Mass Site Defacement Relied On Cheap Trick & Virtual Hosting
The mass defacement involving hundreds of Web sites by World of Hell should go into the hacking record books with an asterisk, a security expert said today. On Thursday a hacking group known as World of Hell (WoH) took credit at its site for defacing 679 homepages in one minute. A mirror of one of the defacements, as well as a list of the compromised sites, was captured by the Safemode defacement information site.
The mass defacement was done using an underground program that exploits a recently discovered bug in the Internet Printing Protocol used in Windows 2000, RaFa gained system-level access to the server and discovered that hundreds of other homepages were stored on the same computer. RaFa of WoH told Newsbytes that he used a simple program written in the Perl scripting language to automatically deface all of the sites on the server with his replacement homepage...
Mass Site Defacement Relied On Cheap Trick
By Brian McWilliams, Newsbytes
In an e-mail today to Newbytes, a WoH member who calls himself "RaFa" said he originally intended only to deface Rickymartin.com.mx, a fan site for pop singer Ricky Martin. But using an underground program that exploits a recently discovered bug in the Internet Printing Protocol used in Windows 2000, RaFa gained system-level access to the server and discovered that hundreds of other homepages were stored on the same computer.
A check by Newsbytes of domain registration records for the hacked sites confirmed that all but a few were hosted by the same Internet service provider: Wisconsin-based Ready Hosting Inc.
Ready Hosting officials were not immediately available for comment. The company's Web site says it is a leading Windows 2000 hosting service and provides domain registration and hosting service for $99 per site per year.
According to Chris Brenton, chief security officer for AlteNet Solutions Inc., a New Hampshire-based managed security provider, Ready Hosting appears to be operating a "virtual hosting" arrangement, in which numerous Web sites are stored on the same Web server.
While such shared configurations keep costs down for both the ISP and hosting customer, they can make mass defacements much easier for hackers, Brenton said.
"Once the attacker has root access to the box, all of the files for the various sites are easy to get to. Replacing the homepage of every site hosted on the server would be easy," said Brenton.
RaFa of WoH told Newsbytes that he used a simple program written in the Perl scripting language to automatically deface all of the sites on the server with his replacement homepage.
Other sites that were part of the mass defacement include Kate-site.com, a fan site for British actress Kate Moss, and Selectcreditcards.com, a credit-card marketing site operated by Syberhill LLC. Most of the 600-plus hacked sites were restored today.
Besides the risk of putting many virtual eggs in one basket, virtual hosting services, if not properly managed, can open other security holes as a result of the need to provide remote management services to hosting customers.
A port scan revealed that Ready Hosting's server had several open services, including one for the file transfer protocol and one for performing remote system control using Symantec Corporation's pcAnywhere utility.
"That says to me that convenience, not security, was their main concern," said Brenton.
A mirror of one of the sites in the mass defacement is here:
http://www.safemode.org/mirror/2001/07/12/www.tomsed.com/
.
An advisory from eEye Digital Security on the Windows 2000 vulnerability is here:
http://www.eeye.com/html/Research/Advisories/AD20010501.html .
Reported by Newsbytes, http://www.newsbytes.com .
