Slashdot Database Compromised! 371
Today the the Slashdot database was compromised by 2 hackers from the Netherlands. !(Nohican && {}) They secured the hole and send an email to the admins, they even should be reading it now. Update: 09/29 11:04 PM by michael : We know about it, blah-blah-blah. Don't email us. I think it's safe to say that whatever happened, you'll hear the full details soon enough. Thanks.
Re:Precisely. (Score:2)
Personally, if someone was doing this to my house, and another individual came along, fixed the poor lock (or in this case, an open door) and left me a note stating the above...i would be grateful. This is not to say that i believe it's ok for people to attempt to break in to my, or anyone else's house. But do you honestly think we should villify the hackers in this instance?
FluX
After 16 years, MTV has finally completed its deevolution into the shiny things network
Re:"fixed" Slashdot? (Score:5)
He's a hole allright. "Security Hole" isn't the first hole that comes to mind though.
Clear Text or Two-Way Encryption (Score:5)
I would hope that /. boys coded the whole database so that passwords were one-way encrypted. Then it would be that much of an issue to change your password.
They aren't. If you forget your password, Slashdot will mail it to you (the "mailpasswd" button on /users.pl when you're logged out). Slashdot emails you your password, in clear text. So, even if the passwords are encrypted, they can be decrypted. How else would Slashdot be able to tell you your password?
Re:That is rather funny... (Score:2)
Re:Best article all day (Score:2)
Re:Stupid Crackers (Score:3)
itachi
133t ru//\0rz d3pt (Score:2)
--
Chief Frog Inspector
Re:The hacker formerly known as {} ? (Score:2)
-{}
Re:So, is this the downside to open source? (Score:2)
Good Thing.
Re:The hacker formerly known as {} ? (Score:5)
Re:paranoia (Score:2)
/. hacked? "nohican", huh? (Score:4)
Let's see what WebFerret [ferretsoft.com] (The only way to search the Web!) makes of "nohican"..
[time passes..]
Ha!
Anybody want to drop the joker a line?ps: read his posts; I think from the context, and from the fact that this is the only "nohican" that came back, that...
t_t_b
--
I think not; therefore I ain't®
Re:full disclosure (Score:3)
The article was posted by the hackers, that's the whole point.
They did it to up their Karma (Score:4)
Maybe that ought to be a rule - anyone that cracks the DB and does no damage gets automatic GOD karma rating.
Other harmless hacking (Score:2)
What did they get? (Score:2)
If they were able to hack, say, Mastercard I'd be impressed (and very scared).
[no subject] (Score:2)
Re:Info! (Score:4)
Bummer Man (Score:3)
Reading through the posts is kind of funny. Half the people are freaking out... "OH MY GOD! /. HAS BEEN HACKED!!!" and the other half are going "Phhhft... Yeah right..".
Whats the worst that can come of a successful hack against the /. database? A password leak, a few karma points added/deleted, a few posts getting majored?
Guys and girls, if you use the same password on /. that you use on other services around the internet, then you're begging for trouble. It doesn't matter if its /. or any other service, you should always use a different password for each. As inconvenient as it is, its the only real way of being secure. There are plenty of programs out there that will let you mantain a "secure" database of all your usernames/passwords if you really think you're going to have a hassle remembering them all. Just search zdnet or any of the other major shareware/freeware sites. Admittedly most of them are Win32 based, but using things like wine [winehq.com] you can usually get around that problem.
The biggest issue is the possibility of the articles being tampered with. I don't know what else is done on the box that hosts slashdot, but if the usual rules are applied, the database should be secure on a seperate machine to the web server.
This is a blessing more than it is a curse. The great wonders of opensource have shown us that even the mighty /. has an exploit in it now and then. I wonder if this would've been made so public if the slashcode wasn't opensource. As it stands, the flaw has been located and supposedly fixed.
Oh well, could be worse I guess. ;) At least they didn't deface the site or destroy the database or any other number of things that could've been done.
<panic>OH MY GOD!!!!!!!!!!! SLASHDOT HAS BEEN HACKED!!!!!!!!!!!!!</panic>
Great, I better call my broker (Score:2)
Re:Perhaps they have tripwire running (Score:3)
Re:It was me! (Score:2)
--
Chief Frog Inspector
Re:paranoia (Score:2)
Re:Why the new account #'s? (Score:2)
-{}
This should be what the hackers should do. (Score:2)
Re:Assuming that the story is true..... (Score:3)
There's no such thing as a friendly hack.
don't trust a netherlander (Score:2)
It has to be fun to be able to.. (Score:3)
In other ramblings of my mind, our friends in the server room should make a mandatory password change. It is always good practice
Best article all day (Score:2)
IMHO,
Geoff
How can you restore without losing recent data? (Score:3)
Any loss (especially of stories and comments) would be highly undesirable for a site such as Slashdot, imho. Then there are even more important systems, such as those that handle financial transactions, in which it is probably mission-critical to not lose any information in the event of a crash or a crack. What methods do database administrators employ for recovery in such situations?
Ignorance is curable. I want to learn. Thanks in advance. :)
Re:It has to be fun to be able to.. (Score:2)
Burris
nonsense (Score:4)
I agree with earlier posters that the second-rate pieces of shit that did this shouldn't be sued or legally harassed- have their parents spank them and send them to bed early without dessert. But it's hard to imagine these vandals serving any more useful purpose than as a focus for the contempt of their middle-school classmates.
Re:They did it to up their Karma (Score:2)
+2 for everything AND infinite mod points.
Re:How can you restore without losing recent data? (Score:3)
I can see it now... (Score:5)
Note to self: IF s/N ratio>=facts(old news +
Don't they deserve a reward? (Score:5)
I kind of think they blew a great opportunity though; imagine the chaos that would ensue if they inserted a story titled "Linux 2.4 Released!" with a link to goatse.cx cleverly hidden as a link to kernel.org...
- Joe
Re:Clear Text or Two-Way Encryption (Score:2)
--
Re:Info! (Score:5)
Maybe some other sites running the Slash code would like five minutes or so to secure their sites before everyone else in the world knows about it?
Or rather, let's make sure everyone's got the fixes before we go passing around the exploits, ok?
---
pb Reply or e-mail; don't vaguely moderate [ncsu.edu].
Cmdrtaco (Score:3)
--
Re:Finally! (Score:3)
Re:Classic (Score:2)
Whereas we foreigners automatically know them all by heart. I am constantly astounded by North American ignorance.
Re:this is cool (Score:5)
Yes, this is most likely the best way to find and fix security problems, but we have to be *very* careful about attitudes such as the one you're proposing. What would have happened had Slashdot carried our credit card numbers as well? Would we be as happy that some people were poking around the website? According to the attitude you're suggesting, the answer would be a resounding YES! YES, because there could be other people out there who are malicious and if the hole didn't get fixed this way it could have turned out to be much worse if other people had found it. But the fact of the matter is that unauthorized hacking is wrong whenever it is committed. A blind faith in white hat hackers is very dangerous because there is no telling what their motivations are, no matter what they say. How in the world do you know that they didn't take CmdrTaco's passwords? If /. had credit cards, how do you know none had been taken? Because they told us about the security hole? That is not enough proof. Hell, the best way to commit a crime would be to hack in, steal a few things, and then report the problem. And they would be held up as heros, not hackers because "luckily, the boys at slashdot "get it""
Property is property, period. Just because this is IP, and just because it is on the Internet does *not* make it any different.
That is rather funny... (Score:2)
Re:sophisticate! (Score:2)
Those darn Americans. But the United States is so big! How can it NOT be the entire universe?
Re:Assuming that the story is true..... (Score:3)
I think that's true regardless of whether there are any visible hacks to the site. Even if they had just emailed the slashdot crew a patch saying "this is broken and allows an exploit", slashdot or VA would still have to check the servers and maybe everything else on the possibility that someone has used the exploit. It doesn't make good security sense to say "well, I don't see any hacks even though there's this exploit, therefore I wasn't hacked into" -- especially on such a high-profile site.
This has fun implications for when you upgrade an OS (or anything else) to patch a security hole; if you're really security conscious, you have to do some risk analysis to decide whether to react as if someone has used the hole already to backdoor your system.
Finally! (Score:2)
Re:Assuming that the story is true..... (Score:3)
Let's see, a still-working site, or
#
#w00t
w00t- not found
#rm -rf
#rm -rf
Of course that's overly simplistic, but think about it. Even if the person found the security hole, and sent in a a patch privately, who's to say the discoverer or someone else hasn't already been quitely exploiting it? Of course now that an exploit has been found (and assuming they DID get the email), There still exists an exploit.
They'll still have to check and make sure that's what really happened, examine their entire system and probably do a whole lot of reinstalling, but that's what happens. I would hope they'd be doing that anyway if someone turned in an exploit+patch.
Which also brings up another point. This site in particular seems to have an inordinate amount of content being passed back and forth that is simply incredulous. How many times a week must Rob &Co. get email to the effect of "3y3 0VVn Jo0!"? How do you know when someone is serious? When the hacker posts a story about it, of course! I'd say this is probably the best (if not funniest) way to let everyone know at once. BTW I do feel sorry for the crew up there having all the shit to go through that they must right now.
One question I do want to see answered, even before the how-to on the crack...EXactly what DID they put in the 1rst post that got it deleted so quickly? Remember that The policy on
Fist Prost
"We're talking about a planet of helpdesks."
Tomorrow's date (Score:2)
Update: 09/29 11:04 PM by michael: We know about it, blah-blah-blah. Don't email us. I think it's safe to say that whatever happened, you'll hear the full details soon enough. Thanks.
--
Re:paranoia (Score:2)
Sincerely,
Bruce Perens*
*Joke, get it? Joke.
Fist Prost
"We're talking about a planet of helpdesks."
Hehe (Score:3)
Re:/. hacked? "nohican", huh? (Score:4)
Admin Name........... Joost Pol
Tech Name............ Domain Administrator
Of course, it all means nothing, I'm sure.
Surely a case of mistaken identity..
t_t_b
--
I think not; therefore I ain't®
BFD (Score:3)
Good, bad, no difference (Score:2)
Ryan
Re:They did it to up their Karma (Score:2)
Re: (Score:2)
full disclosure (Score:2)
__________________________________________________ ___
Just freaking fantastic (Score:2)
Way to go guys! You guys are 31337! (notice the 3 at the beginning, I may speak lamerese, but that doesn't mean I can't speak proper lamerese) It's pretty damn funny to hack
Steven
Re:better watch out (Score:2)
Luckily, this isn't so, as the CoS found out.
But really, you can't blame the guys, it's in our blood: when we see a hole we plug it, for safety's sake. It's what comes from living in a country two-thirds of which are below sealevel. Plug first, then think. And, maybe, pray.
Stefan.
It takes a lot of brains to enjoy satire, humor and wit-
Re:this is cool (Score:3)
Of *course* you still have to do a risk assessment and decide if you might have been robbed while the door was open, possibly by the person leaving the note. That's true of the real-life front door to your house as well as a web site.
The person leaving the note has done two things for you, though: alerted you (and possibly others who visit your house while you're out) that there may have been a problem; and helped reduce the window of exposure to the threat. You do *not* get to conclude that therefore there was no exploit, in part because you don't know how long your front door has been sitting open.
Your IP/property comment strikes me as a non-sequitir; there is nothing wrong with leaving a note on someone's door in real life, so by your argument it should be fine to leave a note on someone's door on the internet.
I may have missed your point, though; if you're instead making an argument that "seeing an open vunerability on a web site is inherently *different* than seeing that someone's door is open in real life, and we should close our eyes on the internet lest we see open doors", well, I disagree. But it would make for a good discussion :)
Re:Please explain this to me (Score:2)
Try reading the story out loud in a Dutch accent. (That is a serious suggestion.) You'll find that poor grammar is much more acceptable when spoken in a foreign accent than when read without the benefit of accent and emphasis.
If that doesn't help, carve the following sentence into one side of a length of 2" x 4" timber and beat yourself over the head with it until you understand.
English is not everyone's native language.
slahsdot.org (Score:2)
--
They Weren't Hackers (Score:2)
Hackers only DOS and Nuke people.
Good luck with finding the real person who did it.
Rock 'n Roll, Not Pop 'n Soul
What the hell is a LART? (Score:2)
--
Gold medals at swimming and now this... (Score:2)
Ok, fun's over, guys, gimme back my Karma point! I was saving them up to buy a CowboyNeal doll for my dog for Christmas.
--
Chief Frog Inspector
Re:paranoia (Score:2)
First 0\/\/|\| (Score:2)
Heh, actually, this isn't the first time. Other oldbies might remember when Slashdot was hacked into back in 1998. (Story: http://slashdot.org/articles /98 /09/14/1949212.shtml [slashdot.org])
Cheers,
Re:Info! (Score:2)
(this is assuming it is a slashcode hole)
1) Because this is not a hole that everyone knows how to exploit, so if its more secretive it will give time for everyone to upgrade. The hackers seemed nice about their hack; so its better to trust them with the power to take down all the systems running slashcode for a long period of time than it would be to give the power to a huge group of people for a short time.
2) Say if it was a hole in apache for example, its better to tell everyone about it because obviously a few crackers/hackers allready know about it. We wouldn't know how honest these hackers would be with the power, so its safer to eliminate it asap. In this situation with the hack of slashdot, I think we can trust them.
3) Not everyone will be able to patch their own slashcode so it leaves the newbies with the soap dropped in the showers of a maximum security prison.
parsing Katz (Score:2)
Re:paranoia (Score:2)
Does Slashdot store your password in plaintext, or is it hashed using a salt? If the latter, you have a lot less to worry about (assuming a decent hash; MD5 should be fine) Can anyone who has checked the slashcode comment on this? Otherwise, I'll be forced to look it up, and I hate perl.
"fixed" Slashdot? (Score:4)
Bruce
Dear God WHY!?! (Score:2)
Even more damming, can you imagine the type of colossal idiot it would take to buy a list of email addresses which is about 90% geeks? "Hmm, should I buy the addresses of wealthy known philanthropists? Or should I target my spam towards a known group of spam-hating technophiles? I'll take the
Steven
Re:paranoia (Score:2)
BTW not a dumb joke..
Re:it's not that cool (Score:2)
--
Re:What the hell is a LART? (Score:2)
Re:paranoia (Score:2)
sorry, it begged for the propper reply.
Re:Info! (Score:4)
What are you going to do now?
We're going to DISNEYLAND!!!
Re:"fixed" Slashdot? (Score:2)
Re:Stupid Crackers (Score:2)
Ask Slashdot (Score:2)
err... (Score:3)
~
~
Re:it's not that cool (Score:5)
I know what you're getting at and sometimes I do feel that way. Also though, I think it can be a very gray area and IMHO it's risky the way you're going with it.
I'll use the car-in-the-parking-lot scenario. Would I mind someone leaving a note on my car if they noticed one of the doors was unlocked? Within reason, probably not. But do I think people have the right to walk around the parking lot trying to open car doors, just to see which ones aren't locked? Of course not.
There are metaphors everywhere. I can encrypt my email to prevent people reading it. Do I want anonymous strangers to try to decrypt it as long as they promise not to read it? Not really. If I say I don't mind, it gives anyone who wants to break it an easy back-door out of being prosecuted. Imagine what it would be like if govco could get away with saying "we were only trying to show you that your cryptography was faulty. Oh and by the way, we stumbled on this evidence which we're going to use against you.". It always starts with small things, and I can't see why it wouldn't lead to that.
Obviously I'd like to know if anyone stumbles on a way in accidently or sees something by chance, but I'd like to arrange for it to be tested on my own, thank you.
So I guess my point is that if it's ethically okay to try to crack websites etc in the interests of improving security, it suddenly makes it ethically okay to crack them. As long as someone hasn't actually stolen the credit card numbers yet, it makes it okay.
Sure some crackers mean well, but it shouldn't be an excuse to let them off. If they really want to test a site that way they should ask permission first. Let sites decide whether they want everyone trying to break them or not. Most of them will say no, and at that point, what right does anyone else have to force their "better" opinion on another person or company regardless? I've had enough of that from govco and I don't want to start getting it from random unidentified script kiddies.
===
Info! (Score:5)
So, let's hear some details. Howdya do it? Remember, we're techies and not magicians; we can reveal our secrets.
----
this is cool (Score:5)
Technically, you could sue these guys and have them thrown in prison (with certain international legal asumptions). Luckily, the boys at slashdot "get it." - This is truly the open source of cracking. Finding a problem and making fixing it. I feel like there should be a sign on the front porch of the internet that says "Please leave this place tidier than you found it"
FluX
After 16 years, MTV has finally completed its deevolution into the shiny things network
paranoia (Score:4)
Full disclosure? (Score:5)
Not that I think we should expect something in the next hour or anything, but in a week or so, maybe...
Refund!!! (Score:4)
I want my membership money returned. Actually, make it 5X my membership fee. What's 5 x $0.00???
This Post May Spontaneously Combust (Score:4)
My mom is not a Karma whore!
Rebuild (Score:3)
I hope they fixed Slashdot! (Score:4)
while(1) { if($c%2==1) { post_article("Cease and Desist Letter to %s","UPCDatabase.com || F---edcompany.com || Napster || FlyingButtMonkeys"); } else { post_article("%s Sues %s for %s","MPAA || RIAA || D:C, FlyingButtMonkeys || Microsoft || 2600, MP3s, DeCSS, CueCat Decoder"); } ++$c; }
I'm surprised no one has caught it yet; it's a pretty big mistake.
#disclaimer.h
I like the MPAA/RIAA/Napster/DeCSS/CueCat/FBM/MP3 stories. I just thought it's fun to get some karma, too.
------------
Hackers Crack Slashdot Database, D.C. files Suit (Score:5)
Nohican and {} were unreachable for comment, and when we got in touch with Greyfox, he did the ``Blow Me Dance'' at us. The community declined to comment officially but some members of it said that they were pretty much doing the ``Blow Me Dance'' and ignoring Kenyon and Kenyon, too.
You believe them? (Score:3)
Maybe I'm over paranoid but there is no way in hell I let that box stay up.
Assuming that the story is true..... (Score:3)
Guys, well done for showing some maturity. I assume you've boosted your Slashdot karma scores to reflect your recent real-life boost in karma?
Re:paranoia (Score:5)
By now... (Score:4)
Re:COMPROMISED! (Score:4)
You bastards!
hehe
Comment removed (Score:3)
Can't fool me (Score:3)
Re:paranoia (Score:3)
What use of it? Well imagine the information that could be gathered about the userbase. We've basically given away a ton. Preferences, slashboxen, posts, poll answers, REAL email addresses, IP addresses. Now consider who could benefit from a database of that kind of specific information about over 100000 users. Governments? FBI? NSA? No, you're thinking too small. It's DOUBLECLICK!
Now we don't know any of this for sure, I'll grant you. But if you start seeing targetted banners that talk about different brands of hot grits, well all I can say is that I TOLD YOU. And by the way, another hint of the takeover would be if this post were moderated in such a way that most users wouldn't see it. They can't remove the post, you know, that would be too obvious! They need to take advantage of our own biases!
--
did anyone else notice... (Score:4)
and also that the sid uses tomorrow's date.
Priceless (Score:4)
reached the 50 karma cap: Months of posting links to partners.nytimes.com
Look on CmdTacos face when he sees the newest