Slashdot Mirror
That North Korean Facebook Clone Has Already Been Hacked (vice.com)
Remember yesterday's story about an off-the-shelf Facebook clone in North Korea? Within a few hours that site was hacked by an 18-year-old college student in Scotland.
An anonymous reader writes:
Using the default credentials, Andrew McKean posted "Uh, I didn't create this site just found the login" in the site's box for Sponsored links. "McKean was able to become an admin for the site just by clicking on the 'Admin' link at the bottom of the site and guessing the username and password," writes Motherboard, which adds that the password was "password". McKean says the breach "was easy enough," and granted him the ability to "delete and suspend users, change the site's name, censor certain words and manage the eventual ads, and see everyone's emails."
The teenager said he had "no plans" for the compromised site -- except possibly redirecting it to an anti-North Korean page.
The teenager said he had "no plans" for the compromised site -- except possibly redirecting it to an anti-North Korean page.
"Uh, I didn't create this site just found the login"
Why not "Kim Jong-Un is a pussy! Sincerely yours, Park Geun-hye" or something more creative like that?
Ezekiel 23:20
The word "hacked" is overused. Making a fairly easy assumption that the default UID / PID has not been changed by some rube North Koreans who didbn't expect anyone to notice the demo site is hardly a "hack".
On the other hand, I'll bet that the REAL North Korean intel guys gathered a whole lot of data from the honeypot site.
If you want news from today, you have to come back tomorrow.
"which adds that the password was "password""
He must have used a sophisticated brute force attack.
No one cares about your Scientology obsession, because no one cares about Scientology. If you were stupid enough to get sucked into it in the first place, you're still stupid.
If you want news from today, you have to come back tomorrow.
The poor shlub who administers that site has probably already been executed.
"The teenager said he had "no plans" for the compromised site"
Ah these young'ins, back in the day it would be goatse.cx 'ed or at the very minimum a penis bird!
Jeeze what's this world become.
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
seriously, this was an easily predicted outcome. PHP and security are at odds with each other.
Anons need not reply. Questions end with a question mark.
sarcasm on: He could have changed the password, and then they would not know how to regain it back....
I hope he is prosecuted to the full extent of the law both UK and NK, any propaganda induced biased against NK is not reason enough to commit a crime.
It was probably a student project, not a gov't sponsored site. I doubt the NK gov't gives a fuck.
Table-ized A.I.
He got in because the password was left as "password". In what programming language is "password" a secure password?
Having said that, ten years or fifteen ago PHP had serious security issues, given that it is designed to be used on web, where the application will be attacked daily. It was literally impossible to write a secure program in PHP; literally "hello world" had a security vulnerability. Much has changed. PHP was originally a CMS, written in Perl with a bit of C. It's now an actual programming language, one used by clueless little companies like Facebook. Seriously, it has improved a lot. The world's largest web sites wouldn't be running on PHP if it were junk.
Having said THAT, it's still an "easy" language to start learning. You can start writing little PHP scripts without being trained and educated as a programmer. If you do that in any language and put your scripts on the web, you'll get hacked. While PHP as a language is pretty decent now, PHP "scripters" who don't know any programming language other than PHP are still mostly people who don't know much. But the same is true of .Net or many other languages. If you learned a bit of a language but never learned programming and especially security issues of web programming, you probably shouldn't expose your software to internet hackers.
This sounds like a default, or near-default install of a basic web application, made available from a public-facing IP. The only remotely interesting thing here is that the IP is in NK, but the only real story seems to be "someone in North Korea with the ability to allocate a public IP played with dolphinPHP." I mean, it could be an official party directive. Or it could be that some bureaucratic entity in DPRK did what bureaucratic entities love to do: had an idea that went nowhere, which may not have ever been understood by anyone in the first place, and led to some amount of useless effort being expended.
1.) since when it is not a crime to hack DPRK, just because its the DPRK, I think the UK computer fraud acts are pretty specific.
The big exception is, when you would be part of the military or part of a secret service - then you can commit crimes sometimes even against humanity and go unpunished.
2.) And there might be an exception when the hacking could go unpunished, exactly if it would be used to save lifes, for example or stop attrocities (by changing the execution list for example), or bring evidence forth about violation of human rights.
Shouldn't the password have been in Korean?
The guy pumped and untared a tar.gz he found on the Net somewhere in a "docs" folder. Probably from the billions available from the US. That happens all the time in Western countries, but since it's NK, that makes the news.
Slashdot, fix the reply notifications... You won't get away with it...
Kinda amused to see this get put out as a story now. It didn't get much attention when I pointed it out yesterday. The little ninja character was gone pretty fast, though.
As unpredictable as the average child with a water gun full of ink. Yes, in theory he could ruin your dress, but in the end he's more afraid of the spanking he'd get for it than you are about your suit.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I'm not sure I'd put my real name on any sort of embarrassment to the North Koreans. They are rather unpredictable.
I predict North Korea will have at least one less (living) IT staff members.
Why is this news? Were people expecting North Korean admins of off-the-shelf websites to somehow be better than ones in the rest of the world?
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
>> Ten or fifteen years ago PHP sucked
> I'm maintaining/refactoring a large legacy PHP
I feel your pain. I've done the same with a million-line PHP project called Moodle.
Since you are refactoring, I hope you study modern PHP and apply it where it makes sense.
Having used Moodle for a university class, I bow to your unholy patience and fortitude.
How many North Corean people will die because of this ?
Or is the crazyness not to that level yet ?
Irrelevant news and morons using moderation to mod down what they disagree on. 2018 resolution: so long.
I'm guessing you used an older version. Moodle too has improved dramatically in the last four years. It has really grown up.