Crackers Deface Two America Online ICQ Servers - AOL Investigating

America Online [NYSE:AOL] is investigating the defacement Monday of two Web servers operated by the company's ICQ instant-messaging unit, AOL said. One of the systems, part of a group of four machines running Microsoft's Internet Information Server that hosts data about ICQ interest groups, remained defaced this morning. The home page of the machine, located at http://icqgroup01.icq.com/ , was defaced by a group calling itself Silver Lords. The group replaced the default home page with one of its own design, which included its logo and a graphic taunting the system's administrator.

A separate hacking group known as Men In Hack on Monday added a different defaced page to the same server. The page included the ICQ logo, a green flower, with the words "hacked" flashing in red capital letters across it. That defacement was still intact this morning as well...

Crackers Deface Two America Online ICQ Servers

By Brian McWilliams, Newsbytes

The other server compromised Monday, located at http://homepage.icq.com , hosts ICQ iT, a Web and ICQ.com search engine. The site's homepage had been restored today, but according to a mirror captured by the Alldas security information site, a group calling itself "iNnOcEnT b0ys" took credit for the defacement. In place of the site's search and directory links, the group posted a simple text message.

ICQ is a free instant-messaging system developed by the Israel-based company, Mirabilis, and acquired by AOL in 1998. According to the company, ICQ has over 100 million registered users worldwide.

AOL officials told Newsbytes that the company was still investigating the break-ins.

Although the two defaced machines appear to be connected to ICQ databases, no evidence at the service's sites suggested that corporate or member data were compromised. ICQ users participating today in the alt.icq Usenet newsgroup and in the ICQ message boards did not report that their interest groups or ICQ home page data had been altered.

According to Russ Cooper, surgeon general for TruSecure Corporation, many Web site defacers use exploits that only allow them to replace pages on the server but not to invoke operating-system commands nor to install programs. But Cooper said only the crackers and AOL know whether the defacements are more than skin deep.

Efforts by Newsbytes to reach the hacking groups by e-mail were unsuccessful.

According to Alldas records, the ICQ interest groups site was previously defaced in February this year by a group called InSaNiTy ZiNe c0rp.

A mirror of the ICQ iT! defacement is here:

http://defaced.alldas.de/mirror/2001/06/25/homepage.icq.com/

The ICQ Interest Groups defacements are mirrored here:

http://defaced.alldas.de/mirror/2001/06/25/icqgroup01.icq.com/

http://defaced.alldas.de/mirror/2001/06/26/icqgroup01.icq.com/

Reported by Newsbytes, http://www.newsbytes.com .