Printable View
I have a friend whos site was hacked a littlte while back by a group calling themselves "Hacking for Jesus" aka "Command Tribulation". Unluckily, he is having some trouble getting his site back up. www.alkalinehorse.com and the "hackers" site is http://www.revolutiongospel.net/, or at least thats the link they left on his website. Unluckily I am not sure if he kept any logs. I am just wondering if this group is widely known. Anyway, any help that can be provided will be appreciated.
Hacking for Jesus? Sounds like a front.
//edit
Uless you want the site up for us all to enjoy the clever words of Jesus, then take it down and boot to a floppy and reformat your hard drives, then reload everything and search AO for "locking down <insert os here>" If you know what your doing to can figure out what went wrong and backup from tape. No logs?No Tape? = Format
They appear to be a Portuguese hacking group. They host a forum here.
You might be able to social engineer ;) a little more information out of them if you join the forum.
Cheers:
Well they seem to be a bussy bunch have a look here:
http://www.zone-h.org/en/defacements...d+Tribulation/
Seem's like a pretty big group (or could be) and is making defacements against your type of website's. Interestingly enough they call themselves Hacking for Jesus, which I think (like RoadClosed said) is a front and a serious load of it. Btw:
Look's to me (based on a number of scan's and research on your site, etc) that they got root on the webserver. Check to see what that's all about and DEFINITELY check your logs.Quote:
sh-2.05# uname -a; id uname -a; id Linux srv1.ariadomain.com 2.4.18-18.7.x #1 Wed Nov 13 20:29:30 EST 2002 i686 unknown uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
do a vulnerability scan on the websterver and see what could have been exploitable and patch it up to avoid further pwnage.
Collect as much data as possible and report it to the authorities.
EDIT:
Ok after a little bit of my own research and the use of some really effective skiddie tools :D...I can tell you that his website/webserver had a huge "WELCOME" sign hanging from all its 15 Open ports and some other stuff that I'd rather not share in public display. He seriously needs to lock that box up....is there a firewall installed?
The box is very vulnerable to numerous high risk exploits quite a few medium risks one and one low risk.
I have a report done but I dont think i want to give it to you...as DjM noted, this might be a sad social Engineering attempt.
cheers.
Thanks guys, gonna have to let my buddy know about this stuff, I have been checking out these Jesus hackers, it has to be a front. Pullezzz. Why would a bunch of Jesus fiends target a 17 year olds webserver? If we were talking pr0n, then I might be able to see why, but thats probably out of thier abilities :) Anyway, I am joining thier forum, (Hope they speak english, dont want to babelfish EVERYTHING.) Thanks again, ill let him know.
(As for open ports, he shouldnt feel too bad, I once left port 139 open on my gaming machine, yes 139, thats not a typo.)
I did some searching and it seems to me that they are wanna be elitist's but I could be wrong.
Everything that I tried to find out like e-mails were fake but none the less, I agree with everyone he should try to get evidence of there behavior and record it for the authorities. Then fry-um. And this is coming from a true "born again christian"
Cant anyone track these guys down??? I mean, even the brazillian Govt has gotta be gettin sick of this.
I wouldn't be as worried about just the ports being open, as much as I would for the 21 vulnerabilities on the server.
just for your info, they are just a bunch of script kiddies. They know from nothing to zero about networking. No one use to track those, since they just group, deface a lot of sites and vanished. I agree with most of guys here: too many "holes" on security. Script kiddies are just like that: run a program to scan computers with vulnerabilities and change pages. I doubt that they know what to do with root access.
However, as these kind of people act as bees (or rats), I repeat previous advices: re-install
all
skiddies or uber-l337-hackers makes no difference...they're still doing harm and they need to be stopped.
I checked their website, and i'm pretty sure they're a bit more advanced that just plain skiddies.
Although they can "evolved" :P
I dont think so. As Ive heard, they are a spin off of other "hackker" group in Brazil.
Try to ask them "What is the purpose of SYN, FIN, RST, PSH bits?" or "what is the difference between ACTV and PASV FTP?"
They know nothing :P
(i believe that a newbie should know tcp/ip basics - they dont know - just use well known tools around internet)
Just my opinion
BTW, we are plagued here by those beasts.
how do you know so much about them...besides being from the same country. Unless you personally know them, how can you claim they don't know ****? Before calling them newbies just because you "think" they use other people's tools, without actually personally knowing them, sit back and think first.
Gee your sig looks vaugely familliar. :rolleyes:
It's always best policy to reinstall from trusted, read-only media after a break-in. If you are interested in the forensics of it, keep an image of the various partitions backed up on another drive, otherwise trash the machine and restore the data from backups.
Well, whether the need to be stopped, and whether they CAN be stopped are two separate things. Even in the United States you can't charge someone for defacing your site(s) unless you can prove more than $5000 in lost revenues (at least last I was aware).Quote:
Originally posted here by Cybr1d
skiddies or uber-l337-hackers makes no difference...they're still doing harm and they need to be stopped.
I checked their website, and i'm pretty sure they're a bit more advanced that just plain skiddies.
As for whether they "seem" to be more advanced than plain script kiddies, you really wouldn't get a good idea without talking to them IMO. A lot of people can look and sound like they know what they are talking about, without actually knowing what they are talking about.
You are assuming he hasn't spoken to them. Either way it could be viewed as an assumption by yourself or cacosapo. He makes it sound as though he has talked to them before.Quote:
Originally posted here by Cybr1d
how do you know so much about them...besides being from the same country. Unless you personally know them, how can you claim they don't know ****? Before calling them newbies just because you "think" they use other people's tools, without actually personally knowing them, sit back and think first.
I am surprised you didnt look this one up guys. His "friend" is hosting thier website at EV1Servers and it should be their issue if the server goes down or is hacked. As it is listed in the Arin database they should email [email protected] or [email protected] to fix this problem. Who knows how many more servers they have accessed.
Source:
http://uptime.netcraft.com/up/graph/...alinehorse.com
Source:
http://ws.arin.net/cgi-bin/whois.pl and enter in the IP address 207.44.184.90.
"Even in the United States you can't charge someone for defacing your site(s) unless you can prove more than $5000 in lost revenues (at least last I was aware)."
*cough BULLSHIT *cough *cough
There is a difference between being charged with something and paying fines than actually going to jail.
"Your getting ****ed one way or the other" - Joe Peci
Sorry, i dont use to tell throw words on a forum without a previous research. Here some info about those guys:
here --> http://ctribulation.webcindario.com/modules/newbb/ <--- you can see their forum. It is in portuguese, and ive READ it. They dont talk like PRO
Until May, 12th they had attacked 2122 sites, according to Delta5. zone-h shows near 3K.
"Friend" groups that they allways mencioned on all mirror sites (like Cyberlords and others) identify themselves as defacers. On a online interview of one of those groups(Cyberlords) told to interviewer "we know nothing about networking, we just love to corrupt websites". And the description of their acts prove that they dont have a good knowledge of nets.
On several public brazilian forums, they appear related to other newbie groups (kids, usually between 14-17). Of course, age doesnt imply on lack of knowledge, im just showing information. Language and expression used on those forums show that they have poor knowledge of networking.
Thats why i told they are newbies.