Hacking contest threatens websites

[RJ]

Check the tips at the end of the article to make sure your web server is secure. There will be lots of hacking going on this week.

A hacking contest slated for this weekend could produce a rash of Web-site defacements worldwide, according to a warning issued Wednesday by security companies and government Internet security groups.

advertisement


The hacker defacement contest is expected to kick off on Sunday. The contest supposedly will award free hosting services, Web mail, unlimited email forwarding, and a domain name of choice for the triumphant hackers, according to a Web site promoting the contest.


Web-site defacement points will be awarded based on the type of operating system running the Web site. Defacement of Web sites running Windows will only win a single point, while sites running Linux, Unix, and BSD are each worth three points. Sites running AIX, IBM's version of Unix, are worth three points, while sites running HP-UX, Hewlett-Packard's version of Unix, and Macintosh, Apple's operating system, are worth up to five points, according to the contest Web site.


Internet Security Systems, which operates a cyberthreat early-warning network called the Information Technology Information Sharing and Analysis Center, is urging Web-site administrators to review their Web-site security before they head home for the US holiday weekend. ISS's X-Force research group says they've received credible information that hacker groups are scanning Web sites to discover vulnerable systems. But X-Force doesn't expect any major activity until Sunday.


While there's been a recent increase in Web-site scanning activity, there's also been a noticeable decrease in Web-site defacements, said Chris Rouland, director of ISS X-Force. "The hackers are sandbagging," he said. "We've seen this before. Hackers will break in before the event and conduct the actual defacement during the contest."


The exact time the contest will start is not yet known, but the contest rules say it will be limited to six hours. X-Force is trying to determine whether the contest is being run by hacking groups from Brazil or Hong Kong, both known for active Web-defacing activity.


The contest also may be a recruiting effort, Rouland says. "This is one way to learn who are the best defacers out there" and to find out which hackers have figured out new ways to break in and deface sites, he says.


The New York Office of Cyber Security and Critical Infrastructure Coordination also issued an advisory about the contest and is asking Web-site administrators to take steps to improve security. Among the recommendations:


• Make sure that default passwords are changed. This should include Web servers and any other servers that the Web server has a trusted relationship with.


• Remove sample applications that aren't being used, such as CGI scripts and Active Server Pages, from Web servers.


• Lock down Microsoft Front Page Extensions. By default, those extensions are installed in a manner that gives every user the ability to author Web pages, even through proxy servers. This recommendation also applies to Front Page Extensions installed on Unix platforms.


• Turn Web server logging on. Logs are essential to determining how a defacement was accomplished so a recurrence can be prevented. Use of the extended log format is recommended.


• Have a current backup of your Web server. In the event of a defacement, a good backup is essential to quickly restore the server to its original look.


• Apply the latest security patches to your Web server and underlying operating system after appropriate testing.


The New York Office of Cyber Security is also guiding Web-site owners to the following resources:


Guidelines on Securing Public Web Servers


http://msdn.microsoft.com/security/downloads/tools/default.aspx


Center for Internet Security, Security Benchmarks


Free vulnerability scan

Story from
http://www.itnews.com.au/storycontent.cfm?ID=9&Art_ID=12315

 

[NameCaster]

Sounds more like a script kiddie contest

Cheers!

 

[Kodeking]

This is a good thing. I say this because, companies will now be able to see how secure they have made thier servers. If they wake up to a main page that has been changed, well, they know they need to work on security.

 

[kajutsa]

Very Interesting

 

[Nintwa]

Yeah... interesting, This looks like it will be fun... I just hope my host has a nice secure server or I am screwed. Haha. Thanks for the info!

 

[Larry]

Originally posted by Kodeking
This is a good thing. I say this because, companies will now be able to see how secure they have made thier servers. If they wake up to a main page that has been changed, well, they know they need to work on security.

This is not funny and it's not about security. It's about people who won't grow up and get a real life.

Having your server(s) hacked is a tremendous waste of time and resources for both the hacker and the hackee.

It's destructive and disruptive and the only people who do this or associate themselves with it are prepubescents and young adults who can't seem to get on with their lives.

I hope everybody who participates in this ends up with a criminal record. This is a criminal offense...not fun and games.

 

[webmasterinfo]

nice 2 now
thx

 

[CenterPoint]

Originally posted by Larry
This is not funny and it's not about security. It's about people who won't grow up and get a real life.

Having your server(s) hacked is a tremendous waste of time and resources for both the hacker and the hackee.

I hope everybody who participates in this ends up with a criminal record. This is a criminal offense...not fun and games.

Could not agree more. It would be nice to see some of these kids use their talents for good rather than destructive purposes.

 

[TheWatcher]

It was posted to BlackHat.INFO website to notify webmasters/admin.

http://www.blackhat.info/live/modul...=article&sid=4503&mode=thread&order=0&thold=0

Cheers,
tw

 

[Nintwa]

Originally posted by CenterPoint
Could not agree more. It would be nice to see some of these kids use their talents for good rather than destructive purposes.

I have heard that some companies actually hire these kids to help them secure there servers and computers etc.. I think that ift his was done more, it would be a really good way to stop kids from getting into hacking/scripting in the first place.

 

[GCgirl4ever]

Good thing I'm not getting my new server until Monday.. otherwise I would be screwed.. we'll see what happens

 

[romantic__]

I hope nobody here gets hacked or whatever. !

 

[TheWatcher]

Your server should be ok as long as you keep your patches updated and shut off services that you don't need.

Regards,
tw

 

[kohashi]

I would be more wary about this. Patches come out after these types of things, not before. I am guessing if this is a serious competition and the volume of defacing done is high, then some of you may be affected; myself included.
Hacking contests are not new, this is just the first time you may have heard of them. http://www.attrition.org used to keep track of them. I dont know if they are current any more, but it used to be a very popular 'club' almost. If you are seriously concerned and think you might be infected, pull the plug for the duration (6 hours I believe). This way your server will be fine, unless they croned the job to run... then... well hope you have a backup.
Larry: it is only natural that this will happen. It is not kids as most people percieve. There is quite a large spectrum of people who practice it. Also, if they didnt do it, someone else would. It is inevitable curiousity with a hint of destruction. Would you rather nobody practice it for a while and security holes go unnoticed? Someone would eventually notice them and exploit them to a greater degree. Face it, it is like the rain, it happens and you cannot do anything about it. Just make sure you have your umbrella.

 

[Lord]

Well, if you think about it, it would be better if they werent purposely trying to deface it, and if they were only trying to get in and show that they could. This contest could ruin a lot of sites, and possibly people's private pages, hopefully they dont go for those however, and they go for the bigger sites as they most likely 'get more points'.

 

[TheWatcher]

some security guidelines and security weblink posted in www.blackhat.info site, check it out.

It's a long story to discuss it here.

tw

 

[Larry]

Originally posted by kohashi

Larry: it is only natural that this will happen. It is not kids as most people percieve. There is quite a large spectrum of people who practice it. Also, if they didnt do it, someone else would. It is inevitable curiousity with a hint of destruction. Would you rather nobody practice it for a while and security holes go unnoticed? Someone would eventually notice them and exploit them to a greater degree. Face it, it is like the rain, it happens and you cannot do anything about it. Just make sure you have your umbrella.

It is not inevitable that this happen Kevin. If you caught these kids (and it is mostly kids...if you don't think so you need to read more about these episodes and the type of low level hacking that is being discussed here) and tossed a few of them in jail it would start to curtail this activity - better yet, throw the parents in jail and see how quickly they get control over this. Or fine the parents for the cost to restore the damage....and see how quickly hitting these folks in their pocketbook would get them to cut their kids off from the internet.

The majority of this can be better controlled if the penalties were high for the parents of the people involved. Conversation about this being helpful for security reason is BS.

This is for and about people with no parental supervision. Why? Because real hackers spend very little time on issues like defacement...that type of grade school stuff is left to the kids. The general glory of defacing was over years ago for anybody with any talent .

My servers will probably be hit...they are up to date and patched to death. But holes abound and a good backup is really your best defense in the end.

 

[NameCaster]

Originally posted by Larry

Why? Because real hackers spend very little time on issues like defacement...that type of grade school stuff is left to the kids. The general glory of defacing was over years ago for anybody with any talent .

Amen †

 

[Sohil]

Good thing.....no one has got hacked yet

 

[wicked_gal00]

Let's hope no one does.

 

[Sohil]

Originally posted by wicked_gal00
Let's hope no one does.

I think hackers got scared

 

[wicked_gal00]

:lol:

 

[Sohil]

LONDON, England (Reuters) -- Computer hackers vying in a global contest on Sunday defaced a slew of Web sites, but the damage was confined to the Internet's backwater of small, unsecured sites, security officials said.

The "Defacer's Challenge" got off to a quick start on Sunday with 300 attacks reported minutes after the 0600 GMT official start, said Roberto Preatoni, founder of Estonia-based Zone-H.org, a site that tracks hack attacks.

"There were no big names," he said. But he added his own site, www.zone-h.org, was knocked offline for much of the day because of a high volume of legitimate visitors and apparent attempts by hackers to bog down his computer servers.

According to the contest Web site www.defacers-challenge.com, which was taken offline last week, hackers were urged to prove their skills by defacing as many Web sites as possible during a six-hour span on Sunday.

Points were awarded for the number and type of computer servers they infiltrated, the rules stated.

Concern grew among cyber security organisations last week that the competition would cripple countless Web sites, but by Sunday afternoon as the event was drawing to a close there was no sign of damage among the Web's most popular sites.

The Web's largest Web sites, including Amazon.com and Yahoo.com, were functioning as normal on Sunday.

"It seems to be a damp squib," said Graham Cluley, spokesman for UK-based security firm Sophos.

Via.Networks, a U.S.-Dutch Internet service provider and Web site hosting firm that manages Web sites for over 50,000 clients in America and Western Europe, also reported no incidences.

"None of our customers have called to report any problems. It's all quiet on the Western Front," said Joanne Hughes, a spokeswoman for Via Networks.

Hacking activities have been on the rise for years as the expertise behind compromising a Web site's vulnerable computer server is freely passed around the Internet in chat areas and is posted on Web sites dedicated to the activity.

Hack attacks range from outright defacement to flooding a server with data requests, knocking a site offline. In the former case, hackers replace the contents of a Web page with their own message, often a political rant written in the signature style of broken English.

With hackers sending out challenges regularly, security officials expressed bewilderment that this contest received so much press attention, fearing it would only encourage more elaborate events in the future.

But Via.Network's Hughes saw something of a silver lining in the fact she and her team were on the ready this weekend for a possible showdown with hackers. "If it makes people more aware about security then that's a good thing," she said.

News from: http://www.cnn.com/2003/TECH/internet/07/06/hacker.day.reut/index.html

 

[Sohil]

More links to that news:

http://news.com.com/2100-1002_3-1023295.html?tag=fd_top
http://story.news.yahoo.com/news?tmpl=story&u=/ap/20030706/ap_on_hi_te/hacker_warning_7

 

[drifta]

http://www.host-rack.com

:D
:lol:
:yell: