Dear EmEditor user,
We have found malicious files were placed in a subfolder of the EmEditor website, and we estimate these files were placed by a hacker between 6:36 am and 11:20 am on August 18th in the Pacific Daylight Time (USA and Canada), or between 1:36 pm and 6:20 pm on August 18th in the UTC. If a user uses EmEditor Update Checker from one of certain IP addresses, a malicious program, not EmEditor, might have been installed. The IP addresses are:
For the following list, * represents any number between 0 and 255. All 256 numbers between 0 and 255 are IP addresses in question.
12.44.85.*
12.189.27.*
12.233.153.*
42.147.69.*
49.101.250.*
61.211.224.*
63.119.133.*
64.102.249.*
64.235.145.*
64.235.151.*
66.129.241.*
77.248.69.*
86.111.221.*
106.139.26.*
106.188.131.*
114.160.192.*
118.103.17.*
118.238.0.*
124.248.207.*
133.6.1.*
133.6.91.*
133.6.94.*
133.56.0.*
133.74.211.*
133.173.2.*
150.26.82.*
173.36.196.*
173.38.209.*
182.162.60.*
188.111.86.*
194.98.194.*
198.135.0.*
199.167.55.*
203.104.128.*
203.180.164.*
204.15.64.*
209.97.118.*
210.17.188.*
210.172.128.*
210.174.36.*
210.224.179.*
216.228.150.*
219.195.174.*
For the following list, # represents a number between 0 and 255, but only one number represents the IP address in question. To protect users’ privacy, the actual IP address is hidden by #. If your IP address is included in this list, please contact us at jp@emurasoft.com with your IP address, and we will let you know your IP address is included.
12.234.38.#
61.202.251.#
101.110.12.#
101.110.14.#
101.110.15.#
101.111.185.#
108.28.100.#
117.103.185.#
118.159.230.#
118.159.235.#
124.85.138.#
126.205.203.#
133.6.76.#
153.163.255.#
180.0.96.#
180.6.227.#
202.7.107.#
202.62.253.#
206.13.28.#
210.148.24.#
210.164.30.# (2 IP addresses)
210.169.198.#
210.175.75.#
210.233.113.#
210.237.143.#
211.7.234.#
If your IP address is included in any of the above lists, and if you use the Update Checker of EmEditor during the above time frame, there is a possibility that your computer might have been infected by a virus. If so, please use anti-virus software to clean your computer.
To check your IP address, please go to www.google.com, enter “My IP”.
Currently, our server hosting company is scanning the whole website. As soon as the scan is completed, we plan to resolve the issue completely by all means.
We will keep you informed of our progress. If we cannot get access to our website, we might use Twitter, Google+, or Facebook to make announcements.
We apologize for any inconveniences that this situation might have caused you.
Switching to Avangate
/in General/by Yutaka EmuraWe are excited to announce that we are switching our online payment partner to Avangate. Our customers will appreciate more features including telephone support in many counties, the ability to control the renewal option during check-out as well as the new fresh user interface. Optional Backup CD and Download Insurance Service are now unselected by default.
If you experience any issues during the checkout, please don’t hesitate to contact us. We always value your feedback.
Thank you.
EmEditor v14.6.0 beta 17 released!
/in EmEditor Core/by Yutaka EmuraToday, we are releasing EmEditor v14.6.0 beta 17.
Updates from v14.6.0 beta 16 include:
We would like to find as many bugs as possible before we release the new version. Please try it out now and let us know if you find any bugs.
To download or see changes, please go to the beta forum – EmEditor Professional v14.6.0 beta 17 released!.
Thank you for continue using EmEditor!
Investigation report about the hacking incident
/in General/by Yutaka EmuraYesterday, we received the final investigation report from JPCERT/Coordination Center.
How unauthorized hacking was happened
From the various remained access logs, we could not identify the cause for the unauthorized hacking. We confirmed suspicious accesses (web and ftp) from 203.194.144.#, and we confirmed traces of attack attempts in early August. However, we couldn’t identify how the hacker entered our site just by these traces. There were no successful logins from these IP addresses.
About unauthorized redirects
From the remained access logs, the following 2 accesses were considered unauthorized accesses redirected by the .htaccess that was placed by a hacker.
These accesses match with the IP addresses written in the .htaccess, the time frame when the incident happened. Also, the number of bytes written in the access log (884) was different from the number of bytes written in the other accesses in the other time frame and other IP addresses.
Usually access logs look like:
the number of bytes is 855 for this file, but the above two accesses show the number of bytes as 884 bytes.
The clients who own the above IP addresses were contacted by JPCERT/CC, and found there were no malware infections. The access logs record all accesses including merely update checking without actual installation.
Future measures
In addition to routine updates of WordPress plug-ins and themes, we periodically scan our site for malware, monitor files on the server, access logs, and block suspicious IP addresses. On August 29th, we protected the entire site of emeditor.com with SSL encrypted connections. We are also planning to move our forums to another site or an electronic mailing list for improved security.
The next version of Advanced Installer that we used to make the Update Checker will be able to block update installers without the same digital signature as ours. The future EmEditor versions will restore the Update Checker with improved security.
We apologize for any inconveniences that this situation might have caused you
See also:
Possible malware attack by EmEditor Update Checker
New Filter Bar feature: (EmEditor Professional v14.6.0 beta 11)
/in EmEditor Core/by Yutaka EmuraToday, we are releasing EmEditor Professional v14.6.0 beta 11.
Updates from v14.6.0 beta 8 include:
We would like to find as many bugs as possible before we release the new version. Please try it out now and let us know if you find any bugs.
To download or see changes, please go to the beta forum – EmEditor Professional v14.6.0 beta 11 released! (New Feature: Filter Bar).
Thank you for continue using EmEditor!
EmEditor Professional v14.6.0 beta 8 released!
/in EmEditor Core/by Yutaka EmuraToday, we are releasing EmEditor Professional v14.6.0 beta 8.
Updates from v14.6.0 beta 4 include:
We would like to find as many bugs as possible before we release the new version. Please try it out now and let us know if you find any bugs.
To download or see changes, please go to the beta forum – EmEditor Professional v14.6.0 beta 8 released!.
Thank you for continue using EmEditor!
EmEditor Professional v14.6.0 beta 4 released!
/in EmEditor Core/by Yutaka EmuraToday, we are releasing EmEditor Professional v14.6.0 beta 4.
Updates from v14.6.0 beta 1 include:
We would like to find as many bugs as possible before we release the new version. Please try it out now and let us know if you find any bugs.
To download or see changes, please go to the beta forum – EmEditor Professional v14.6.0 beta 4 released!.
Thank you for continue using EmEditor!
EmEditor Professional v14.6.0 beta 1
/in EmEditor Core/by Yutaka EmuraToday, we are releasing EmEditor Professional v14.6.0 beta 1.
We used to use terminology “Separated Values” or “CSV/DSV/TSV”, but we will start calling all separated values by any delimiters as “CSV”.
Updates from v14.5.4 include:
We would like to find as many bugs as possible before we release the new version. Please try it out now and let us know if you find any bugs.
To download or see changes, please go to the beta forum – EmEditor Professional v14.6.0 beta 1 released!.
Thank you for continue using EmEditor!
EmEditor v14.5.4 released!
/in EmEditor Core/by Yutaka EmuraIn response to the hacking incident on the other day, we decided to disable the update checker until we can confirm the safety of our server and the Update Checker. We strongly recommend this update to all EmEditor users.
For safety of customers, we removed update configuration files in our server. Therefore the Update Checker on older versions of EmEditor will not be available anymore. If you try to check updates from older versions, you will see the prompt message: “Invalid or missing updates configuration file. …”. This is not a bug. Please download and update to the newest version of EmEditor by clicking here.
Updates from v14.5.3 include:
Features Removed
Enhancements
Bug Fixes
Please see EmEditor v14 New Features.
Download EmEditor v14 Now.
Thank you for using EmEditor.
See also
Possible malware attack by EmEditor Update Checker
/in General/by Yutaka EmuraDear EmEditor user,
We have found malicious files were placed in a subfolder of the EmEditor website, and we estimate these files were placed by a hacker between 6:36 am and 11:20 am on August 18th in the Pacific Daylight Time (USA and Canada), or between 1:36 pm and 6:20 pm on August 18th in the UTC. If a user uses EmEditor Update Checker from one of certain IP addresses, a malicious program, not EmEditor, might have been installed. The IP addresses are:
For the following list, * represents any number between 0 and 255. All 256 numbers between 0 and 255 are IP addresses in question.
12.44.85.*
12.189.27.*
12.233.153.*
42.147.69.*
49.101.250.*
61.211.224.*
63.119.133.*
64.102.249.*
64.235.145.*
64.235.151.*
66.129.241.*
77.248.69.*
86.111.221.*
106.139.26.*
106.188.131.*
114.160.192.*
118.103.17.*
118.238.0.*
124.248.207.*
133.6.1.*
133.6.91.*
133.6.94.*
133.56.0.*
133.74.211.*
133.173.2.*
150.26.82.*
173.36.196.*
173.38.209.*
182.162.60.*
188.111.86.*
194.98.194.*
198.135.0.*
199.167.55.*
203.104.128.*
203.180.164.*
204.15.64.*
209.97.118.*
210.17.188.*
210.172.128.*
210.174.36.*
210.224.179.*
216.228.150.*
219.195.174.*
For the following list, # represents a number between 0 and 255, but only one number represents the IP address in question. To protect users’ privacy, the actual IP address is hidden by #. If your IP address is included in this list, please contact us at jp@emurasoft.com with your IP address, and we will let you know your IP address is included.
12.234.38.#
61.202.251.#
101.110.12.#
101.110.14.#
101.110.15.#
101.111.185.#
108.28.100.#
117.103.185.#
118.159.230.#
118.159.235.#
124.85.138.#
126.205.203.#
133.6.76.#
153.163.255.#
180.0.96.#
180.6.227.#
202.7.107.#
202.62.253.#
206.13.28.#
210.148.24.#
210.164.30.# (2 IP addresses)
210.169.198.#
210.175.75.#
210.233.113.#
210.237.143.#
211.7.234.#
If your IP address is included in any of the above lists, and if you use the Update Checker of EmEditor during the above time frame, there is a possibility that your computer might have been infected by a virus. If so, please use anti-virus software to clean your computer.
To check your IP address, please go to www.google.com, enter “My IP”.
Currently, our server hosting company is scanning the whole website. As soon as the scan is completed, we plan to resolve the issue completely by all means.
We will keep you informed of our progress. If we cannot get access to our website, we might use Twitter, Google+, or Facebook to make announcements.
We apologize for any inconveniences that this situation might have caused you.
Website scans were completed and all websites are clean
/in General/by Yutaka EmuraOur website scans were completed, and all our websites were clean, including all of our foreign language EmEditor websites as well as Emurasoft Customer Center. This means this English website was not affected by this case.
Nevertheless, as a precaution, we recommend changing your password if you have an account in one of our sites, and please do not share the same password with Emurasoft Customer Center or any other websites.
To prevent future hacker attacks, we have tightened our security level. We no longer accept new members automatically. If you are not a member yet, and if you would like to join our forums, please contact us.
Once again, we apologize for any inconveniences.
Thank you for using EmEditor!