Slashdot Mirror

← Back to Stories (view on slashdot.org)

Crack.LinuxPPC.org Cracked

Posted by CmdrTaco on from the that-took-awhile dept.

An anonymous reader noted that it appears that crack.linuxppc.org has been, well, cracked. There is a mirror of the defaced page at here being hosted by attrition.org. The actual box is down as of when I type this. On the upside, it sure took a long time for someone to get in there (I'm still amused that they posted the root password). Jason Haas from LinuxPPC said "The machine is going to Daniel Jacobowitz, who won it legitimately. The subsequent problems occured after Dan installed a backdoor, and have since been cleared up. The original problem was that proftpd-1.2.0pre4 was left running with a /incoming directory."

125 comments

  1. _incoming_ ? by Emphyrio · · Score: 1

    I hadn't even _tried_ that one :)
    Funny, that even with competitions like this, the easy holes always seem to stay open..
    I think it's sort of a bad thing that the linuxppc guys missed it themselves though...

    Emphyrio

    1. Re:_incoming_ ? by heh2k · · Score: 2

      it wasn't an "easy" hole, it took them several weeks (iirc) to write the ppc asm shell code.

      i believe that the point of the contest was to see how long an UNMODIFIED box would stay up. that is, w/o upgrading anything.

      personally, i think it's a pointless. it's only a matter of time before a system is broken; there's always bugs.

    2. Re:_incoming_ ? by little_blaine · · Score: 1

      Emphyrio, I'm just curious, if you had tried it, just what would you have done? This is not an easy hole...

    3. Re:_incoming_ ? by Emphyrio · · Score: 1

      What i would have done.
      If you find a proftp daemon with the right version, and you _know_ this version is vulnerable on other platforms (in the case of bufferoverflows platforms not 'suffering' with a non-executable stack), the only thing you have to do is incorporate shell code for the 'target' platform into the standard exploit, and probably change some offsets.
      If you regularly keep track of the (abundant) security mailing lists, you see that there is a _huge_ amount of buffer overrun exploits to be found.
      Modifying shellcode to work on other hardware platforms is not arcane science; you can find lots of tutorials about it on the web (take mudge's 'smashing the stack for fun and profit' for example).
      The difficulty in this case is that you need to create carefully crafted directories in the world writable directory, _and_ the buffer overflow is not directly made; a buffer is overrun, and the net result doesn't show until strlen() is called in another function. Hard thing.
      Still, the core task of porting the exploit to another platform is porting the shellcode.

  2. Anti-Karma by Anonymous Coward · · Score: 0


    The First Post Challenge, The Best Game On The Net!

    This Anti- Karma HOWTO document explains how to not impress your fellow slashdotters by getting low Karma. Although Anti- Karma HOWTO documents are targeted towards use with the Windows operating system, this one is not dependent on the OS used to access Slashdot.

    This Anti- Karma HOWTO is a joke.
    __________________________________________________ ____________________

    Table of Contents

    1. Introduction
    2. Tips
    2.1 Comment Length
    2.2 When to Post
    2.3 Where to Post
    2.4 What to Post - Avoiding Positive Karma
    3. Maintenance Information
    __________________________________________________ ____________________
    1. Introduction

    Your Karma rating on Slashdot lies in the hands of the moderators. This is your target, and as you'll soon find out it's quite easy to manipulate and fool them into moderating you down. By following a few simple guidelines you can soon surpass all the regulars, and eventually get down there with the best of the first post and off-topic whores.


    2. Tips


    2.1. Comment Length

    Perhaps the best tip in getting moderators to moderate you down deals with the length of your posts. It's quite simple, always post very SHORT comments and when possible, MAKE IT IN ALL CAPS. Many moderators equate this with "Troll" and "Off-Topic", regardless of what you say. Furthermore, moderators are MUCH less likely to moderate you up or leave you at 1 if your post is short enough.
    Also, use those invalid HTML tags! Nothing makes your post seem like a wanna be karma whore than lack of whitespace. A really stupid signature can also help out here. It is also very important to gain all the credit you can for your trollish behaivor. Please use your account. The mail only needs to be used once
    to gain the password and if you only "FIRST POST" as AC, your negative karma will never add up.


    2.2. When to Post

    Timing is everything. Go for the gusto, spend most of your slashdot time refreshing the main page. If you wait too long to post, almost no moderator is going to have a chance to moderate it down -- no matter how bad your post is! As a general rule of thumb, any comment posted more than 15 minutes after a story is submitted will not be moderated one way or the other (Trolls: this is your chance!) Open a text editor and have your first post, rant or other completely off-topic comments PRE-WRITTEN and copied to the clipboard. This will save valuable seconds while you race for the prize! Be creative! Dont just tag a line that says "First Post Dude!" or something lame like that. Look at the true first post leaders. Mick the First Post Mastah, McDougal the Llama, Trollmastah, Natalie Portman Guy, and the other regulars. They seem to have style and are generally much more likely to be moderated down because of it.


    2.3. Where to Post

    After no extensive lab research in Slashdot moderation, some key information was made up. Make sure all your posts are not top-level posts! I cannot stress this enough. Anything posted more than all the way down, won't get seen, and you'll waste all your effort. The only exception is replying to the first batch of comments, since they're sometimes moderated more thoroughly. A bottom-level post is 16 times more likely to be moderated down than a reply!
    Under current moderation practice, the first two comments are often marked as "Redundant" if they're not first-posters. Yes, I know this defies the very meaning of the word redundant, but many (not all) moderators don't seem to understand what redundant means. Leave this area alone. People will just ignore it and your post will not be noticed. This happens so often that one begins to think it's automated. Thus, strive to post first or second -- all true Anti-Karma whores know that First post is prime real estate.


    2.4. What to Post - Avoiding Positive Karma

    While the contents of your post aren't quite as important as comment length, it does play a large role in the fate of your post. There are a number of rules to follow when submitting posts to earn that coveted low Karma:

    1) Always take sides. Nothing will get you marked as "Flamebait" faster than a controversial comment (ESPECIALLY very short to short length comments, one liner posts are generally OK regardless). Always think you can take the popular side and get moderated down. For example, it used to be possible to take a side against Windows, or take sides against Microsoft. This is no longer the case - there are too many slashdotters now who have moderator access and use Windows. Posting an anti-Windows comment will even get marked as "Flamebait" faster than a anti-Linux post these days! Go for it! Slam both sides! a good link for this is Scott Pakin's automatic complaint-letter generator You should keep the drivel down to 2 paragraphs of less though.

    2) Never Stay neutral. A good way to get moderated down in almost any thread is to never summarize both sides of the issue in one post. Not only are these posts generally shorter, but they can even be moderated down as "Flamebait"! Similarly, posts with subjects like "it's all about choice!" seem to play well with the moderators, avoid these. Make yours creative. Use subjects like "OH YOU SUCK" or "I THOUGHT SLASHDOT WAS FOR X" These will help you on your ride to the bottom.

    3) Never come across as insightful. Nothing will make you appear more insightful than going against the trend of the first 25 posts or so (this doesn't conflict with #1, read on). This does mean you have to take sides. A good subject example of this faked-insight post is "Missing the point", in which you explain all the previous posts are overlooking the big picture. Avoid this at all costs. Also keep you comments as negative as possible. "I agree" should never appear in your posts.

    4) Use a Flamebait comment subject. Unless you're Natalie Portman Guy (Anti-Karma God) and can get low Karma using "xxx Natalie" as your subject, you'd better follow some guidelines. Subjects like "This is a crock of shit (TM)" are generally good if your post is fairly short. Others that are moderated down included subjects with some type of quote or cliche (e.g, "Linux Sux", "Bill Gates Rocks!", or anything cheesy like that)

    Another tactic that has recently become useful is starting your commentary or subject with "News For Nerds? Stuff that Matters?..". Don't worry - you will not have to post anything controversial, moderators will reward your trollish subject regardless of what you say!

    5) Find related sites to the issue at hand and post broken links as soon as possible (remember, if you don't, someone else will!). You don't have to go all out, they can be general links that dont relate to the article. Links to AOL, Pron or to your own company really work well, especially if you make the "Spammish" in their appearance. Things like "Surf the net and make money! Come to my site at HTTP://Site.com". Also only embed your links some of the time. Inconsistancy really gets their panties in a wad. Most moderators will mark it as "Redundant". Remember, always have your comments pre-packaged! without even checking the URLs!

    Also, if someone beats you to the first post with a list of URLs, all is not lost. There's still a wonderful opportunity for some Anti-Karma. An excellent strategy is to reply with "you idiot, here are the corrected urls", in which you lie and say the links they gave were wrong, and you have the correct ones.

    6) Allways paste a portion of the sniglet of the article with a little commentary such as "You Suck" or "KEWL". This will always show that you didn't even click the real link to the article and shows all that you just copied and pasted from the top of the thread.


    3. Maintenance Information
    If you have any other ideas or tips for this Anti- Karma HOWTO, feel free to share them and they may be added to this document.

    3.1 Contributors

    Thanks to the creative first posters and all the trolls for their suggestions to this "Slashdot Anti-Karma HOWTO".

    1. Re:Anti-Karma by Anonymous Coward · · Score: 0

      Hmmmm.... I suppose when you find gainfull employment you won't have all this spare time anymore, but alas... I did find that pretty amusing.

    2. Re:Anti-Karma by tak+amalak · · Score: 1

      This has been one of the most amusing posts I have read in a long time. Give him a break... at least he's not MEEPTing or pouring hot grits down his pants.
      --

      --
      Don't lead me into temptation... I can find it myself.
    3. Re:Anti-Karma by Anonymous Coward · · Score: 0

      These meta topics about one's ass should be filtered out. I mean why should I have to read this shit at level 2? I'd prefer not to look at these rehashed offtopic topics.

    4. Re:Anti-Karma by Anonymous Coward · · Score: 0

      Yo Bozo, didn't you just read? If you want to gurantee that you will be re-incarnated as a cockeroach, you have to post non-anonymously.

      Now you have to start all over again, take your 100 points back.

    5. Re:Anti-Karma by Anonymous Coward · · Score: 0

      Hey, I LIKED The Glorious Meept! The grits and Natalie Portman stuff are all one-shot-at-best attempts at humor that haven't shown any originality in a long time (if ever), but at least The Glorious Meept! was an original. I mean, how can you help but laugh at stuff like, "The Glorious Meept! would like to combine all the divided factions of Slashdot into one big glorious divided faction"?

      Of course it could just be like disco nostalgia, fondly remembering something that was just plain annoying at the time. I suppose in a year or two we'll all be wishing the Natalie Portman posts were the *least* annoying thing on /.

    6. Re:Anti-Karma by Anonymous Coward · · Score: 0

      Too bad this is a blatant ripoff of the Karma HOWTO. Funny anyways though...

    7. Re:Anti-Karma by Anonymous Coward · · Score: 0

      I suppose in a year or two we'll all be wishing the Natalie Portman posts were the *least* annoying thing on /.

      They already are.

      I propose we create a new site: meept.org. We'll post deliberate flamebait articles and spend all day trolling.

      Of course, the site will eventually be ruined by slashdotters posting "serious" discussions.

    8. Re:Anti-Karma by Anonymous Coward · · Score: 0
      Thank you Captain Obvious

      I think it is supposed to be.

    9. Re:Anti-Karma by Anonymous Coward · · Score: 0

      If you don't want to look at replies to offtopic posts, just create an account, go into your preferences section, and tell it not to re-parent comments. Now stop complaining.

  3. The exploit by Kaht · · Score: 1

    Is this something new, or did they just not bother to fix it?

    Is this sort of exploit a wide-spread problem, or did they just goof up?

    --
    Devilled Eggs - A disturbing little creation of mine.
  4. They don't seem too happy about it... by Phizzy · · Score: 1

    The box seems to be up, with this message:

    We had a sudden influx of script kiddies. Page temporarily offline until the machine is fixed.

    This machine resecured courtesy of drow

    I guess they're a bit irked about this latest hack.

    I am totally impressed that this server stayed up and uncracked for such a long time. That is, after it woke up from its slashdot-effect induced coma.

    I think more companies should do this with their beta products. It would be a great thing for companies to start putting up beta versions of their servers, securing them the best they can and opening them up for attacks. This would let everyone know if the server they are about to install can withstand the force of everyone throwing what they've got at it. If more companies started creating these open targets, it would also create a situation where anyone who did not would instantly be up for scrutiny. What better method of peer review for a software project. That, and open hacking wars like this are just plain fun.

    //Pre-Coffee Phizzy



    --
    "Most European technology just isn't worth our stealing," -- Former CIA chief James Woolsey, referring to Echelon
    1. Re:They don't seem too happy about it... by JustDan · · Score: 1

      Making machines available for attack on the net does nothing to increase the security of a product.

      In a perfect world, it would, but the fact is that the people with the smarts to find the security holes in a product are not the ones that respond to such "cracker challenges". Every once in a while, the Hacker News Network has a news item on some (cr|h)acker challenge, in which they decry such activities much more eloquently than I can. I'm pretty sur ethey have a Buffer Overflow about it too....

      --
      If this were a sig, you'd be reading it
    2. Re:They don't seem too happy about it... by WNight · · Score: 3

      To be precise, if you have a hacking contest where you pay $x to the winner, if the computer is not cracked, all you have proved is that the machine is not crackable in that ammount of time, by anyone who values $x more than a potential $x * n, where n is the number of potential juicy targets running this system, or by anyone who values $x more than being anonymous.

      So, if you offer $10k for a two-month contest to crack into a potential bank security system, you may get a few bored people playing around with it, but the real devious people will wait till it's "proven" uncrackable, and they'll crack into the bank running it, perhaps getting away with more money.

      This does produce semi-valid results, for small values of 'n', the number of potential juicy targets, or very high values of $x... If Microsoft paid $1M for 'arbitrary binary' exploits on Win9x, they'd get a lot of takers, because $1M is more than you'd probably get in any reasonable win9x attacks, because nobody uses win9x for anything important. Similarly, if you only had one system, and $x was high enough to rival any potential gains from cracking the system later, you might get people seriously trying.

      But, over all, it's a publicity stunt. You aren't guaranteed to get the same people trying, or with the same motivation, so you can't expect the same results.

  5. /incoming == security breach??? by anonymous+loser · · Score: 1

    That doesn't make sense to me. I mean, I assume that the ftpd does a chroot() to the top-level ftp directory. This, by itself, does not explain how someone got root on the machine.

    1. Re:/incoming == security breach??? by elixir · · Score: 2

      he exploited a buffer overflow in proftd. since the machine was a ppc, no one could use the pre-written expliots... the winner rewrote the exploit in ppc assembly.

      --
      -- The intelligence on this planet is a constant, but the population is growing. --
    2. Re:/incoming == security breach??? by bmetzler · · Score: 2
      That doesn't make sense to me. I mean, I assume that the ftpd does a chroot() to the top-level ftp directory. This, by itself, does not explain how someone got root on the machine.

      Yes, it'd be nice if it was explained how the hack worked, like the PC Week hack was documented.

      -Brent
    3. Re:/incoming == security breach??? by Emphyrio · · Score: 2

      a world writable ftp directory exposes a remote root vulnerability in this version of proftpd.
      Check your standard script kiddie sites (i.e. rootshell, securityfocus et al.)..

      Emphyrio

    4. Re:/incoming == security breach??? by elixir · · Score: 2

      See the following article.

      --
      -- The intelligence on this planet is a constant, but the population is growing. --
    5. Re:/incoming == security breach??? by Anonymous Coward · · Score: 0

      Breaking out of a chroot(2) jail per classical POSIX semantics is trivial if you're root. It offers a false sense of security unless the implementation of chroot(2) in itself implicitly calls chdir(2). Also, mknod(2), mount(2) and several other system calls should be restricted. In short, if you're root, chroot() doesn't really matter. OpenBSD has remedied this in many ways, but their implementation is sadly the exception rather than the rule.

  6. awesome by jdonofrio99 · · Score: 1

    there's always a way to hack a machine. just takes a while to find it i guess. Still, to keep a /incoming directory open was pretty damn stupid if you ask me.

  7. Re:proftpd has had at least five releases since... by Anonymous Coward · · Score: 0


    pre4 is old. they are at pre8 or pre9; and each
    interim release has had security fixes such as
    this...

    If they had just visited the proftpd site once,
    they would have seen the dire warnings to update
    to the newest version.

    mark

  8. I'm a little surprised... by jd · · Score: 4
    Warnings about possible security risks of setting -any- anonymous account writable have been around for a while. Even SATAN, which is hardly new, used to complain viciously about that one.

    On the other hand, regularly sweeing crack.linuxppc.org with security scanners, to see if there are any holes there could be construed as cheating, as it would present a moving target, which is virtually guaranteed to stay ahead of all currently-known exploits.

    However, this -does- show the importance of such sweeps, for mainstream machines, and why it's important to take advisories seriously, either from a scanner, CERT, securityfocus, or the developer.

    If you download a package off Freshmeat, which has a huge warning sign glued onto the announcement saying "DO NOT HAVE WRITABLE ANONYMOUS ACCOUNTS", I'd be willing to bet that the developer isn't asking for a plate of scrambled eggs, grits and toast.

    --
    It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    1. Re:I'm a little surprised... by dmiller · · Score: 1

      On the other hand, regularly sweeing crack.linuxppc.org with security scanners, to see if there are any holes there could be construed as cheating, as it would present a moving target, which is virtually guaranteed to stay ahead of all currently-known exploits.

      Why would this be cheating? Any competent sysadmin should be doing exactly this. ProFTPd has had multiple vulnerabilites found since 1.2.0pre4, all of which were reported to bugtraq and other places.

      IMO the organisers of the contest have let the Linux community down by leaving a known vulnerability on such a prominent box. I hope that they weren't relying on the obscurity of PPC shellcode for security.

    2. Re:I'm a little surprised... by cale · · Score: 1

      They didn't let the community down, the whole point was to prove how secure a standard DEFAULT install was. I think it did rather well, I don't know how well redhat 6.1 would fare in that same type of contest.

  9. Speaking of proftpd by Kaht · · Score: 1

    It's avaliable here: here and the website is here.
    Funny how Freshmeat's description of it is
    "Advanced, incredibly configurable and secure FTP daemon"
    This will probably be counted against them, despite it not really being their fault.

    --
    Devilled Eggs - A disturbing little creation of mine.
  10. why it took so long by jnazario · · Score: 4
    hi all,

    it took so damned long not because a hack didn't exist (ProFTPd has been vulnerable for some time) but because the standard method used to crack the, a buffer overflow, probably wasn't written with PPC assembly in mind. most BO's out there are for x86, with a good number for SPARC, as well, but ony recently did some PPC shellcode (along with Alpha shell code) get put out in wide release. after the ProFTPd crack was well known, it became, unfortunately, more of an exercise of security through obscurity.

    a link to a recent piece on PPC shellcode is at http://packetstorm.se curify.com/papers/unix/ppc.shellcode.txt. i just checked for proftpd exploits on packetstorm and found quite a few; the presence of a writable incoming/ directory helps a LOT.

    so, it still took longer than most challenges out there, and that's why i like LinuxPPC for various servers. that and they're just damn fast.

    --
    jose nazario jose@biocserver.cwru.edu
    1. Re:why it took so long by drow · · Score: 1

      Well, first of all, that's interesting - I didn't know any PPC shellcode had ever been publically released. Mine is a bit shorter than his because I took a different approach to avoiding NULL bytes, and I also had a different set of character restrictions to deal with. I handled the caches explicitly instead of counting on luck to get them right; my experience was that the cache would NOT get them right. While I rewrote the whole thing, I owe Anthony Tong a big thank-you for the initial attempt at shellcode that I based mine on.

      There were a bunch of other interesting aspects to the exploit itself; I'll write it all up in a week or two when I get back from vacation.

      As for DJ-Serra0... I can tell you exactly what he did. I made a stupid mistake when I left myself a way to access the machine, and he found my stupid mistake. He hacked my carelessness, not crack.linuxppc.org.

  11. HTML Generator vs. "wrote exploit" by r2ravens · · Score: 1

    Something looks a little hinky here. Is it just me, or do these thing not seem to match:

    "he exploited a buffer overflow in proftd. since the machine was a ppc, no one could use the pre-written expliots... the winner rewrote the exploit in ppc assembly." -comment by elixir

    "meta name="GENERATOR" content="Microsoft FrontPage Express 2.0"" -from attrition.org mirror of cracked page

    Is it odd that one who is capable of writing in "ppc assembly" would use FrontPage.

    IANAP (I am not a programmer), but I do write all my HTML by hand. This sounds funny. Am I wrong... or missing something?

    This is an honest question, not intended to be a troll.

    Russ

    --
    War is Peace. Freedom is Slavery. Ignorance is Strength. - George Orwell or George Bush?
    1. Re:HTML Generator vs. "wrote exploit" by Kaht · · Score: 1

      I'm quite capable of writing my own HTML, but sometimes it's easier to use, say, an image map maker, or an html generator like netscape's... it may save time (though rarely does)

      but I use it because layout it easier that way.. instead of saying, make it this many pixels right, I just click the box and drag it.. dont have to write, check, edit, check, etc until it's just right. that doesn't mean I'm any less adept at programming.

      --
      Devilled Eggs - A disturbing little creation of mine.
    2. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      I believe that the page on attrition.org is by one of the script kiddies who followed the actual cracker in, using the backdoor he installed.

    3. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      Sounds like you're guilty of trying to control page layout. Just post a gif if that's what you want. You aren't supposed to be talking about pixels.

    4. Re:HTML Generator vs. "wrote exploit" by Bud · · Score: 1
      Is it odd that one who is capable of writing in "ppc assembly" would use FrontPage.

      Not really. A tool is a tool is a tool. If you want to produce a smart-looking web page in no time, FP is excellent. FP sucks if you want to produce nice HTML code, host your web site on non-MS servers or view it with non-MS browsers.

      --Bud

    5. Re:HTML Generator vs. "wrote exploit" by Steve+X · · Score: 1
      That is certainly true, but for something like the cracked page, there's very little in the way of image maps or anything even remotely complex.

      but I use it because layout it easier that way.. instead of saying, make it this many pixels right, I just click the box and drag it..

      This is very true, but again, you talk of layout when there wasn't any. I'd think it would be easier to use pico on the remote box (or something equally simple) than to whip out a WYSIWYG and have to ftp it over. I mean, really... Frontpage?

    6. Re:HTML Generator vs. "wrote exploit" by elixir · · Score: 1

      correct

      --
      -- The intelligence on this planet is a constant, but the population is growing. --
    7. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      If you want to edit, use an editor.

    8. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0
      FP sucks if you want to produce nice HTML code, host your web site on non-MS servers or view it with non-MS browsers.
      As Tim Berners-Lee said: ``Anyone who slaps a `this page is best viewed with Browser X' label on a Web page appears to be yearning for the bad old days, before the Web, when you had very little chance of reading a document written on another computer, another word processor, or another network.''

      In others words, FP is inherently fucked up, evil, and wrong. Its users are addicted to the poison milk from teat of Microsoft. Its victims are the whole world.

    9. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0
      I'd think it would be easier to use pico on the remote box
      I'd rather use an editor. :-)
    10. Re:HTML Generator vs. "wrote exploit" by Kaht · · Score: 1

      Looking at the cracked page, you're definately correct. I have no idea why he would do that... I mean, given that it was all text, simply putting a .html extension on a text file would've worked. Any other ideas on why he might've done this, other than he doesn't know what he's doing?

      It's possible that he's a programmer, and still just doesn't know how the WWW works, I guess... perhaps he had front page lying around on his computer, or one nearby, and used it rather than going to a website and checking the HTML to figure out how it works. Also, perhaps he thought it'd be a complicated language, and wasn't about to waste his time trying to learn it... I've never seen COBOL, but I still think it'd be difficult to learn in a short period of time.

      --
      Devilled Eggs - A disturbing little creation of mine.
    11. Re:HTML Generator vs. "wrote exploit" by Relforn · · Score: 1

      In other words, Front Page is very, very, very Politically Incorrect!

      Grrr! Grrr! Bad, bad Front Page! Grrr! Grrr!

      (insert doinky sound clip of Martin the Marvin saying "you are making me very, very angry!")

    12. Re:HTML Generator vs. "wrote exploit" by evilpenguin · · Score: 2

      If I read the lead article correctly, the defaced web page was done by someone else after a back-door had been installed by someone who wrote a PPC exploit of the proftp hole. In other words, FrontPage boy had to be let in by someone who knew how to do something... Mind you, I'm just interpreting the lead story -- I do not have firsthand knowledge.

    13. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      Not true... I know quite some people who can hack (I can't) but ask me or someone else to put together a HTML page.

    14. Re:HTML Generator vs. "wrote exploit" by dillon_rinker · · Score: 2

      Several others in this thread have already made comments amounting to "a tool is a tool", so I'll chime in with this. I have a friend who is fluent in 486 assembler (he does embedded control work). He also knows C. I ask you, why would someone who knows assembler use a compiler to create binaries?

      I know how to use a screwdriver to turn screws by hand. I prefer a variable-speed drill with a screwdriver bit. A $39.95 Black & Decker works as well as a DeWalt.

    15. Re:HTML Generator vs. "wrote exploit" by mcc · · Score: 1
      yeh but the funny thing here is that it WASN'T smart-looking. it contained nothing more than three

      s and a . Obviously anyone who would use MS Frontpage to do something _that_ simple doesn't know ANY html at all. Which is the original poster's point, that anyone who knows ppc assembly would know enough html that it would be _much easier_, at least for the level of simplicity in this page, to open notepad and do it there.. a tool may be a tool, but there are times where what you want to do is simple enough that an automatic tool like frontpage becomes more cumbersome than helpful..

      Of course since the people responsible for attrition's version apparently didn't know PPC assembly after all it's a moot point, but whatever.

      --
      Irritable, left-wing and possibly humorous bumper stickers and t-shirts
    16. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      > I think the guy probably meant it as a joke. Or maybe to cast irony on the fact that a microsoft dude hacked linux.

    17. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      `notepad'? Pardon me as a I vomit. Even Microsoft's victim deserve a real editor, and can get one. More than one, actually.

    18. Re:HTML Generator vs. "wrote exploit" by w3woody · · Score: 2

      You're not missing anything; HTML and PowerPC assembly are two different languages. Hell, it would like me sniffing my nose at you because you couldn't code in Cobol or something else equivalently useless to you where you work...

    19. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      Where is the logic? If one knows X how does that make him or her know Y.

    20. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      Exactly. It's people like him who make pages that look like sh*t on my monitor (running at 1280x1024). Resolution and pixels (other than image size) don't play well with a medium that can be viewed at as low as 40x24 (text mode) or as high as 4000x2000...

      [center] is ok, x,y positioning just plain well isn't...

    21. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      another one for the rocks/sucks o meter:

      I would have to say that PICO ROCKS!

      Don't dis the world's easiest editor! So little to learn... :-)

    22. Re:HTML Generator vs. "wrote exploit" by Anonymous Coward · · Score: 0

      Yeah, the Black and Decker is great - The first time you use it.

      I talked to someone who was in the business of selling tools, especially drills. He basically explained to me why all of today's Black and Decker equipment is only a small step up from Sears quality. Old B&D stuff was not bad, but today's stuff uses plastic housings, single insulated cables, and barely enough fan action to keep the commutator cool.

      DeWalt is instead, a relatively high quality tool (according to him). They don't cheapen the tool to the point where after 20 or 30 uses, it'll break.

      Sounds like Frontpage is like Black and Decker, after 10 or 20 uses you can probably expect a GPF or a Blue Screen. Pico or Vi are like the DeWalt, they don't break after 10 or 20 uses...

    23. Re:HTML Generator vs. "wrote exploit" by lassie_bst · · Score: 1

      Not to mention the Dewalt is made by b&d just there "high" end line.

    24. Re:HTML Generator vs. "wrote exploit" by friedo · · Score: 1
      IANAP (I am not a programmer), but I do write all my HTML by hand. This sounds funny. Am I wrong... or missing something?

      Yes, you are. The page you saw there was cracked by a script kiddie who used a backdoor installed by Mr. Jacobowitz when he used the buffer overrun in ProFTPD. I don't know if Jacobowitz even defaced the page at all, if he did, I didn't see it. But the message you see there was NOT done by him.

    25. Re:HTML Generator vs. "wrote exploit" by drewpt · · Score: 1

      I ask you, why would someone who knows assembler use a compiler to create binaries?

      Less code to write.

      Less code is associated with easier to debug/easier to maintain (not all developers are fluent in ASM).

      I develop in both Intel ASM and C. Unless I NEED the speed of ASM, I use C.

  12. software problem, not writable "/incoming" by jetson123 · · Score: 2
    Being able to write information (through ftp or otherwise) on a public server in some form or another is often an essential part of its function, and the rule "don't have publically writable directories" simply doesn't make sense.

    In this case, it appears that the ftp daemon was buggy, and in this particular case did the wrong thing with a writable /incoming directory. The solution is to run a different FTP daemon or to fix the bug.

    In part, the responsibility for this lies with the ubiquitous use of C for Linux system programming. Guarding against buffer overflows in C is a lot of work, and it is humanly impossible to catch all the possible problems in a large program. C++ helps a lot with its string class. Writing servers in Java, Perl, Python, Eiffel, Ada, SML, or many of the other languages with runtime checking is even better.

    1. Re:software problem, not writable "/incoming" by Cramer · · Score: 1

      Oh spare me your bullshit. Buffer overflows happen everywhere (even in assembly.) It's fairly trivial to audit code for overflow problems.

      The true problem is not the compiler or the language. It's the idiot with the keyboard writing the program in the first place. Everyone wants to flog Microsoft for their unbelievably stupid programming, but no one every has a bad word about anyone else's (open source, freeware, GPL, et. al.) bad code. If you think about what you are doing, then you don't have these problems.

    2. Re:software problem, not writable "/incoming" by WNight · · Score: 2

      Not true.

      And I'm not a bullshit OOP bigot. I do 90% of my 'real' code in C.

      In C, if you read a string of characters, you need to have space allocated for it. You can either read a set ammount and truncate, or read a variable ammount and auto-allocate.

      But, whatever you do, you need to do it yourself. You can't simply say "string data; data stdin;" and get the whole string, to the limit of available memory.

      You can code a routine to do this, anyone who writes anything which accepts user input has probably written a reusable 'safe input' module. But, you still have to do it yourself.

      And you have to do it EVERYWHERE you look at data. You can't make any assumptions. If 999 of 1000 expected comma seperated integers are integers, the 1000th might be something else entirely, consisting of non-numeric characters. You need to check for nor just the correct inputs, but ALL forms of incorrect input. And then, you need to attach basic error handling to all of these.

      If a fucking pain. A good half, at least, of anything I write is spent in input checking, even when the actual input it done in a couple of lines, and could be scanned with a few scanf()s (albeit badly.)

      It's not a good reason to switch to what might be a more crippled language, just because that language keeps you from making errors, but you need to recognize the weaknesses of your tools or you can't work past them.

    3. Re:software problem, not writable "/incoming" by Cramer · · Score: 1

      It doesn't matter how much magic C++ hides from you, it's just as prone to bugs. You're still going to read in an unknown amount of data so you don't know how much space to allocate. Data from an untrusted source should be untrusted - period. All the C++ string crap does is provide a Microsoft-like uniform bug. It makes it even easier for the programmer to not care about what is being done.

      If one does not think about security when writing one's code, then I can assure it has none. Outlook is very good example -- nobody thought about what kind of evil lurks on the internet.

      "If you cannot trust your users, who can you trust? Exactly."

    4. Re:software problem, not writable "/incoming" by Another+MacHack · · Score: 1
      It doesn't matter how much magic C++ hides from you, it's just as prone to bugs. You're still going to read in an unknown amount of data so you don't know how much space to allocate.

      The whole point is that it can keep track of how much data it's reading, and keep allocating space as needed. You can do this in C too, but apparantly not everyone does. If it were trivial to do, then there wouldn't be a problem with people not doing it. Any language with umpteen different ways for a programmer to smash the runtime system is going to have problems. (Drinking Game: read the ANSI C spec, and take a drink every time the effect of a particular action is said to be "undefined")

  13. attrition by heh2k · · Score: 1

    anyone have the original modified page? one of those asshole kiddies decided to rm -rf the site. imnho, attrition shouldn't mirror the script kiddie version.

  14. MODERATE THIS DOWN by Anonymous Coward · · Score: 0
    Please Moderate this down, so we dont have to look at it at level 2!

    Thank you.

  15. I guess someone had a bad xmas by pivo · · Score: 1

    A little humor got your shorts in a knot?

  16. attrition.org page by little_blaine · · Score: 4

    The defaced page posted by attrition.org is NOT what was done when the machine was first cracked. AFAIK, the web site wasn't defaced when Dan Jacobowitz first cracked the machine, but Dan left a back door open for script kiddies to exploit and said kiddie went and did his "look at me I'm so cool send me email via hotmail - page created with frontpage" act.

  17. Suggestion: by gnarphlager · · Score: 1

    Toolbox. I do alot of HTML (it's what I do for a living), and rather than deal with the subtle annoyances of an editor(I've yet to find one that lets me tailor all the automated tags) I keep a few "toolbox" text files with commonly used scripts and tags (particularly complicated tables and generic headers). Less time is spent typing when you're cutting and pasting, and you can spend more time working out the gritty bits. The only drawback is it's easy to not want to write ANY new code . . . just rehash old stuff. Then again, I've spent all morning refining a JavaScript search I wrote, and it's almost pretty as well as functional ;-)

    and this way you can keep your "text editor" pride ;-)

    --

    Bad things often happen to good people,
    It is up to them to see that they remain good.
  18. Check out the archived version's HTML by Oscarfish · · Score: 1
    From the HTML of Attrition.org's mirror :

    meta name="GENERATOR" content="Microsoft FrontPage Express 2.0"

    I wonder if this is how Attrition.org created the page, or if the hacker but up the "I won" message with it. That would be awful, wouldn't it, a version of Linux hacked on a Microsoft machine? And posted via FrontPage, arguably the worst HTML program available? Just give me pico :)

    --

    --------

    Oscarfish.com: tropical fish with attitude. Way t

  19. One of these days dist maintainers will wake up by Greyfox · · Score: 3
    I get pretty thoroughly annoyed by the assorted Linux dists that by default enable every damn server ever made. By doing so, they increase your security exposure immeasurably. New users of the OS will either never use those services or they'll open further security holes by allowing all their friends to log in. To make matters worse, most dists merrily setuid any program where the author claims it needs setuid, meaning those new users may as well be giving their friends root, because once you obtain a shell login on the machine, root becomes trivial to obtain.

    A far better solution would be to not install ANY servers by default -- let the user go in and install them after the install if he wants them. For people with a legitimate need, most dists allow you to create a list of packages to install, which should work fine for any large shop that actually needs those services installed. At the same time, make it much harder to obtain a setuid bit in a standard dist. Anything that gets a setuid bit should be subjected to a source code audit to make sure that at the very least no simple buffer overflows (Such as the one that compromised this machine) exist in the software. Closed source programs should probably never be allowed an setuid bit as closed source programmers tend to be sloppier and their source isn't open to review.

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

    1. Re:One of these days dist maintainers will wake up by WinTired · · Score: 1

      Couldn't agree more! I'm new to Linux, but when I saw all the services running in my machine, all turned on by default, I decided I won't boot it Linux with a phone cable even close by until I've figured out what each and every one of those services do. It may not be "cool", but at least no one is touching my SAM, that's for sure.


      -------------------------

      --

      -------------------------
      "People ask FAQs all the time". - David Allen

    2. Re:One of these days dist maintainers will wake up by Cramer · · Score: 1

      Amen brother! They might as well add a checkbox/option for "install every known security flaw and a few no body knows about" along side the "[dist] backdoor" button.

      Every time I install Redhat, it takes about 5 minutes to install (read: waste 1.3G of drive space) and then an hour to remove the brain damage and other worthless crap it installs.

      I really miss the simplicity of SLS!

    3. Re:One of these days dist maintainers will wake up by Anonymous Coward · · Score: 0

      SLS.... Well, Slackware exists. Give it a whirl. You'll still need to disable stuff, but it is pretty easy. Edit inetd.conf, and a couple of little things in rc.d, and you are set. :-)

      I also wish in slackware you had to edit things to turn services ON, not off...

  20. Dan's Crack by mhatle · · Score: 5

    A lot of us were on IRC when Dan was trying to crack the box. He realized the exploit in ProFTPd, but it still took many days to come up with the shell code.

    Shell code on a PPC is much more difficult to do then intel due to the multiple caches.

    Dan intentionally didn't deface the page, all he did was add his name to the end of the credits and update the "cracks" to 1. :)

    It was a pretty amazing crack exploiting not only the program, but how the CPU controls the cache. Especially when he could barely use GDB on his own machine to debug it. (GDB got confused with the discrepecies in the cache, and the out of order execution of the CPU.)

    Congrats Dan! (FYI Dan hacked into the machine well over two weeks ago..)

    1. Re:Dan's Crack by Nick+Mitchell · · Score: 1

      PowerPC's are not out-of-order...?

    2. Re:Dan's Crack by Anonymous Coward · · Score: 3
      In response to all the posts on this, I felt it would be best to give people a bit of a timeline of what happened when. Please note, I am a Fine Arts Major with hardly any low-level computer experience, so even though he talked about *how* he was doing it frequently enough, I didnt understand more than 2% of it.

      Wednesday Dec 15th:
      Finals are over: Dan gets started.
      Friday Dec 17th:
      Dan sucessfully cracks the Machine. Increments Number of Cracks, adds name to Credits, and waits to see how long it takes for someone to notice. Leaves self back door in form of open port to telnet to.
      Thursday the 23rd:
      I notice the change of the website to what is currently hosted here, and emailed Dan about it. (on a side note, I'm not trying to take credit for notifying him first. I'm just stating what I saw)
      by Friday the 24th:
      Dan resecured the site.

      Signed,
      Mike
      The guy who lives next to Dan.
    3. Re:Dan's Crack by Anonymous Coward · · Score: 0

      True, this poster doesn't have a clue.

    4. Re:Dan's Crack by Anonymous Coward · · Score: 0

      is that a question or a statement? yes, ppc is out of order exec

    5. Re:Dan's Crack by Nick+Mitchell · · Score: 1

      I'm sorry it was a statement: PowerPCs are not out of order.

      The question mark was me wondering why the poster thought they were.

  21. Flooded by MrPlab · · Score: 2

    Hmm, seems their machine is being flooded.

    Straight from the website:
    We had a sudden influx of script kiddies. Page temporarily offline until the machine is fixed.
    This machine resecured courtesy of drow.

    Interesting.. maybe it wasn't truely cracked after all. Hehe, that would be neat.

    With karma issues,
    Matthew
    _____________________________________

    --
    sortakinda.ca | canadian paraphrasing.
    1. Re:Flooded by nmx · · Score: 1

      No, apparently Dan cracked the machine using said exploit and left a backdoor open for the script kiddies.

      --
      "Well kids, you tried your best, and you failed. The lesson is, never try."
  22. Packages need some way to validate security by Christopher+B.+Brown · · Score: 2
    What "the world needs" is for there to be some automated tools to help search for configuration problems of this sort.

    Something like cfengine would be usable to this end; make install should generate a cfengine script that validates the system configuration, with the option of either warning of problems or of fixing them.

    If not cfengine, then something else may be usable.

    The critical point here is for the tool used to not merely be "a shell script," as those may get diverse in style to the point of unreadability. The validation needs to be in more of a descriptive style so that it doesn't get unreadable.

    --
    If you're not part of the solution, you're part of the precipitate.
  23. 503010 login attempts? by Redundant() · · Score: 1

    503010 loggin attempts that would take about 6 days assuming they worked ass backwords at one attempt per second. I wonder what kind of password gen they used?

  24. Script Kiddie Bait. by GodHead · · Score: 3


    So what exactly does this contest prove? Not that the box is secure. All it means is that the 31337 hax0r dudes couldn't find a script to gain root. How many people actually think that the real black hats will stop trying to transfer funds from NationsBank long enough to really try and brake this machine. And even if master hackers did get root why would they bother to boast about it with some lame "U R Ow3nd!" page? Most likley they'd use the information to hack other boxes.


    So take these "security challenges" with a grain of salt. And please, no "Why doesn't every vendor do this." posts.


    G.H.
    I do not want what YOU haven't got.

    --
    Just wait till some crappy band steals your nic.
    1. Re:Script Kiddie Bait. by the+eric+conspiracy · · Score: 1


      I don't think that this 'proves' anything. However I do find these case histories interesting.

  25. linuxppc already awake by mcc · · Score: 4

    > A far better solution would be to not install ANY servers by default -- let the user go in and install them after the install if he wants them.

    i have linuxppc 1999, and they actually do exactly what you suggest. Nothing, not even httpd or telnetd, is turned on by default, and to turn it on you have to go into whatever that file is and uncomment out the lines. Meaning nothing gets enabled unless the user cares..
    which is why linuxppc makes such a big deal about their "out of the box" security, since you're no more likely to crack linuxppc "out of the box" than the proverbial server with no network connections buried in a concrete box.. there's nothing there to crack.

    i believe that the thing with the crack.linuxppc.org box specifically is that they started out with nothing enabled, and then have been slowly adding services over time in order to make hacking easier..

    --
    Irritable, left-wing and possibly humorous bumper stickers and t-shirts
  26. Did they use LIDS? by Anonymous Coward · · Score: 0

    LIDS (Linux Intrusion Detection System) provides many enhancements to the kernel that should be looked into by sysadmins. It not only provides added logging capabilities, it prevents some actions from being performed even by root!

    See the LIDS web site and mailing list for more details;

    http://www.soaring-bird.com.cn/oss_proj/lids

  27. Don't be a dumbass by Zico · · Score: 1

    You can tell FP which brand of browser you're targetting (IE, Netscape, WebTV, or a combination), which generation of browser you require as a minimum (version 3.0 and up, or 4.0 and up), which server will be hosting the pages (Apache or IIS), as well as whether or not they use FP Server Extensions. And yes, you can choose a custom option for all of those choices. Now what does this have to do with a "Best Viewed By" banner?

    Cheers,
    ZicoKnows@hotmail.com

  28. fnord by zpengo · · Score: 1

    hail eris

    --


    Got Rhinos?
  29. UNIX security is hopeless. by Animats · · Score: 4
    Look. The problem is architecture. Nothing that has servers running as root is ever going to be secure. The amount of trusted software is just too large. The problem is that so many people have seen nothing but the UNIX/NT model of the world that they don't realize there are other ways to design a system.

    There are alternative OS architectures. But they're rare on PCs.

    • Systems with "mandatory security". This is the feature that gets you above the C level in the Orange Book standards. In the mandatory security world, there is no root login, and as you increase in privilege level, you can read less and less. If you log in as the security officer, you can only read security-officer level files and use special security-officer tools; you can't use the system normally. So viruses, etc. can't leak upwards. Conversely, programs running at high security levels can't write data to lower levels, so classified data can't leak down.
    • Transaction processing OSs, the archtype of which is IBM's CICS. Think of an OS architected to run CGI-BIN programs, each in its own protected space.
    • Capability-based systems, like EROS and KeyKOS. Unfortunately, the people who write these tend to be incomprehensible. And work on EROS seems to have stopped since the key people graduated. EROS is GPL'd, and someone might pick it up and bring it up to the point that it was usable. Any takers?

      We need one widely used secure OS, just so people can see what one is like.

    1. Re:UNIX security is hopeless. by realfnord · · Score: 1

      Sounds like you want RSBAC: http://www.rsbac.de/rsbac/

      From the overview:
      "What is RSBAC?
      RSBAC is a security extension for current Linux kernels. It is based on the Generalized Framework for Access Control (GFAC) by Abrams and LaPadula and provides a flexible system of access control based on several modules.
      All security relevant system calls are extended by security enforcement code. This code calls the central decision component, which in turn calls all active decision modules and generates a combined decision. This decision is then enforced by the system call extensions."

      --

      -- Elie Rosenblum
    2. Re:UNIX security is hopeless. by WNight · · Score: 2

      Congrats on a well written explanation of how it's possible to have a more secure system...

      But, how is this possible without trusted binaries and all?

      I mean, eventually there's an account which can do disk maintenance. This account has to be able to read the HD, and thus can read all information and write it to files another user has access to.

      How do you allow ultimate access without creating what is essentially a root login with a restricted shell?

      What seems to me to be the best idea is to modify most everything so that only the barest cores of the OS run as root, everything else would run as a user. Thus TCP stack exploits could crash the TCP stack, and take the machine off the net, but they couldn't give access to anything, etc.

    3. Re:UNIX security is hopeless. by Kaufmann · · Score: 4

      In capability-based systems, users or user accounts do not "own" processes, per se. There are specific objects that do disk maintainance; these objects possess very specific capabilities that allow it to do manipulate storage, but little else. The user, in turn, acquires capabilities that allow him to tell these objects to do certain things.

      Philosophically, capability systems are much more egalitarian than ACL-based systems; they are also much closer to the real world: you don't see "root people" going around doing anything they want to everyone else's property, do you? (Well, actually, you do: they're called the police force. We're working to fix that bug by the next release. :])

      --
      To the editors: your English is as bad as your Perl. Please go back to grade school.
    4. Re:UNIX security is hopeless. by heh2k · · Score: 1

      the best thing to do is run all externally accessible daemons in chroots not running as root.

    5. Re:UNIX security is hopeless. by jnazario · · Score: 1
      i quite agree. it is hopeless, this all or none model that UNIX gives us, and Linux depends on.

      so i bet you'll love this: Orange Linux. yep, Linux to Orange Book certifications. which means adding capabilities and mandatory ACLs and the whole lot. http://www.sgilinux.org/presentations/security/ind ex.htm

      yeah, life is gonna rock. TCB's, ACLs, the whole lot. C2 and B2+ grade Linux.

      --
      jose nazario jose@biocserver.cwru.edu
  30. Re:Don't be a dumbass? by Anonymous Coward · · Score: 0

    Answer: which brand of browser you're targetting (IE, Netscape, WebTV, or a combination)

    Question: what does this have to do with a "Best Viewed By" banner?

    I can see someone answering their own question if they have a very long post, and make numerous points, but you must have the attention span of a gnat if you couldn't see THAT one.

    Let me make it a little plainer for you - HTML should not have to be targetted to a specific browser. If it's written properly, it will look good in any browser. If you have to "target" it at all, then it's not written properly.

  31. Whoa whoa whoa by FascDot+Killed+My+Pr · · Score: 2

    And please, no "Why doesn't every vendor do this." posts.

    Let's be careful with our non-sequiters, there, pardner.

    I agree that "cracking contests" like this do NOT prove you have unbreakable security. But that doesn't mean that crack attempts are useless.

    For instance, all security experts recommend that you should try to crack your own boxes to test them. How is this different?
    ---

    --
    Linux MAPI Server!
    http://www.openone.com/software/MailOne/
    (Exchange Migration HOWTO coming soon)
    1. Re:Whoa whoa whoa by GodHead · · Score: 1

      Hacking your own box or network or toaster is a Good Thing(TM). It provides great insight into the security of your box, the holes in your network, or the crumbs in your toaster. This is different. This is a marketing ploy. "see see!! Our P-32SpaceA. box is still up. We are the most secure vendor ever!!" or even worse "We had our SuperDandy brand server up and it was hacked but we fixed all the holes so we are the most secure vendor ever!!" My point is this: don't believe that just because this box was up for x days with no problem does NOT mean that your box (with different hardware and software, run for different purpose, on a different network, ect ect) will also be up for x days with no problem.

      --
      Just wait till some crappy band steals your nic.
  32. Fuck You. by Anonymous Coward · · Score: 1

    The only people who should be shot are assholes who want to ridicule someone and call them "stupid" just because they're inexperienced. Get off your fucking high horse.

  33. Frontpage? by Anonymous Coward · · Score: 0

    Did anyone else notice that the meta tags in the defaced page are from Frontpage Express? Sounds like a script kiddie to me...

  34. can't take your own advice? by Anonymous Coward · · Score: 0

    Why didn't you post this as a logged-in user and reap the benefits of that -1 rating?

  35. "Re" Moderate the parent... by Anonymous Coward · · Score: 0

    Umm, how is this -1? Offtopic, maybe, but -1? Fact is, this is how most people here feel: This is the kind of news we want here, not "Book Reviews: LEGO Mindstorm Book Review". Now, this is a private site, and the people that run it are free to do what they like with it. But if they want to keep the droves running to slashdot, it should be kept ONtopic.

    Just a thought.

  36. Too bad by jormurgandr · · Score: 1

    I learned alot from that server. They left just enough running to make it difficult, but possible. Nice to see that the greatest OS and the most powreful CPU make a good team. Too bad the people who designed it didn't make it a little stronger.
    =======
    There was never a genius without a tincture of madness.

  37. Um, aren't we glorifying crackers? Is this good? by Anonymous Coward · · Score: 0

    Posting the cracked page and giving it coverage only encourages more to crack.

  38. Moderate Cramer's post UP dammit! by jabbo · · Score: 2

    Languages, while not totally irrelevant, are often a bandaid for poor architectural, system, and policy decisions. Writing servers in Python (which is written in C) or in Java (whose JVM is written in C, and whose Java-to-native frontend for GCC is written in C) or in SML, or in Middle Welsh, or in Urdu, will not overcome all the problems of human stupidity, arrogance, and inexperience. The OpenBSD people did the Right and Boring and Horribly Painstaking thing and just audited everything in sight, which is why I'm setting up OpenBSD for my firewall and NAT box. Still, somebody else's empty promises won't keep me from getting 0WN3D, and my own auditing and hardening might not either.

    Neither will StackGuard or MultiStack or DDD or assiduous use of MemProf, Checker, Electric Fence, and GDB. People make mistakes, not only in programs to handle incoming packets, but also in automated test harnesses, in compilers, in networking code, in firmware for NICs, in (f00f) CPUs...

    I disagree with the "if you think about what you're doing" line of argument (if you think about it hard enough, your system will be infinitely secure cause you'll never write a line of code), but the "just choose a better language" schtick is even worse.

    The determined Real Programmer can write Fortran in any language. I personally stick to what I'm reasonably good at (secure distributed transaction processing) and ask other people to audit the shit out of it, then tell the users how to flog me if it breaks. If you're writing daemons for more than just fun and education (i.e. if you think you suck less than I do) I certainly hope you have similar standards... hell, I'm a systems administrator, not even a developer, but I see some real circus acts billing themselves as "developers" these days...


    As an aside, my personal take on the Kill-Microsoft bent is that people resent a company whose foundation is "We Know Best" and whose track record indicates "Actually, We Don't, But Pay Us Anyways".


    --
    Remember that what's inside of you doesn't matter because nobody can see it.
  39. Re:Don't be a dumbass? by Zico · · Score: 1

    Please tell me you're not that dense. You see, the version 3 browsers don't support HTML 4.0. Now, you're welcome to stay back in the stone age at 3.2, but you should be aware that things have advanced since then.

    Let me make it a little plainer for you - HTML should not have to be targetted to a specific browser. If it's written properly, it will look good in any browser. If you have to "target" it at all, then it's not written properly.

    That's garbage. Let me guess, you have absolutely no real world experience, do you? If you did, you'd know that you can write HTML 4.0 compliant pages 'til the cows come home, and Netscape will still choke on it. What's funny is listening to the Netscape users here bitching about some "poorly written" web page that Slashdot linked to, because it shows up mangled on their browsers. Of course it looks great on IE and Opera, but since Netscape gakked on it, they think it's a coding problem.

    I would say that the absolute best thing about Mozilla is that it finally puts W3C HTML 4.0-compliant browsers into the hands of people who've been stuck with the current Netscape releases. Because if there's one thing that's been holding back web development, it's Netscape's atrocious lack of support for standards. You just can't sit down and write some HTML 4.0 page and expect it to work under Netscape. That is the main reason why you see "Best viewed with Internet Explorer" banners: not because they're using IE-only extensions, but because they're using W3C-compliant HTML that Netscape can't grokk. Perhaps there should be a "Best viewed with Internet Explorer or Opera" banner, or even "Best viewed with anything but Netscape" for these situations. ;-)

    And there's nothing at all wrong with the way FP targets specific browser brands, because most Intranets standardize on a single browser and make use of extensions. These aren't meant to be seen on the Internet and has nothing to do with my question to the original poster, who seemed to imply that FP was capable only of producing proprietary HTML -- he quotes Berners-Lee and takes it to mean that FP is "fucked up, evil, and wrong." They have nothing to do with each other, and he's an idiot for thinking that they do.

    Cheers,
    ZicoKnows@hotmail.com

  40. Security Statistics by Anonymous Coward · · Score: 2

    This site is very interesting: If you look at "http://www.attrition.org/mirror/attrition" and check the statistics, you will find that almost 65% of all the hacked servers are running NT/IIS. However, if you check "www.netcraft.com", you will see that NT/IIS are only being used on 23.5% of all the Internet servers. This makes me wonder: How can MS claim that nobody did ever make any proof that NT/IIS is less secure than UNIX/Apache ? This is the real world proof that NT is very very insecure !

  41. How long? by mrdisco99 · · Score: 1
    Sorry if I missed it, but how long was the machine up?

    +++

    --

    +++
    NO CARRIER

  42. Still can get to other pages at crack.linuxppc.org by vrmlguy · · Score: 2

    If you want to see the original page, circa November, google still has it cached here. And, it looks like the links on that page still work, so you can go to the credits page and see both the number of successful cracks: 1 in the info box and the additional credit to And Daniel Jacobowitz, because good security isn't always good enough. near the end of the listing.

    --
    Nothing for 6-digit uids?
  43. Dan's credit page by jaso · · Score: 1

    fyi, when Dan cracked the machine, he just made a couple of tiny changes to the credits page (currently online at http://crack.linuxppc.org/credits.shtml). He changed the number of successful cracks to 1, and added this line to the bottom of the credits: "And Daniel Jacobowitz, because good security isn't always good enough."

  44. Re:ProFTPd is badly written by bad-badtz-maru · · Score: 1

    I have had the good fortune to be able to work with the developer of ProFTPd on a number of projects over the years and I assure you that he is quite competent and experienced. I suspect that you have never worked on a large scale application or you would be very familiar with the method by which bugs manage to work their way into just about any piece of software. I am curious as to your development background. It must certainly be extensive for you to so readily triumph your own programming superiority.

  45. ProFTPD by MacGyver · · Score: 4

    I'm the maintainer/developer of ProFTPD. Just a couple of notes to those who've already responded here:

    1) ProFTPD has very loud notices saying that anything before 1.2.0pre8 is not to be considered secure.

    2) On the whole, ProFTPD has had far, far, far fewer security issues and exploits out there than any other open-source FTP server. We take security seriously, and have always responded quickly to security issues. The code has undergone a couple of audits now. No, that doesn't mean it's 100% secure, but it does mean we've taken a close look at it, and are endeavoring to make it as secure as we can.

    3) ProFTPD, when properly configured, will not run as root or with root privileges except for very limited periods for specific actions. Compiling ProFTPD with capabilities support on Linux is definitely the recommended configuration.

    4) The official ProFTPD web site is www.proftpd.net.

    5) The latest version of ProFTPD is 1.2.0pre9. 1.2.0final will be out this week sometime.

  46. Closed source (was Re:One of these days..) by Trent+Took · · Score: 1

    > Closed source programs should probably never be allowed an setuid bit as closed source programmers tend to be sloppier and their source isn't open to review.

    I have to take issue with that statement. I agree that Open source has benifits in public exposure, but please don't assume that all closed source programmers are sloppier just because the public (who 99% don't look at the code) don't see the code. Code Review is an important part of ny software development (open or closed).

    --
    See old Atari's come to life stonx.sourceforge.net
  47. Funny, MS Site wasn't cracked by Anonymous Coward · · Score: 0

    I guess it is true. Win2k IS more secure than Linux.

    :-(

    1. Re:Funny, MS Site wasn't cracked by dyslexia · · Score: 1

      An os that hasn't even been released is more secure? I don't think so. When it's out and web servers use it, the bugs will start to come out of the woodwork, and keep in mind how long it takes Microsoft to fix them.

      --
      --Have a Johsonville brat.
    2. Re:Funny, MS Site wasn't cracked by Anonymous Coward · · Score: 0

      The W2k machine doesn't stay up of available long enough to crack it. MS and others don't consider DoS attacks as successful cracks. Anyone, myself included can DoS attack a sever using only shell scripts. Apparently this is all anyone is trying on the W2K site, `cause I can never even get to it.

      KH

    3. Re:Funny, MS Site wasn't cracked by Anonymous Coward · · Score: 0

      Thats because ANY os is vulnerable to DoS. Duh.

  48. Linux: 2 Windows: 0 by Anonymous Coward · · Score: 0

    Well, lets see:
    First PC Weeks Linux box was cracked.
    Now Linux PPC was cracked.
    Yet, Windows 2000 was not.

    1. Re:Linux: 2 Windows: 0 by dyslexia · · Score: 1

      You cannot speak of the security of an os that has yet to be released or used for a real web server. Rest assured, when it comes out, there will be bugs, and they will take forever to get fixed.

      --
      --Have a Johsonville brat.
  49. Re:proftpd has had at least five releases since... by Tom+Rini · · Score: 1

    ...actually, Linux/PPC has had updates for proftpd up for a while (I believe they have it up to pre8 or pre9 right now). But seeing as it was a stock machine, they didn't apply any of the security updates.

  50. Re:Um, aren't we glorifying crackers? Is this good by Darchmare · · Score: 1

    It also encourages good security.

    Plus, this was a 'legit', solicited crack. What's wrong with that?

    - Jeff A. Campbell
    - VelociNews (http://www.velocinews.com)

    --

    - Jeff
  51. Linux isn't secure by Anonymous Coward · · Score: 0

    Moral of the story: No generally useful OS is inherently secure. Security is a matter of careful configuration, whether you run Linux, Solaris, Windows NT, or anything else.

  52. Fools - Frontpage is used by Mirror admin by DrSkwid · · Score: 1





    html of page



    See - the Mirror webmaster left the attrition watermark in!
    .oO0Oo.

    --
    There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
  53. Hehe - 4got to extrans it by DrSkwid · · Score: 1









    .oO0Oo.

    --
    There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
  54. here's the code! by DrSkwid · · Score: 1



    <head>
    <meta http-equiv="Content-Type"
    content="text/html; charset=iso-8859-1">
    <meta name="GENERATOR" content="Microsoft FrontPage Express 2.0">

    </html>
    <!-- www.attrition.org web hack mirror - watermark or something -->

    .oO0Oo.

    --
    There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter