Slashdot Mirror
Doorways Sneak To Non-Default Ports of Hacked Servers
UnmaskParasites writes "To drive traffic to their online stores, software pirates hack reputable legitimate websites injecting hidden spammy links and creating doorway pages. Google's search results are seriously poisoned by such doorways. Negligence of webmasters of compromised sites makes this scheme viable — doorways remain unnoticed for years. Not so long ago, hackers began to re-configure Apache on compromised servers to make them serve doorway pages off of non-default ports, still taking advantage of using established domain names."
This seems more like they're boarding ships than infringing on copyright.
Maybe it has something to do with the submitter's name being "UnmaskParasites" and the URL of the article being http://blog.unmaskparasites.com/2010/12/03/doorways-on-non-default-ports-new-trend-in-black-hat-seo/.
If the author of the article did indeed just submit it here in some petty attempt to get traffic, he or she probably wouldn't have known what was unclear with the article.
Had some neutral party submitted this, this submitter may have had to also look up these non-standard terms, and may have had the sense to include the definitions in the summary.
Or maybe the submitted hacked into an Apache server, put up this navel-gazing article and submitted via a non-default port to Timothy's queue.
o_O
Or maybe Slashdot is turning into a keyword spam infested link dump, like Digg and Reddit and the rest of the goddamned web. I miss the days when we featured cool nerdy projects, and Ask Slashdot required an IQ of at least 120 to even understand the question. This place has gone to the dogs.
-Billco, Fnarg.com
Ob-1999: I think you misspelt "cracker."
Kid-proof tablet..
Would blocking unusual portnumbers in the firewall be a solution?
When they say, "software pirates hack reputable legitimate websites" it means the number of web sites that have fallen victim is: two
Oh, and in between those two are The Doors...
This place has indeed gone to the dogs, but revealing modern hacker techniques one should watch out for is part of the reason I keep coming here. I just don't know how I'm going to tell my folks and other non-techie associates that there's something called port numbers that they should also find some way to add to what they try to pay attention to.
Attention zealots and haters: 00100 00100
Also, you'd think that timothy could lay off the huffing paint fumes and eating crayons for a moment, and maybe avoid using the word "hackers" in the pejorative sense on a site where many view themselves as hackers in the real sense. But no, he manages to embarrass himself once again.
Go and get yourself cleaned up, timothy, and try again.
Finished throwing ones teddy out of the pram have we? Language changes over time and has dual meanings deal with it!
Here's a typical break-in, at University of Oakland.. This has a good search position in Google for "64 bit Windows". This leads to a software-for-sale page with phony seals of approval from Microsoft, Verisign, etc. That's hosted at Starnet, in Moldovia. The payment site for the sales site is "payment8ltd.net", also hosted on Starnet in Moldovia. They're selling pirated copies of brand-name software at roughly half retail price.
That site has a TrustWave seal, which pops up a popup for Paym8, a real payment processor in Zaire. TrustWave's seal server doesn't check the referrer when displaying a seal popup, so it can be spoofed. Nor does the TrustWave seal even give the domains to which it applies. Verisign and BBBonline check this, but not TrustWave.
It looks like the actual payment processing occurs at "https://payment8ltd.net/shop/order/process/"; that's where the order goes on "Submit". The site has one of those worthless GoDaddy "Domain control only validated" SSL certs.
Starnet presents itself as an Internet and telecom service provider, offering the usual data, voice, colocation, and hosting. Headquarters of Starnet seems to be at Vlaicu Parcalab, 63, Chisinau, Republic of Moldova. That's a property of Flexi Offices, one of those small-office rental places. Interestingly, Microsoft also has an office in that building.
There's actual Whois information for that site:
Registrant Contact: Viktor Menshikov
Viktor Menshikov (loyal@yourisp.ru)
ul.V.Urdasha d.36 kv.1
Rakovo, Respublika Tatarstan, RU 422455
P: +7.8435122221 F: +7.8435122221
That location exists; it's a farm town about 500Km east of Moscow. Probably not a real address.
Searching for "yourisp.ru" brings up a large number of scam reports. The domain itself is registered but not in DNS.
Most of this recent batch of attacks seem to have similar underlying information.
Are we finally using the term "pirates" correctly?
Correctly? You think there's a "the" correct usage? I hate to tell you this, but words in English can, and frequently do have more than one meaning; and there usually isn't just one you can point to and say "this is the correct meaning." In this particular case, the 1913 public domain version of Webster's that is widely distributed on the Internet includes the infringement definition for "pirate", so that use is at least a century old, making it more legit than, say, the term "sky pirate".
If you want to argue that using the term for infringement is inappropriate and should be abandoned, I'm with ya, but to claim it's incorrect just makes you look silly.
That said, I'm not sure the term "pirate" applies here no matter which meaning of the word you choose. But yes, it does seem closer to the nautical definition, if anything. :)
Any box on the internet that doesn't have all ports except 80, 443 (if needed) and an ssh port firewalled is nuts.
If the page-rank algorithm is currently automatically counting different web servers at the same address but on a different port as the same site, stop that.
Racist!
Ideally you should stick your web servers in a DMZ and only open the ports in/out through the firewall that you specifically need. It's not the be all/end all, but it's an additional layer of security and would help mitigate against this particular attack.
First sentence in TFA: "A year ago I blogged about how hackers managed to hijack hundreds of high-profile websites to make them promote online stores that sold pirated software at about 5-10% of a real cost." When they say pirates, they are referring to the fact that these web sites were built to sell pirated software. Even a profession that was not in the tech black market category would have fit in the summary. For example "To drive traffic to their web sites full of illegal and potentially poisonous recipes, rogue chefs hack reputable legitimate websites injecting hidden spammy links and creating doorway pages."
I host sites on a reseller account. What's a good way to check up on this and make sure my hosted sites are OK? I'm not going to go check every link in every site and compare that to every file on the servers for each site. There has to be an easier way.
http://Communityville.com - A free place for new and old neighborhood webmasters to hang out.
Language only makes sense in a context. In case it escaped you, this is Slashdot, and in this context hackers and crackers are two different things. It is one thing to acknowledge that much of the world is ignorant of the difference. It is another entirely to feed into that ignorance here. If you knew about why people mistakenly call crackers hackers, then you would understand why it is a sensitive issue. IIRC, Steven Levy misunderstood the term when it was used to describe the Robert T. Morris Internet Worm, and used it incorrectly in a New York Times article. The rest is history. To this day it is a common error to use your when the contraction you're is correct. The fact that the mistake is made on a regular basis by people all over the Internet doesn't make it suddenly correct. Likewise, using the word hacker to describe a cracker will never be correct usage, no matter how many people make the error.
See also In popular usage and in the media, computer intruders or criminals is the exclusive meaning today, with associated pejorative connotations. (For example, "An Internet 'hacker' broke through state government security systems in March.") In the computing community, the primary meaning is a complimentary description for a particularly brilliant programmer or technical expert . - [emphasis added]
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Uh, no, ideally you shouldn't allow the web server to rewrite its own config.
If it can do that, it's either already running as root, or, duh, its config files can be rewritten so it, from then on, runs as root. Which means the attacker is now running as root either way.
Frankly, half the time it'd be easier to detect extra ports than extra files. A lot of people have either gui interfaces to their http config, at which point an extra server on a weird port showing up would be noticeable, or have a script that writes the config files from a database, in which case an extra server might be erased (Depends on where it was added, though.)
Hell, you'd probably notice it from netstat at some point.
Whereas malicious files hidden in a web site tend to be hidden in a .whatever directory and some obscure CMS include/ file patched to include them, which no one will ever notice.
But stopping 'extra ports' actually does fuck-all for security anyway...it hardly matters if attackers are running malicious web sites out of extra http locations they've set up, or the pre-existing web server...the security implication of that is exactly the same.
The security implications of attackers rewriting http config files, OTOH, are through the roof. If you want to rewrite the http config from web pages, either use something like Webmin, which is designed for it and allows you to run your actual websites as a unprived user, or use a page that rewrites a database, and have a root-owned and root-running script that looks for updates to that database and rewrites everything. Do not, I repeat, do not, make /etc/httpd/domains.d/ owned by apache. (Or whatever the path and user for your web server.)
Like I said, it's trivially easy for an attacker with just web-server permissions to figure out that location and write a file that gives the web server root access, and next time it gets restarted...hey, look, their malicious scripts have root access also.
If corporations are people, aren't stockholders guilty of slavery?
...and Ask Slashdot required an IQ of at least 120 to even understand the question.
Can you point to even ONE study that links IQ and nerdiness / geekiness? Unapplied Intelligence is fungible, and any community that adopts memes like "hot grits!" or "first post!", while clearly nerdy, does not seem to be demarcated by any substantial intellect requirement.
(Oh, and the English language is organic instead of prescribed. "Ain't" is a word, "ATM Machine" isn't really a tautology, and "hacker" means someone who engages in "hacking", or the illegal access of computer systems through use of technical knowledge.)
the 1913 public domain version of Webster's that is widely distributed on the Internet includes the infringement definition for "pirate"
Wow, you are right! You can even look back further than that and see that even the 1828 version contained "To take by theft or without right or permission, as books or writings".
I have never understood why the term generates such a massive response here. All language is fluid. Even if the definition wasn't in these old dictionaries, it is in the modern ones because that is the term that people use for the act. Just live with it, I say.
I have never understood why the term generates such a massive response here.
Because people don't like that what they're doing got a word with negative tone for it. If it was "Liberators" instead of "Pirates", they wouldn't complain.
What exactly have you done? Are you suggesting that we ought to have an academie francaise that rules on correct usage of technical terms? OK that would be IBM and we would be calling mother boards planars; fans AMDs and hard disks as DASD.
Get over it the terms usage has changed.
Ps and “hacker” is also used to indicate a poor golfer which usage predates any technical usage
The word "liberators" assumes that what is being liberated wants to escape. Whether you are copying games, music, films or books, none of these things actually desires to be liberated. Instead, the pirate wants to use the product without paying for it, so they just take it. It is a completely selfish act, and a label with a negative tone is quite apt.
I'm not going to go all Marge Simpson here and say "don't do that". All I ask is that the pirates don't try and sugar coat what they do as something noble.
Are you responding to the same comment I see? Where does "running in a dmz" == "running as root"? Your points about it being bad for web servers to rewrite their own config are fine and dandy...but I'm hard pressed to see how they have anything to do with a dmz....
Yes, I am responding to you.
You seem to think the way to stop this problem is to stop one single way that a hijacker of a web server is using to attack other people.
They still have other ways to attack people. (Like rewriting the actual files of the site.) And, more importantly, they're still in control of a server!
Like I said somewhere else, this article is 'Assassins who break into people's houses are now shooting people out the window, instead of just the door', which is a moderately useful thing to know, especially when that means they can look like they're coming from another, actually secured, location in the building.
But it has inexplicably which has lead to a discussion about boarding up windows.
While that is a fine thing to do, it is, I must submit, is not the actual problem, nor is it the actual solution.
The problem is that there are assassins in people's houses.
If corporations are people, aren't stockholders guilty of slavery?
http://yro.slashdot.org/comments.pl?sid=1888084&cid=34378092 You're the troll that ran when he was confronted on his trolling there in that URL I just put up, because you weren't able to dispute and disprove what was posted and you were asked to. You talk a big game metrix007, but you can't even show anyone here that you've done more than those you called "ignorant and misinformed" in that URL above. You're a noob, and we all know it, just based on that URL above as well as your repeated insults (obvious or attempted subtle ones) and name calling of others that is shown in your posting history here this week alone, like this one also. Grow up, do something with your life, before you try to play "expert" with anyone here or elsewhere that have (which is what you tried above, and you ran, lol!). Your nitpicking now? Completely irrelevant (though crack/cracking/cracker would be better to use than hack/hacking/hacker, we know what was implied/meant anyhow - no need for your trollish english grammar technique, which gives you away as being on your "last leg" and until you can show us your PHD in English? You're FAR from an expert on that too...)
Run, runner... http://yro.slashdot.org/comments.pl?sid=1888084&cid=34378092 and keep showing the rest of us how much of a cowardly little troll you really are.
Thanks for supplying the bogus domains information. I checked on yourisp.ru, and sure enough - a known bogus malware domain/host name. It's blocked out here now, alongside payment8ltd.net, & how? Here is HOW & WHY:
15++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:
1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).
2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).
3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.
4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).
5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via PINGS &/or WHOIS though, regularly, so you have the correct IP & it's current)).
6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders
7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:
GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):
http://ddanchev.blogspot.com/
http://www.malware.com.br/lists.shtml
http://www.stopbadware.org/
http://blog.fireeye.com/
http://mtc.sri.com/
http://news.netcraft.com/
http://www.shadowserver.org/
REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):
http://www.mvps.org/winhelp2002/hosts.htm
http://someonewhocares.org/hosts/
http://hostsfile.org/hosts.html
http://hostsfile.mine.nu/downloads/
http://hosts-file.net/?s=Download
https://zeustracker.abuse.ch/monitor.php?filter=online
Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)
8.) HOSTS files will allow you to get to sites you like, via hardcoding your favs into a HOSTS file, FAR faster than DNS servers can by FAR (by saving the roundtrip inquiry time to a DNS server & back to you).
9.) AdBlock & DNS servers are program