[mohaa] icculus.org

Josh Berry josh at chickenmonkey.co.uk
Wed Jun 25 08:02:28 EDT 2003


It says this on the site at the mo:

We got hacked. It's under control, but the cocksucker tagged us during
the WWDC keynote, when I was otherwise occupied. We have cleaned up,
except we need to replace some vandalized HTML from backup and upgrade
some software before the webserver can go back up. Email and other
services are working. 

For the record, it looks like he used a PHP exploit to execute a file
which locally exploited the Linux 2.4.20 ptrace() hole. This means he
had a root shell. 

What you can do: 

CHANGE YOUR PASSWORD. I don't think they were compromised, but you never
know. We have verified that the "ssh" and "passwd" binaries are not
compromised, so log in and change it. 
VERIFY YOUR SOURCE. If you have a cvs project, do a fresh checkout and
diff it against your existing sources. I don't think this is a problem,
either, but safety first. 
PAY IT FORWARD. If you can't raise your kids to not be script kiddie
fuckheads, consider birth control. 
Again, everything is back up but the web server, which will come back
hopefully tonight. 

Stay tuned, True Believers

So there ya go...

Josh

-----Original Message-----
From: richardnharrison at btinternet.com
[mailto:richardnharrison at btinternet.com] 
Sent: 25 June 2003 09:45
To: mohaa at icculus.org
Subject: RE: [mohaa] icculus.org

not me.

>  from:    Bradley Caricofe <caricofe at comcast.net>
>  date:    Tue, 24 Jun 2003 23:05:01
>  to:      mohaa at icculus.org
>  subject: RE: [mohaa] icculus.org
> 
> A couple of weeks later and I still can't get to Icculus.org, was
wondering
> if anyone else could?
> 
> > -----Original Message-----
> > From: Steven Hartland [mailto:killing at barrysworld.com]
> > Sent: Saturday, June 14, 2003 9:07 PM
> > To: mohaa at icculus.org
> > Subject: Re: [mohaa] icculus.org
> >
> >
> > Nope its been down :(
> > ----- Original Message -----
> > From: "Bradley Caricofe" <caricofe at comcast.net>
> > To: <mohaa at icculus.org>
> > Sent: Saturday, June 14, 2003 10:32 AM
> > Subject: [mohaa] icculus.org
> >
> >
> > > I haven't been able to get to icculus.org in a few days, was
> > wondering if
> > > it's just me?
> > >
> > > - Brad
> > >
> > >
> > >
> >
> 





More information about the Mohaa mailing list