Slashdot Mirror
July 6th - Website Defacement Day?
pabl0 writes "According to an article from SFGate.com (San Francisco Chronicle), a challenge has been posted, inviting web-site defacers to alter the content of as many web sites as possible on July 6th, with an apparent limit of 6,000 websites per contestant. Looks like this would be a good time to make sure all those web-server security patches are applied!"
Alternate Link for Article: http://www.msnbc.com/news/934055.asp?vts=070220031 125
Yes, let's put this article on Slashdot, so a few million would be hackers can go ahead and deface a couple of hundred websites apiece.
What the hell is wrong with you? This kind of coverage only causes trouble.
Hacking into servers and defacing websites is illegal, whether you like it or not. Doing things like this costs PEOPLE money.
And don't argue back with that "well Microsoft deserves to be defaced" bullshit argument, or anything of the sort. They don't deserve it anymore than you do.
Now watch me get modded down by all the haxx0r n00bz0rz with mod points.
wonder how many millions Homeland Security is going to spend "preparing" America for this one.
. SLASHDOT: Home of the vicious nerd.
I notice the 6th is a Sunday. It would have to be, so all the children can do it without missing school.
July 7th was announced as national handcluffing day when hordes of hackers would be paraded around the streets in major cities.
Siggy Say, Siggy Do
Don't do this... Please... For the sake of all that is bad legislation...
Just think of all the very bad things that could happen if this is:
1. Sucessfull
2. Very unsucessful
If the former think of all the good laws that will be inacted. If the later, people will have a who cares attituce about network security.
Both are bad.
Stop posting articles like this... Don't feed the trolls.
Fantasy remains a human right; we make in our measure and in our derivative mode... -- JRR Tolkien
For M$'s website to have it's DNS pointing to SourceForge instead : )
-Cho
Slashdot has little to do with the defacement. Slashdot is simply reporting this.
Gee, the site promoting it didnt last long - wonder who had that shutdown? Hah... guess they dont realize that publicizing it will only make matters a lot worse and draw more people to it.
This is just really awful. A huge call out for Script Kiddies of the world to unite. Terrible.
*shakes head*
*looks around*
*starts researching latest exploits*
*runs*
Canadian Cynic, canadian politics is less boring than you
Government Warns of Mass Hacker Attacks
Yeah, as funny as I think it is when websites get defaced, and as much as I don't care, this guy is right. What the hell is wrong with you?
I will bring out my honeypot then!
Isn't the challenger here opening himself up to a barrage of lawsuits? Not to mention the participants.
One is reminded of the perpetual debate in security: Whether to post an exploit to a group, in order for the vendor to have incentive to patch it, or wait and hope the vendor listens to you. There are excellent arguments on both sides.
This seems to be little different than that example. The challenge is unethical, as far as I am concerned. July 6 is a Sunday, for one thing--in general businesses do not hold normal shifts on a weekend, so this is going to surely cause more grief than an attack on, say, a Tuesday. Moreover, if successful, this could seriously halt a lot of legitimate business, personal, and other transactions across the Internet.
Is this a call to deface Web sites, or generally screw over sysadmins who oftentimes are paid beans to being with? Shameful.
Page deface!
Challenge - July 6
Please stay away
From the AP article:
"The purported "prize" for participating hackers was 500-megabytes of online
storage space, which made little sense to computer experts. They said
hackers capable of breaking into thousands of computers could easily steal
that amount of storage on corporate networks."
Given that you're going to do it anyway, why not start with the RIAA, MPAA, and SCO sites. After that, any spammers anyone happens to know.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Its in the news, look here.
I would think that the kiddies that deface web sites do it every Sunday anyhow, so I fail to see why this should have any impact.
It's not like people are going to say "gee, I never thought of that! Let's deface web sites on this particular sunday, although we never would do it otherwise!"
But I'm sure that some people find a way to make money (or pork) from this "announcement". *sigh*
Regards,
--
*Art
Why do this? What positives can come out of such an exercise? Granted, the many insecure websites out there will be forced to re-think their security, but it seems to me like a immature and childish way of going about things.
The purported "prize" for participating hackers was 500-megabytes of online storage space
WOOHOO! After all that hacking into thousands of web-sites with who knows how many terabytes of storage, I can now get almost a FULL CD of free web-storage!!!! WOOHOO!!!
Wait, can I still use that in prison?
YOU SUCK BALLS!
At least I'll know when we'll be restoring from a back-up. I really hate being caught off guard...
It's just a massive slashdotting!
(someone had to say it)
I use Macs to up my productivity, so up yours Microsoft!
Given the current state of autogenerated/Over-templated/Flash-ridden crappiness?
I've noted that the domain quoted in the article http://www.defacers-challenge.com doesn't appear to resolve to anything at the moment. Anyone have the IP address for the site?
Regardless, this is yet another challenge that won't produce much of anything useful. Too bad the people participating don't have anything more useful to put their idle time towards (what with so many Open Source projects needing help out there, you'd think these people could find lots of useful places to use their skills).
I'm off to backup the files for my website, just in case...
Yaz.
Please don't feed the trolls.
On the surface, this seems like a great idea. After all, we know Micro$oft servers are a lot easier to crack than Linux or BSD servers, so they'll probably take the brunt of this. But, after it's all said and done, isn't Bill Gates going to point at the Linux crowd, and sites like Slashdot, as having started this? "Hackers" have such a bad name already, do we really want to feed it?
It would be a lot easier for Bill to get media exposure, as he owns CNBC and everything, so I can just see them trying to interview Linux Tovalds and asking him "So how many websites did you and your Free Software friends deface today?" I thank that would be bad for our message.
Nice try, but it seems to me we should focus on more productive things to bring down Micro$oft, like trying to get Linux on the XBox!!!
Cheers,
FtP
Consensual sex is boring.
one wonders if the riaa will be on their 'to-do list.' (er... one hopes)
But don't quote me on that.
"The holiday weekend affords us an opportunity to get away from our workplace, relax and enjoy the summer weather. However, not everyone will be outside in the sunshine. Hackers will be in front of their computer screens trying to get into all of those computers"
I think the thing that pisses me off the most is that they assume that everyone gets to take the holiday weekend. I'm a grad student, I'll be inside working. They're such insensitive jerks sometimes.
Welcome to the 5 oclock news, today is July 7, 2003. This morning, an estimated 9,000 teenage boys were arrested as part of a massive sting to capture the perpetrators of yesterday's massive computer related attack. Investigators have confiscated a record number of computers related to this attack.
Oh, I must have forgot that hacker kiddies only use XScan when preparing to participate in little overblown competitions! And hot damn am I glad that all these bad ass hackers will quit scaning once this competition is over, because I feel vulnerable now.
Wahahah...homeland security...it`s an oxymoron!
July 7th is National Rob-As-Many-Banks-As-You-Can Day. In Canada, the 14th is Kill-Puppies Day. And down in Argentina, the 30th is Moon-Your-Boss-Day.
Not to be outdone, Louisiana has added 37 more days of Mardi Gras, and Brazil has announced Carnival will be from July 03 - July 05.
If /. gets hacked, I'll wet myself laughing.
1. announce web defacement day
2. ???
3. profit
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
New York officials urged companies to change default computer passwords, begin monitoring Web site activities more aggressively, remove unnecessary functions from server computers and apply the latest software repairs from vendors such as Microsoft Corp.
Well it took some doing, but I managed to get that latest Microsoft service pack installed on my web server. It said that it fixed a lot of issues, so I felt it was worth it, even though I run a Slackware 9.0 Linux server. Here's to hoping it reboots alright!
The purported "prize" for participating hackers was 500-megabytes of online storage space
Err, so if they want 500 Mb of free online storage space, why don't they just connect their computers to the internet, install a FTP server and use it as storage? That would grant them hellova lot more than 500 Mb.
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
Registrant:
;)
of, Day (TPEEWXQFBD)
11 Albert Rd
AMITYVILLE, NY 11701
US
Does that place exist? If so *deface that*
I doubt it will be a real address though, however the idiocy of some people does often suprise me!
Taste My Dinner, FAILURE! It's 5/7/5, moron!
Website defacement -
Illegal and damaging.
Still beats going to church.
~Berj
Flame on, but, I don't think /. should be reporting this kind of story. Aside from all of us story loving, comment posting maniacs, /. does get viewed by our script kiddie "friends." There have been challenges before (as mentioned), this isn't anything new, most of which [however] have not had enough media attention to bother with. Remember the "April Fools Defacement Day" one that a few newspapers picked up on, last April? This is exactly the same thing. The more fuel we give the kiddies, the bigger mess they're going to make...
It's a sad day when replacing index.html is regarded as "hacking". The entire idea that only web servers are worthy of hacking just shows journalistic ignorance worthy of the New York Times.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Eh... I think this deserves coverage on Slashdot because it's interesting to people, but I suppose it's also sort of increasing the number of participants in this. Oh well, if you're running IIS without patches you kind of deserve it. =P
-------
"In times of universal deceit, telling the truth becomes a revolutionary act."
-- George Orwell
could make many companies green in the face, considering the new law that jumped into effect not just a day ago....
funnything is about the websites defacement is it conide on same week as terminator3 which skynet get activicated and WWIII starts! intresting thing :-) too bad i do not have own website :-p
Whether we like it or not, Microsoft _has_ done a better job with security now, and Windows has gotten a lot more secure nowadays. Though in my opinion, sysadmins could do a LOT more to protect their Linux systems than their Windows systems (much more stuff is configurable), it is still fact that good security dosn't mean using Open Source Software like Linux or BSD and stopping there, it requires competent sysadmins and being updated about security, as well as using patches and new versions of software.
Or, you could just use NetBSD :)
if on July 6, /. would be defaced and its DNS pointing to the goatse site.
wonder how many millions Homeland Security is going to spend "preparing" America for this one.
Is it really going to cost that much? I mean, I already got my plastic sheeting and duct tape, so now I'm completely immune to all terrorist + hacker activity.
right?
RIGHT????
The theory of relativity doesn't work right in Arkansas.
That goes to the great slashdot troll investigation post. It had something like 500 mods. Indymedia did an article on it, even.
If you think you can take a break from kissing your mother! You can find me at: www.microsoft.com
Disclaimer: Message meant purely in jest, I know you were just seeing if the chocolate pie was really as good as she said it was.
Kind thoughts do not change the world
this is a maps.yahoo.com output for that address
;)
Be warned this could be a totally false address and *not* the bloke who regged the domain, however.....
probably not- but a more accurate title.
.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
This wouldn't work. While it would be a good way of catching people, it's illegal for police to use this approach. It's called entrapment.
Hmmm - defacers-challenge.com is not in the dns anymore.
Could it be someone pulled the plug on our erstwhile dare-devil? Or, was he just slashdotted off the face of the planet?
Enquiring minds want to know...
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
or does anyone else think that the Feds are behind this challenge, as part of a massive sting operation?
"Freedom means freedom for everybody" -- Dick Cheney
It's usually lost amid all the other random graffiti, though with 1300+ posts under my belt, I'm becoming renown for my +5 Funny posts.
Guess what, I'm smart and a smartass. Put that in your pipe and smokit, Taco! ;)
Friedrichs, though, said Symantec's global monitoring network wasn't detecting unusual rectal probes.
Hey...whoever moderated this up as Informative...you apparently overlooked some inaccuracies in the posted article text...maybe you should check your butt too and make sure you didn't overlook any of those probes...
http://www.swimages.co.nz/
Hahahaha.....
Ok, sure, I suppose between nmap, nessus, and a few zero-day exploitz this stuff could generate a bit of a tee-hee among the script kiddies.
Why not raise the stakes a bit...oh, say, by targeting/posting personal info from CA residents where companies would then be required to publicly disclose the breach. A system gets 0wn3d and a company gets a public caning.
Blah blah blah illegal blah against the law blah don't do any of this blah blah.
right both of you have said it, please, what the hell is a handcluff?!
Gee, I'd never have known about this small-time hacker stunt if /. hadn't brought it to the attention of millions. Talk about using your powers for mayhem, /. ...
Kevin Fox
1) Backup your web content (You do do that anyway, don't you?)
2) Apply patches as necessary
3) ....
4) Profit!!!!
This sig no verb.
So, tell me about this lucrative salary thing that happens when I do my postdoc? Fortunately, I do love my research. I just miss the outside when it is light out.
First, these activities do not cost people money, they cost corporations money. I know, I know, this is supposed to trickle down to the individual level to where it hurts consumers. I think that the statement should be that "hacked web sites costs people time". Face it, who wants to come in on a Sunday to fix a hacked web page? Most salaried people receive no overtime for this type of work, so it costs them time. If there is any expense here, it is corporations who foot the bill, which relates to the next point...
Fixing web pages does not cost tens of thousands of dollars. A simple restore of an html page should not be perceived as an activity that puts a company into the red on a balance sheet. I still do not understand how corporations say that a cracker cost them $250,000 when someone replaces their corporate logo with Domokun. Perhaps it is because in reality this money is being spent to patch the holes they should have taken care of months ago? The headlines shouldn't say, "Hacker costs company $50,000 for hacked website!" The headline should say, "Company fails to follow basic security guidelines in patching their servers, costing their mismanaged budget $50,000."
Would I be pissed if my company's website was hacked? Yes. Would I be pissed if I had to take care of massive security holes on my Sabbath day? Yes. But would I accept the idea that it monetarily hurt my employer? No. This way of thinking needs to go.
--Chag
Regarding 'Mischief Night' -
:-}>
In America, we call that 'Weekends' and 'Holidays'...
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
if i can replace your index.html..
i can probably replace or delete many other things. Yeah, still hacking.
Okay, what prize do I win if I deface www.defacers-challenge.com?
:-)
All of their server space?
Mikey-San
Karma: +Eleventy billion (mostly affected by watching Celebrity Jeopardy)
but it's not
the police do this daily. usually, they call up the criminal telling him/her they've won something, and they need to go to such and such a place to claim the prize. presto, back of the cruiser.
vodka, straight up, thank you!
Hmmm...july 3rd...counting down...
;)
;) Those are surely bill-able hours right?
/.'s troll ratio will drop, and IRC will become a pleasant experience....NOT! :^D
But...let's look on the positive side:
Let's say thousands of websites DO get de-faced (w00t - how very unlikely
A) Thousands of extra hours of work created to clean up the mess. (or not - y'all make backups right
And it's on the weekend, wahey! Double rates!
B) All the administrators of web-servers that WERE defaced will HAVE to examine the security of their web-servers. Improvements will HAVE to be made. If 'thousands' of web-servers are forced to improve their security...is that a bad thing?
C) Perhaps a lot of administrators (and PHB's) will notice that the most commonly defaced web-servers were (or are likely to be) those that run M$ software of some sort. Would that make them more likely to switch to OTHER software?
D) Hundreds of lamo script-kiddies prosecuted, jailed and/or permanently disallowed from using the internet. Excellent. Perhaps
On the upside: Finally, a story on slashdot that doesn't involve who's suing who, violating this contract/license, going to court for that.
On the downside: July 8th is more legal babble on slashdot day.
I think you need to go back to Unix 101 to learn about shell commands. No profit for you.
AC Post = 0
total = 0
60% Insightful = +3
total = +3
20% Flamebait = -1
total = +2
20% troll = -1
total = +1
Boy, that was hard to figure out...
Does this mean that I shouldn't flash people with my headlights if they have theirs off like that rumor about ten years ago? What is this? Now hackers are on the level of street gangsters? This is stupid, I can't believe it got news coverage.
my guess is that the 500 megs is just to lure in more script kiddies.. nothing else
SLASHDOT News for scriptkiddies. Stuff that 1337
d035 7hi5 100k 1ik3 4n l337 5i6 2 j00 ?
It's like the Simpsons' episode where the police called all the scofflaws and told them they won a boat.
"Stop throwing the Constitution in my face, it's just a goddamned piece of paper!" - George W. Bush Nov. 2005
Is this a call to deface Web sites, or generally screw over sysadmins who oftentimes are paid beans to being with? Shameful.
Maybe if hundreds of corporate websites get defaced so easily, they'll actually wake up and START hiring more qualifed sys admins for a decent salary, and STOP over working those they have now.
Sometimes what a problem needs is a good exposing in order for someone to start fixing it. If everythings going along AOK where's the incentive for a business to change the status quo?
to see my website defaced on my BRAND NEW TOSHIBA with 17" SCREEN!! YEEEEHAAAA.....
Looks like they lost their own contest already..
[4:30pm]jnichols@cheese% host www.defacers-challenge.com
Host not found.
[4:31pm]jnichols@cheese% host defacers-challenge.com
Host not found.
[4:31pm]jnichols@cheese%
In your title, you make a pretty understandable spelling mistake with the word "wrecklessness"
.,'"`'.,.",:,.'"".,.
The correction to your spelling is similar to the correction many people worldwide would like to make to the US government: Drop the 'W'
I can see where the idea of "wrecking" things would lead you to "wreckless" behavior, but this is incorrect. Dictionary.com lists the origin of 'reckless' (its correct spelling) as:
"Middle English reckeles, from Old English rcelas. See reg- in Indo-European Roots."
Perhaps this is a pun, GrammarFairy is often humor impaired, but I provide this information for the public benefit as well.
Grammar Fairy Dust for you:
-GrammarFairy
Y2K was not 'a' bug, maybe, but it was definitely a serious of 'bugs' (or 'features', if you really prefer).
And, if you want to get technical, ILOVEYOU wasn't really a virus, in that you had to spread it yourself. It was more of a social engineering incident than anything, or maybe a trojan.
Or actually, a poison. It was the equivalent of sending out a bunch of free cans of Coke to people that instead released a bunch of nerve gas and hurt the surronding individuals.
Oh I'm sure a few sites will be defaced by the kiddies, but it won't amount to any serious damage. And if they choose to target the /. enemies (RIAA, MPAA, etc ... more power to them.
I'm too lazy to compose a creative sig.
well we all deplore security by obscurity... but at the same times constantly look over our shoulder to make sure that our services are secured. Time for the real security experts to stand up and little boys to shut up and get out of the way of real men/women.
why did you post this on /.? now tons of computer-literate people will see it, doubtless increasing the amount of pages to be taken down. Maybe not by much, but I'm sure it will happen. Like troop locations, it might be interesting news, but best kept under wraps (raps?)
www.defacers-challenge.com doesn't resolve for me. Does someone have a mirror or the IP?
(Just curious. I'm not a hacker.)
How to lock down a server:
Don't use remote administration. Your system is then only as secure as your password.
Use a router. Never put your system right on the wire no matter what OS you're using.
Block all ports that you don't need the whole world to see.
Don't run services that use OS accounts. The accounts used to log into the FTP, SMTP, and POP3 servers on my server have absolutly nothing to do with the accounts used to log into Windows.
It'll be interesting to see how many lame attempts are made to haxx0r my server considering it's running Windows 2000 and hasn't been patched since January (oooooops. Did I say that?).
Ben
Work Safe Porn
A hacker puts Netscape or even Mozilla up for download on the M$ front page.
Coincidence? I think not!
~S
Too funny...
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
Might it be a big coverup from some real blackhats to disguise their own traffic whilst hacking some evil (tm) company/government/whathaveyou?
The release of a new worm also comes to mind...
The best weapon of a dictatorship is secrecy, but the best weapon of a democracy should be the weapon of openness.
About 2 weeks ago I was running RedHat. I would have been running around frantically trying to track down any patches I might have missed, version-checking my RPM's...etc etc.
d uper-new-version" of any of my daemons, so there's no problem at all with Deb, despite the arguements of many.
Once I read this I was like "crap crap crap, a whole lotta patching to do"
Then I SSH'ed to my server...
And remembered I was running debian...
apt-get update && apt-get upgrade...
I suddenly feel a lot better about the few hours it took me to make the switchover.
If I were running an MS server I would probably have had a near heart-attack by now. I've never needed the
"newest-most-spectacular-greatest-ever-super
...and my agency is spending exactly zero dollars on the software (Apache 2.0.46 update from very slightly previous version of Apache2 running on FreeBSD 4.7 on a 7 year old Proliant 5000 PentiumPro 200MHz hand-me-down server) and spending almost zero dollars on labor, since I'm a salaried employee who gets no overtime, only comp time off, and it's taking me about an hour and a half (after normal working hours) to download the new version, back up all my website data & configs just in case, and compile/install/test the new version of Apache.
:-)
Now lets just hope the Apache team have made 2.0.46 as hackerproof as possible
I fell pretty confident about my webserver now. How do you feel about yours?
As the article said, the site was pulled at the behest of law enforcement. That's why the site won't load. It hasn't been /.ed.
Zagreus sits inside your head, Zagreus lives among the dead, Zagreus sees you in your bed and eats you in your sleep.
this article will probably read "July 6th - NE0258 RUL3Z"
1. Most everyday people have no idea how much 500mb of storage is. Saying something like that is an insult to the real hackers online.
2. The more stories the govt security groups cook up about the Phantom Menace the more they
can represent themselves in a useful light.
3. There are rumors going around that FBI undercovers could be training underaged script kiddies to cause havoc, since they are easier to corrupt. (unfounded rumor/speculation dept)
4. The govt will use any means necessary to spread FUD about the internet so they can gain more control over it policing. The black boxes that were installed the day after 9/11 are a testament to that. Its taken them how long to catch up to just a fraction of what most people do online? Think about it.
5. If somebody wants to a group to deface 6000 web sites, they aren't going to put a target on their own heads by advertising it. The isp might not disclose who it is but they don't need their disclosure to get the info because of the Homeland Security Act. so why bother advertising that.
Cold-War tactics still apply people. Look how easy it is to spread FUD these days. Internet Security has only come into focus since the dot-com boom & decline. I could say more but this post would last forever. People easily forget the past. And sensationalizing articles like this is just adding more fuel to the fire.
Slashdot has become a media-hog now, get with the program people. Mod me down suckaz.. You know u want to.
this sig is classified..how about yours?
That was about the time I gave up on slashdot as a serious news source!
Not Meta-modding due to apathy.
Gotta love this quote from Oliver Friedrichs, at Symantec:
Home Internet users, who typically do not operate Web sites, probably would not be affected directly, said Oliver Friedrichs, the senior manager for security response at Symantec Corp.
They were shut down by their ISP (Affinity), but I still have the English version in my cache from an earlier viewing:
http://www.insecure.org/tmp/defacers-challenge/
Note that Insecure.Org DOES NOT in any way condone or promote this so-called challenge. I'm just providing the link so people can see what the fuss was about. I'm planning to add a note to that effect to the top of the page in a few minutes. What I found most humorous is that they ask people to register in advance by sending in their contact info. That is a really great idea :).
-Fyodor
Concerned about your network security? Try the free Nmap Security Scanner
x
And be sure to change your passwords. Love, sex, secret, and god aren't very secure.
Sometimes people have to be burned before they will respect fire extinguishers.
;)
Our main webserver got hacked just last weekend. It was a RedHat 7.2 that was up for about 450 days straight and was kept pretty well patched. Unfortunately, some custom Apache stuff kept us held back on patching httpd. I guess it really does only takes one weak link in the chain. Once they got in, they put in a rootkit called ZK and started setting up a hidden webserver where they were trying to sell web space on MY box.
Lucky for me, I had a couple of cron jobs in place that used a hidden copy of tripwire and chkrootkit to check for intrusion and shutdown the network interfaces after they mucked around with sshd and the known hosts file. A cheap trick, but it worked.
I'm actually glad it happened. My boss and all of upper management are finally taking security seriously, and I'm milking it for all its worth. Its basically a blank check to lock down the fort. We've eliminated 75% of static NATs, shoved things off the LAN and onto the DMZ, closed dozens of ports, sprung for RHN subscriptions, eliminated several old NT4 servers, and generally did away with all the "convenient hacks" our engineers insisted on.
After seeing this submission published, I noticed several folks who mentioned the very good point that by posting this, I may very well be drawing the attention to the contest that would make it a "success". I essentially responded to this via a newly posted article on my site, but thought it was worth posting here as well, so that hopefully my reasoning will make more sense. (Article Follows.)
Thanks,
Paul Robinson
gotclue.net
1) Register domain with a discount webhoster
...
2) Upload a stupid hacking-contest website written in bad english
3) Make frontpage news, trigger homeland security defense program
4)
5) Profit?!?!
--- Eat my sig.
What I don't understand is why I'm reading "advisories" from the FBI, ISS, et al on MSNBC, Cnet News, SF Gate?? Why arn't they talking to the System Administrators via a known mailing list (or their own mailing-list)??
This seems to be either 1) sent out early by mistake, or 2) ISS and the FBI seeking publicity again. Can't see any other reason.
The San Francisco Chronicle are inviting burglers and property defacers to alter as many homes and businesses as possible on july 7th, with an apparent limit of 6,000 properties per contestant. Looks like this would be a good time to make sure that your private arsenal is fully functional, loaded and well stocked with ammo and your Doberman Pinscher has an elastic band around its private parts in preparation for the fucked-up "friendly" fire-fest! See you in the shit!
Can we say, honeypots? Let's go catch us some h4x0rz!
Your points are all somewhat idealistic... it's obvious you haven't yet fallen under the cynical yoke of the real world yet. Let's disabuse them one by one shall we?
A) July 6th is a Sunday... which leaves all of Monday through Friday as "Official Cleanup Week". Last time I checked, M-F didn't fall under "weekend".
B) This is the real world we're talking about.
C) See (B).
D) See (C).
I browse Slashdot at +3, Funny
Buffy Search
Maybe this will scare people into securing their web servers (e.g. possibly less Nimba traffic and whatnot).
http://www.archive.org/details/ThePowerOfNightmares
I got debian stable on mine. Come on Big BOYZ!
Sigs are dangerous coy things
nt
I can't say that I like the idea...
How long will it be until such days of lawlessness bring us to "Hunt Down Minority X day"?
I don't know the meaning of the word 'don't' - J
Sunlight is overrated.
...and trust me, they are suffering enough - defacing it might actually be an improvemnt (didn't you ever see the Amityville horror??)
Sound waves should be free!
After all, we know Micro$oft servers are a lot easier to crack than Linux or BSD servers, so they'll probably take the brunt of this.
:D
It's asinine thinking like this that causes people to get hacked!
According to this article, 76% of boxes hacked in May were Linux boxes! Only 15% were Windows machines. It's just the simple thought that "oh it's open source, so it's gotta be secure!" that gets people to not update their stuff and get hacked.
Open source security vulnerabilities are just as frequent as Msft's, even moreso. Regardless of what you're running, you need to friggin update and stay on top of the game.
Or, you could just run chroot'ed Apache on OpenBSD.*
*The above statement shows the equal tradeoff between security and speed.
Perhaps i should give my root-account a password?
It looks as if someone got in on the act early and targetted our beloved Slashdot.
Huh? Whassat? This is a redesign?
Years waiting for a more user-friendly layout and this is the best that they could come up with?
You'd think that they could have come up with something better. After all, it's not like they spend their time checking for dupes, hoaxes or even simple spelling errors.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
Slashdot may have informed a bunch of hackers about Defacement day, they are also informing a large number sysadmins who will check their weekend back ups and prepare for a Sunday in the office.
Of course, the smart thing to do is to deface your own web site, then you can take the weekend off 'cause the hackers will think you've already been tagged.
It's still annoying
ZUUL.
Oh I can't help loving you, fyodor! ;) eliza
This thread is too old for this reply to really get seen; but I'm suprised this hasn't come up yet ...
Isn't it the 9th already?
So wouldn't we already know whether this happened or not ?
Anyone got the addy of the defacement contest page???
Zone-H has released a press release about it. Read it here.
"The FBI is taking this very seriously," FBI spokesman Bill Murray said. "Hacking is a crime and those who participate in this activity will be investigated and brought to justice."
Bill then claimed that July 6th would never arrive for him as he is forever stuck on Groundhog Day. He then shot himself in front of reporters.
Need Free Juniper/NetScreen Support? JuniperForum
I don't have my own hosting, I just use the space verizon gives me, but I am not all that confident in the security that they provide, so I just make sure I have an up to date back of my web site, so if it is defaced I can put it back up.
The fact that the website is offering a prize is a case to prosecute the creators. I'm not a lawyer.. yet I think that rewarding an illegal act is called solicitation. In all states this is an illegal act that would be prosecuted by usually charging them with the same crime and reducing the class of the offense by one level. I hope they arrest and prosecute the moron who placed the site.
2) ???
3) PROFIT!
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
Hehe, I think those hackers have been having a little test run...and hacked /. look...what's going on with that new nav-bar...why, it's almost easy to use, well laid out...and looks nicer than the "text hump" b4. ;o)
I am NaN
Who dun gone and defaced /. already?
Oh, it's like this all the time?
Nevermind . . .
This seems to be a way of ruining everyone's 3 day July 4th weekend. Gosh, we all need to be at work checking all the servers, etc, instead of spending a long weekend with the family. Let's post a website and cry "wolf" about hacking. Watch everyone run in circles. I'll bet the crackers are taking a long weekend off enjoying themselves.
It's Skynet, assuming control! There is no physical "core"-- it's just SOFTWARE! The missiles are about to start flying!!!
Good thing John Connor is in that fallout shelter with Claire Danes.
Ooops, I guess those were T3 spoilers. My bad.
The Department of Homeland Security said Wednesday it was aware of the hackers' plans but did not expect to issue any formal public warnings. The Chief Information Officers Council, part of the Office of Management and Budget, cautioned U.S. agencies and instructed experts to tighten security at federal Web sites. "Frankly, hacker challenges occur frequently, and we don't think they all rise to the level of a warning," Homeland Security spokesman David Wray said. Is it just me, or aren't there more rumors of terrorist attacks than hacker challenges on a daily basis?
If there are any spammers in michigan, chances are good they're jackasses with sports cars, since michigan is crawling with jackasses in sports cars.
Thanks, you are -so- da man.
Well, I also thought Defacement Day could be a good income opportunity. Web Admins could charge something like a hundred bucks then put whatever marks a hacker wants on the site. It would be a good way for cashed strapped sites to make a few bucks. The hacker could brag. If you play the game right, the might get some free publicity.
The only real problem I see is that I don't know if I would trust that the hacker I am dealing with gave me a legit credit card (it is really easy to steal credit card numbers at the local restaurant). Oh well, too many good ideas fall apart when you get down the the actual exchange of cash.
With all due respect: this is about more than just loss dollars.
Dissent is what protects us from the type of complete control that large corporations and certain governments would love to have.
What's more, humour is worth something too!
Perhaps you should consider that business is essesntially evolved to consume vast amounts of resources to exaggerate economic growth so that more resources can be consumed (why do you think it's called busy-ness?)
So a little disruption is worth a whole lot of political freedom... and it's fun!
Throttle the traffic. Only allow normal information in and out.
Monitor the traffic
Know your pads. One time pad: good for cryptography. Two timing pad: where to take your mistress.
Add verses, mix and rearrange to taste. These crappy lyrics are hereby placed in the public domain:
----
She had a fast machine
she kept her modem clean
she was the best damned hacker
I had ever seen.
She knew the best exploits
Defacing major web [soites???]
0wn1ng IP addys
both left and [roite???]
She got a password prized
just by battin' her eyes.
She was social engineering like my oh my.
Now my hard drive's shakin,
the network's quakin'
For caffeine I'm achin'
and she's still breakin' in and you
Hacked me all night long.
She DOS'ed me to a crawl
Broke through my firewall
she set me up the bomb
and then I took the fall.
Circ and Nimbda too
But she still wasn't through,
she launched Anna Kournikova
and "I love you!"
Now my hard drive's shakin,
the network's quakin'
For caffeine I'm achin'
and she's still breakin' in and you
Hacked me all night long.
[repeat as necessary]
You want the truthiness? You can't handle the truthiness!
They should hack the computers that serve up welfare, that way the losers that do this don't get their check on time.
In my humble opinion as a web-designer, Nooooooooooooooooo!!!!
Yet every damn Slashdot story that links to an AP or Reuters written article (usually crediting the article to whoever is posting it in the Slashdot headline), some karma whore who doesn't RTFA links to the same story at another newspapers website (crediting the story to that paper). And then some idiot moderators who also don't RTFA mod it up as "Informative".
RTFA people! And give credit where credit is due. If AP wrote the story, say that when you submit the story to Slashdot.
I'm going to 0wn slashdot on defacement day! 1 g0tz teh 1337 haXor sk1||z!~
====
Crudely Drawn Games
boring
OpenBSD 3.3 .... $40
Router w/NAT.... $100
Portsentry set on Anal mode....free
Sending Script Kiddies to /Dev/Null....Priceless
For everyone trying to Crack, there's jail time.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
you have been trolled.
Look at it this way: Your Web site has the back door unlocked and wide open. You don't know that, but it's true. Would you rather find out on National Defacement day, where the probable goal is just to deface your website some? Or would you rather find out when some other nefarious activity happens later-- like cracking into your customer credit card database or something?
for a personal website. Aside from wasting bandwidth on Nimda and Code Red blind attacks you're just asking to be scanned. I run three sites and two Groupware web access sites out of my home network and I've never seen a valid reason to have any of them sit on port 80.
really. I tried
defacers-challenge.com,
deface-challenge.com
I tried searching for them on google. nothing.
are we sure that it is not a big joke? I couldn't even find the DNS entry for that domain! And I haven't see a working link anywhere.
But maybe I'm wrong..
-- There are two kind of sysadmins: Paranoids and Losers. (adapted from D. Bach)
This is quite an interesting development, especially after California's Security Breach Information Act just went into effect. If you want a concrete example of how a hacked website could cost people money - think about this. Not only is time lost in recovery of the site, but money is spent to notify people of the break-in, and customers may be lost due to security worries.
What the heck is that? I'm in the UK and I've never heard of it. Are you talking about Halloween?
:-)
If not, I'm going to assume you're from someplace like Bradford. THE REST OF THE COUNTRY IS NOT LIKE THAT!
OK, now that Kevin Mitnick is out, my bets are on him!
Read Dean Ing's novel Getting Thruogh
Diplomacy is the art of saying "Nice doggie" until you can find a rock. Will Rogers
Thanks alot assholes, it's bad enough that I have a boss that's making me work on days that the rest of the company is off, now I have to spend my birthday worrying about whether I'm going to have to restore all of the websites on our system. Happy Birthday to me.
Me too.. Never heard of it.
The only references I can find on Google say it's a US phenomenon, not UK (there's a good explanation of it on alt.culture.us.1970s).
First rule of Mischief Night: Don't talk about Mischief Night.
google
Mark my words - nothing will happen. Come Monday, they won't even mention it on the news. It won't be being discussed on Slashdot, or, if it is, people will be begging someone to come up with even a single screenshot of a defaced site. Nothing will happen. No sites will be defaced. This is just some kid who put up a goofy webpage that was taken down within a few hours - there is no organization of hackers preparing to unleash a coordinated attack on our web servers. There's just us. Trust me, this is being blown waaay out of proportion.
Nothing will happen. Not a single site. Nothing.
Like woodworking? Build your own picture frames.
Maybe its a joe-job?
There have been numerous patches to the kernel in 450 days since then. Are you sure you weren't vulnerable? Unless you're willing to reboot on a regular basis, keeping the rest of the system patched is close to kidding yourself.
Stop the brainwash
A lot of people will be out on vacations, such as myself.. and if my cell phone rings, I won't be answering.
I am not sure if you really got the concept of opportunity cost: take a look at some definition here.
Return To Fetch Assholes? Rudely Tickle Free Apples? Regulate Three Fat Americans? Rummage Through Farting Anglos? Relocate The Fighting Armies? Reestablish Trouble For All? Resolve To Forget Anything? Rimjob Titties Farthead Assmaster?
We're just a plain ordinary bureaucratic local government administrative office and have no call center. There is nobody else in our entire organization who even knows what SSH is, except me, and sshd only answers on the interior network nic's address anyway. And like I said earlier, only port 80 and DNS traffic from the outside world can get in to the webserver. The only internal network traffic that can get to it comes from my workstation, and yes we do have a cute blonde secretary who authors our webpages, but she really is so clueless that she can't even manage to FTP her work to the webserver over the internal net, so I just have her drag-n-drop it to a folder on an internal NT server and I FTP it to the webserver myself. We have no pimply-faced kids working here either. Everyone who works here is so old and technophobic that it took me 3 years to condition them to use email instead of typewritten (yes, typewriters -- at least they were electric typewriters) memos.... the first year was a transition period to using word processors to make the paper memos. LoL!
No, I'm pretty sure my only vulnerability will be in any undiscovered problems in Apache 2.0.46 and BIND 9.2.2 from the outside.
Goddamnit, they don't need to be defacing websites now, they need to be hacking into the alien ships with all of their l33t virii so Will Smith and Jeff Goldblum can deliver a nuke to the mother ship and save all of humanity.
Oh, wait...
Gabriel Ricard
maybe on weekend furlough from juvenile detention?
Apocalypse Cancelled, Sorry, No Ticket Refunds
http://blackhawkranch.net/
July 6th - Website Defacement Day?
No! That's wrong. It's more like Canadian Independance Day July 1st, United States of America Independance Day July 4th, Internet Independance Day July 6th. Have some respect people, celebrate on these days, every year!
If anyone is wondering why we should celebrate world wide real time communications, think about this.
10,000 Years ago the Bog People lived. They had coins, hand tools and life was pretty well the same for 9,000 years.
Real dramatic change only occured within the last 200 years of human development. Within this time frame of + / - 150 years, we've gone through incredible advancements.
Once Electricity was aquired life changed forever for the human race. All of our other technologies began to build in place.
Industrialization, Engineering, Assembly Line, Automation, Robotics.
Telegraph, Radio, video, broadcast, Realtime, computers, email, cellular, Internet.
Medical Science has advanced so far that people from 100 to 150 years ago would consider it to be an act of God. Not to offend any of the Gods, its just a simple fact, when we can perform heart lung transplants and other similar interventions.
Aerospace,
Personal Flight, Drone, Rocket, Satelite, Flights to the Moon, Flights to Mars.
The Bog People were presented in the Canadian Museam of Civilization. 10,000 Years was represented as a piece of wood about 5 feet long. The last 200 years, was about 2 inched on that timeline.
Do the Right Thing!
Celebrate Internet Independance Day July 6th, 2003.
We have accomplished great things recently and every July 6th we should celebrate it.
That this press release serves only to do three things:
1) panic the general public - half of whom hardly know what a web page is anyway - in order to justify the existence of the Department of Homeland Security.
2) promotes the hacker web page in question beyond the wildest wet dreams of the 16 year old cyberpunks that run it.
3) pretends that a bunch of 16 year old punks armed with what essentially amount to spraycans and lockpicks have anything at all to do with national security.
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
I work for a large European government and we've decided to take the server down befoer we leave tonight and go have ourselves a nice weekend.
Here is some info on the people who registered the domain name defacers-chanllenge.com that started this whole mess.
11 Albert Rd
AMITYVILLE, NY 11701 US
Administrative Contact:
sotaa@wongfaye.com
11 Albert Rd
AMITYVILLE, NY 11701
US
631) 842-5471
Technical Contact:
Affinity Hosting, LLC (TS1126-ORG) contact@AHNET.NET
16611 S. Vermont Ave
Gardena, CA 90247
US
310-354-2626 fax: 310-354-1592
Notice that there are some email addresses in there. Why not email the script kiddies and let them know that they are doing is stupid, and will give legit hackers a bad name.
http://www.samspade.org/t/whois?a=defacers-challen ge.com&server=magic
follow this link to get all the contact info for the individual that registered defacers-challenge.com, the site that started all of this. There's phone #'s and email addresses, so contact these script kiddies and let them know that what they are doing is stupid. Bringing even more media hype against legit hackers.