Slashdot Mirror
Web Hosts — One-Stop-Shops For Mass Hacking?
jjp9999 writes "More than 70,000 websites were compromised in a recent breach of InMotion. Thousands of websites were defaced and others had alterations made to give users a hard time accessing their accounts and fixing the damage. A similar attack hit JustHost back in June, and in a breach of Australian Web host DistributeIT just prior to that, hackers completely deleted more than 4,800 websites that the company was unable to recover. The incidents raise concern that hacker groups are bypassing single targets and hitting Web hosts directly, giving them access to tens of thousands of websites, rather than single targets. While the attacks have caused damage, they weren't as malicious as they could have been. Rather than defacing and deleting, hackers could have quietly planted malware in the sites or stolen customer data. Web hosting companies could be one of the largest holes in non-government cybersecurity, since malicious hackers can gain access through openings left by the Web host, regardless of the security of a given site."
Duh?
"incidents raise concern" -> as if this is something new ? it has been so since internet had become available for masses to host websites personally. anyone who had remotely got affiliated with hosting industry knows that.
why the fuck is this submitted and accepted as if it is something new ?
Read radical news here
The sooner these people are hunted down and feed a face full of lead, the better.
I mean, if you can somehow hack TCP/IP itself, you've just rooted the entire Internet.
completely deleted more than 4,800 websites that the company was unable to recover
They host (at least) 4,800 websites yet they don't have a working backup system in place? Amazing.
If you're worried about your host provider leaving doors unlocked use www.firehost.com. They lock everything down to where the only thing that has the possibility of being hacked is your poor web code. At that point it IS your fault.
nuff said.
Okay. Let me start off by saying that I am a highly qualified individual with an online degree in chemical mathematics again. After reading the summary, I have not only come to the conclusion that it is incorrect, but that it is also not stargazer. It is actually pew pew along the lines of magazine.
Sorry I came to the garbage of this place and realized it.
This is an ongoing problem when services are concentrated under one roof: it gives potential attackers a much richer target, with many more juicy pieces of low-hanging fruit in a convenient, easy-to-hit area.
Cloud and remote-hosting services are not bad; in many cases they are a wonderfully effective deployment tool. Customers must be careful, though, to ensure their provider implements good security practices and that their backup solution truly allows for service recovery after a disaster.
Unfortunately, this information is rarely presented on the service's website or in their ad brochure.
You have the right to remain silent. If you don't, anything you say will be misquoted and used against you.
Is it necessary to point out that they could have done worse? The bank robber that could have murdered all the hostages and set fire to the bank is still a criminal is still a bank robber and still a criminal.
What is the intent of writing things this way, to make us think they were doing us a favor?
The hosting industry really has segmented itself along pricing lines. The overhead to start a small hosting business is so low that there are hundreds if not thousands of hosting 'companies' that offer a very mediocre product but can get by on providing for the cheap and the clueless.
When you see these types of operations with 'unlimited' resource plans starting at 2 or 3 bucks a month is it any surprise that system security is not a core compentency?
While not a universal truth I've found you most often get what you pay for especially as you leave the budget shared hosting segment and move towards VPS or dedicated offerings.
"The incidents raise concern that hacker groups are bypassing single targets and hitting Web hosts directly, giving them access to tens of thousands of websites, rather than single targets."
I am concerned that this is happening, that these hackers are doing this, it really concerns me.
Most quality web hosting provides customers with shell access to the web server, or when cases where they don't, usually something like PHP is installed that usually allows for arbitrary execution.
On a web server that hosts a few thousand sites, using the Bing IP Search, you can find a list of all the domains. Usually there will be a lowest hanging fruit that's easy enough to pluck. Or, if you can't get shell access through a front-facing attack, you can always just sign up for an account with the hosting company yourself.
So once you have shell, then it's a matter of being a few steps ahead of the web host's kernel patching cycle. Most shared web hosting services don't utilize expensive services like ksplice and don't want to reboot their systems too often due to downtime concerns. So usually it's possible to pwn the kernel and get root with some script-kiddie-friendly exploit off exploit-db. And if not, no doubt some hacker collectives have repositories of unpatched 0-day properly weaponized exploits for most kernels. And even if they do keep their kernel up to date and strip out unused modules and the like, maybe they've failed to keep some [custom] userland suid executables up to date. Or perhaps their suid executables are fine, but their dynamic linker suffers from a flaw like the one Tavis found in 2010. And the list goes on and on -- "local privilege escalation" is a fun and well-known art that hackers have been at for years.
So the rest of the story should be pretty obvious... you get root and defeat selinux or whatever protections they probably don't even have running, and then you have access to their nfs shares of mounted websites, and you run some idiotic defacing script while brute-forcing their /etc/shadow yada yada yada.
The moral of the story is -- if you let strangers execute code on your box, be it via a proper shell or just via php's system() or passthru() or whatever, sooner or later if you're not at the very tip top of your game, you're going to get pwn'd.
ZX2C4
Every day someone comes into #httpd on freenode asking "How do I protect one user's site from another user's site when both are using PHP or CGI or whatever else?" and the answer is invariably "It will cost too much to bother."
If you are a business and you are taking in customer information, you should be held responsible when another user on that server actually figures out how much money that information is worth.
There is no excuse. A VM is about $20 a month. A DynDNS account is less. Shared hosting is for personal home pages, not businesses.
What fucking century is this story from?
I was going to mod, but I decided to post instead. I used to work at one of the companies mentioned, and what I hear through my channels is kind of retarded. One of the so-called "admins", who really ought to have known better, set up a tunnel from a personal VPS to an internal machine which had no internet-accessible address -- just the tunnel. The VPS got popped and that gave them access to an internal machine which had SSH keys as root to every single VM node and shared hosting box, as well as every dedicated machine on which the customer didn't have root access.
All the VPS accounts were vulnerable, because the host nodes were compromised, so even if a VPS customer had root, they were vulnerable, too. However, that was the kind of irresponsible, non-professional crap that I saw going on there and is why I left about 2 years ago: I assumed that the longer I stayed, the more likely it was to tarnish my reputation and ruin my career. Well, that and the fact they paid for shit and worked my like a salve tied to a shift bench on a factory floor. But then, I don't really know what anyone can expect web hosting is pretty much the fast food of it, and that's the level of talent that one can reasonably expect to retain for very long, or attract in the first place in most cases.
Some how the VPS that I left hosted there didn't get whacked, though. I guess they just forgot about me.
I've seen mass compromises on Aruba in Italy and Dreamhost in the US too over recent weeks.
Never email donotemail@WeAreSpammers.com
are you guys lacking original material? did the script kiddies g.f gave the moderator a blowjob?
http://iesucks.org
thats all i need to screw millions of websites
and it does work
has worked
and will continue to work
we are watching
Hackers' Lounge:1 - Payload Anatomy of InMotion Hosting Defacements
http://hackerslounge1.blogspot.com/2011/10/payload-anatomy-of-inmotion-hosting.html
As long as they leave godaddy alone, we are all safe, we can all go back to work now, phew!
I don't know if inmotion hosting is good. I use ipage web hosting for few of my sites. and I got very good price. It is the cheapest price. get it here: cheapest ipage web hosting