I think scrolling down that was more suspenseful than any book I've ever read :)
Astalavista.com hacked, including details
11–20 of 68 posts
Re: Astalavista.com hacked, including details
#12Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups. For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer…
Brutal indeed. Not only did they expose all aspects of astalavista, they actually trashed and dropped everything. As bad as astalavista is, is it right to reciprocate and trash their server? It seems as if the hacker sunk to their level. Are there legal ramifications to something like this?
"Are there legal ramifications to something like this?"
Uh, yeah, of course. Good luck catching them, though.
Re: Astalavista.com hacked, including details
#13Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups. For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer…
I'm thinking I was not the only one reading the title as altavista.com and I was really shocked.
Thanks for the background info on the site.
Re: Astalavista.com hacked, including details
#14Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups. For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer…
They did have off-site backups, which the hacker found and erased.
One strategy that I employ to mitigate this is to have my backup service connect to the production server, rather than the other way around. That way if your production services are compromised, your backups remain untouched (on a machine that's running no services, behind a firewall, etc, and for all intents invisible).
Re: Astalavista.com hacked, including details
#15I think scrolling down that was more suspenseful than any book I've ever read :)
mysql> drop database ... (x9 databases)
My jaws literally dropped when I got to that part.. that's gotta suck, even for a crude site like Astalavista.
Re: Astalavista.com hacked, including details
#16That was painful to "watch" happen to them. Lesson learned. Do NOT f * with hackers...
Yes and the fact that there are always smarter people with more time on their hands than you out there on the internet.
Re: Astalavista.com hacked, including details
#17Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups. For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer…
It looks like they first buffer overflowed Litespeed to spawn a shell (which was ironically running as a user 'apache'). The http headers that are being returned from Astalavista are consistent with this theory (in addition to the obvious output of the first binary run). Apparently Litespeed has a pretty dodgy security record after doing a cursory search.
Far more interesting was the root escalation exploit. 2.6.18 is a relatively recent kernel, and I haven't heard of exploits publically disclosing something of that caliber. Has anyone seen anything on securityfocus/bugtraq/milw0rm etc regarding this?
Re: Astalavista.com hacked, including details
#18I think scrolling down that was more suspenseful than any book I've ever read :)
mysql> drop database ... (x9 databases) My jaws literally dropped when I got to that part.. that's gotta suck, even for a crude site like Astalavista.
Not as bad as where they found the backup plan in the bash history, FTP'd to their remote backups, and deleted them all...
Re: Astalavista.com hacked, including details
#19Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups. For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer…
I'm thinking I was not the only one reading the title as altavista.com and I was really shocked. Thanks for the background info on the site.
I definitely read "altavista" at first too having never heard of astalavista until now.
Re: Astalavista.com hacked, including details
#20Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups. For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer…
It looks like they first buffer overflowed Litespeed to spawn a shell (which was ironically running as a user 'apache'). The http headers that are being returned from Astalavista are consistent with this theory (in addition to the obvious output of the first binary run). Apparently Litespeed has a pretty dodgy security record after doing a cursory search. Far more interesting was the root escalation exploit. 2.6.18 i…
There's a nasty bug in the vmsplice() syscall in anything from 2.6.17 to 2.6.24.1. Exploits have been public since early 2008.