jawa.mee.nu

May 04, 2006

Hackers Still Hacking

After being mentioned without being really mentioned today on CNET. Aarons.cc has been hacked again.

The hacker left this email address. Mail To : 020@xp020[dot]com

Seems to me these guys have caused enough trouble and not just for Aaron.

Blue Security Via CNET : Blue Security was unavailable for comment at the time of writing, but in its blog posting, it said Blue Frog would continue to combat spammers.
"We're helping the community fight the Blue Independence War. We fight for our freedom from spammers and cybercriminals. This is our big chance to reclaim the Internet. We must not let it slip from our hands," it said in the blog.
"Some desperate spammers are doing their worst to harm our community. They'd like us to back off, and agree to get their spam silently. Needless to say, that is not going to happen. We're not here to listen to their vile threats and fraudulent advertisements. We're here to stand up for our right to be let alone," the posting added.

Posted by: Howie at 09:19 PM | Comments (16) | Add Comment
Post contains 178 words, total size 2 kb.

1 Thanks for reminding me, I need to give my server a security audit again.

Posted by: Michael Hampton at May 04, 2006 09:40 PM (FVbj6)

2 Hosting Matters hasn't responded to my ticket since last night. They acknowledged that a script had been dropped into one of my directories and they SAID they were going to work on it. It's been over 24 hours and whenever I previously sent a status request email, they told me that doing so would automatically put my issue at the bottom of the support queue.

Lovely.

This one was tracked to Cyprus and I saw it on my logs.

I won't give them (HM or the hackers) the satisfaction of my giving up.

Posted by: Aaron's cc: at May 04, 2006 10:20 PM (ov6Vw)

3 I didn't realize it had been down 24 hrs Last to know I guess. Just looked and saw it. Me casa is su casa. I think Rusty would agree. If we can do anything holler.

Posted by: Howie at May 04, 2006 10:37 PM (GRDou)

4 Aaron, is this a wordpress issue? I noticed you were already running the current version 2.02 (security release)
Last time did you export your database to flattext and ensure they did not inject user accounts into it? mysqldump is a quick way to write out your database to flattext to view in an editor, attackers normally leave something behind as a backdoor to get back in.
did you see POST requests in your logs, to some of your scripts? either to attack the script, or upload their backdoor scripts.
You might also concider putting .htaccess/.htpasswd into effect in your wp-admin directory.

Posted by: davec at May 04, 2006 10:38 PM (CcXvt)

5 I use .htaccess and blocked .sa but this was from a different country. The last 5 hacks were different from the first and used, I think, the same exploit left behind as a cuckoo's egg.

I found a file in a directory that was not part of the WP install and I've notified HM to remove it, because I can't, not through cPanel or my FTP interface. It's been over 24 hours and HM is not responsive. Not cool.

The WP user table looks clean.

I'm betting on the mystery scripts that I can't delete.

Posted by: Aaron's cc: at May 04, 2006 11:23 PM (ov6Vw)

6 You probably cannot delete them because they were created by the webserver and owned by nobody/www?
I used to see a lot of that with old CGI scripts that got owned, and files dumped by the attacker in the /tmp directory.

if you know php you should write a script to delete those files, and execute it from the web, which will also run as the webserver and be able to delete those files.

Posted by: davec at May 04, 2006 11:30 PM (CcXvt)

7 just in case you don't know php i'll throw a very simple way to do it
create a file called deletefile.php and put the following in it.

<?php
$badfile="/home/aaroncc/public_html/hackersfile.php";
unlink($badfile);
?>

edit the path to match the file you need to delete in $badfile, you can most likely get your whole path using the 'pwd' command from ftp, then just browse to the deletefile.php on your site, and check via ftp if the hackers file was deleted.

If that file is owned by the webserver (www/nobody/web/etc) it points to active exploitation of software installed on your site to create/upload the files.

Posted by: davec at May 04, 2006 11:50 PM (CcXvt)

8 Dave, it isn't a Wordpress issue, it's a muslim issue. We are living in the last days of civilization unless we wake up and realize that the only way to deal with muslims is to kill them in massive numbers.

Posted by: Improbulus Maximus at May 05, 2006 02:58 AM (0yYS2)

9 sounds like "Hosting Matters" should change it's name to "Hosting only Matters when we can be bothered."

Posted by: davec at May 05, 2006 11:53 AM (CcXvt)

10 Isn't it odd that leftards and 'slamotards use the same methods to quell speech they don't like?

Posted by: Improbulus Maximus at May 05, 2006 06:36 PM (0yYS2)

11 Looking today it appears Aaron may be close to being back up. check him.

Posted by: Howie at May 06, 2006 06:07 AM (D3+20)

12 ok we all can see that aaron was hacked but what we have to do when your blog is under attack ? just wait or what else ? also do someone know where to find all the photos that he had on his site ? coz with some friends we will open hundreds of blog with "aaron" in blog name and we will continue his job but power 1000 times stronger.

Posted by: James at May 07, 2006 01:18 AM (nzUqX)

13 Please james oh what will be do when we are always under attack. Please tell us just who you are James with the poor english.

Posted by: Howie at May 07, 2006 01:34 PM (D3+20)

14 just french guy who dont know perfectly your language but its ok i try to increase it daily by reading news or blog or speaking, by the way i guess it would be fun to hear u speaking french. whatever, about the topic : when blog was hacked what do u have to do ? is the blog coming back by itself at the "normal", also as its possible to make lots of blog u could do if u have many friends the same contents in all that blogs so what the matter if few are hacked ?

Posted by: James at May 07, 2006 08:10 PM (nISDy)

15 James that's fie withteh fatwa and the threats the question where are all the pics on the net kind of feels suspicious. Sorry about that I'm understanably paranoid at the moment. And no I can't speak french at all period. I don't know we have backup blogs so we go there until it's back.

Posted by: Howie at May 08, 2006 07:40 PM (D3+20)

16 aaron if you read this email me I'll give you acess to my blog all you like.

Posted by: Howie at May 08, 2006 07:43 PM (D3+20)

Hide Comments | Add Comment

Comments are disabled. Post is locked.

36kb generated in CPU 0.0263, elapsed 0.0538 seconds.
34 queries taking 0.0374 seconds, 171 records returned.
Powered by Minx 1.1.6c-pink.

Search Thingy

May 04, 2006

Recent Comments