Changes To Pandorapress

[diegor]

I think if there's going to be any vigilante justice, the openXile boys are going to execute it. The wordpress-based news thing? Yeah that's just a front. It's like Fat Sam's speakeasy back here.


Seriously this is nothing to worry about. Atomicthumbs is a smart guy, he'll have kept backups, it's just a matter of whacking them back on his hosting (if they're even gone). And also I think some new security options may need to be considered.

No backup needed i suppose. The blog it's still here. The very smart "i-don't-know-javascript-i-just-cut-and-paste-bugged-code" hacker has just changed the front page. But you can still access the blog using different url: http://pandorapress.net/2010/02/14/os-status/ . Probably removing the front page is enough.

Cya.

 

[parag0n]

Damn IE only websites!

 

[craigix]

This is the curse of using off the shelf software. It's also why I have a fear of the main pandora site being hacked now it isn't custom anymore.

 

[BackAssward]

Seems it is a child called "Kala$nikoV", script kiddies are so pathetic... co-opting others work, using it, and taking some pride as if they accomplished something themselves.

Edit: seems his "t34m" likes wordpress, another hit here "http://esotericlaw.com/" and here "http://nzreporter.com/?p=124" (just a couple examples).

Seems he/they aren't terribly capable, just learned of a flaw within wordpress.

Also, he/they write web pages like crap... I mean, if you are going to deface something, do it with style, not as if you are a semi-retarded 3rd grader with the artistic ability of a hamster.

Edit @ Chest Rockwell: re-read my post, he/they have hit a number of wordpress sites. Please do some checking before posting a criticism.

 

[Chest Rockwell]

This is the curse of using off the shelf software. It's also why I have a fear of the main pandora site being hacked now it isn't custom anymore.

It's not some big wordpress epidemic. It was probably hacked for one of two reasons, plugins that had vulnerabilities or an outdated version of wordpress. If it's some shocking new vulnerability it's not going to be used to take down a smalltime blog for a smalltime console.

BackAssword: I Never "read" it in the first place, you posted while I was typing. That doesn't show anything, other than multiple wordpress blogs had the same vulnerability- once again, it's because of an unofficial plugin or an old version, or else they would be keeping it a secret or doing high profile hacks instead of searching for a bunch of random blogs with google that have the vulnerable code.

 

[danielliu88888]

pfffftt oh wow



i thought they actually had done something serious

 

[gruso]

The direct links don't work for me either (naturally I tried all that). I do have dashboard access though, and all the content is there.

We had a lot of new visitors last week (40k hits, 20k unique). Script kiddie is probably a reddit reader.

 

[Tom`]

We should get paperghost on the case.

Really, what is this? I mean, are all these guys in third grade or what? If you've actually owned the site there would be so much better stuff you could do - I don't know, make a post saying that craig had discontinued the project to focus on iPad sales, anything, I don't know. This is just ridiculous.

 

[sehs33]

An accurate translation from a native Arabic speaker who is ashamed by what these kids did:

"Finally bombed it hahahaha.... I dedicate this hack to our teacher/boss and to all members of The Spiders and with persistence there will be a second stepping (crash) and third etc"

I didn't read the whole topic, but if anyone can link me to one of these kids' emails I might be able email them and convince them to stop (if it is not a bad idea).


Here they are:
http://www.vbspiders.com/vb/t25004.html#post104692

The posts say:
1st post:
This my first accomplishment dedicated to The Spiders and as I said the day will come that I announce my accomplishment and it is done
bunnitude.com

2nd post:
Congrats dear for the attack
I expect the website came back though
Any site you hack register it in the zone H so the attack stays recorded <-- zone H?
And my regards to you beloved one [keep on going]
best of luck

3rd post:
thank you for passing by
I just tested and the site is still hacked
Regarding the zone H I recorded the attack but it doesn't appear because there's "no index" only some words I wrote <-- I guess he means by no index that he didn't get root access

What do you think guys?

 

[Trip]

So this little knob gobbler decided to hack a small community run web site for an open source hand held for his first hack, and he's actually proud of it?
That's like taking someone's bills out of their letter box for your first try at stealing :huh:

EDIT TO TRY AND BE MORE USEFUL: If Internet Explorer can get on the site but non of the other browsers, it could be a DNS issue. IE handles DNS requests differently that all the other browsers, so that could make sense maybe??

 

[sehs33]

Actually I highly doubt he knows anything about the Pandora, looks like he was searching for a host with the hole he learned recently and found bunitude.com

Edit: I am no expert, but if it is a DNS issue I guess IE is viewing the page simply because its DNS record is cached.
+ Looks like the attacker didn't redirect the page, to another host.

 

[tonyyeb]

Actually I highly doubt he knows anything about the Pandora, looks like he was searching for a host with the hole he learned recently and found bunitude.com

Edit: I am no expert, but if it is a DNS issue I guess IE is viewing the page simply because its DNS record is cached.
+ Looks like the attacker didn't redirect the page, to another host.

View the source of the page and you can see the message being shown. It just looks like a bit of javascript that only IE handles as expected. It doesn't display in Chrome.

 

[sehs33]

It is the same message I translated above but he only concatenates their teacher/boss's name "VoLc4n0" who from another thread on that forum seems to having hard time with his ISP who blocked all access to his favorite hackers communities (he posted that from a mobile phone or something similar)

 

[Butterman]

So this little knob gobbler decided to hack a small community run web site for an open source hand held for his first hack, and he's actually proud of it?
That's like taking someone's bills out of their letter box for your first try at stealing :huh:

EDIT TO TRY AND BE MORE USEFUL: If Internet Explorer can get on the site but non of the other browsers, it could be a DNS issue. IE handles DNS requests differently that all the other browsers, so that could make sense maybe??

It's not a DNS issue. It's a javascript one. If you look at the site in firefox the source is still identical than if you looked at it with internet shitsplorer, except the javascript refuses to run on firefox.

 

[TrashyMG]

So this little knob gobbler decided to hack a small community run web site for an open source hand held for his first hack, and he's actually proud of it?
That's like taking someone's bills out of their letter box for your first try at stealing :huh:

EDIT TO TRY AND BE MORE USEFUL: If Internet Explorer can get on the site but non of the other browsers, it could be a DNS issue. IE handles DNS requests differently that all the other browsers, so that could make sense maybe??

It's not a DNS issue. It's a javascript one. If you look at the site in firefox the source is still identical than if you looked at it with internet shitsplorer, except the javascript refuses to run on firefox.

See even hackers should check if their code is cross browser compatible..

 

[Trip]

So this little knob gobbler decided to hack a small community run web site for an open source hand held for his first hack, and he's actually proud of it?
That's like taking someone's bills out of their letter box for your first try at stealing :huh:

EDIT TO TRY AND BE MORE USEFUL: If Internet Explorer can get on the site but non of the other browsers, it could be a DNS issue. IE handles DNS requests differently that all the other browsers, so that could make sense maybe??

It's not a DNS issue. It's a javascript one. If you look at the site in firefox the source is still identical than if you looked at it with internet shitsplorer, except the javascript refuses to run on firefox.

Ah k. Didn't check the source, was just spitballing ideas

See even hackers should check if their code is cross browser compatible..

:lol:

 

[WizardStan]

I didn't read the whole topic, but if anyone can link me to one of these kids' emails I might be able email them and convince them to stop (if it is not a bad idea).

Don't, your email will be responded with douchebaggery, and then you'll be flooded with spam. These kids aren't known for their levels of respect. If it were one of the larger groups that actually discover the zero day exploits, they would probably accept and leave us alone if asked, but these script kiddies that target small sites running software with known vulnerabilities won't listen to reason. They're like the playground bully beating up on the nerdy kid: it's not because the kid is a threat or anything, it's because it gives them a false sense of accomplishment, and they target the weaker one specifically because they know they can win.

 

[Mr B]

Fix the hole, up the site, and get things back to normal. Thats the nerdy kid kicking the bully in the nuts while his friends are watching.
B!

 

[cosurgi]

with javascript turned off, the site doesn't load either. It's totally void.

 

[robotjohn]

I like the new polar bear in a snowstorm wordpress theme. However it might be a little to minimalistic for my tastes.