Slashdot Mirror
Cryptome Hacked; All Files Deleted
eldavojohn writes "Over the weekend, the whistle blowing site Cryptome was hacked and vandalized, resulting in all 54,000 files being deleted and two days worth of submissions lost. Cryptome reported that its EarthLink e-mail account was compromised in ways unknown, and once the attacker was inside there, they were able to request a new password from the administration console for Cryptome at their hosting provider, Network Solutions. Once the attacker had that password, they deleted the ~7 GB of data that Cryptome hosted in around 54,000 files. Cryptome was able to eventually restore the site, as they keep backups ready for cases like this and stated that they 'do not trust our ISP, email provider and officials to tell the truth or protect us.'"
Holy cow, please edit the submissions before posting them.
*sigh* I'll get modded down for having the nerve to ask for a baseline of professionalism, won't I?
The real WTF here is that
A) Cryptome is running on Network Solutions
B) The email associated with the account is on *earthlink* ???
C) None of these things have been shut down.
Seriously, doesn't cryptome host some pretty shady stuff? On the same level as wikileaks, isn't it? What the hell is going on here?
NewslilySocial News. No lolcats allowed.
stated that they 'do not trust our ISP, email provider and officials to tell the truth or protect us.'"
Just like I wouldn't trust you not to pull something like this for publicity's sake, but I guess in both cases, no one will ever know, so its moot.
Basically this stuff was never safe to begin with, and you're an idiot if you post anything there expecting to be anonymous.
Airplane Photos, Airline News, Planespotting Guides
Seriously, back up your data. Multiple copies in multiple locations.
These guys were smart enough to keep backups (hopefully up-to-date backups) so this is nothing more than an annoyance to them, but if they hadn't it would be what we refer to around here as a resume-generating-event.
If it's worth keeping, its worth backing up.
"You want to know how to help your kids? Leave them the fuck alone." -George Carlin
Your high profile site got hacked and you blame everyone else.
Well you did pick your ISP and email provider. Honestly folks might I suggest RackSpace? We use them and they have been great if a little expensive but you get what you pay for.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
The controversy about hacker vs. cracker is old and unsolved. But this case really does not warrant the use of the word "hack/hacked" under any meaning of the word whatsoever. This is a act of pure vandalism, nothing more.
Didn't they tell you to use both uppercase and lowercase letters? Had you used "Passw0rd" instead, nobody would have found out!
The Tao of math: The numbers you can count are not the real numbers.
Is a social engineering attack a hack? It sounds like someone called over to EarthLink and got an e-mail password reset. Then, once holding the e-mail account, called over to Network Solutions. This sort of thing wouldn't be difficult at all.
Hoist Number One and Number Six.
If "they" have the physical machine, they own your data. You have to live with the consequences of relying on that third party. Unfortunately that is how the internet and most of society works. We hope that there are mechanisms and governing bodies in place that are trustworthy and reliable.
A professional organization that knows its web presence is its life is going to have a bit better setup than a server that someone else (Network Solutions in this case) has control over. The right solution is a co-located server that is controlled exclusively by the organization. The hosting company doesn't need to have any passwords. They are also going to have their email processed by their own server and not be relying on an ISP for anything at all except connectivity.
However, a completely amateur operation is going to use shared virtual hosting because it is cheaper and the hosting company will be doing backups for them. And controlling passwords. And all other security. Oh, and using a non-domain based email setup from an ISP.
I guess it is pretty obvious into which category Cryptome falls, right?
Yes, it would cost $2000 a year or more for a co-located server whereas shared virtual hosting is dirt cheap.
Cryptome was cool before Wikileaks made it mainstream. And John Young is the original gangsta, so you know he got backups. Bitches don't know about all the backups he has.
And give him a raise! If you're back up, he did his job, superlatively.
Demmit.
"Tongue tied and twisted, just an Earth bound misfit
I once had an account with them, back in the 33k days. Also Erols. I guess these old services never truly die..... they just fade away.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
And Cryptome is now saying that a Wired reporter contacted them after having spoken with a hacker claiming responsibility for the attack.
Which they responded to with a threat of a subpoena, and publishing news about it before the reporter, after they told the reporter they wouldn't? ... er. Way to burn bridges, guys? Seriously, I understand free speech and using reporters as sources, but I don't think reporters are going to be too gung-ho about reporting your findings later after this.
Its the only CMS I use on my servers. Mercurial for version control over ssh. Update my sites with hg push. Hooks on the receiving side to run hg up and rebuild if required. SSH can be configured to require certificates only for authentication. Desktop environments all integration with ssh-askpass or similar.
http://michaelsmith.id.au
Its not as difficult as many might think to breach the security of a large ISP. Ask any Red Team. The IT personnel working there is probably mired by the tribulations of just trying to keep up with the little stuff, and haven't the time to build security in. Having a security 'plan' has little effect if your forward facing defence boundaries look like a piece of IP protocol Swiss cheese. It only takes one foothold inside that defence perimeter to make all the efforts of the entire IT organization look totally ineffective.
The slash and burn technique serves to cover up all sources of incriminating evidence, and better yet, hides the true motivation of the attacker unless they actually take the time to leave a message behind. You are not likely to find a trail of breadcrumbs laying around if their intent was business rather than pleasure.
Well, it just goes to show you get what you pay for. From the point of view of security Colo is probably the best, but running a server on a static IP from home is likely the most cost effective. Virtual hosting is dirt cheap but worthless for any serious operation. VMs tend to be configured minimally and ISPs mash them all together using shared resources so performance is all over the place. It's pretty easy to brick an OS running in a VM due to the minimal memory configuration it is typically given.
And backups... well, there are lots of choices there. There is no need to lose more than the most recent 60 seconds worth of modifications if you run a near-real-time streaming backup off the site. Something like DragonFly + HAMMER can do just that (and here is my unashamed advertising of DFly :-)).
Also... only 8G of data? That's it?
-Matt
Also... only 8G of data? That's it?
how much data do you expect them to host? it's not like they store multi GB long videos of events or anything.
not really familiar with Cryptome, so I'll go ahead and start bashing! It's hard to imagine that they didn't have something as basic as 2-factor auth on admin/shell/etc if they are touting that they host sensitive data of any kind... just reeks of "doing it wrong"
always lock your workstation before leaving ....
Jehovah be praised, Oracle was not selected
Why am I suddenly worried for the state of your laundry?
Cheers,
"What in the name of Fats Waller is that?"
"A four-foot prune."
textbook perfect example of why everyone should make a backup.
Hard to say where to draw the line though.. every day, every two days? ever 12 hours?? To each their own.
I just like seeing that there WAS a backup used here. I see too many people without backups used at all. Two days would be a miracle for so many people.
Yes earthlink is still alive.. and when time warner rolls out consumption based billing (as they are doing right now) you will probably end up a customer of earthlink since by paying them for the same internet service over cable.. you can avoid the extra charges that cbb will cost you.
Every normal man must be tempted, at times, to spit on his hands, hoist the black flag, and begin slitting throats. -HLM
and the crime against you will go unpunished
i'm not saying that you have no right to seek out the information source about the crime against you, i'm saying your tactics suck
what you do is you let the information source speak, and you ask the reporter for more information. you make up false reasons for why the information source is wrong, forcing the information source to prove they actually are genuine. or you keep them talking, until they make a mistake, and they reveal themselves
you set a fire, and you smoke them out, THEN you pounce
but if you run into the initial situation yelling subpoena, the source clams up, and your strong arm tactics only wind up hurting yourself, because now you can't hunt down the criminal
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
And if it's the government they wouldn't have to actually hack the email account password, they'd already know it. They'd simply log in and do the work and nobody would suspect them. It's a very convenient time, considering what was being posted on Cryptome, it was very explosive stuff involving Julian Assange, Wikileaks, etc.
If the government wants to shut down a site they can probably do it. They'll just have one of their assets at earthlink or whereever handle it.
Who would have guessed? This isn't a surprise at all.
Why not use Hotmail while you're at it.
John Young is alleged to be paranoid as hell; no idea how something like this can happen.
You mean... there's still people out in the world that do business with that outfit?
Excuse my lack of sympathy.
Mike
-- Karma whore? You betcha. --
ComputerWorld actually linked to Encyclopedia Dramatica? Yeah, this is going to go well. :)
-Ed Felix qui potuit rerum cognoscere causas.
Also... only 8G of data? That's it?
I have to appreciate that 20 years ago the same amount of data would have elicited a response more like "8G of data? What on earth are they storing that would require that much?!?"
Well, it just goes to show you get what you pay for.
Are you in marketing by chance? "You get what you pay for" is what somebody trying to sell crappy products at a quality price says. The fact is, you DON'T always get whet you pay for, although you usually pay for what you get.
Any time someone tells me "you get what you pay for" I hold on to my wallet extra tightly.
Free Martian Whores!
No, you need uppercase, lowercase, numbers, and punctuation. "Pass-w0rd" is unbreakable!
Free Martian Whores!
and the crime against you will go unpunished
i'm not saying that you have no right to seek out the information source about the crime against you, i'm saying your tactics suck
I didn't advocate any particular tactic or timeline. What I said was I would do whatever it took, including outright lie and/or threaten prosecution against the reporter who was protecting the identity of the person who committed the crime against me.
Hiding the identity of a criminal is an accessory after the fact offense. I'd work that angle until the cows came home.
That doesn't mean you have to go in all guns blazing, there's no requirement that you be stupid about it.