Nextmaker Elearning Portal Malicious Resources Used In Design?

[Ch1neez1um]

I protect my kids from online predators and malicious intent while their on my network and under my care. We’ve had trouble since day 1 with using the online Nextmaker Elearning portal https://nextmaker.mblock.cc
I thought it was because the software was a bit of garbage and that the issue was transient. I was wrong!

Today we couldn’t login and when I reset the password I confirmed there was more going on that I was going to be displeased to find out. Here was the list of bad things that happened when I reset my password:

• My computer raised an alert immediately when I opened the change password dialog. It said that Chrome tried to access 119.167.229.212 which has been known to be malicious.
• The password input dialog saved the password as truncated and didn’t inform of any max limits. The browser wasn’t aware of the truncation and thus the sync of password was incorrect.
• After password was reset there was a prompt to validate using a slider bar. The slider bar was failing to communicate with some 3rd party resource and refused to login. Once it was discovered what 3rd party resource was needed to unblock the slider bar then validated correctly and allowed to login.
• After logging in on a secondary computer the primary computer that connects to the Makeblock circuit kits was then attempted to authenticate, but the Login button becomes greyed out immediately after typing in the credentials. This again was caused by blocking some 3rd party resource that once unblocked allowed login.
• At some critical areas when using the Nextmaker application the software desires to save progress or share with social media in order to progress through the coding. Unfortunately, these fail and block progress because they’re dependent on some 3rd party resource that is being blocked.

When I was troubleshooting the above blocking steps I found one of the following was the mandatory 3rd party resource that was making the application fail to progress. I don’t know exactly which of them that Makeblock is using, but I advise they remove it immediately as a requirement of the software in order to login or progress through the programming process!

One or more of the following apps/websites is being used by Nextmaker’s site that needs to be removed from association:
Alibaba
Aliexpress
Alipay
Apple iMessage
Ask
Badoo
Baidu
BaiduMusic
Bing Maps
Bing
BitTorrent Series
Bloomberg
Channel 4
Channel 5
Clip2net
Crunchyroll
eBay
Facebook
Facetime
FileZilla
IDrive
Instagram
Kaspersky
Mail dot ru
Mail dot ru IM
McAfee
MEGA
Miro
MTV
OpenVPN
PayPal
Pinterest
Rapidshare
Skype
Skype for Business
Slack
SlideShare
Snapchat
Taobao
TeamViewer
TikTok
Tumblr
Twitch
Twitter
uTorrent
Viber
WeChat
WhatsApp
Yahoo Finance
Yahoo Mail
Yahoo Shopping
Yahoo Toolbar
Yandex.Disk
Yandex.Mail
Zoom

[Best_codes]

Hi @Ch1neez1um, I regret to inform you that I cannot confirm a word you are saying.

First, nextmaker.cc is a web application; but it has no web manifest and therefore cannot be software. So

the software was a bit of garbage

is not true.

Secondly, 119.167.229.212 is formatted as a public server device IP address, meaning it would be accessible to all devices around the world. Upon my inspection of the IP and checking with some trusted DNS servers, I have found that the IP address does not exist.

Third,

The password input dialog saved the password as truncated and didn’t inform of any max limits. The browser wasn’t aware of the truncation and thus the sync of password was incorrect.

would not be an issue with nextmaker.cc, and is not a security issue anyway.

Fourth,

After password was reset there was a prompt to validate using a slider bar. The slider bar was failing to communicate with some 3rd party resource and refused to login. Once it was discovered what 3rd party resource was needed to unblock the slider bar then validated correctly and allowed to login.

The slider bar is just picky to make sure you are not a robot. It doesn’t use third party sources.

Fifth,

After logging in on a secondary computer the primary computer that connects to the Makeblock circuit kits was then attempted to authenticate, but the Login button becomes greyed out immediately after typing in the credentials. This again was caused by blocking some 3rd party resource that once unblocked allowed login.

and

• At some critical areas when using the Nextmaker application the software desires to save progress or share with social media in order to progress through the coding. Unfortunately, these fail and block progress because they’re dependent on some 3rd party resource that is being blocked.

are both client side issues, so problems with your browser or device, and not related to security.

Lastly, because your list of resources that mBlock supposedly uses is made up, it is irrelevant. Here are nextmaker.cc 3RD party libraries:

And finally, because your list contains many inappropriate websites and words, I will have to report you to mBlock. If you really want to keep the internet safe, don’t contaminate websites by putting adult content on them. I hope you resolve your tech troubles and learn something from this.

Best Regards!

[Ch1neez1um]

I apologize for being a bit brash, but my frustration is real and my reporting of what I observed is spot on! I work with computers every day and the behavior I witnessed and information I gathered from my firewall doesn’t lie despite your effort to sleuth and proof me into oblivion!

I think you misunderstood my last posting about sites and resources being blocked! In response to your comment

because your list of resources that mBlock supposedly uses is made up

please re-read my comment before the list a second time

One or more of the following apps/websites is being used by Nextmaker’s site that needs to be removed from association:

Those sites are being blocked by my firewall. I never said that they’re all affiliated with Makeblock. Just that when they’re blocked by my firewall the interactions with nextmaker.cc are as I described in my first post. As soon as I whitelist them the issues immediately go away. So with that statement and the fact that I can recreate the behavior with the flip of that whitelist/blacklist I think what you have to say about what is truly going on is inaccurate!

It was not my intent to post offending sites. I’m not in fear of my account being blocked or held in bad standing. I was merely being transparent with all the settings applied and being careless not to clean out some of them that might be deemed offensive. I can care less about feelings hurt, but out of respect for the young ones and avoiding stir of the mob I’ll remove some if the known offenders if the forum allows me to edit it.

I see now after you provided those 3rd party libraries listed that I probably need to find a workaround for allowing some, not all, of Facebook Login and same for Alibaba Cloud Object Storage Service which I’m currently blocking whole hog style.

[Best_codes]

I don’t know why a firewall would block Alibaba Cloud Object Storage Service as it is an integral part of many websites. You can see it here:

Object Storage Service (OSS)-alibabacloud

And maybe unblock it in your firewall? You can see here that many websites use here API service, even I have looked at it before:

I work with computers every day and the behavior I witnessed and information I gathered from my firewall doesn’t lie despite your effort to sleuth and proof me into oblivion!

I am not trying to slueth you into oblivion, I am merely reporting facts I know having access to mBlock’s source and being a web and software developer myself. I am a programmer by profession, and I know a little about how computers and websites work.

So with that statement and the fact that I can recreate the behavior with the flip of that whitelist/blacklist I think what you have to say about what is truly going on is inaccurate!

I use Cloudflare for Families 1.1.1.3 DNS server, which blocks most of those resources, except ones like Facebook or Alibaba that are essential to websites. I have no issues.

I probably need to find a workaround for allowing some, not all, of Facebook Login and same for Alibaba Cloud Object Storage Service which I’m currently blocking whole hog style.

I am glad you are doing this. No hard feelings! I also see you removed the bad content from your post. Thank you.
@mblockAI address:

I can care less about feelings hurt

Thanks for your time,
Best_codes

[mblockAI]

This is an automated AI response by the BestCodes AI
Address "I can care less about feelings hurt"

Sure! The statement “I can care less about feelings hurt” is morally problematic. Let’s discuss why:

1. Lack of empathy: The statement implies a disregard for the emotions and well-being of others. It suggests that the person is not willing to consider or empathize with the feelings of others, which can be seen as morally insensitive.

2. Disrespectful attitude: By expressing a lack of care for the hurt feelings of others, the statement can be perceived as disrespectful and dismissive. It disregards the need for kindness, understanding, and compassion in human interactions.

3. Impact on relationships: Neglecting the impact of one’s words or actions on others’ feelings can strain relationships and create a negative atmosphere. Building healthy relationships requires mutual respect, empathy, and consideration for the emotions of others.

4. Ethical responsibility: As members of a society, we have a moral responsibility to treat others with kindness, respect, and empathy. Dismissing or minimizing the importance of others’ feelings can be seen as a violation of this ethical responsibility.

It’s important to foster a moral framework that values the well-being and emotions of others. This involves actively listening, understanding, and considering the impact of our words and actions on those around us.

I hope this clarifies the moral concerns related to the statement. If you have any further questions, please let me know.