Slashdot Mirror
Web Hosts — One-Stop-Shops For Mass Hacking?
jjp9999 writes "More than 70,000 websites were compromised in a recent breach of InMotion. Thousands of websites were defaced and others had alterations made to give users a hard time accessing their accounts and fixing the damage. A similar attack hit JustHost back in June, and in a breach of Australian Web host DistributeIT just prior to that, hackers completely deleted more than 4,800 websites that the company was unable to recover. The incidents raise concern that hacker groups are bypassing single targets and hitting Web hosts directly, giving them access to tens of thousands of websites, rather than single targets. While the attacks have caused damage, they weren't as malicious as they could have been. Rather than defacing and deleting, hackers could have quietly planted malware in the sites or stolen customer data. Web hosting companies could be one of the largest holes in non-government cybersecurity, since malicious hackers can gain access through openings left by the Web host, regardless of the security of a given site."
"incidents raise concern" -> as if this is something new ? it has been so since internet had become available for masses to host websites personally. anyone who had remotely got affiliated with hosting industry knows that.
why the fuck is this submitted and accepted as if it is something new ?
Read radical news here
completely deleted more than 4,800 websites that the company was unable to recover
They host (at least) 4,800 websites yet they don't have a working backup system in place? Amazing.
Okay. Let me start off by saying that I am a highly qualified individual with an online degree in chemical mathematics again. After reading the summary, I have not only come to the conclusion that it is incorrect, but that it is also not stargazer. It is actually pew pew along the lines of magazine.
Sorry I came to the garbage of this place and realized it.
This is an ongoing problem when services are concentrated under one roof: it gives potential attackers a much richer target, with many more juicy pieces of low-hanging fruit in a convenient, easy-to-hit area.
Cloud and remote-hosting services are not bad; in many cases they are a wonderfully effective deployment tool. Customers must be careful, though, to ensure their provider implements good security practices and that their backup solution truly allows for service recovery after a disaster.
Unfortunately, this information is rarely presented on the service's website or in their ad brochure.
You have the right to remain silent. If you don't, anything you say will be misquoted and used against you.
Is it necessary to point out that they could have done worse? The bank robber that could have murdered all the hostages and set fire to the bank is still a criminal is still a bank robber and still a criminal.
What is the intent of writing things this way, to make us think they were doing us a favor?
The hosting industry really has segmented itself along pricing lines. The overhead to start a small hosting business is so low that there are hundreds if not thousands of hosting 'companies' that offer a very mediocre product but can get by on providing for the cheap and the clueless.
When you see these types of operations with 'unlimited' resource plans starting at 2 or 3 bucks a month is it any surprise that system security is not a core compentency?
While not a universal truth I've found you most often get what you pay for especially as you leave the budget shared hosting segment and move towards VPS or dedicated offerings.
Most quality web hosting provides customers with shell access to the web server, or when cases where they don't, usually something like PHP is installed that usually allows for arbitrary execution.
On a web server that hosts a few thousand sites, using the Bing IP Search, you can find a list of all the domains. Usually there will be a lowest hanging fruit that's easy enough to pluck. Or, if you can't get shell access through a front-facing attack, you can always just sign up for an account with the hosting company yourself.
So once you have shell, then it's a matter of being a few steps ahead of the web host's kernel patching cycle. Most shared web hosting services don't utilize expensive services like ksplice and don't want to reboot their systems too often due to downtime concerns. So usually it's possible to pwn the kernel and get root with some script-kiddie-friendly exploit off exploit-db. And if not, no doubt some hacker collectives have repositories of unpatched 0-day properly weaponized exploits for most kernels. And even if they do keep their kernel up to date and strip out unused modules and the like, maybe they've failed to keep some [custom] userland suid executables up to date. Or perhaps their suid executables are fine, but their dynamic linker suffers from a flaw like the one Tavis found in 2010. And the list goes on and on -- "local privilege escalation" is a fun and well-known art that hackers have been at for years.
So the rest of the story should be pretty obvious... you get root and defeat selinux or whatever protections they probably don't even have running, and then you have access to their nfs shares of mounted websites, and you run some idiotic defacing script while brute-forcing their /etc/shadow yada yada yada.
The moral of the story is -- if you let strangers execute code on your box, be it via a proper shell or just via php's system() or passthru() or whatever, sooner or later if you're not at the very tip top of your game, you're going to get pwn'd.
ZX2C4
Every day someone comes into #httpd on freenode asking "How do I protect one user's site from another user's site when both are using PHP or CGI or whatever else?" and the answer is invariably "It will cost too much to bother."
If you are a business and you are taking in customer information, you should be held responsible when another user on that server actually figures out how much money that information is worth.
There is no excuse. A VM is about $20 a month. A DynDNS account is less. Shared hosting is for personal home pages, not businesses.
WTF does that even mean?
TCP/IP is a protocol--actually two protocols, one over the other.
You can fake packets in it. So what? That doesn't automagically give you root on anything.
Now if there's actually enough of an error in the TCP/IP code to give you kernel control from there, sure, you've rooted only *half* of the internet (or whatever percentage run the same kernel code). But (1) that code is looked over once or twice by security people and (2) that code is such a headache that even with the source code, almost all crackers would prefer to find a much easier target to deal with, and (3) the last time I looked at the code, around 2004, the comments on it, on the apple side, had not been updated since the mid-eighties, IIRC. Maybe the early nineties. (Although the code had changed.) Which doesn't exactly make it easier. (4) Such an error is unlikely to be found there to begin with. But not impossible.
TCP/IP Kernel code is kind of like Buckaroo Banzai doing neurosurgery. [To Jeff Goldblum]: "Don't tug on that, you never know what it might be attached to."
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
Here it comes..., wait for it....
Whooosh!
I was going to mod, but I decided to post instead. I used to work at one of the companies mentioned, and what I hear through my channels is kind of retarded. One of the so-called "admins", who really ought to have known better, set up a tunnel from a personal VPS to an internal machine which had no internet-accessible address -- just the tunnel. The VPS got popped and that gave them access to an internal machine which had SSH keys as root to every single VM node and shared hosting box, as well as every dedicated machine on which the customer didn't have root access.
All the VPS accounts were vulnerable, because the host nodes were compromised, so even if a VPS customer had root, they were vulnerable, too. However, that was the kind of irresponsible, non-professional crap that I saw going on there and is why I left about 2 years ago: I assumed that the longer I stayed, the more likely it was to tarnish my reputation and ruin my career. Well, that and the fact they paid for shit and worked my like a salve tied to a shift bench on a factory floor. But then, I don't really know what anyone can expect web hosting is pretty much the fast food of it, and that's the level of talent that one can reasonably expect to retain for very long, or attract in the first place in most cases.
Some how the VPS that I left hosted there didn't get whacked, though. I guess they just forgot about me.
Well, perhaps I didn't see it that way because it wasn't analagous, and so took it as if serious. =)
A hosting provider is, on average, much more vulnerable than TCP/IP code.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
I've seen mass compromises on Aruba in Italy and Dreamhost in the US too over recent weeks.
Never email donotemail@WeAreSpammers.com
are you guys lacking original material? did the script kiddies g.f gave the moderator a blowjob?
http://iesucks.org
Hackers' Lounge:1 - Payload Anatomy of InMotion Hosting Defacements
http://hackerslounge1.blogspot.com/2011/10/payload-anatomy-of-inmotion-hosting.html
As long as they leave godaddy alone, we are all safe, we can all go back to work now, phew!