Web Site Attacks Are On The Rise

Nicholas Roussos writes "According to recent numbers from 2004, website attacks are on the rise, and many of them are being performed by mischevious school kids. Some of their favorite targets include U.S. government and military websites."

Comments

Top 5 attackers

[Virtual Karma]

Here is a list of top 5 attackers of Indian websites:

AIC - 166 defacements - 21.28%
GForce Pakistan - 116 defacements - 14.87%
Silver Lords - 101 defacements - 12.95%
WFD - 59 defacements - 7.56%
ISOTK - 17 defacements - 2.18%

Attack or Compromise?

[kevin_conaway]

Both articles from the summary indicate that the attacks on the the U.S. govt and military computers were just that, attacks. Anyone have any info on whether these were successful attacks or not? The Zone-H website is running a little slow to figure it out.

Re:No surprises there, then

[DrEldarion]

Why should ISPs be responsible? Would you blame a phone company for people using their network for phone fraud? No. Would you blame a car manufacturer if somebody crashed into you in one of their cars? No.

Why should ISPs be different? They shouldn't be responsible for what people do (or don't do) with their product/service. The people themselves should be held responsible. ISPs are just another carrier, and as soon as you make them take responsibility for things that happen to take place on their network, everything goes to shit.

It's funny that when everyone's talking about hacking attempts, people here say that the ISPs should be held accountable. But when talking about P2P? No! They're just common carrier!

Re:No surprises there, then

[Tassach]

On looking at the weblogs, it looks like 80-90% of all traffic is attempted hacks

If your traffic pattern is like mine, 99% of these "hack" attempts are really IIS worms trying to propegate. It's sad to say that after nearly 4 years NIMDA, Code Red/Blue, and their spawn are still a daily annoyance. As long as you don't have an unpatched IIS instance open to the world, these attacks are no threat.

The worms were polluting my weblogs so badly that I had to set up conditional logging in Apache to send them to a seperate log:

SetEnvIf Request_URI "^/c/winnt" ATTACK
SetEnvIf Request_URI "^/c/winnt" NO_LOGACCESS
# etc
CustomLog logs/attack_log common env=ATTACK
CustomLog logs/access_log common env=!NO_LOGACCESS

<Location />
Order Allow,Deny
Allow from all
Deny from env=ATTACK
ErrorDocument 403 "Worm Attack - Access Denied"
</Location>

Re:Worth Noting -- it's not just Windows servers!

[jangobongo]

Zone-H has a continuously updated chart on their front page that tracks today' verified attacks thus far:

225 single IP
352 mass defacements

Linux (67.2%)

Win 2000 (17.3%)

Win 2003 (6.8%)

FreeBSD (5.4%)

SolarisSunOS (2.3%)

Win NT9x (0.7%)

NetBSDOpenBSD (0.2%)

[other]... (0.2%)

Re:Slashdot is constantly being attacked

[eno2001]

I think some schoolkids had modpoints. Bad schoolkids! Bad! Get back to class before we bring out the cattle prods! Else you won't amount to much when you grow up. Only time will tell...

Re:No surprises there, then

[YrWrstNtmr]

Speaking of which, why is it that ISPs don't want you to host your own mail server/web server/ftp server etc.?

Because they want you to buy their busine$$ cla$$ service if you do all that stuff.