Ugh!!'s Greymatter Honeypot » hack http://www.u-g-h.com Distracting the Mind with Information Overload Wed, 08 Feb 2012 23:39:10 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Cruelcard Post-mortem: How my Joomla site got hacked http://www.u-g-h.com/2008/09/08/cruelcard-post-mortem-how-my-joomla-site-got-hacked/ http://www.u-g-h.com/2008/09/08/cruelcard-post-mortem-how-my-joomla-site-got-hacked/#comments Mon, 08 Sep 2008 18:26:17 +0000 Owen http://www.u-g-h.com/?p=2489 hacker

So, I decided to have a play with Joomla a couple of weeks ago as one of the first websites I ever built Cruelcard needed to be moved away from my Windows host and had to be rebuilt in something other than ASP. I’ve been wanting an excuse to play with Joomla and well, here it was. I built the site, put up the plugins I wanted, themed it and lo and behold had a brand spanking new website. Everything was good .. the sun was shining etc .. until last night ..

Last night I logged in to find that the site had been defaced. I should have taken a screenshot to show you, but I just overwrite the message with a “Will be back soon” message. I left everything as it was so that I could find out exactly how the hackers broke into my site. Today I had some time, so I went through my logs and this is what I learnt:

  • The hacker was from Turkey. Well, I knew that as the defacement was in Turkish but his IP address (85.110.114.98) confirmed that.
  • He was specifically looking for Joomla sites to target. The first referrer I have is: http://go.mail.ru/search?&q=Powered+by+Joomla%21.+Valid+XHTML+and+CSS&no_morph=n&sf=480. You can see exactly what he was looking for, but seeing I’m on page 49, he must have gone through quite a few other sites first.
  • He gained access to the site by resetting the admin password. I actually found the exploit in Milworm (possibly this one anyway). This coupled by the fact that the sequence of commands were all placed in under a minute suggests that this was a scripted attack.
  • Once the admin password was changed, the hacker went straight to the admin site and did whatever he needed to do.
  • The hacker also seems to have uploaded some media using the Media Manager which suggests I need a proper rebuild of the whole thing.

It was pretty interesting to follow the hacker‘s footsteps. I will need to rebuild with a newer version of the software that blocks that hole, but I am partly responsible because I didn’t change the default administrator’s name. If I had done that, I might have had a bit of protection. I’m not going to abandon Joomla just because of this but it has certainly highlighted the importance of backups to me!

If anyone’s interested, you can read through the log: cruelcardcom-hack

Note to self: Read more about Milw0rm and don’t watch so much CSI

Share

]]> http://www.u-g-h.com/2008/09/08/cruelcard-post-mortem-how-my-joomla-site-got-hacked/feed/ 2 Hacking a bridge http://www.u-g-h.com/2007/02/17/hacking-a-bridge/ http://www.u-g-h.com/2007/02/17/hacking-a-bridge/#comments Sat, 17 Feb 2007 16:23:57 +0000 Owen http://www.u-g-h.com/index.php/2007/02/17/hacking-a-bridge/ Here’s a cool project. As part of SwitchedOnLondon, the Tower Bridge in London has been turned into a massive light artefact. The cool thing is that pattern of lights on the Tower Bridge is actually governed by people walking along London Bridge, just down the road. Sensors on London Bridge sense Bluetooth devices as they work their way across the bridge and relay the information to control lights on Tower Bridge. Really cool. Read all about it here

Share

]]> http://www.u-g-h.com/2007/02/17/hacking-a-bridge/feed/ 0 Security Links http://www.u-g-h.com/2007/01/13/security-links/ http://www.u-g-h.com/2007/01/13/security-links/#comments Sat, 13 Jan 2007 22:40:46 +0000 Owen http://www.u-g-h.com/?p=41 Interesting post on Lifehacker about Ophcrack Live CD which is a resource to help you recover lost Windows passwords. Apparently you create a CD which you boot with. This examines your Windows partition and extracts any passwords it finds from it. The other interesting aspect of the post is the commend thread that follows as it highlights a number of other security resources. Here are some:

Enjoy!

Share

]]> http://www.u-g-h.com/2007/01/13/security-links/feed/ 0 WGA hack still works http://www.u-g-h.com/2005/08/02/wga-hack-still-works/ http://www.u-g-h.com/2005/08/02/wga-hack-still-works/#comments Tue, 02 Aug 2005 19:56:33 +0000 Owen http://www.u-g-h.com/PermaLink,guid,f1c3222a-fdc9-4681-946d-01aec7f48e2b.aspx Had to try this just to verify. The Windows “Genuine Advantage” initiative still hasn’t fixed the rudimentary hack reported on BoingBoing last week. You’d expect that someone would have plugged the hole, even renaming the flag (g_sDisableWGACheck) would stop most of the uneducated populace from taking advantage of the hack.

Share

]]> http://www.u-g-h.com/2005/08/02/wga-hack-still-works/feed/ 0 50 fun things to do on your iPod http://www.u-g-h.com/2005/05/17/50-fun-things-to-do-on-your-ipod/ http://www.u-g-h.com/2005/05/17/50-fun-things-to-do-on-your-ipod/#comments Tue, 17 May 2005 15:07:07 +0000 Owen http://www.u-g-h.com/PermaLink,guid,fbe1bfb3-8252-4898-a3e3-91e2d8fcbd04.aspx Found on Kottke …

In the four years since its introduction, the iPod has proven to be a versatile little device. Despite a relatively closed architecture, hackers have found their way in. Content creators and software makers put information at your fingertips when you’re on the go. Would-be designers have added to the fashionable stylings of the now-ubiquitous white ear buds. Hardware makers and enthusiasts have augmented the iPod with new add-on gadgets.

For fun, I’ve compiled a bunch of hacks, add-ons, accessories, and such. Here are 50 Things to Do with Your iPod (besides listen to music with those white earbuds).

[kottke.org]

Share

]]> http://www.u-g-h.com/2005/05/17/50-fun-things-to-do-on-your-ipod/feed/ 0 Tracking down the vendor portion of a MAC address http://www.u-g-h.com/2005/05/11/tracking-down-the-vendor-portion-of-a-mac-address/ http://www.u-g-h.com/2005/05/11/tracking-down-the-vendor-portion-of-a-mac-address/#comments Wed, 11 May 2005 22:29:29 +0000 Owen http://www.u-g-h.com/PermaLink,guid,ee1193ca-c3cb-4a36-a7cd-8a436f620685.aspx Now .. this is interesting

I was trying to track down the source of an IP address conflict earlier today and I came across two sites offering a search service for the initial 24-bit (6 digit hexadecimal) vendor portion of an Ethernet media access control (MAC) address. The IEEE service is the official one, from where you can also download the complete listing, but MAC finder is also useful as you can use the ?string=00%3a00%3a00 command on the end of the URL (replacing the zeros with the appropriate hexadecimal digits).

[Mark's (we)Blog]

Share

]]> http://www.u-g-h.com/2005/05/11/tracking-down-the-vendor-portion-of-a-mac-address/feed/ 0 Show My IP http://www.u-g-h.com/2005/04/26/show-my-ip/ http://www.u-g-h.com/2005/04/26/show-my-ip/#comments Tue, 26 Apr 2005 11:53:15 +0000 Owen http://www.u-g-h.com/PermaLink,guid,7c1fb735-b50a-45ee-b79c-8b0ae162180d.aspx Ever wondered what your external IP address was ? : http://www.showmyip.com/

Share

]]> http://www.u-g-h.com/2005/04/26/show-my-ip/feed/ 0 Wardriving Resources http://www.u-g-h.com/2005/03/08/wardriving-resources/ http://www.u-g-h.com/2005/03/08/wardriving-resources/#comments Tue, 08 Mar 2005 17:42:07 +0000 Owen http://www.u-g-h.com/PermaLink,guid,b1a53f07-2b8d-440a-8701-21f94e6b891d.aspx Today, an email conversation at work turned to the subject of WarDriving. Quite an interesting debate, and while it was raging on I came up with a couple of interesting links I wanted to post here for posterity:

and last but not least …

Share

]]> http://www.u-g-h.com/2005/03/08/wardriving-resources/feed/ 0