Gootloader infection cleaned up

Dear blog owner and visitors,

This blog had been infected to serve up Gootloader malware to Google search victims, via a common tactic known as SEO (Search Engine Optimization) poisioning. Your blog was serving up 383 malicious pages. Your blogged served up malware to 76 visitors.

I tried my best to clean up the infection, but I would do the following:

  • Upgrade WordPress to the latest version (one way the attackers might have gained access to your server)
  • Upgrade all WordPress themes to the latest versions (another way the attackers might have gained access to your server)
  • Upgrade all WordPress plugins (another way the attackers might have gained access to your server), and remove any unnecessary plugins.
  • Verify all users are valid (in case the attackers left a backup account, to get back in)
  • Change all passwords (for WordPress accounts, FTP, SSH, database, etc.) and keys. This is probably how the attackers got in, as they are known to brute force weak passwords
  • Run antivirus scans on your server
  • Block these IPs (5.8.18.7 and 89.238.176.151), either in your firewall, .htaccess file, or in your /etc/hosts file, as these are the attackers command and control servers, which send malicious commands for your blog to execute
  • Check cronjobs (both server and WordPress), aka scheduled tasks. This is a common method that an attacker will use to get back in. If you are not sure, what this is, Google it
  • Consider wiping the server completly, as you do not know how deep the infection is. If you decide not to, I recommend installing some security plugins for WordPress, to try and scan for any remaining malicious files. Integrity Checker, WordPress Core Integrity Checker, Sucuri Security,
    and Wordfence Security, all do some level of detection, but not 100% guaranteed
  • Go through the process for Google to recrawl your site, to remove the malcious links (to see what malicious pages there were, Go to Google and search site:your_site.com agreement)
  • Check subdomains, to see if they were infected as well
  • Check file permissions

Gootloader (previously Gootkit) malware has been around since 2014, and is used to initally infect a system, and then sell that access off to other attackers, who then usually deploy additional malware, to include ransomware and banking trojans. By cleaning up your blog, it will make a dent in how they infect victims. PLEASE try to keep it up-to-date and secure, so this does not happen again.

Sincerly,

The Internet Janitor

Below are some links to research/further explaination on Gootloader:

https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/

https://news.sophos.com/en-us/2021/08/12/gootloaders-mothership-controls-malicious-content/

https://www.richinfante.com/2020/04/12/reverse-engineering-dolly-wordpress-malware

https://blog.sucuri.net/2018/12/clever-seo-spam-injection.html

This message

Categories: Uncategorized | Leave a comment

Faction Friday: Lystrata, Lamia of the Lost Library

Public domain image of a Mayan pyramid

Deep in the wilderness, an ancient stone ziggurat squats, its vine-covered walls slowly crumbling to time. Many secrets and wonders lie within this monument to a dead civilization, and a new resident patiently plumbs its depths.

A lamia named Lystrata has taken up residence inside this complex, which contains everything from ball courts to baths to libraries, all appointed in opulent tastes. As is typical for her kind, Lystrata has acquired a large retinue that inhabits the ziggurat with her, and she’s re-opened many of its chambers, reactivating the wondrous mechanisms left behind here that provide artificial light and pump water from mysterious sources. It is the perfect lair.

The library in the lowest level of the ziggurat is sadly incomplete; some years ago a cluster of ankhegs burrowed into the library accidentally, exposing its books and scrolls to humid air that rotted a large proportion.

As a friendly faction, Lystrata has become captivated with researching the secrets of this ancient civilization, and has grown less evil and more obsessed. She treats her retainers reasonably well, if mostly because she’s too distracted by her research to pay them much attention.

The library has revealed the location of several other ziggurats, and Lystrata desperately wants to find them. Unfortunately, none of Lystrata’s retainers have experience as adventurers, so she’s resorted to sending out her retainers to hire adventuring parties (like the PCs) to find and secure the ziggurats.

Some PCs may be uncomfortable with working for a lamia. This is a great source of potential role-play.

As a foe faction, Lystrata is a typical lamia: evil and self-absorbed. The ziggurat has become her private pleasure lair, filled with her slaves and captured beasts, where she feasts on any adventurers who attempt to explore it. She has no particular interest in the knowledge contained in the library, but the patron who sends the PCs against her very much does.

The ziggurat itself can be a classic dungeon crawl, but Lystrata will not fight to the death. She already controls several other ziggurat lairs, and will retreat (with some of her retainers) to another if the PCs do particularly well, allowing her to serve as a long-term villain.

Categories: Uncategorized | Leave a comment

Monster Monday: Frost Mites

Sometimes, you want to give your players a monster that they can’t just whack or shoot at willy-nilly.

Today, I present frost mites, tiny arthropods that leech heat out directly out of their prey.

Normally, frost mites are barely noticeable pests; a hand covered with half a dozen mites will feel uncomfortably cold, but hardly any danger.

But in early autumn and late spring they swarm, gathering in masses of thousands underneath rocks. A foraging animal — or adventurer looking for an entrance to a cave — that disturbs a swarm will find him- or herself covered in masses of blue specks within seconds.

Importantly, you can’t just fire an arrow at a mass of frost mites and expect to stop them. More worryingly, you can’t knock them off-balance; they cover their victim.

As such, frost mites are immune to all damage types except fire, bludgeoning, and magical damage, and they resist bludgeoning damage (taking half damage). They cannot be knocked prone.

Watch your players try to deal with that!

Categories: Monsters | 2 Comments

Faction Friday: Gyllehaal and His Orcs

Old gnome, via http://www.wampstore.com/store/old%20gnome

Gyllehaal, an old gnome, has seen a lot in his life. He spent decades adventuring unluckily; he can barely remember how often he was captured and beaten within an inch of his life, or a treasure chest turned out to be empty, or a valuable gem slipped from his grasp and went careening down a chasm.

But eventually his luck turned, and after a number of successful adventures, he grew rich. Given so many years of hardship, now he has to show off his hard-won fortune.

Gyllehaal struts the streets of his favorite city, bedecked in jewels and expensive furs, visiting money-lenders during the day to manage his money and every gambling house and high-society party he can get invited to at night.

Nobody steals his jewels, though, because of the 4 full orc bodyguards that accompany him everywhere. They speak only among themselves (and then, only in orcish), and they follow Gyllehaal’s orders with completely professional alacrity. They even follow him into parties, though they know enough to stay on the periphery of whatever grand ballroom he’s in.

The orcs are a mystery to outsiders. They wear well-tailored leather clothes trimmed with wolf fur and heavy boots, and wear their hair pulled back in pony tails. They each carry large, ornate axes strapped to their backs. They seem well-mannered, though they don’t say or do much; just surround Gyllehaal while he’s in the streets and stand in a knot muttering among themselves when he’s inside a structure. Folks whisper that Gyllehaal defeated them in battle some years ago and they swore fealty to him, though he must have done something pretty amazing to manage that.

As a friendly faction, Gyllehaal is no more or less than an ex-adventurer enjoying the fruits of his labor. He’ll ask the PCs to collect various amulets, rings, and other objects he can wear in public.

As a foe faction, Gyllehaal may have made a fortune, but he quickly lost it to gambling. Now he works for the money-lenders in a protection racket, using his orcs to squeeze protection money out of a number of businesses.

Unfortunately, Gyllehaal has no problem calling on the City Watch if he’s molested, and they have no beef with him, so a group of PCs who just walk up to Gyllehaal and attack him will soon find themselves swarmed with members of the Watch.

Instead, they will have to gather evidence, such as a set of cooked books that he keeps in the basement of his heavily guarded mansion.

Categories: Faction | Leave a comment

Inspiration in the SEA OF DEATH

I recently finished a fantasy novel set in the Greyhawk universe, written by none other than Gary Gygax. It’s “The Sea of Death,” starring his character Gord the Rogue.

First off: It’s a rollicking D&D-esque adventure and a fun diversion.

However, it also contains a number of insights about how Gary expected D&D adventures to flow. A few lessons:

Groups of intelligent creatures don’t rush at each other on sight, even if both are enemies. They each send an envoy to size the other side up, and will retreat if the odds are overwhelming.

Every group of monsters–intelligent or not–will break and run if at least half of them die during an encounter (except in extremely rare circumstances). Gygax even has a magically animated statue surrender once one of its legs is broken. And while, yeah, that’s like the morale rules in early D&D, those just provided increased chances that enemies would run. Here, they always try to make a break for it when half their number die. Interesting.

I may have to bring back morale rules in my 5E games. Probably make it a collective Wisdom check vs. 10 as an initial rule.

Combat isn’t a matter of trading blows. While you are constantly swinging your sword or what-have-you, you’re more wearing your opponent down until you can get in a killing strike, and there’s plenty of fancy footwork and use of the environment. Sometimes combat feels surprisingly closer to a Jackie Chan movie than a Conan movie.

You can absolutely have unsavory things in your campaign world and keep them out of your campaign. Slavery exists and is consistently portrayed as odious, but in the story is mainly a thing that happens to other people or a threat if the heroes are captured.

Evil doesn’t win partly because evil characters are always plotting against each other to gain the ultimate victory for themselves. They can’t cooperate for long, and once one turns against another, that opens up opportunities for the heroes as long as the heroes continue to push against the villains.

Categories: GM Advice | Leave a comment

Faction Friday: Amethyst of the Jeweled Ones

Amethyst, a lively and mysterious young tiefling woman with a penchant for long, shimmering green dresses and high society parties, secretly leads a society of spellcasters.

As far as most people know, she’s simply an independently wealthy ex-adventurer with an infectious laugh and a shrewd mind.

But several nights a week, she meets with others of her kind in basements all across the city, where they train each other in magical combat. These fights can be very hard, but they’re not intended to kill or even hurt. They’re meant to toughen. Each member of her organization has embedded a small jewel somewhere on his or her body, typically in the middle of the breastbone.

Amethyst believes in a coming sea change in the public perception of magic. She believes that a purge will sweep civilization a few years from now, where the common people will rise up out of fear of magic and hunt down spellcasters.

So her followers train to defend themselves on that day, and they’re building a secret stash of magical tomes and records that they can keep safe through the upcoming purge.

As a friendly faction, Amethyst and her Jeweled Ones are a slightly crackpot but ultimately benevolent group. Amethyst is misreading various political signals, and her organization serves as a diversion and sort of insurance just in case the worst does happen. They can be treated like UFO hunter “true believers.”

Amethyst can hire the adventurers to search for various arcane books that are lost deep in dungeons, abandoned temples, and other suitable adventuring environments.

As a foe faction, Amethyst is a seriously disturbed person who’s convinced herself of an upcoming apocalypse. The Jeweled Ones train furiously and acquire magical knowledge through any means necessary. And anyone who finds out about them and talks of them publicly doesn’t survive long.

Basically, they’re a cult that are rapidly becoming terrorists.

The PCs may be hired to investigate a murder that was committed by a Jeweled One to silence the victim, or to find a magic tome before they do (a la Indiana Jones and the Last Crusade).

A showdown with Amethyst and her followers can occur in the following map, which can be either a sewer or basement complex. Entry comes through the left, and Jeweled Ones will hide in room 1 until the PCs enter room 2, then pour out to meet them. Amethyst will be waiting in room 3.

 

Categories: Faction | Leave a comment

How to Run Stranger Things in The Whispering Road

With the Kickstarter for Kids on Bikes combined with talk of the Dark Places & Demogorgons RPG, I thought I’d write a post about using The Whispering Road to run a Stranger Things game.

The Whispering Road is actually ideal for this.

You’ll want to decide whether you’re just playing the kids or whether you’re playing any of the adults, and whether you’re playing an analogue of Eleven or not. The adults and Eleven could totally work as allies. If a player wants to play Eleven, she’d definitely be a Chosen One. If a player wants to play an adult, he/she will almost certainly be a Mentor. The kids will probably be a mix of Ordinary Heroes and Rascals.

Here are three new Traits that would apply well to these kids:

Danger Sense (mental) — In unfamiliar situations, you often feel danger before others can, and you know what to do when that happens.

Natural Leader (relational) — Others look to you when they’re not sure what to do.

Psychokinesis (physical) — If you concentrate hard, you can move objects (about as big or heavy as you could normally) with your mind.

Act One will involve the introduction of the Eleven analogue, Act Two will introduce the villains, and in Act Three you can bring in adults and other authority figures who can assist the kids temporarily. The rest of it should operate exactly as in The Whispering Road.

Hope this helps!

Buy a copy of The Whispering Road in print for USD $10 or digitally for $5.

Categories: Random Idea | Leave a comment

On Teenage Punk Tabletop RPG Design

James Raggi IV (designer of Lamentations of the Flame Princess) posted this on Google+ a few days ago (this is just the middle part):

I ask you: When did innovation and pissing off the establishment become something that smelly old farts did?

Seriously.

I think about the history of heavy metal, and how the groundbreaking acts, the ones who really pushed the boundaries of what noise could be made, and what do I find…

Venom members were just 19-21 years old when their first album came out.
Slayer were 18-22.
Possessed were 18-20.
Death members were 19 and 20.
Napalm Death, 18-22.
Carcass’ members were 18 and 19.
Sodom was 17-21.
Everyone in Entombed was a teenager, 17-19, when Left Hand Path came out.
Emperor members were 19-20 years old when their first record came out.
Mayhem, 18-19.
The Darkthrone guys were 18-19.
Hellhammer, 17-21.
Sepultura 16-18.

And figure the recording contracts were signed some time before, not to mention when the demos that got them signed would have been made. These fuckers were young. Making noise like no one before them because they wanted to be heavier, they wanted to be faster, they wanted to push things farther than they’d ever been pushed before. And the established music industry didn’t want to touch them, so their peers founded record labels just so this stuff could get out there and change the world. In many cases their mommies had to co-sign their record deals with them because they were minors.

And in gaming we’ve got… old, old fucks. The new noise is very often made by some crusty geriatric flexing his creative freedom after leaving his old company. Startup publishing companies are formed by people who have been gaming forever in order to release books by people who have been gaming forever because they too need to release their album of standards. Just like in metal, where the sickest shit today is made by the same people who were playing the sickest shit 25 years ago. It’s disgraceful.

Not quite as disgraceful as the kids getting together to ape their granddads. “Oh, how cute, these guys are 20 years old and playing just like Iron Maiden’s early stuff.” Timelinewise, that is just like Iron Maiden forming (in the 70s) and deciding instead of doing metal to base their sound on The Wizard of Oz’s musical numbers.

Who are the young rebels not obeying the laws of decorum and trying to piss off The Man with all our profanity? Well… me, Chandler, and Venger are all in our early forties. Alex “dicks dicks dicks” Mayo is even older. fuuuuuuuuuuuck. And our whippersnapper Kiel is 29. 29! Remember when you were young enough to think you could conquer the world? 29 is just a couple months away from being 30 and ANCIENT DEATH!

On the one hand, I totally agree that I’d like to see more young blood in the hobby.

On the other, Gary Gygax was 36 when he first published D&D, and Dave Arneson was 25. Mark Rein-Hagen published Vampire: The Masquerade when he was 27.

This has never been a hobby of teenagers publishing tabletop RPGs.

Moreover, if you want to see teenagers designing games, go to https://www.reddit.com/r/rpgdesign and check out the designs there. It’s not all 18-year-olds, of course, but it’s a pretty useful indication of what it looks like when teenagers design games.

I’m not being salty; I was like that at that age. Writing useful games is hard.

Now, I have no experience in writing music, but it seems to me that getting instruments together and composing a rock or punk song is something you can hack together. You don’t need a plan; you can be very lizard brained about it. The drummer lays down a beat, the bass player tries a few things, and the guitarists work out a chord progression. And as long as the four of you in the band know how to play it, once you’ve experimented enough to get a song, you’re done.

Tabletop RPGs have to be fixed in written language that your audience can grok. You have to use your left brain a lot when writing a game, while punk and rock are gloriously right brained. Sure, there’s some crossover, and there’s plenty of right brained work in making a game, but it seems to me there’s a lot more left brained work in making a game other people can understand how to play than there is in hashing out a 3-minute punk song.

Which leads us to an interesting question: How can we help 18-year-olds to write cool games?

If you’re a teenager reading this, here’s my advice:

  1. Read your favorite RPG specifically for how it explains its rules. If you want to make songs like Iron Maiden, you have to listen deeper, to how an Iron Maiden song is constructed of its various parts. Same thing here.
  2. In your game, be gloriously creative and imaginative when describing your world. Create a cool, weird environment for the game.
  3. When it comes to describing how players actually roll dice and interpret the results, be clear. Use your experience in the first point above. Change tone if you have to, so someone reading your game will totally understand what you’re saying.
  4. Find people outside of your friends to read and play your game. You’ll get a lot of bad feedback, but you’ll get some good suggestions, too, especially about what isn’t clear. If the feedback would change the fundamentals of your game, ignore it, but if it would help, definitely try it out.
Categories: Game Design Hour | Leave a comment

Faction Friday: Anne Arundel’s Cotton Knitwear of Doom

'Knit scarf macro' by m01229 on Flickr

‘Knit scarf macro’ by m01229 on Flickr

Who can truly predict popularity?

Certain bright, patchy-patterned scarves, vests, and other knitwear have become hugely popular of late. Everyone knows they’re knitted by the innumerable women who form the loose coalition known as Anne Arundel’s Cotton Knitwear.

AACK, as it’s more commonly known, formed around the prodigious knitted output of its eponymous founder. Anne is a near-legendary figure of benevolence and industry, who recruited dozens, then hundreds of other women to knit caps, scarves, gloves, and other items of clothing in distinctive patterns, with a small but significant profit making its way back to Anne herself, of course.

It’s been a boon to many a struggling farmer’s purse, though some grumble that they’re encouraged to overwork themselves by overly-aggressive members of the organization.

And the knitwear produced by these women have indeed found widespread popularity. They just seem to keep you warm (optionally granting +2 on Constitution or Wisdom (Survival) checks to resist natural cold effects).

As a friendly faction, AACK grew out of unexpected popularity, and has suffered all the growing pains of a grassroots organization. It doesn’t extort money from its members, but some of its representatives can be overly enthusiastic and run their knitting circles like factories.

Members can be found in all but the tiniest villages, and frequently need someone to check on a caravan or tinker that’s on its way with a shipment of particular yarn or dyes.

As a foe faction, AACK’s members are unwittingly part of a very large, secret plot. Anne Arundel is secretly a hag, and each piece of knitwear forms a thread in the massive tapestry of a spell that will make her a demigod. When the ritual activates, it will steal life essence from anyone wearing the clothing.

Anne keeps the equipment for this ritual in a secret chamber in the sewers underneath the major city that serves as AACK’s headquarters. She keeps a few high-ranking members of AACK as bodyguards, who will defend her to the death in her sewer hideout before she transforms and uses all of her hag spells against the party.

Categories: Faction | Leave a comment

Character Creation using the Inverse Barker Mechanic

'A Taste of Africa' by DaPuglet on Flickr

‘A Taste of Africa’ by DaPuglet on Flickr

As I’ve been thinking about how to use the Inverse Barker Mechanic (roll d100 in any difficult situation; higher is better), I think there are (at least!) 2 immediate problems to solve:

  1. How do you create characters that are “balanced?” That is, how do you keep one player from just having maximum stats in everything?
  2. How does the GM officiate an interesting story with this system?

I have two answers to the first problem.

Solution 1: Let the GM Figure It Out

If the GM builds characters ahead of time, or at least defines the majority of each character’s abilities, then he or she can ensure balance.

This isn’t as weird as it may at first appear. A lot of LARPs and story games use pre-gens, as did the earliest tabletop RPGs like Braustein.

You can also divide the character sheets into skills and personality, letting a player choose a predetermined skill set, but defining whatever personality he or she wants.

Think of playbooks in Powered by the Apocalypse games: picking a playbook defines a large majority of your character, and the game generally works better when each player uses a different playbook.

Solution 2: Point-Buy, a la GURPS

I know, some people really dislike GURPS. We’re not using the system here, though; we’re using the approach.

Imagine this: The GM (and/or the group) defines the abilities, powers, attributes, and such that may come into play in the game. For each “universal” attribute in the game (like strength), each player gets 50 character creation points, and for each “uncommon” attribute in the game (like paranormal investigation), each player gets 25 character creation points. Players then distribute these points among the game’s abilities, powers, attributes, etc., where each can be between 0 and 100. For traits that are either on or off, you let each character have, say, one of these.

With this solution, you still don’t necessarily use those numbers directly in the game, trying to roll over/under those numbers (though you could certainly apply the unmodified Barker Mechanic to do so). While you could, you quickly run into questions about overlapping abilities. This is just to establish relative ability.

 

Now, figuring out how to help a GM run a cool story with a relatively loose system like this is a very big task, and one for which I don’t have a great process. I think it would involve the basic stuff: create antagonists with strong goals, put them directly in the PCs’ paths, etc.

Categories: Random Idea | Leave a comment