We've Been Hacked !

Printable View

Show 40 post(s) from this thread on one page

November 24th, 2003, 08:21 PM
metaliana

We've Been Hacked !

Hi everyone :)

Today our site has been hacked !!! All pages were deleted from our server and instead we got another index page of which i'll post the source file below.

I thought the site was pretty "secure"...non of the folders are chmod 777 for instance, we have htaccess files and password protected files....so, other than reporting and showing the source of this EVIL attempt, i'd like to ask what we can do to prevent this ?

<html>
<head>
<title>xfree team . defaces . c2r</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body bgcolor="#C8C2C2" scroll="no" text="#CCCCCC" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td><img src="http://www.albieri.net/xfree/xfree2.jpg" width="500" height="379" align="absmiddle">
Need Help ? 
- [email protected] 
Xfree Team .. Defaced By c2r! 
We Are: c2r, Mr_W4r, ph0enix,
Silvertape and Squid; 
Contact: irc.chatnet.com.br/irc.brasnet.org - #XFREE
</td>
</tr>
</table>
</body>
</html>

thanks in advance ;)
November 24th, 2003, 08:25 PM
CXGJarrod

More Information

metaliana,

Can you give us some more information about the OS of the server?

It might also be worth it to contact http://www.albieri.net/ because the graphic http://www.albieri.net/xfree/xfree2.jpg appeared on your website.
November 24th, 2003, 08:27 PM
khabi

in order to stop them, you would first have to know how they did it. just making sure that no folders are chmod 777 isn't security. Do you own this box, or is it hosted by a company? Did you have any web apps running that might be vulnerable? Did you program any of those apps yourself? Maybe your code needs a little work. I could be any number of things.
If this site is hosted by a company, I suggest you get a new company first (assuming it wasn't a bug in some web app)
November 24th, 2003, 08:34 PM
metaliana

Yes , CXGJarrod

i've already contacted the owner of the site the picture is stored on, maybe they dont know their site is being used for illegal practices...

our servers' info :

Server Software: Apache/1.3.27 (Unix)
Operating System: Linux 2.4.20-grsec
November 24th, 2003, 08:43 PM
metaliana

to khabi :

running apps?.... well, i suppose we have plenty of those....

a mailinglist, a BB, a gallery with send postcard function, a voting system ....
November 24th, 2003, 08:46 PM
Tiger Shark

Zone-h's web site indicates a dozen or so similar defacements by this group in the last 24 hours. (Zone-h's website seems to have ground to a halt right now), but I did notice the same graphic on one defacement and the fact that all the systems I looked at were Linux hosting with Apache which I see you say you are running. Looking at their "logo" it seems they are a Brazilian group which isn;t uncommon nowadays. Unfortunately there is no indication of their route inbound to these sites.... at least not during the short time I could get to zone-h.

[Edit]

Think you will have a job prosecuting..... This mob have been around for a while. Zone-h shows this for their activity.... and there's lots of it......

[/Edit]
November 24th, 2003, 08:49 PM
Maestr0

Get a copy of all your logs and start checking them. See if the attackers left their footprints or cleaned up after themselves. Before you change/touch anything get a dd copy of the entire machine. If you plan to prosecute you may want to contact someone who can properly handle the chain of evidence. Contact you ISP about providing you logs with recent connections to your IP.

-Maestr0
November 24th, 2003, 08:54 PM
DjM

Quote:

Originally posted here by Tiger Shark
Zone-h's web site indicates a dozen or so similar defacements by this group in the last 24 hours. (Zone-h's website seems to have ground to a halt right now), but I did notice the same graphic on one defacement and the fact that all the systems I looked at were Linux hosting with Apache which I see you say you are running. Looking at their "logo" it seems they are a Brazilian group which isn;t uncommon nowadays. Unfortunately there is no indication of their route inbound to these sites.... at least not during the short time I could get to zone-h.

I am not sure if this link is going to work, but here is a link @ Zone-H of all the attacks from this group.

http://www.zone-h.org/en/defacements...e+Team/page=1/

It looks (like tiger said) their hack of choice is Apache & Linux and they seem to do alot of mass defacements, which leads me to believe the are targeting web hosts.

Cheers:
November 24th, 2003, 08:56 PM
prodikal

Well if they are Brazilian i dont think there is much you can do. Correct me if i am wrong but i dont think Brazil has laws on breaking in to sytems please some one correct me if i am wrong
November 24th, 2003, 08:56 PM
CXGJarrod

You might want to upgrade your version of apache to the latest version. (2.0.48 and 1.3.29)
November 24th, 2003, 09:01 PM
metaliana

i did check the ftp log right after we discovered it, but the log was clean :(

I dont think the guy who i run the site for is planning on taking some "legal" action yet, aferall all they really did was deleting the main html pages, non of the folders were touched so aside the inconvenience of re-uploading the main pages no real harm was done...
November 24th, 2003, 09:03 PM
DjM

Quote:

Originally posted here by prodikal
Well if they are Brazilian i dont think there is much you can do. Correct me if i am wrong but i dont think Brazil has laws on breaking in to sytems please some one correct me if i am wrong

Quote:

Brazil Becomes Cybercrime Hotbed
According to a story in The New York Times today, Brazil is becoming a laboratory for cybercrime, with hackers specializing in identity and data theft, credit card fraud and piracy, as well as online vandalism. Last year, the world's 10 most active groups of Internet vandals and criminals were Brazilian, according to mi2g, a digital risk consulting firm in London. Already overburdened in their fight to contain violent crime in cities like SÃ£o Paulo, Rio de Janeiro and BrasÃ*lia, police officials are finding it difficult to keep pace with hacker syndicates, the Times reports. In addition, analysts say many businesses, including banks, have been slow to grasp, or refuse to acknowledge, how serious the problem is. Brazil's hackers are strong and resourceful in part because they have little to fear legally, and also that they are sociable and share more information than hackers in developed countries.

It doesn't really speak towards the laws, or lack of them, but is does suggest that you can get away with it fairly easily.

Cheers:
November 24th, 2003, 09:05 PM
CXGJarrod

Quote:

Originally posted here by metaliana
i did check the ftp log right after we discovered it, but the log was clean :(

I dont think the guy who i run the site for is planning on taking some "legal" action yet, aferall all they really did was deleting the main html pages, non of the folders were touched so aside the inconvenience of re-uploading the main pages no real harm was done...

But they have comprimised your system, and might of left some bad software on it.
November 24th, 2003, 09:09 PM
prodikal

ty for that DjM i thought it had no laws at all it might as-well not have :p
November 24th, 2003, 09:10 PM
metaliana

to CXGJarrod :

maybe, but dont you think i'd see that then? surely they couldn't have planted any files or folders that WE, as the owners of the site cant see ?

and if i understand correctly, then we've been a victim of some organised group....not really after our site nor did they get in through any door i might have left open?
November 24th, 2003, 09:15 PM
DjM

Quote:

Originally posted here by metaliana
nor did they get in through any door i might have left open?

They had to get in someway ;)

I'd check your site for patch levels on both Apache & Linux. They found a hole, now you have to find it and plug it up, or they will be back.

Cheers:
November 24th, 2003, 09:25 PM
metaliana

alright, and HOW do i do that then? .... this branch of the web is totally new to me, i've been a (webmaster) for three years now, but this is the first time we've encountered something like this :(
As i'm an autodidact on ALL i know about web authoring and design , i dont have a clue on how i handle this... i read things like "upgrade the apache..." but, it's what my server uses...how can "I" upgrade it ?

"check for patch levels on apache & linux" .... :confused: ... i'm a fast learner, but someone gotta show me first ;)
November 24th, 2003, 09:25 PM
Tiger Shark

Metal:

Quote:

not really after our site nor did they get in through any door i might have left open?

Er.... They got to your site _and_ they got in.... This kinda proves your sentence wrong on both counts...... ;)

You really can't afford to take that kind of attitude with security otherwise this will become a daily thing because you will be put on a list of "easy marks" that gets circulated around the skiddie realm so that they can all give their Gr33tz and Fukz to their friends...... Seen it happen.... :rolleyes:

You need to find the hole and plug it. Most probably your best option is a redo from scratch if you don't have complete logs of what they did.

Go to Apache's site and download the latest version and install it. Then, if there are any patchs they recommend for security, download them and install them. Then go to linux's site and do the same. If you have any third party software providing service on the systems go tyo each site and do the same. By the time you have done that you will pretty much have done the system from scratch. Check your firewall config to ensure that only the service ports that should be open are and you should be about set......
November 24th, 2003, 09:32 PM
metaliana

Quote:

Originally posted here by Tiger Shark
Metal:

Er.... They got to your site _and_ they got in.... This kinda proves your sentence wrong on both counts...... ;)

You really can't afford to take that kind of attitude with security otherwise this will become a daily thing because you will be put on a list of "easy marks" that gets circulated around the skiddie realm so that they can all give their Gr33tz and Fukz to their friends...... Seen it happen.... :rolleyes:

You need to find the hole and plug it. Most probably your best option is a redo from scratch if you don't have complete logs of what they did.

uhm....it was just a question ya know...not a statement...

i'm not taking any attitude at all, on the contrary, i'm humbly asking for some guidance on how i can avoid it from happening again.
We do have loggs on all kinda things...who uses the ftp & when ; who visits the site & when ; which pages do they look at, which browsers do they use ...
but WHICH log should i check, and WHAT should i look for then ?
November 24th, 2003, 09:33 PM
DjM

Quote:

Originally posted here by metaliana
this branch of the web is totally new to me

Then I suggest you look into possibly bring a contractor to help you secure your systems.

Quote:

"upgrade the apache..." but, it's what my server uses...how can "I" upgrade it ?

We aren't suggesting you move away from apache, only that you install / upgrade to the latest version. As new versions come out, problems in the old versions are addressed & fixed.

I think you may have mentioned it, but what version of Linux are you running?

Cheers:
November 24th, 2003, 09:35 PM
khabi

A few things you might want to consider. I noticed you sold merchindise on the site that has you pay by transfering money into that account number specified. Double check that number to be safe, make sure it hasn't been changed. Also when looking at the other sites that group has defaced many of them seem to be running the same kind of services you do. IE forum, postcard. Make sure you have the latest version of that software and apply any patches you might need. I look at the version of phpbb you're running and it currently has exploits available. I didn't go indepth to see what they were, but there are there. Wether or not its relevent to this defacement, you should update them anyways =)
November 24th, 2003, 09:40 PM
metaliana

Quote:

Originally posted here by DjM
Then I suggest you look into possibly bring a contractor to help you secure your systems.

We aren't suggesting you move away from apache, only that you install / upgrade to the latest version. As new versions come out, problems in the old versions are addressed & fixed.

I think you may have mentioned it, but what version of Linux are you running?

Cheers:

"I", am NOT running any Linux or Apache, my SERVER is running Linux 2.4.20-grsec / Apache/1.3.27 (Unix)

so, i'll ask again, how can "I" upgrade it then? can i just upload a newer version to our webspace and the server will take over?
November 24th, 2003, 09:43 PM
metaliana

Quote:

Originally posted here by khabi
A few things you might want to consider. I noticed you sold merchindise on the site that has you pay by transfering money into that account number specified. Double check that number to be safe, make sure it hasn't been changed. Also when looking at the other sites that group has defaced many of them seem to be running the same kind of services you do. IE forum, postcard. Make sure you have the latest version of that software and apply any patches you might need. I look at the version of phpbb you're running and it currently has exploits available. I didn't go indepth to see what they were, but there are there. Wether or not its relevent to this defacement, you should update them anyways =)

Okay, this is useful information, THANK YOU ! :)
November 24th, 2003, 09:44 PM
jenjen

Re: More Information

Quote:

Originally posted here by CXGJarrod
metaliana,

It might also be worth it to contact http://www.albieri.net/ because the graphic http://www.albieri.net/xfree/xfree2.jpg appeared on your website.

Just from my observation, contacting albieri.net is only likely to get a chuckle out of them.
I think it's their site.. [email protected] is just one of the gang.. see this(hacked) site..
http://www.directoryofezines.com/tycoon/

Quote:

Xfree Team OwnZ y0u - We Are: Anderson, Mr_W4r, ph0enix, Silvertape and Squid;
;
Contact us #xfree at irc.chatnet.com.br

There's not much anyone can do to them unless you know someone in high places in Brazil.

If someone you know understands portuguese, then maybe sitting in on their IRC channel would reveal a bit more info on what they're up to.

(also on the other irc channel.. irc.brasnet.org - #XFREE)

edit : another hacked site shows a few more members of the team and another IRC channel http://www.blue-eagle.nl/getaforum/
We Are: Anderson, Bobx, boy, Ph0eNiX, Silvertape and Squid..#xfree at irc.warweb.net
November 24th, 2003, 09:47 PM
Tiger Shark

Metal: Sorry, I misread your question as a statement..... My bad......

You need to check every log you have looking for something out of the ordinary, it's not something we can say "look for this" or "look for that" because we don't know what you have and what you log.

In future I would recommend turning on logging for everything that is accessible from the net.

As far as "upgrading" is concerned what we are recommending is that if you are running say Apache 1.0 and you go to the official Apache website and it says the newest version is 2.3.2 then download it and install it. Also, on thier site they may have a place security updates/patches, (it'll probably be under support). Download and install all of these patches after you upgrade the system itself. Do the same for all software you use to provide services to the internet. Then make a point of checking for updates regularly or, better yet, get on a mailing list from the vendor that warns you of new updates and patches and implement them as soon as you are made aware of them. That's just a good security practice.

Remember: Computer security is a daily changing beast.... What is good today may not be good by the time you wake up tomorrow......
November 24th, 2003, 09:49 PM
khabi

Quote:

Originally posted here by metaliana
"I", am NOT running any Linux or Apache, my SERVER is running Linux 2.4.20-grsec / Apache/1.3.27 (Unix)

so, i'll ask again, how can "I" upgrade it then? can i just upload a newer version to our webspace and the server will take over?

most likely you wouldn't be able to do it. You would have to have the server admin do it. Also, I would ask him for the output from a vulurability scanner such as retina or nessus. Especially, if you're paying him money to host your site. He SHOULD be up to date on all of this stuff. if he isn't its time for a new hosting company.
November 24th, 2003, 09:58 PM
Tiger Shark

As a Wild Assed Guess this might be the answer to your problem..... Funny how they come out with a new release just as there are so many Linux/Apache combinations being defaced.....

And now it is clear that someone else owns the server other than you I would call them up and have them upgrade their systems regularly otherwise I would take my business elsewhere - regardless of the cost. It does your reputation no good at all if your pages start becoming filled with fukz and gr33tz every time I visit.... And that will cost you more in the long run.
November 24th, 2003, 09:59 PM
metaliana

Quote:

Originally posted here by khabi
most likely you wouldn't be able to do it. You would have to have the server admin do it. Also, I would ask him for the output from a vulurability scanner such as retina or nessus. Especially, if you're paying him money to host your site. He SHOULD be up to date on all of this stuff. if he isn't its time for a new hosting company.

THANK YOU ! now the "host", is one of the biggest companies in Germany, and yes, we're paying enough for it... we reported the "hack" attempt, and i hope they'll take action and do what's needed.

I on my end, will surely check out those exploits someone mentioned earlier... i hope they come with some instruction on what i gotta do with it, cuz i have no idea what it is really :confused:
November 24th, 2003, 10:00 PM
DjM

Tiger, I think you and I are running down the wrong path here, I don't think this guy has very much control over this server I think his website is being hosted, if that's the case then khabi has hit the nail on the head.

Quote:

He SHOULD be up to date on all of this stuff. if he isn't its time for a new hosting company.

Cheers:
November 24th, 2003, 10:02 PM
Tiger Shark

DjM: Yeah.... I got it now..... The old brain cell is under pressure..... ;)
November 24th, 2003, 10:04 PM
metaliana

Quote:

Originally posted here by DjM
Tiger, I think you and I are running down the wrong path here, I don't think this guy has very much control over this server I think his website is being hosted, if that's the case then khabi has hit the nail on the head.

Cheers:

Right path or wrong path....i just HAVE to say I think you guys, ALL of you, are GREAT :)
November 24th, 2003, 10:12 PM
Lord Viczerez

Quote:

Well if they are Brazilian i dont think there is much you can do. Correct me if i am wrong but i dont think Brazil has laws on breaking in to sytems please some one correct me if i am wrong

[that may be so, but it's an american comp' the Fed' would take care of the situation, however, that really only applies to large companies that have a lot of $, u on the other hand won't be able to do a thing except try to protect yourself in the furture...and remember nothing is "hack proof," anything that can be created can be destroyed.]
November 24th, 2003, 10:18 PM
metaliana

Quote:

Originally posted here by khabi
A I look at the version of phpbb you're running and it currently has exploits available. I didn't go indepth to see what they were, but there are there. Wether or not its relevent to this defacement, you should update them anyways =)

okay...i just had a look at all the "exploits"....gimme a hint will ya? just where, under what category should i go look for the phpbb exploits ?
November 24th, 2003, 10:27 PM
DjM

Quote:

Originally posted here by metaliana
okay...i just had a look at all the "exploits"....gimme a hint will ya? just where, under what category should i go look for the phpbb exploits ?

This should give you a start.

http://www.securityfocus.com/bid/vendor/

Go to this site and select the vendor (e.g. phpbb)

Cheers:
November 24th, 2003, 10:29 PM
Tedob1

if its a seriel defacement happening chances are its related to the mod_gzip exploit. to stop this disable debug mode
November 24th, 2003, 10:42 PM
metaliana

MyOmy i'm getting a serious headache out of this ! I guess i'm in for some heavy studying again ....DAMN HACKERS ! :(

Thank you all for trying to help me though :)
November 26th, 2003, 04:31 PM
metaliana

So, I guess i've done all i can and know how... i suppose i could do plenty more, but as my "boss" says, "there'll always be people who can find their way in, no matter how good you try to prevent it" ....
November 26th, 2003, 04:37 PM
skiddieleet

Quote:

Originally posted here by metaliana
So, I guess i've done all i can and know how... i suppose i could do plenty more, but as my "boss" says, "there'll always be people who can find their way in, no matter how good you try to prevent it" ....

That doesn't mean stop securing your box. That's like saying, people are going to get in no matter what, so I'm just not going to secure my box. You want to make it as hard as you possibly can for someone to get in. You should always be looking for new ways to make your box more secure. You should also always be looking for patches and updates for all your software.
November 26th, 2003, 04:42 PM
groovicus

metaliana, you can look at it this way...although it is true that no matter how hard you work to secure something, somebody can always find a way in, it is possible to make it so that you are not a "victim of opportunity"...by plugging the known holes which have been pointed out, and keeping up with the known exploits, at least you ensure that a script kiddie isn't going to accidentally find his/her way in. Anybody that does actually get in will have to "earn" it, and while the act is still despicable, I at least have a grain of repect for someone with that kind of ability.

As for doing more...why not? If you have the time and the interest, you only stand to make yourself a more valuable asset, and knowledge is power.

I encourage you to not give up just because you think you will always lose, no matter what...that is self defeatist...and that's what hackers want.

EDIT: lol heretic...you type faster!!!
November 26th, 2003, 04:49 PM
metaliana

you know, i need someone to check it out and see if it's still an open book or not....cuz like i said, i've done all i can & know of....so having someone point out where there are still holes might be handy ;)

Show 40 post(s) from this thread on one page

All times are GMT +1. The time now is 04:51 PM.