Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today!

If you have any problems with the registration process or your account login, please contact us.

Post New Thread Reply

Register GFY Rules Calendar
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >
Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed.

 
Thread Tools
Old 11-10-2004, 04:51 PM   #1
emmanuelle
Confirmed User
 
emmanuelle's Avatar
 
Join Date: Mar 2003
Location: Oh Canada!
Posts: 3,662
server hack?

My friend just had a bunch of his index pages replaced with
"SPYKIDS .. irc.chatplus.com.br #spykids.. enjoy "


Anybody know who's behind this stuff and how they tend to get in?
emmanuelle is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:00 PM   #2
BIGTYMER
Junior Achiever
 
BIGTYMER's Avatar
 
Industry Role:
Join Date: Nov 2004
Location: Walled Garden
Posts: 17,066
They get in via an exploit of some sort. You need to harden and keep your box patched and updated.
BIGTYMER is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:02 PM   #3
Alky
Confirmed User
 
Alky's Avatar
 
Join Date: Apr 2002
Location: Houston
Posts: 5,651
Quote:
Originally posted by Kingpins
They get in via an exploit of some sort. You need to harden and keep your box patched and updated.
good advice
Alky is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:02 PM   #4
NetRodent
Confirmed User
 
Join Date: Jan 2002
Location: In the walls of your house.
Posts: 3,985
Why not ask the people on the irc channel #spykids on the server irc.chatplus.com.br.
__________________
"Every normal man must be tempted, at times, to spit on his hands, hoist the black flag, and begin slitting throats."
--H.L. Mencken
NetRodent is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:04 PM   #5
Ad3pt
Confirmed User
 
Join Date: Aug 2002
Location: California
Posts: 476
Quote:
Originally posted by emmanuelle
My friend just had a bunch of his index pages replaced with
"SPYKIDS .. irc.chatplus.com.br #spykids.. enjoy "


Anybody know who's behind this stuff and how they tend to get in?
server spec's?
__________________
Don't look here for the joke. It's in your pants.

South O - World Class surfer destination since 2001.
Ad3pt is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:04 PM   #6
BIGTYMER
Junior Achiever
 
BIGTYMER's Avatar
 
Industry Role:
Join Date: Nov 2004
Location: Walled Garden
Posts: 17,066
Quote:
Originally posted by Alky
good advice
And you've got better?
BIGTYMER is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:05 PM   #7
Ad3pt
Confirmed User
 
Join Date: Aug 2002
Location: California
Posts: 476
Quote:
Originally posted by Kingpins
They get in via an exploit of some sort. You need to harden and keep your box patched and updated.
how do you know this to be the case?
__________________
Don't look here for the joke. It's in your pants.

South O - World Class surfer destination since 2001.
Ad3pt is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:05 PM   #8
Dirty F
Too lazy to set a custom title
 
Dirty F's Avatar
 
Industry Role:
Join Date: Jul 2001
Posts: 59,204
Quote:
Originally posted by emmanuelle


Anybody know who's behind this stuff and how they tend to get in?
Just a wild guess but maybe these guys:

SPYKIDS .. irc.chatplus.com.br

I did some research.
Dirty F is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:07 PM   #9
BIGTYMER
Junior Achiever
 
BIGTYMER's Avatar
 
Industry Role:
Join Date: Nov 2004
Location: Walled Garden
Posts: 17,066
Quote:
Originally posted by Ad3pt
how do you know this to be the case?
How else would they get in? Did they login via ftp with his u/p? I hight doubt it. And its showing an IRC page and IRC is know for its carding, hacking kiddies.
BIGTYMER is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:11 PM   #10
Ad3pt
Confirmed User
 
Join Date: Aug 2002
Location: California
Posts: 476
Quote:
Originally posted by Kingpins
How else would they get in? Did they login via ftp with his u/p? I hight doubt it. And its showing an IRC page and IRC is know for its carding, hacking kiddies.
If they have the ftp u/p it's not an exploit.

On the other hand, if their local workstation is owned by a trojan/keylogger that would be an exploit.

Only point Im trying to make is that having this guy jump to conclusions isn't going to give him the info he needs.
__________________
Don't look here for the joke. It's in your pants.

South O - World Class surfer destination since 2001.
Ad3pt is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:12 PM   #11
Dirty D
Confirmed User
 
Dirty D's Avatar
 
Join Date: May 2002
Location: Paying Webmasters Millions Since 1999
Posts: 4,044
It looks like someone got root access to the server.

There are many exploits to get root access.

Here are some tools to check for and fix rootkits

http://www.chkrootkit.org


My advice:
Eliminate any backdoors (rootkit)
Restore the domains
Change all user and root passwords
Verify linux and apache are up to date.
Dirty D is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:15 PM   #12
BIGTYMER
Junior Achiever
 
BIGTYMER's Avatar
 
Industry Role:
Join Date: Nov 2004
Location: Walled Garden
Posts: 17,066
Quote:
Originally posted by Ad3pt
If they have the ftp u/p it's not an exploit.

On the other hand, if their local workstation is owned by a trojan/keylogger that would be an exploit.

Only point Im trying to make is that having this guy jump to conclusions isn't going to give him the info he needs.
Yes, but the chances are greater that they got in via an exploit.
BIGTYMER is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:19 PM   #13
erehwon
Confirmed User
 
erehwon's Avatar
 
Industry Role:
Join Date: Nov 2003
Location: A secure undisclosed location...
Posts: 3,759
Quote:
Originally posted by emmanuelle
My friend just had a bunch of his index pages replaced with
"SPYKIDS .. irc.chatplus.com.br #spykids.. enjoy "


Anybody know who's behind this stuff and how they tend to get in?
It sounds like a run of the mill defacement, your friend probably didn't patch something they should have.

The hackers likely went to a database like Packetstorm and found something to break into the server.

Have your friend drop these guys, http://www.ibouncer.com a line, to lock things down
__________________
Money NEVER $leep$...
erehwon is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 11-10-2004, 05:22 PM   #14
V_RocKs
Damn Right I Kiss Ass!
 
Industry Role:
Join Date: Dec 2003
Location: Cowtown, USA
Posts: 32,409
What domains were effected?
V_RocKs is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Post New Thread Reply
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >

Bookmarks



Advertising inquiries - marketing at gfy dot com

Contact Admin - Advertise - GFY Rules - Top

©2000-, AI Media Network Inc



Powered by vBulletin
Copyright © 2000- Jelsoft Enterprises Limited.