Slashdot Mirror
Slashdot Database Compromised!
Today the the Slashdot database was compromised by 2 hackers from the Netherlands. !(Nohican && {}) They secured the hole and send an email to the admins, they even should be reading it now. Update: 09/29 11:04 PM by michael : We know about it, blah-blah-blah. Don't email us. I think it's safe to say that whatever happened, you'll hear the full details soon enough. Thanks.
He's a hole allright. "Security Hole" isn't the first hole that comes to mind though.
I would hope that /. boys coded the whole database so that passwords were one-way encrypted. Then it would be that much of an issue to change your password.
They aren't. If you forget your password, Slashdot will mail it to you (the "mailpasswd" button on /users.pl when you're logged out). Slashdot emails you your password, in clear text. So, even if the passwords are encrypted, they can be decrypted. How else would Slashdot be able to tell you your password?
I pronounce it as "bracketbracket" :)
- Nohican
Let's see what WebFerret (The only way to search the Web!) makes of "nohican"..
[time passes..]
Ha!
Anybody want to drop the joker a line?ps: read his posts; I think from the context, and from the fact that this is the only "nohican" that came back, that...
t_t_b
--
I think not; therefore I ain't®
I'm on PJ's "enemies" list! Are you?
You know that's why they cracked the DB, so they could post with +1 for everything.
:)
Maybe that ought to be a rule - anyone that cracks the DB and does no damage gets automatic GOD karma rating.
Nope. When an exploit is being actively used, you publish details immediately. Especially in this case, where the code can be patched by the end users themselves. (this all assume it's a hole in the slash code of course, and not some other problem.)
Maturity? Obviously you've missed the point of this story, but in any case you seem to have odd delusions about personal property and information security. Regardless of whether the powers that be need to audit their code better, the fact that the site could be cracked in no way justifies the actions of the childish losers who went ahead and broke in. I'll avoid the tortured analogies to an unlocked house, but I certainly expect that polite users will stay the fuck away from my machines, whether or not I overlooked the buffer-overflow-du-jour. I wouldn't for a moment trust any asshole who ended up with a root prompt on a system I use or run without authorization.
I agree with earlier posters that the second-rate pieces of shit that did this shouldn't be sued or legally harassed- have their parents spank them and send them to bed early without dessert. But it's hard to imagine these vandals serving any more useful purpose than as a focus for the contempt of their middle-school classmates.
On E-Bay:For sale ANY /. user account you want. Who needs to purchase a high karma account when you can just buy your enemies accounts and trash thier karma, reputation/image? That's right! Step right up boys and girls. 5r1p7 k1dd135 Inc. will for a limited time only give you access to any account you desire and you may trash away at will:) Call 1-800-urh4x0r3d in the next sixty seconds and we will even throw in a snippet of code that will gaurantee you the same access to any slash based site.
Wait! Theres more! mention OpenSource and we will even throw in a free kernel upgrade and the link to the actual HOW-TO's will also be yours! Here's the best part!!! If you call and say CmdrTaco sent you we will even throw in his account and all the censoring powers that come with it. Imagine, you and your friends can kill off quickies and JonKatz with a single click(TM). /. $authors)
Note to self: IF s/N ratio>=facts(old news +
Prospecting Stinks. Stop Wasting Time on Cold Calling.
I kind of think they blew a great opportunity though; imagine the chaos that would ensue if they inserted a story titled "Linux 2.4 Released!" with a link to goatse.cx cleverly hidden as a link to kernel.org...
- Joe
-Joe
Wait up, man...
Maybe some other sites running the Slash code would like five minutes or so to secure their sites before everyone else in the world knows about it?
Or rather, let's make sure everyone's got the fixes before we go passing around the exploits, ok?
---
pb Reply or e-mail; don't vaguely moderate.
pb Reply or e-mail; don't vaguely moderate.
Yes, this is most likely the best way to find and fix security problems, but we have to be *very* careful about attitudes such as the one you're proposing. What would have happened had Slashdot carried our credit card numbers as well? Would we be as happy that some people were poking around the website? According to the attitude you're suggesting, the answer would be a resounding YES! YES, because there could be other people out there who are malicious and if the hole didn't get fixed this way it could have turned out to be much worse if other people had found it. But the fact of the matter is that unauthorized hacking is wrong whenever it is committed. A blind faith in white hat hackers is very dangerous because there is no telling what their motivations are, no matter what they say. How in the world do you know that they didn't take CmdrTaco's passwords? If /. had credit cards, how do you know none had been taken? Because they told us about the security hole? That is not enough proof. Hell, the best way to commit a crime would be to hack in, steal a few things, and then report the problem. And they would be held up as heros, not hackers because "luckily, the boys at slashdot "get it""
Property is property, period. Just because this is IP, and just because it is on the Internet does *not* make it any different.
Bruce
Bruce
You are the real Bruce Perens.
Okay, so you've hacked Slashdot, fixed the security hole and pulled a classic white hat move which will live in infamy.
What are you going to do now?
We're going to DISNEYLAND!!!
I know what you're getting at and sometimes I do feel that way. Also though, I think it can be a very gray area and IMHO it's risky the way you're going with it.
I'll use the car-in-the-parking-lot scenario. Would I mind someone leaving a note on my car if they noticed one of the doors was unlocked? Within reason, probably not. But do I think people have the right to walk around the parking lot trying to open car doors, just to see which ones aren't locked? Of course not.
There are metaphors everywhere. I can encrypt my email to prevent people reading it. Do I want anonymous strangers to try to decrypt it as long as they promise not to read it? Not really. If I say I don't mind, it gives anyone who wants to break it an easy back-door out of being prosecuted. Imagine what it would be like if govco could get away with saying "we were only trying to show you that your cryptography was faulty. Oh and by the way, we stumbled on this evidence which we're going to use against you.". It always starts with small things, and I can't see why it wouldn't lead to that.
Obviously I'd like to know if anyone stumbles on a way in accidently or sees something by chance, but I'd like to arrange for it to be tested on my own, thank you.
So I guess my point is that if it's ethically okay to try to crack websites etc in the interests of improving security, it suddenly makes it ethically okay to crack them. As long as someone hasn't actually stolen the credit card numbers yet, it makes it okay.
Sure some crackers mean well, but it shouldn't be an excuse to let them off. If they really want to test a site that way they should ask permission first. Let sites decide whether they want everyone trying to break them or not. Most of them will say no, and at that point, what right does anyone else have to force their "better" opinion on another person or company regardless? I've had enough of that from govco and I don't want to start getting it from random unidentified script kiddies.
===
So, let's hear some details. Howdya do it? Remember, we're techies and not magicians; we can reveal our secrets.
----
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
i think something like this truly embodies the hacker ethic (yes, we're talking about the one you hear about in the news :(
Technically, you could sue these guys and have them thrown in prison (with certain international legal asumptions). Luckily, the boys at slashdot "get it." - This is truly the open source of cracking. Finding a problem and making fixing it. I feel like there should be a sign on the front porch of the internet that says "Please leave this place tidier than you found it"
FluX
After 16 years, MTV has finally completed its deevolution into the shiny things network
"It is seldom that liberty of any kind is lost all at once." -David Hume
They claim to be good guys, but there's no proof of it. If you use the same passwords for slashdot as you do for other systems, change them. I realize that it's unlikely that any hacker would pick you out of the hundreds of thousands of accounts on slashdot, but they might. I hope that the admins have stuck a fresh slashdot up online (new box, new install, installed patch for the problem, etc) or are doing that now. If you're hacked, the only ways to know that no trojans are around are to wipe clean and start over, or make sure that you were running the box off of a cdrom disk and you've replaced writable areas. Even doing file digest scans are not trickyness-proof.
Just curious if we'll have a report on what happened and how it was done after everything is cleaned up. With slash being full-open-source, it would be a good way to educate the community.
Not that I think we should expect something in the next hour or anything, but in a week or so, maybe...
I want my membership money returned. Actually, make it 5X my membership fee. What's 5 x $0.00???
Fight Spammers!
Well, I've been a little worried for awhile about the generally poor quality of stories on Slashdot. But finally, something worth reading about.
My mom is not a Karma whore!
Maybe in their quest to l33t-dom, they fixed the obvious bug in Slash. Here's the rogue code:
while(1) { if($c%2==1) { post_article("Cease and Desist Letter to %s","UPCDatabase.com || F---edcompany.com || Napster || FlyingButtMonkeys"); } else { post_article("%s Sues %s for %s","MPAA || RIAA || D:C, FlyingButtMonkeys || Microsoft || 2600, MP3s, DeCSS, CueCat Decoder"); } ++$c; }
I'm surprised no one has caught it yet; it's a pretty big mistake.
#disclaimer.h
I like the MPAA/RIAA/Napster/DeCSS/CueCat/FBM/MP3 stories. I just thought it's fun to get some karma, too.
------------
------------
Tonight on Fox: Deadliest Executions Part XVII
Nohican and {} were unreachable for comment, and when we got in touch with Greyfox, he did the ``Blow Me Dance'' at us. The community declined to comment officially but some members of it said that they were pretty much doing the ``Blow Me Dance'' and ignoring Kenyon and Kenyon, too.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I'm sure hundreds of people have submitted this as a story to the slashdot guys....
THEY DELETED THE FIRST POST!
You bastards!
hehe
...that they also took away the privilege of first post: http://slashdot.o rg/comm ents.pl?sid=00/09/29/0231248&cid=1
and also that the sid uses tomorrow's date.
First Post: Hours of time waiting for a new story to appear
/. article: Priceless
reached the 50 karma cap: Months of posting links to partners.nytimes.com
Look on CmdTacos face when he sees the newest