happening again I'd recommend that the student use Windows Update regularly and switch to using the FireFox browser.

In reply to David Scotson

Re: Nasty link appears in profile seemingly spontaneously

by Paul Nijbakker -
The problem was not the browser address changing or anything, but that when the student clicked Update Profile, his profile suddenly listed the sex site as his Web page in his profile. It happened in class and since the site was from Oz, I thought there might be something to it. However, if no one else ever experienced this, I can rest assured that it was a freak occurence, or a (bad) joke.
In reply to Paul Nijbakker

Re: Nasty link appears in profile seemingly spontaneously

by David Scotson -
I would still recommend the student check his/her machine with the free programs I suggested.

People have been sacked and even put in prison for things done by Browser Hijacker software on their machines. Assuming that it wasn't a prank (which is possible) then the next time this software decides to add porn urls to a web form, the student (or others using the same machine) may not be using the web site of someone so understanding.

Although, I've never heard of this exact type of thing occuring, many similar things do happen all the time, and it seems too much of a coincidence, as there are many more direct ways that a student carrying out a prank could have vandalised someones user profile.

You can read some more here:

http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci994463,00.html

If you still know what the url of the site is then you could probably Google to find out if it's known to employ spyware to drive traffic. Though obviously it would be best to either inform your system administator before doing so or even let them handle this situation themselves.
In reply to Paul Nijbakker

Re: Nasty link appears in profile seemingly spontaneously

by Rhonda Goetz -

Yes this happened yesterday.  My student then went to several different machines at home and at school to see if the problem replicates.  It did everytime he set up a profile. 

I have not been able to recreate this.  Anyone have an idea on how to prevent this?  I don't want to have to inspect student profiles. 

In reply to Rhonda Goetz

Re: Nasty link appears in profile seemingly spontaneously

by Martin Dougiamas -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
Please be assured it's nothing in Moodle!  (it's an open source project so you can check this if you like!)    cvs:/moodle

Perhaps if people shared the text/link being seen then we might identify the Windows virus/bot that is doing this.

In reply to Martin Dougiamas

Re: Nasty link appears in profile seemingly spontaneously

by Paul Nijbakker -
I know, I could kick myself for not scribbling down the URL blush, but its like when you find something burning, you exstinguish it first and then think of where it came from sad.
In reply to Paul Nijbakker

Re: Nasty link appears in profile seemingly spontaneously

by Martín Langhoff -
One thing we have seen (while I was working at Te Kete Ipurangi http://www.tki.org.nz ) is that sometimes educational websites are hosted with discount hosting companies that cram on the same servers -- ahem -- "other types of educational websites".

If the (good) educational website is hosted there no more, but the domain still points to the server, there is a good chance your (good faith) URL to a page on trigonometry will lead to akward places.

As TKI hosts a search engine full of educational links, we resorted to a periodic crawling of the linked pages, to check that (a) they didn't contain 'trigger' words from a list of words we imaginatively put togethere and (b) they had not changed too much (we had a fuzzy matching mechanism, and an old copy of the HTML of the page for that).

Having said that, I think this case is either a prank, a spambot trained to abuse Moodle (let's hope not -- wikis are suffering a lot from such spambots) or a trojan in his machine.

In reply to Martín Langhoff

Re: Nasty link appears in profile seemingly spontaneously

by Marcus Green -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers

I recommend testing the installation with a browser other than IE, e.g. firefox/mozilla/opera. I have spent many hours trying to chase down junk that was re-directing browsers to dubious sites etc, and in the end I found it was easier to recommend my users to only use IE to view sites that simply would not work with other browsers.

I combination of inherently lax security and being the biggest target on the web means using IE is a high risk proposition.

Some very authorative sources have given similar recommendations (including the Microsoft owned Slate web magazine)

Marcus

In reply to Martín Langhoff

Re: Nasty link appears in profile seemingly spontaneously

by David Scotson -
I think we can rule out the Moodle spambot. Wikis have had problems because they are, by design, often available to the general public for anonymous editing. This is, for obvious reasons, not the case in Moodle for student accounts.