Sometime shortly after 6AM this morning, my blog site and home page were defaced, replaced with a message reading “Happy 9/11 LOL” and a very ugly image.
I happened to be up and working and discovered the damage quickly, probably within minutes of the attack. Less than ten minutes later I had received three pieces of email and a phone call alerting me; apparently, I have enough friendly readers that even if I had not been on line I would have been informed of such vandalism within a half hour.
I have undone the damage, taken some appropriate security measures, and reported full details of the crack to the ibiblio site admins. The pinhead behind this attack is very likely to be tracked down, and had better hope the ibiblio site people find him before I do.
ESR, how do you know it will be so easy to track him down? He could be in another country without an extradition treaty to the US. Also, he could be using tor to hide his tracks.
>ESR, how do you know it will be so easy to track him down?
Sorry, I’m not going to answer that question. If you know anything about computer security you might be able to deduce some possible answers. I will not discuss, confirm, or deny any of them.
it’s damned hard to be perfectly anonymous, as the net was never designed w/that in mind
that said, it’s not impossible, if you know *exactly* what you’re doing
doing anything about it once you *have* found the perp is another matter, of course
Someone who knows exactly what they’re doing would hardly be pressed to deface sites in this manner, they have other things to do with their time. I saw the page/image, it was a really stupid gesture.
I saw the crack (a little after midnight Pacfic time, by the way) and was one of the people who e-mailed Eric. I would suggest that he run a hot lead injection attack in retaliation.
ESR, yes, I do know something about computer security. This is why I think it will be next to impossible if the attacker made minimal attempts to cover his tracks. I believe the only thing you have is the IP address and the MAC address of the attacker. Modern ethernet mac addresses are easy to spoof. As for IP addresses, what if he was using a proxy? If the attack was purely against the web server, then any HTTP proxy would have worked. I already mentioned tor. He could also have been using any of the thousands of proxies on the internet (possibly more than one); good luck getting the server logs from any of them. Another possibility is that he was using a zombie host to carry out his attack; if you, as David Delony suggests, ‘run a hot lead injection attack in retaliation’, you could be shooting a man whose only crime was that he did not have a secure system. The unwitting host does not even have to be owned; the attacker could have connected to an open wireless network with a spoofed MAC address, and then he would be practically untraceable.
>>Adriano says: Someone who knows exactly what they’re doing would hardly be pressed to deface sites in this manner, they have other things to do with their time.
Not necessarily. I have never pwn3d a b0x, and I know at least the preceding information. If the HaX0r has been in ‘the scene’ for more than two seconds, he would also know the above information. He could just be a computer-literate teenager with way too much time on his hands.
I noticed something was wrong around 11:30 PM PDT. Maybe it was Barbra Streisand’s hubby James Brolin…after all, he wished everybody a “happy 9/11” in a radio interview last year:
http://www.nypost.com/seven/09152007/gossip/pagesix/james_brolins_9_11_gaffe.htm
Then again, with less intellectual power on tap than the average script kiddie, he probably wasn’t.
Man, hackers suck…
..oh, wait… ;o)
Seriously, though, I hope you find and administer appropriate discipline to this jerk.
People who deface websites generally aren’t very tech-savvy. The ones who are tech-savvy have better ways to spend their time.
If the guy was being minimally un-stupid about it, it’s hard to find him. However, I concur with what some people have said that someone who would think of this on their own probably has better things to do. It rests, I guess, on how good the script he was using was.
About a year and a half ago, my company was the victim of a hack. Prior to that, I didn’t worry about much about intrusions. Now, I read server logfiles daily (well, LogWatch reports really). That experience combined with the cyber attacks that Russia has mounted against its democratizing neighbors has convinced me that there’s a need for a retaliatory infrastructure that is NOT government sponsored and maintained.
One aspect of the infrastructure should be educational. For instance, a list of which IP addresses are associated with which countries. Such a list would allow companies to refuse all connections that originate from countries with whom they never do business. That will help neighborhood restaurants, hobby stores, and other small businesses.
The other aspect should be the development of a voluntarily organized, retaliatory botnet and the necessary “rules of engagement”. The legal precedent for this is the right to self-defense implicitly codified in the US Constitution’s 2nd Amendment as well as the Congress’s power, granted in Article 1, to “grant letters of marque and reprisal”. Initial authorization of such a plan may need to be approved by Congress, but the idea here is to allow the US government to duck foreign entanglements while American citizens support their Georgian allies by scrubbing Russian hard drives. Of course, I’d love foreign help, too, but I suspect most foreign governments would work to shut something like this down.
esr, I look forward to a long post with your thoughts! Take your time as you formulate them…
Wow, I think we all might have been complacent about security. I guess I shouldn’t put off changing my passwords any longer!
I’m sure most people knew, as I did, that it was not your doing. But a disgusting reminder that even the most technically savvy among us are not not immune.
dsm, your ‘retaliatory botnet’ idea is crazy. The best you could do is send DDOS attacks against random zombie hosts. How would you find the guys behind the botnets in the first place? Plus, to set-up a botnet, you would have to r00t lots of boxes, and while self-defense may be justified, electronic hijacking is not.
I do find your idea of an IP address intriguing, however.
> dsm, your ‘retaliatory botnet’ idea is crazy. The best you could do is send DDOS attacks against random zombie
> hosts. How would you find the guys behind the botnets in the first place? Plus, to set-up a botnet, you would have to
> r00t lots of boxes, and while self-defense may be justified, electronic hijacking is not.
Did you miss the part about “voluntarily organized”? The idea has its ups and downs, but I guess it would be more like a big distributed-computing network than a botnet. Botnet (AFAIK) implies machines that have been hacked.
“you could be shooting a man whose only crime was that he did not have a secure system”
Exactly what I was thinking. I think the IP/MAC address of most attacks points to some 80-year old lady living on a farm running a wide open Win98 and having no idea her PC is being used as a “zombie”.
Errr.
Phil Says:
>SR, yes, I do know something about computer security. This is why I think it will be next to impossible if the attacker made minimal attempts to >cover his tracks. I believe the only thing you have is the IP address and the MAC address of the attacker.
How can you discover some ones Mac address? at the 1st route action (These thing kinda happen on the internet) the mac address is goner.
Daft Says:
>How can you discover some ones Mac address? at the 1st route action >(These thing kinda happen on the internet) the mac address is goner.
A cookie can broadcast it if I am not mistaken.
ty for info
Greetings! and test of guestbook, coming up here to show love to the site.,
Wow, I think we all might have been complacent about security. I guess I shouldn’t put off changing my passwords any longer!