I will add this here as it is an important matter. The problem has been resolved.
An unauthorized third party has set the domain name alltheseimages.com to resolve to the same IP number as BioStar. Due to a default setting on the server the Biostar the site allowed to be accessed via a different domain name.
All traffic submitted via this domain was still handled by BioStar only that it happened under a different domain. No data was at any time transferred to this third party.
The only way to exploit this data by this third party site would be to first make users associate permissions via OpenID then create a new, different site that now also requires OpenID authentication. Only at that time could they access the OpenID information and even at that point only the content of the OpenID token would be visible to them. Notably these OpenID tokens are domain specific and cannot be transferred to another site nor do these allow someone to log you into a different site.
We believe that only a few users may be affected.
If you have attempted to log in via this third party domain: the symptom would be attempting to log in but the login would not succeed, visit your OpenID provider's token management interface and revoke the token for the alltheseimage.com site.
For example for Google this page is located at https://accounts.google.com/b/0/IssuedAuthSubToken
Hi, I was searching for a user in google and got him on Biostars But I was not logged in, so I logged in using openID, after authentication, I wasn't signed up. Tried again but all in vain. Then, just looked at the url, it was http://alltheseimages.com/ . What is this, is it a mirror of Biostars or a scam.
http://alltheseimages.com/u/426
I am just worried, as my details might have been passed on to this.
Thanks
•
written
by
Sukhi Singh
Ok that's really strange - it is not a mirror - someone just set the DNS name to resolve to to our IP. Basically what you see is the same BioStar via a different domain name.
Could be malicious or just a mistake somewhere (mistyped IP number. I can also change the settings to not allow it.
I will look into it.
•
written
by
Istvan Albert
Yes, Waiting for you give a final call/announcement!!
•
written
by
Sukhi Singh
Yes, this is most likely SCAM!
Seemingly not a respectable registration or valid customer. If you entered your OpenID credentials while going through their site, you should definitely change you OpenID password NOW!
They have their own login page and could do whatever with your account data, If Istvan doesn't know them, then this has most likely been set up to harvest openID accounts. Istvan should try to have this fraudulent site shut down.
$ whois alltheseimages.com
Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
Domain Name: ALLTHESEIMAGES.COM
Registrar: NEW DREAM NETWORK, LLC
Whois Server: whois.dreamhost.com
Referral URL: <http://www.dreamhost.com>
Name Server: NS1.DREAMHOST.COM
Name Server: NS2.DREAMHOST.COM
Name Server: NS3.DREAMHOST.COM
Status: ok
Updated Date: 13-oct-2012
Creation Date: 13-oct-2012
Expiration Date: 13-oct-2013
>>> Last update of whois database: Thu, 14 Feb 2013 13:18:28 UTC <<<
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.
TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability. VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.
The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
Legal Stuff:
The information in DreamHost's whois database is to be used for
informational purposes only, and to obtain information on a
domain name registration. DreamHost does not guarantee its
accuracy.
You are not authorized to query or access DreamHost's whois
database using high-volume, automated means without written
permission from DreamHost.
You are not authorized to query or access DreamHost's whois
database in order to facilitate illegal activities, or to
facilitate the use of unsolicited bulk email, telephone, or
facsimile communications.
You are not authorized to collect, repackage, or redistribute the
information in DreamHost's whois database.
DreamHost may, at its sole discretion, restrict your access to
the whois database at any time, with or without notice. DreamHost
may modify these Terms of Service at any time, with or without
notice.
+++++++++++++++++++++++++++++++++++++++++++
Domain Name: alltheseimages.com
Registrant Contact:
alltheseimages.com Private Registrant alltheseimages.com@proxy.dreamhost.com
A Happy DreamHost Customer
417 Associated Rd #324
Brea, CA 92821
US
+1.7147064182
Administrative Contact:
alltheseimages.com Private Registrant alltheseimages.com@proxy.dreamhost.com
A Happy DreamHost Customer
417 Associated Rd #324
Brea, CA 92821
US
+1.7147064182
Technical Contact:
alltheseimages.com Private Registrant alltheseimages.com@proxy.dreamhost.com
A Happy DreamHost Customer
417 Associated Rd #324
Brea, CA 92821
US
+1.7147064182
Billing Contact:
alltheseimages.com Private Registrant alltheseimages.com@proxy.dreamhost.com
A Happy DreamHost Customer
417 Associated Rd #324
Brea, CA 92821
US
+1.7147064182
Record created on 2012-10-13 08:09:50.
Record expires on 2013-10-13 08:09:50.
Domain servers in listed order:
ns1.dreamhost.com
ns2.dreamhost.com
ns3.dreamhost.com
DreamHost whois server terms of service: http://whois.dreamhost.com/
Get a 14-day free trial of unlimited everything from DreamHost Web Hosting.
Paid web hosting includes A FREE domain registration!
http://www.dreamhost.com/
Use promotional code "WHOIS" for an additional $50 off any plan!
the problem has been resolved - I have edited the main post to reflect the new information
•
written
by
Istvan Albert
A whois of domain registrar revealed the owner of the domain to be: New Dream Network LLC.
http://www.networksolutions.com/whois/results.jsp?domain=alltheseimages.com
They offer web hosting apparently:
http://en.wikipedia.org/wiki/DreamHost
I have no idea why they are mirring BioStar.
edit
I misread. The webhost does not own the domain. A private customer utilizing the webhost owns it.
•
written
by
Damian Kao
According to my fav. tracker, it says
Results of IP Tracking for 198.74.58.207
IP address 198.74.58.207
Hostname li549-207.members.linode.com
ISP Linode
Country United States
which leads to here, http://www.linode.com/
•
written
by
Sukhi Singh
Log in to answer this question.
hope it is just a mistake, however from the security side you should definitely more paranoid (like in my answer). It is extremely suspicious that "after authentication, I wasn't signed up". Given that the owner of the server has full control over what you get to see, they can as well have redirected you to their own fake openID provider page. One might not notice difference, except in the URL (e.g. for Google that would be https://accounts.google.com ) if that was instead something different, I would definitely change credentials immediately (that doesn't hurt anyway).
Yeah Michael, Thanks, I've changed my passphrase, just to be on a safe side. Lets wait and see what the reality of this domain.
Seems it was made by this guy. I'm backing simple mistake.
It looks like Istvan fixed it so DNS won't point to BioStar IP.
My blog gets a few hits from BioStar regularly and I noticed this address redirecting to my blog: tampa-rb.r12.railsrumble.com. If you search for the address on google, you also get BioStar posts. I think that site perhaps also was pointing to BioStar. Seems like a bigger DNS issue
seems like the same source - the alltheseimages.com site was developed for a railsrumble competition. There is a also a bit of a facepalm experience with the webserver (see main post) - why would the default be to match every domain to the first listener no matter what the domain name is, but if it is listed as the second then strictly match the domain name ... cue Picard MEME