Yes, we got hacked... AGAIN!
At about 2:00 or 2:30 pm EST we suffered a defacement-- again. The attacker managed to get control of our banner ad management system, injected SQL into the database to remove all exsisting banners except the alphaque.com one, however modified the query to show the defaced text which read as follows:
"is dis a defacemt? damn.. i was jes runnin a script, i know not wat i m doing... satan makes me do it... anyhow, greetz to L33tdawg...hehe -script kiddie"
The injected SQL also had a windows function call to log users out of their accounts after a set period of time... Obviously you wouldn't have been affected by the 'log out' sequence if you were on a UNIX based machine, but I'm sure most of you would have seen the defacement. All the same, it was pretty embarrasing to find that even with all the work we did the last time to prevent cross-site scripting as well as SQL injection bugs, we overlooked this one particular function. Word to script-kiddie for pointing out the flaw, even if I don't agree with the ethics behind the attack and the method used to show us up, at least we now know of the problem, and I'm just thankful he/she wasn't more malicious. I only got around to fixing the problem this morning since I was pretty much dead to the world (after returning from a Nokia Developers Conference held in Singapore) when biatch0 sent me an SMS at 4 am to let me know about the defacement. The banner ad bits have been removed for now until I have a little bit more time to look through the code and patch it up. Anyway, if anyone has a link to the defacement, just post it in a comment or I'll put it up a little later.
I'm really tired of all this (and the thought of actually shutting the entire site down and being done with it DID cross my mind), but I guess it's part and parcel of running a site like HITB. You just know that people are around waiting for you to slip up, so they can show you their l33t c0d1ng sk1llz. Life's like that I guess. Much thanks and love to the numerous people who e-mailed me about the defacement...
