Astalavista.com hacked, including details

by gmazzola • 17 years ago

171 64 17 years ago

gmazzola3• 17 years ago

Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b

The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups.

For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer security information. It hosted software exploits, and quickly degenerated into a forum for sharing software cracks, spyware, and virii.

Being a security-related website, you'd expect the owners to be a little more careful, which is why this is interesting.

noodle• 17 years ago

hell, i tend to find any reasonably detailed description of the process of exploiting something to be pretty interesting.

gives a fairly good idea of how to not make the same mistakes, if applicable.

andreyf2• 17 years ago

Yeah, considering how last-decade astalavista.com is, I wouldn't be surprised if now is the most pageviews they've gotten in awhile ;)

asnyder• 17 years ago

Brutal indeed. Not only did they expose all aspects of astalavista, they actually trashed and dropped everything.

As bad as astalavista is, is it right to reciprocate and trash their server? It seems as if the hacker sunk to their level.

Are there legal ramifications to something like this?

enneff3• 17 years ago

"Are there legal ramifications to something like this?"

Uh, yeah, of course. Good luck catching them, though.

Timothee• 17 years ago

I'm thinking I was not the only one reading the title as altavista.com and I was really shocked.

Thanks for the background info on the site.

bdmac973• 17 years ago

I definitely read "altavista" at first too having never heard of astalavista until now.

enneff3• 17 years ago

They did have off-site backups, which the hacker found and erased.

One strategy that I employ to mitigate this is to have my backup service connect to the production server, rather than the other way around. That way if your production services are compromised, your backups remain untouched (on a machine that's running no services, behind a firewall, etc, and for all intents invisible).

sev5• 17 years ago

Definitely a much better method of handling backups. Completely agreed.

obanite• 17 years ago

What's the point in offsite backups (for security reasons) if they're connected over network connections?

jlcheng2• 17 years ago

I thought the typical definition of offsite backup also means data is backed up to a media like tape and stored in a different location.

How is your offsite backup implemented? Is the data stored on a network drive, or backed up to tape?

ekarulf• 17 years ago

We use tarsnap (http://www.tarsnap.com) to handle our offsite backups. If you give your production servers write only keys you can mitigate this risk (and not send your backups across the wire in the clear).

iheartmemcache• 17 years ago

It looks like they first buffer overflowed Litespeed to spawn a shell (which was ironically running as a user 'apache'). The http headers that are being returned from Astalavista are consistent with this theory (in addition to the obvious output of the first binary run). Apparently Litespeed has a pretty dodgy security record after doing a cursory search.

Far more interesting was the root escalation exploit. 2.6.18 is a relatively recent kernel, and I haven't heard of exploits publically disclosing something of that caliber. Has anyone seen anything on securityfocus/bugtraq/milw0rm etc regarding this?

duskwuff3• 17 years ago

There's a nasty bug in the vmsplice() syscall in anything from 2.6.17 to 2.6.24.1. Exploits have been public since early 2008.

http://www.milw0rm.com/exploits/5092

http://www.milw0rm.com/exploits/5093

ableal• 17 years ago

The version string "2.6.18-128.1.10el5" is exactly what CentOS 5.3 shows (toy VM I installed last week, updated to May 31, no updates today). They may have turned off SELinux for convenience ...

[P.S. my VM is 32 bits, because VirtualBox has an issue with 64 bit CentOS 5.3 and AMD PhenomIIs: http://www.virtualbox.org/ticket/3927 ]

Confusion• 17 years ago

Offtopic, but please, don't use 'virii'. The correct plural is 'viruses'. 'Virii' is wrong for two reaons:

1) The Latin plural of word ending in -us is not -ii. -i at best.

2) 'Virus' doesn't have a Latin plural, because its meaning is like (in the sense of not having a plural) 'sand': it already denotes a multitude.

sev5• 17 years ago

Why is it that the plural of "radius" is "radii" but the plural of "virus" is not "viri"? I don't see "virus" as inherently denoting a multitude in the dictionary. Just curious.

DrJokepu2• 17 years ago

Being a Latin geek myself I can't help but point out that nouns in the fourth declension (u stem) also end in -us in singular and receive an -us affix in plural as well.

"Virus" is however, in the second declension (virus -i n. "slime, poison, goo") with the oddity of being neutral while having a second declension -us ending which is normally a feature of masculine nouns. And indeed, its plural would be "viri".

gmazzola3• 17 years ago

Ironically, I was very careful with my choice of "virus vs. virii" when I wrote that message. I looked up the Wikipedia article for Plural of Virus ( http://en.wikipedia.org/wiki/Plural_of_virus ), and noted the sentence "In reference to a computer virus, the plural is often believed to be virii...".

As an amateur Latin geek myself, I agree that "viruses" is proper from a grammar standpoint, but I sided with Wikipedia because I was using computer terminology.

Sephr• 17 years ago

The correct term in Hixie English is virii. You need to learn your Hixie English (even the HTML5 standard is written in it).

takeda• 17 years ago

you're mistaking astalavista.box.sk with astalavista.com.

astalavista.com stole their name to ride on their popularity.

dmix2• 17 years ago

Its the (other) hacker news this week on HN.

gmazzola3• 17 years ago

Indeed. I figured this particular piece of news would interest both types of hackers, as it contains technical details you wouldn't expect from a standard defacement. It's rather similar to the urge to rubberneck at a car crash: it's both horrific and exciting at the same time.

If my assumption is incorrect and no one is interested, I will humbly tuck my metaphoric tail between my legs and refrain from posting such things again.

dmix2• 17 years ago

That type of respect for quality makes HN great. </circlejerk>

jrnkntl• 17 years ago

This somewhat concludes the whole point of the hax0rs:

Quote: "plaintext passwords? yes, those so called "security professionals" who charge you $6.66 / month to register at their hack-proof portal, save your passwords in plaintext... brilliant!"

andreyf2• 17 years ago

I especially liked "philip"... one of the 100 most common boy names.

dark side of me: I wonder how many of those passwords work to get into those e-mail accounts...

oscardelben2• 17 years ago

or bank accounts

bdmac973• 17 years ago

That was painful to "watch" happen to them. Lesson learned. Do NOT f* with hackers...

weaksauce• 17 years ago

Yes and the fact that there are always smarter people with more time on their hands than you out there on the internet.

sev5• 17 years ago

Well, I guess they deserve it for screwing people over $6.66/month at a time for 15 years for distributing publically available material (literally).

dylanz• 17 years ago

I think scrolling down that was more suspenseful than any book I've ever read :)

mdolon• 17 years ago

mysql> drop database ... (x9 databases)

My jaws literally dropped when I got to that part.. that's gotta suck, even for a crude site like Astalavista.

bdmac973• 17 years ago

Not as bad as where they found the backup plan in the bash history, FTP'd to their remote backups, and deleted them all...

s3graham• 17 years ago

Heh 13.33.33.37.

duskwuff3• 17 years ago

The tool they were downloading appears to have been private. Hence the anonymized IP and hostname (anti.sec.labs).

froo• 17 years ago

I saw some paypal details in there aswell, I'm wondering if astalavista used any of the same passwords to secure that account?

gojomo• 17 years ago

When a site is reported as 'hacked', am I alone in not wanting to visit it for a look-see? Aren't the same people who deface sites likely to try fresh browser compromises against rubberneckers?

sev5• 17 years ago

I doubt quality folks such as the one's participating here at HN would ever post a link to a site, even a defaced one, that would potentially harm anyone visiting it. </circlejerk>

jameskpolk• 17 years ago

That seems like a decent security precaution.

However, since astalavista was the site in question, you will probably be safer to visit after the hack.

andr• 17 years ago

The hackers complain about Astalavista being targeted towards script kiddies. However, it looks like they used a prepackaged exploit, too.

slater• 17 years ago

i think that was the point: Astalavista is also an IT security company, yet they can't even keep themselves from being hacked in every way possible, using the simplest of prepackaged exploits available.

gaius• 17 years ago

Who? If it was altavista.com this might be news...

Hexstream• 17 years ago

Read from line 1758 (at http://pastebin.com/f751e9f5b) and you'll see that those astalavista guys have no taste... Good riddance.

c00p3r• 17 years ago

2.6.18-128.1.10.el5 is the latest patchlevel of RHEL or CentOS kernels. It seems like their security officers are sleeping on their keyboards. Good news for so-called enterprise linux customers. amazon.com? =)

btw, this is merely good quality of system maintaince (of course, their backup system is very funny), but this is very usual way people uses linux and oss nowadays - no one cares to much, thanks to apt-get and yum and xen.

Linux is a mainstream now, nothing special, just stupid, plain activity. It was cool when they were migrated from 2.4 to 2.6 kernel, or even from 2.1 to 2.2 glibc. Today it lost all its coolness and romance.

Just imagine what happening in corporate sector, who hires cheap boys or guys from third-world, like me.

xtxlog• 17 years ago

a bunch of people on efnet irc say that it was hacked by some guy named darkpontifex or some group called dikline or something. supposed to not be a litespeed vuln its actually an ntp daemon vuln just changed the name to confuse people.

Tom232• 17 years ago

From Digg: http://digg.com/security/astalavista_com_Hacked_2

http://romeo.copyandpaste.info gives an idea about anti-security movement...

ComputerGuru• 17 years ago

The site is back up now...

Tom232• 17 years ago

http://pastebin.com/m592e1f1c

Astalavista.com hacked, including details

Related Stories