Slashdot Mirror
July 6th - Website Defacement Day?
pabl0 writes "According to an article from SFGate.com (San Francisco Chronicle), a challenge has been posted, inviting web-site defacers to alter the content of as many web sites as possible on July 6th, with an apparent limit of 6,000 websites per contestant. Looks like this would be a good time to make sure all those web-server security patches are applied!"
Yes, let's put this article on Slashdot, so a few million would be hackers can go ahead and deface a couple of hundred websites apiece.
What the hell is wrong with you? This kind of coverage only causes trouble.
Hacking into servers and defacing websites is illegal, whether you like it or not. Doing things like this costs PEOPLE money.
And don't argue back with that "well Microsoft deserves to be defaced" bullshit argument, or anything of the sort. They don't deserve it anymore than you do.
Now watch me get modded down by all the haxx0r n00bz0rz with mod points.
wonder how many millions Homeland Security is going to spend "preparing" America for this one.
. SLASHDOT: Home of the vicious nerd.
Don't do this... Please... For the sake of all that is bad legislation...
Just think of all the very bad things that could happen if this is:
1. Sucessfull
2. Very unsucessful
If the former think of all the good laws that will be inacted. If the later, people will have a who cares attituce about network security.
Both are bad.
Stop posting articles like this... Don't feed the trolls.
Fantasy remains a human right; we make in our measure and in our derivative mode... -- JRR Tolkien
Slashdot has little to do with the defacement. Slashdot is simply reporting this.
Well, I think a large majority of the US schools aren't on a year-round system, so most kids would already be able to do it any day in July without missing school. Next theory, please.
One is reminded of the perpetual debate in security: Whether to post an exploit to a group, in order for the vendor to have incentive to patch it, or wait and hope the vendor listens to you. There are excellent arguments on both sides.
This seems to be little different than that example. The challenge is unethical, as far as I am concerned. July 6 is a Sunday, for one thing--in general businesses do not hold normal shifts on a weekend, so this is going to surely cause more grief than an attack on, say, a Tuesday. Moreover, if successful, this could seriously halt a lot of legitimate business, personal, and other transactions across the Internet.
Is this a call to deface Web sites, or generally screw over sysadmins who oftentimes are paid beans to being with? Shameful.
Given that you're going to do it anyway, why not start with the RIAA, MPAA, and SCO sites. After that, any spammers anyone happens to know.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
As carl67lp pointed out, businesses are less likely to have people who can deal with these attacks on the clock on Sunday than on other days.
~Berj
Flame on, but, I don't think /. should be reporting this kind of story. Aside from all of us story loving, comment posting maniacs, /. does get viewed by our script kiddie "friends." There have been challenges before (as mentioned), this isn't anything new, most of which [however] have not had enough media attention to bother with. Remember the "April Fools Defacement Day" one that a few newspapers picked up on, last April? This is exactly the same thing. The more fuel we give the kiddies, the bigger mess they're going to make...
It's a sad day when replacing index.html is regarded as "hacking". The entire idea that only web servers are worthy of hacking just shows journalistic ignorance worthy of the New York Times.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
After all, we know Micro$oft servers are a lot easier to crack than Linux or BSD servers, so they'll probably take the brunt of this
No, for the millionth time, no. Either system has hundreds of vulnerabilities, with sysadmins too lazy to patch fully. A properly up to date MS, Linux, Unix, BSD, OSX server will be fairly free from vulnerabilites to the same extent.
If you think you're running any more secure than an MS system just because you use one of the alternatives, you're living in a "security by obscurity" dreamworld.
MS systems get attacked more as they have the critical mass worldwide to a) have more people know their faults well, and b) ensure spread of trojans.
Think
Whether we like it or not, Microsoft _has_ done a better job with security now, and Windows has gotten a lot more secure nowadays. Though in my opinion, sysadmins could do a LOT more to protect their Linux systems than their Windows systems (much more stuff is configurable), it is still fact that good security dosn't mean using Open Source Software like Linux or BSD and stopping there, it requires competent sysadmins and being updated about security, as well as using patches and new versions of software.
Or, you could just use NetBSD :)
or does anyone else think that the Feds are behind this challenge, as part of a massive sting operation?
"Freedom means freedom for everybody" -- Dick Cheney
First, these activities do not cost people money, they cost corporations money. I know, I know, this is supposed to trickle down to the individual level to where it hurts consumers. I think that the statement should be that "hacked web sites costs people time". Face it, who wants to come in on a Sunday to fix a hacked web page? Most salaried people receive no overtime for this type of work, so it costs them time. If there is any expense here, it is corporations who foot the bill, which relates to the next point...
Fixing web pages does not cost tens of thousands of dollars. A simple restore of an html page should not be perceived as an activity that puts a company into the red on a balance sheet. I still do not understand how corporations say that a cracker cost them $250,000 when someone replaces their corporate logo with Domokun. Perhaps it is because in reality this money is being spent to patch the holes they should have taken care of months ago? The headlines shouldn't say, "Hacker costs company $50,000 for hacked website!" The headline should say, "Company fails to follow basic security guidelines in patching their servers, costing their mismanaged budget $50,000."
Would I be pissed if my company's website was hacked? Yes. Would I be pissed if I had to take care of massive security holes on my Sabbath day? Yes. But would I accept the idea that it monetarily hurt my employer? No. This way of thinking needs to go.
--Chag
if i can replace your index.html..
i can probably replace or delete many other things. Yeah, still hacking.
I don't think your average web-site defacer has ever been too concerned about the positive repercussions of his or her actions before, and I find it highly unlikely that a competition with their peers is going to jump start their sense of ethical responsibility.
A lot of people in this thread will say that a benefit of roving defacement groups is that it helps to highlight poor security. Sure - In the same way that setting peoples houses alight helps to highlight the importance of changing your smoke detector batteries.
I call shennanigans. This might be a happy side-effect, but if your happy haquer was really concerned with improving security, how hard would it be to find the hole, and then mail the site admin from inside the network boundary, or leave a message somewhere apart from the frontpage and then tip off the administrator?
They could do this. But there's no bragging rights there - and that's what this is all about when you get right down to it:
- Bragging rights and a sense of importance within their peer group ( look at the 'shout outs' that accompany many defacements ).
- Mean spirited embarassment for the victim
and in some rare casesTo answer your question, and echo a sentiment that will probably be seen in numerous other posts in this thread nothing positive will come from this that could not have been achieved by less disruptive, upsetting or destructive means.
As to those who said "Great, MS will bear the brunt of it", grow up. Your mean spirited and childish attitude does you zero credit. Cracker attacks are a menace that have to be faced by all sectors of the computer community, and wishing them upon your rivals smacks of extreme poor taste ( not to mention the fact that most of the actual victims are likely to be non-technical clients of hosting companies who do not understand, wish to understand, or control their hosting solution ).
One god, one market, one truth, one consumer.
Possibility 2: The script kiddies who pull defacements are not, in fact, capable of stealing a shell account.
Probably both.
What I'm listening to now on Pandora...
We make fun of the script kiddies, but you're right, if there are perfectly good exploits out there and you aren't prepared, then you're just being stupid and egotistical. "They'll never get me." will suddenly become "damn, they got my site."
Serious? Seriousness is well above my pay grade.
About 2 weeks ago I was running RedHat. I would have been running around frantically trying to track down any patches I might have missed, version-checking my RPM's...etc etc.
d uper-new-version" of any of my daemons, so there's no problem at all with Deb, despite the arguements of many.
Once I read this I was like "crap crap crap, a whole lotta patching to do"
Then I SSH'ed to my server...
And remembered I was running debian...
apt-get update && apt-get upgrade...
I suddenly feel a lot better about the few hours it took me to make the switchover.
If I were running an MS server I would probably have had a near heart-attack by now. I've never needed the
"newest-most-spectacular-greatest-ever-super
After all, we know Micro$oft servers are a lot easier to crack than Linux or BSD servers, so they'll probably take the brunt of this.
:D
It's asinine thinking like this that causes people to get hacked!
According to this article, 76% of boxes hacked in May were Linux boxes! Only 15% were Windows machines. It's just the simple thought that "oh it's open source, so it's gotta be secure!" that gets people to not update their stuff and get hacked.
Open source security vulnerabilities are just as frequent as Msft's, even moreso. Regardless of what you're running, you need to friggin update and stay on top of the game.
Or, you could just run chroot'ed Apache on OpenBSD.*
*The above statement shows the equal tradeoff between security and speed.
I put it more that is the last day of a Long weekend with many people having the 4th off. So a lot of stuff is going to slid until monday morning.
Just a Tuna in the Sea of Life