Slashdot Mirror
That North Korean Facebook Clone Has Already Been Hacked (vice.com)
Remember yesterday's story about an off-the-shelf Facebook clone in North Korea? Within a few hours that site was hacked by an 18-year-old college student in Scotland.
An anonymous reader writes:
Using the default credentials, Andrew McKean posted "Uh, I didn't create this site just found the login" in the site's box for Sponsored links. "McKean was able to become an admin for the site just by clicking on the 'Admin' link at the bottom of the site and guessing the username and password," writes Motherboard, which adds that the password was "password". McKean says the breach "was easy enough," and granted him the ability to "delete and suspend users, change the site's name, censor certain words and manage the eventual ads, and see everyone's emails."
The teenager said he had "no plans" for the compromised site -- except possibly redirecting it to an anti-North Korean page.
The teenager said he had "no plans" for the compromised site -- except possibly redirecting it to an anti-North Korean page.
"Uh, I didn't create this site just found the login"
Why not "Kim Jong-Un is a pussy! Sincerely yours, Park Geun-hye" or something more creative like that?
Ezekiel 23:20
The word "hacked" is overused. Making a fairly easy assumption that the default UID / PID has not been changed by some rube North Koreans who didbn't expect anyone to notice the demo site is hardly a "hack".
On the other hand, I'll bet that the REAL North Korean intel guys gathered a whole lot of data from the honeypot site.
If you want news from today, you have to come back tomorrow.
"which adds that the password was "password""
He must have used a sophisticated brute force attack.
And watch the Scientologists square off with the government of North Korea.
I'll bring the popcorn....
I dunno who boasts more Chuck-len Norris-esque jokes, Scottlan or Bess Koreahhhhh? I would have sold admin access to someone who would write some embassy into North Korea like on the tip of their Waffelhotel or write some more unicorn layets around somewhere... you know, because tgey tend to claim fiction exaggerations as greatest propoanda peices. Then install System D on their server to really scare them.
Pot is an agriculture product, no different than hopps.
I'm not sure I'd put my real name on any sort of embarrassment to the North Koreans. They are rather unpredictable.
The poor shlub who administers that site has probably already been executed.
Doesn't matter what he did, you said "hacker". It's the law!
Hopefully he will be extradited to face his punishment.
"The teenager said he had "no plans" for the compromised site"
Ah these young'ins, back in the day it would be goatse.cx 'ed or at the very minimum a penis bird!
Jeeze what's this world become.
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
seriously, this was an easily predicted outcome. PHP and security are at odds with each other.
Anons need not reply. Questions end with a question mark.
So it's ok to be a virtual vandal in some cases?
Shouldn't the password have been in Korean?
And what "eventual ads?" Maybe propeganda, but in a true Communist country there are no billboards, TV ads, or on-line ads. People are directed to build things like this and the central government is supposed to provide what people in the West would buy (food, shelter, clothes). And bigger items get shared by the public.
sarcasm on: He could have changed the password, and then they would not know how to regain it back....
I hope he is prosecuted to the full extent of the law both UK and NK, any propaganda induced biased against NK is not reason enough to commit a crime.
It was probably a student project, not a gov't sponsored site. I doubt the NK gov't gives a fuck.
Table-ized A.I.
It's surprising that one would admit to a felony like that. It being in nk doesn't suspend law.
He got in because the password was left as "password". In what programming language is "password" a secure password?
Having said that, ten years or fifteen ago PHP had serious security issues, given that it is designed to be used on web, where the application will be attacked daily. It was literally impossible to write a secure program in PHP; literally "hello world" had a security vulnerability. Much has changed. PHP was originally a CMS, written in Perl with a bit of C. It's now an actual programming language, one used by clueless little companies like Facebook. Seriously, it has improved a lot. The world's largest web sites wouldn't be running on PHP if it were junk.
Having said THAT, it's still an "easy" language to start learning. You can start writing little PHP scripts without being trained and educated as a programmer. If you do that in any language and put your scripts on the web, you'll get hacked. While PHP as a language is pretty decent now, PHP "scripters" who don't know any programming language other than PHP are still mostly people who don't know much. But the same is true of .Net or many other languages. If you learned a bit of a language but never learned programming and especially security issues of web programming, you probably shouldn't expose your software to internet hackers.
This sounds like a default, or near-default install of a basic web application, made available from a public-facing IP. The only remotely interesting thing here is that the IP is in NK, but the only real story seems to be "someone in North Korea with the ability to allocate a public IP played with dolphinPHP." I mean, it could be an official party directive. Or it could be that some bureaucratic entity in DPRK did what bureaucratic entities love to do: had an idea that went nowhere, which may not have ever been understood by anyone in the first place, and led to some amount of useless effort being expended.
1.) since when it is not a crime to hack DPRK, just because its the DPRK, I think the UK computer fraud acts are pretty specific.
The big exception is, when you would be part of the military or part of a secret service - then you can commit crimes sometimes even against humanity and go unpunished.
2.) And there might be an exception when the hacking could go unpunished, exactly if it would be used to save lifes, for example or stop attrocities (by changing the execution list for example), or bring evidence forth about violation of human rights.
ObPHPlink: A fractal of bad design.
Will North Korea pursue this malignant hacker?
Kinda amused to see this get put out as a story now. It didn't get much attention when I pointed it out yesterday. The little ninja character was gone pretty fast, though.
The world's largest web sites wouldn't be running on PHP if it were junk.
Lol, I'm sure that's a logical fallacy.
The only reason why Facebook is still using PHP is because they had too much legacy code. They had serious up-scaling issues a number of years ago, so they created their own "PHP", which is compiled and supports type checks. They also use extensive unit tests for every little bit of code, which is not how the typical PHP app is written.
So is it possible to write (non trivial) secure code with modern PHP? Maybe, with a lot of effort and testing. But I wouldn't stake my life on it. Wordpress and Drupal get hacked all the time.
Btw I'm maintaining/refactoring a large legacy PHP backend, so I'd like to think I know what I'm talking about. PHP is the only programming language I've used (of many) where WTF is the new normal...
Why is this news? Were people expecting North Korean admins of off-the-shelf websites to somehow be better than ones in the rest of the world?
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
>> Ten or fifteen years ago PHP sucked
> I'm maintaining/refactoring a large legacy PHP
I feel your pain. I've done the same with a million-line PHP project called Moodle.
Since you are refactoring, I hope you study modern PHP and apply it where it makes sense.
Having used Moodle for a university class, I bow to your unholy patience and fortitude.
I bet that the owner cannot or does not read this or any other tech news.
How many North Corean people will die because of this ?
Or is the crazyness not to that level yet ?
Irrelevant news and morons using moderation to mod down what they disagree on. 2018 resolution: so long.
This prank will probably cause the poor schmuck that is web admin for the site to literally lose his head.
North Korea consists of 1 maniac leader, a handful of supplicant generals fearing for their lives, and millions of poor schmucks nearly starving to death while fearing for their lives.
He got in because the password was left as "password". In what programming language is "password" a secure password?
The password programming language of course. It is spelt pa55w0rd don't you know? Shame on you Mr. Morris. LOL
I'm guessing you used an older version. Moodle too has improved dramatically in the last four years. It has really grown up.
Powdered Toastman ftw!
...but some guy called Kim has the most friends.