Slashdot Mirror
Hacked MIT Server Used To Stage Attacks
wiredmikey writes "A compromised server at the Massachusetts Institute of Technology (MIT) has been identified as being used as a vulnerability scanner and attack tool, probing the Web for unprotected domains and injecting code. According to researchers, the ongoing attacks appear to be related to the Blackhole Exploit Pack, a popular crime kit used by criminals online. The attacks started in June, and an estimated 100,000 domains could have been compromised. Judging by initial data, one MIT server (CSH-2.MIT.EDU) hosts a malicious script actively used by cyber-crooks to scan the web for vulnerable websites. These types of attacks are how BlackHat SEO scams are propagated, which target search results in order to spread rogue anti-virus or other malware. In addition, compromised hosts are also leveraged for other schemes, such as spam or botnet control."
http://fuck-the-skull-of-jesus.mit.edu/
Futurist Traditionalism
These kind of exploits just don't happen when you're running OpenBSD. OpenBSD is THE ONLY safe option for any publically-accessible server.
That's not very smart.
Thats some good admin work there Lou.
If MIT can't secure their system, how will I ever secure mine?
MIT owns an entire Class A range of ip addresses (18.*.*.*). Of course there are going to be compromised machines when every student and his grandmother is allowed to set up multiple servers. Back when I ran servers on that network, I reported scans from compromised machines every couple of weeks.
Congrats for noticing that neglected machines get compromised. News at '11.
Servers everywhere are compromised all the time. I get port scans from US Military machines hourly. It's been this way since at least 2000.
Are we quite sure this server was hacked? I wouldn't put it past some college student, or possibly even a network admin, to do this personally. While that may technically still be "hacking", it wouldn't qualify for it in the popular-media definition (which is the way TFA seems to be using it... or maybe not, maybe the writer is using the term deliberately.) The proper term is "cracked."
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
And we're certain this is not a research project, because?
For Christ's sake man, you are visiting a site with "Fuck The Skull Of Jesus" in the domain name, but you're worried about a blow job picture? You are what's wrong with America.
How is this news? Servers get hacked all the time when someone misses a security update on a package. Just because it happened to be at MIT doesn't mean anything.
They use windows as servers at MIT. Not all they (MIT) are cracked up to be apparently.
I used to keep a couple of honeypot open servers on the DSL line in my lab in the late 90s. Nobody ever bothered the Win95 box, but the unpatched Red Hat 6.x box was broken into and brutally killed enough weeks in a row I ended up naming it "Kenny". It got attacked by some machine in Sweden and was pinging home to check in and receive further commands, so I and the admin there cleaned up our machines. I forget if the attack on the wu-ftpd daemon came from Washington University or was used to attack them. The bad guy thought they had covered their tracks by replacing the ps and ls commands, but I noticed their extra directories with "find", and their processes with "echo /proc/*" :-)
So one week the attack was coming from MIT. I tried going through mit.edu's website to find a sysadmin to talk to, didn't get a response, so I sent email to a security researcher I knew there, who already knew about the problem. It turns out that the attack wasn't actually from MIT - it was from somebody in Japan who was using a compromised Sun server, and there was a byte order problem in the attack code. So the attacker wanted my machine to be pinging him at x.y.z.18, but instead my responses were going to 18.z.y.x at MIT.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I've seen this story posed over and over. Some computer sitting in Building 1 on campus, used by Course 1, was compromised. BFD. MIT's Information Services and Technology deal with computers like this every day, as does anyone who manages a network with tens of thousands of computers. There are dozens of machines a day that get compromised. This is not a server sitting in the racks; this is a computer sitting in a closet or under a desk in an academic building. There are multiple addresses people can use to report maliciousness on the network (abuse@mit.edu, stopit@mit.edu, security@mit.edu), and they take care of the compromised computers in an order that actually matters.
I guarantee you there are dozens of other computers on the MIT network right now that are also serving malware or acting as a point of entry for hackers, and they'll get dealt with as they get noticed.
I noticed that esi.mit.edu was hacked a few years ago (they used an old version of Joomla or something), let them know and they took it offline.
I didn't know this sort of thing makes Slashdot these slow news days.
...for calling them "criminals" and not "cyber-criminals."
Student: Is it true that the foundation of the universe is paradox?
Master: Well, yes and no.
Spoken like a true Engrish major.
Their they're doing there hair.
on US and call it a cyber criminals' haven, oh wait, this isn't China!
Having gone there for my undergrad, this isn't that surprising. Students' computers get fixed IP addresses on the network (and it's very straightforward to get a hostname registered). Due to the fixed IP addresses, hackers scan the network range fairly regularly looking for boxes to pop. Back in 2002 I set up a Win2k box on the network. Within 24 hours of it being online (and stupidly, unpatched), it was infected with code red.
Who does csh-2.mit.edu belong to at MIT? For a school that large there is a very good chance that it belongs to someone who is not necessarily well versed in network security. It is entirely possible that the system was compromised because of an exploit that an admin would consider "obvious" for whatever OS was running on it.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I think that what is the funniest part in this is that MIT is supposed to be a leader in cyber security and all that is high tech. The fact they were p0wned, to me shows that times are getting really hard to maintain that title. I guess they are not so hot any longer....eh?
It's hard not to have a few hacked servers when you comprise 1/255 (approx) of IPv4 space with everything sitting on an enormous pipe. Plus there's such a high flux of students coming, setting up servers (sometimes in closets), and leaving that there is a nightmare of unpatched everything there. Plus school is a place where you are supposed to learn, and a lot of learning comes from making mistakes.
I work for an Information Security office on a campus of a major Tech college. We send out weekly vulnerability reports to the owners of all systems that have vulnerabilities and exploits (at least ones that are known). This usually amounts to thousands of reports weekly, most of which are completely disregarded and filtered straight into spam folders by end users. Granted, there are more false positives than I'd like, but we have to bash heads and go up to dean level interventions to get some of the SysAdmins on campus to do anything. Usually they cry foul that "our systems are too old to upgrade", "we are too understaffed to implement security updates", or my favorite "you are actually in violation of your own policy by scanning for vulnerabilities in the first place!"
At times, I think government gets more done than universities do...