RE: [atlarge-discuss] Hack Report

["Abel Wisman" <abel@able-towers.com>]

To do a fornesics on remote almost non-existing knowledge of the server
this was running on is impossible.
If it is interesting at all, decent forensics on hacked machines are
done locally.

Undoubtedly it was a php exploit that was used, since the forum used
php.

It still means the entire server is compromised, only decent thing to do
with that is replace disk, and start from scratch, been there, done
that, got the diploma.

Please, with all die respect NEVER state that "only a part" of the site
was hacked, whoever did it rooted the machine: -eof-


Most ideally you would have clean back-ups of all content.

Sorry, but this is experience and realism

Abel


-----Original Message-----
From: Bret Fausett [mailto:fausett@lextext.com] 
Sent: 03 November 2002 18:33
To: At Large Discuss
Subject: [atlarge-discuss] Hack Report


Early this morning, Sunday 3 November 2002, the discussion forum of the
icannatlarge web site was apparently hacked. Most of our discussions
have moved onto mailing lists, so I have taken the forum off-line until
the issue can be resolved. I've temporarily put up a replacement page
asking conversations to move to <atlarge-discuss@lists.fitug.de>.

     http://icannatlarge.com/forum/

To the best of my knowledge, the culprits did not hack the main site or
any of the static pages. What was compromised was the online web-based
discussion forum, so I assume a security vulnerability in that
particular software was exploited.

I apologize if any ongoing conversations on the web-based forum were
interrupted by this outage. Please move them to this discussion list
until the forum is again up and running.

    -- Bret Fausett 


---------------------------------------------------------------------
To unsubscribe, e-mail: atlarge-discuss-unsubscribe@lists.fitug.de
For additional commands, e-mail: atlarge-discuss-help@lists.fitug.de



---------------------------------------------------------------------
To unsubscribe, e-mail: atlarge-discuss-unsubscribe@lists.fitug.de
For additional commands, e-mail: atlarge-discuss-help@lists.fitug.de