Web Site Attacks Are On The Rise

Nicholas Roussos writes "According to recent numbers from 2004, website attacks are on the rise, and many of them are being performed by mischevious school kids. Some of their favorite targets include U.S. government and military websites."

Comments

choice quote by Reuters

[Anonymous Coward]

"For the average person it sounds complicated but if you know what you are doing it's really quite easy," he said.

Couldn't that statement be applied to any subject?

Which PR firm generated this story?

[justanyone]

Some would say that most news outside of the main NYT and others is generated by PR firms providiing "information" to reporters in the hopes of getting an article published. I would argue that the interesting thing about this "article" is not that the non-news it contains:

* website attacks are most commonly peformed by schoolboys
* attacks are on the rise
* attacks are commonly politically motivated

This "news" isn't new. Thus, who asked for the article or provided the info in it? Symantec, pushing antivirus software? Cisco, trying to induce worry about security in general and sell their more 'secure' routers? IBM, EDS, Siemens, or someone else, selling E-Commerce security software?

Being a critical reader is not just asking, "is this story true". Nowadays, it's asking, "Why was this story published?"

-- Kevin

There's not more attacks...

[c0ldfusi0n]

There's just more targets.

Worth Noting -- it's not just Windows servers!

[SlashChick]

As the owner of a web hosting company for several years now (and one that stays away from Windows as much as possible), we've noticed a dramatic spike in attempted attacks on our servers in the past 12 months. If you put an unprotected /tmp directory (i.e. one that allows executable files) in a server that's connected directly to the Internet, you're asking for trouble. We've seen these boxes sending out spam or DOS'ing other servers (mostly targeting IRC servers) in a matter of hours from when we put them online. The hackers find some exploit like an old version of phpBB, insecure PHP code, etc. It's really not that hard; if you have several sites on a server, chances are that one of them has something vulnerable in a web-accessible directory. It's gotten so bad that we've devoted part of our standard CentOS install to locking down the /tmp directory so no files can be executed (and explaining this change to our customers.)

Worse yet, the hacks have now turned to running perl or php from the command line on things in /tmp to get around the noexec mount option. The hack works like this:

1) Find exploitable site. (Again, with the number of insecurities in commonly-used programs like phpBB, or god forbid, the *Nuke series, this isn't hard.)
2) Upload perl script to /tmp.
3) Run "perl [script name]" repeatedly to accomplish your goal.

We've again locked down our servers to prevent this, but unfortunately, we can't make this part of our default install because our customers like to run perl and php from /tmp! (Argh.) So we simply educate them and tell them how to lock the servers down themselves, and why putting any scripts in /tmp is a Bad Idea.

It's not just us, either... go to any forum where webmasters or hosting company owners congregate and you'll see this is one of the most common problems out there. Linux is no longer more secure as a web server... not when you factor in most of the PHP programs out there that people love, at least.

Script Kiddies

[digitaldc]

How did they come to the conclusion that many of these attacks are by kids? Just that the hacks spike when school is out? The article really didn't go into much detail.
Nowadays, if you don't protect your website from being hacked, you might as well expect it to be hacked. Maybe they should try hacking Argus systems Pitbull LX and win(?) money.

Re:Careful!

[warpSpeed]

I swear I've posted this like 5 times this week, but ISPs should be held liable for malicious traffic comming from their networks if they don't do anything about it. It's getting ri-freakin-diculous people!

Speaking as the owner of a very small ISP, this is very nearly imposible. How do you define "don't do anything about it"? Which ISP are you going hold liable? The one that sells bandwidth to the offending PC (IP address)? Or the upstream ISPs. What if the middle ISP is multi-homed? Perhaps some guy just left his WiFi open, and a neighbors infected laptop has latched on to it (I've seen this happen). Would the Open WiFi guy be the ISP in this scenario?

It is not just getting "ri-freakin-diculous", it has been pretty bad for quite a while now. With better and cheaper bandwidth becoming more and more readly avaiable the problem will continue to get worse. However the ISPs here are common carriers, they cannot (and I do not want then to) track ever IP packet that travels over their network.

Perhaps you could whip on the OS makers where the majority of these problems originate from?

From the article:

[asoko]

"A lot of 15- and 16-year-old guys are smart enough to have strong political opinions," Roberto Preatoni, Zone-H founder, told Reuters on Monday.

Since when did intelligence become a prerequisite for having strong political opinions?