A hacker gained access to an offsite backup server and then used information on that server to walk into the main live server. The hacker deleted the backup databases, and then deleted the live site. Apparently, they also covered their tracks and over wrote the drives so that no possibility of recovery was possible.

On a forum post a community member of WHT revealed the following:

This attack was very deliberate, sophisticated and calculated. The attacker was able to circumvent our security measures and access via an arcane backdoor protected by additional firewall. We are still investigating the situation, but we know the attacker infiltrated and deleted the backups first and then deleted three databases: user/post/thread. We have no record or evidence that private message data was accessed. Absolutely no credit card or PayPal data was exposed.

Unfortunately for WebHostingTalk, the last local offline copy of the system is from late last year. So expect them to be offline for a bit, while they rebuild their database.

It just goes to show how important offline backup is. Make sure you have the correct backup solution.

Adapted from: http://www.webmasterworld.com/community_building/3879428.htm

DNS has been with us since 1983 ??? nearly as long as the Internet. And although DNS RFCs have come and gone, DNS is still very similar to its original specifications. Certainly it has grown in feature set and complication, but it still has the same underlying security problems it did when it was invented by Paul Mockapetris. The biggest problem is the lack of default authentication. Several security mechanisms have been created for DNS with varying degrees of success (and failure) to solve the authentication problem, but it is still relatively easy to fake a DNS packet to either a DNS server or an unwitting client.

Klein’s last find involved two discoveries, both of which allow important parts of a DNS server packet to be forged with trivial effort. The first implementation error involves the DNS UDP source port. Although it should be randomized to prevent forging, it turns out that the source port never changes the whole time the DNS server is up and running. The second, and more important, problem is the trivial predictability of the transaction ID value. Both errors allow DNS server packet information to be predicted and forged.

An attacker can send a malicious Web page link and induce an end-user to click on the link. The clicked link sends off a DNS client query, which can be forged, sending the end-user to a bogus location. DNS has been found vulnerable in the same way before. In fact, Klein laments, “It is saddening to realize that 10-15 years after the dangers of predictable DSN transaction ID were discovered” that DNS software is still susceptible to transaction ID exploitation.

Klein reported his findings to BIND’s caretakers, the Internet Software Consortium (ISC), in late May and to Microsoft in April. Both the ISC and Microsoft have released patches or updated software. Thanks are due to Amit Klein for his research and responsible disclosure.

Overall, Microsoft’s DNS implementation has been relatively secure. The last major security update to Windows DNS was in Windows 2000 SP2 and SP4, as well as Windows Server 2003 (nearly five years ago). BIND is the most popular version of DNS server software used on the Internet, and its overall security track record has been a bit more active over the years, as one would expect with more popular software. BIND versions 8.x and 9.x have had at least six different vulnerabilities published.

The most secure version of DNS is considered djbdns, named after its author, Dr. Dan J. Bernstein, one of the most prominent voices for security over functionality in computer software. Although djbdns (also known as tinydns for one of its daemons) is not nearly as functional as Windows DNS or BIND, it is run by some of the world’s largest companies. Dr. Bernstein claims that more than 1.8 million .com addresses use djbdns. And though Dr. Bernstein has been offering a $500 reward to anyone who can find an error in its 7,000 instructions, there has yet to be a successful claim. Unfortunately, djbdns is built only for Unix and could not be used efficiently to support an Active Directory domain.

Besides making sure your DNS servers are running up-to-date versions of DNS, I think Klein’s findings bring up another interesting point. Open source advocates are always touting how open source software allows programming and security bugs to be found faster than with closed source software. It certainly makes sense ??? there’s source code to review, and more eyeballs to review it. But as Klein’s research shows, it doesn’t make that much of a difference. In the 10 to 15 years that have gone by, nobody (publicly) found the bugs in either the closed source or open source versions inherently faster. Both errors went undetected for more than a decade until one person got interested in the research.

There are dozens of cases just like this, where open source bugs remained unfound for a decade or more, until one lone individual on their own personal quest did some digging. You can look at any of the popular protocols (such as SMTP, SNMP, HTTP, FTP, ASN.1, and so on) and find vulnerabilities that went undiscovered for over a decade. Heck, people are still finding problems in IPv4 packets that have been around for 20-odd years. And as far as I can tell, whether or not the product was open source didn’t really play a part in the finding or the fix, albeit the open source fixes are consistently coded faster when the problem is located. What mattered most was a single person (or company) that cared enough to investigate. To the responsible bug disclosure people, I salute you!

Original URL: http://news.yahoo.com/s/infoworld/20071123/tc_infoworld/93597

In an October 25 grand jury indictment, John Escalera, 29, and Gustavo Razo, 28, were charged with using Escalera’s position within California State University, Fresno’s IT help desk center to gain access to the university’s grades database.

The men could face 20 years in prison and $250,000 in fines if convicted of the eleven counts on the indictment, which includes charges of unauthorized computer access, identity theft, conspiracy, and wire fraud.

Though they are charged with identity theft, a university spokeswoman could not immediately say whether or not sensitive information such as social security numbers had been compromised during the crime.

According to the indictment, Escalera used “computer hacking techniques” to acquire the password of a supervisor and then used this account to get access to usernames and passwords used by the university’s Web-based PeopleSoft academic record system, hosted at a Unisys data center in Salt Lake City, Utah. PeopleSoft products are sold by Oracle.

Escalera allegedly obtained user name and passwords for the university’s registrar, extension academic program registrar, academic records coordinator, and others, and used these passwords to bump up his own grades as well as those of his friend, Razo, who paid cash for the grade change.

The grades were changed several times between January and June of 2004, the indictment states.

The university had recently updated to PeopleSoft from a legacy system known as the Student Information Management System/Relational database, and IT staff finally caught wind of the problem during a routine audit designed to check the accuracy of the conversion.

Original URL: http://www.infoworld.com/article/07/11/02/…/grades_1.html

The Trojan installs a scaled-down webserver on an infected machine that masquerades as eBay and several third-party destinations frequently used to sniff out fraudulent offerings, including Carfax.com, Autocheck.com and Escrow.com.

When a victim browses to one of these sites, the webserver creates a parallel universe of sorts, in which the victim sees counterfeit pages designed to counter fraud protection mechanisms offered by eBay and third-party sites.

“To think that somehow they got software on their system that managed to spoof all the validation sites – that’s a shit-scary story,” said Roger Thompson, a researcher at Exploit Prevention Labs who specializes in web-based attacks. “It’s fiendishly clever.”

The malware was found on the machine of one eBay Motors user who recently lost $8,650 after trying to buy a 2005 Jeep Liberty advertised for 10 days on the site. Customer representatives have refused to cover the theft because, they said, the transaction was made outside of eBay.

Shortly after making the offer, the victim received a notification in the My Messages section of her eBay account telling her she had won the auction. eBay has long cautioned users not to rely on notifications unless they appear in this official section.

The malware installed on the victim’s machine caused her browser to display a counterfeit version of just such a message. Had she used a non-infected computer to access her account, no such message would have appeared.

“There’s no reason to suspect it’s fraud until its too late,” said the Ohio-based user, who agreed to tell her story on the condition her identity was not revealed. The Register was able to verify the scam by confirming details with eBay and by reviewing screenshots, emails and files pulled from her machine.

The malware appears to be a reworking of Trojan.Bayrob, which first came to light in early March when researchers from Symantec wrote reports about it.

It arrives in an attachment to an email responding to a bid and installs a local proxy server that redirects traffic bound for eBay. The proxy, according to Symantec, spoofs sensitive pages on eBay, including online auction’s “ask a question” messaging feature. The Trojan also inflates the user feedback score of the purported buyer, according to Symantec.

In the intervening seven months, the Trojan has been updated so that, among other things, traffic bound for sites such as Carfax and nine other addresses maintained by third-party companies will also be redirected. This helps thwart victims who try to independently confirm details fed on the falsified eBay pages.

eBay spokeswoman Nichola Sharpe says the company’s security team has forwarded samples of the new strain to anti-virus companies so they can add it to the updates they send to customers.

Original URL: http://www.theregister.co.uk/2007/10/19/return_of_trojan_bayrob/print.html

After a series of cabinet-level meetings this month at the White House, computer security analysts say the Bush administration is considering creating a new agency or cyberwar center to better protect the federal government’s computers and find ways to help private companies and public utilities fend off computer attacks.

Those attacks, which could be just a few key strokes away, could shut down U.S. power grids and communication and banking systems, security analysts warn.

“Basically we would find the lights go out, the dial tone stop and we have no ability to access our money,” Sami Saydjari, founder and president of the Cyber Defense Agency, told ABC News.

Internet security companies, such as Akamai in Boston, are currently tracking thousands of attacks against the U.S. government and corporate computer systems every day.

“We would not be in a good situation if we were to enter a cyberwar today,” Akamai co-founder and chief scientist Tom Leighton said.

On most days, the single biggest source of those attacks is China.

“A Chinese general has talked about how they would reach out through cyberspace and turn off the American electric power grid before any conflict with the United States,” said Dick Clarke, a former White House counterterrorism official and now ABC News consultant.

White House advisors say alarm bells sounded when this past June Chinese hackers got into the unclassified computers of Secretary of Defense Robert Gates.

“The intelligence community has come to the recognition that China and other foreign governments have free run of American computer networks,” Clarke said.

In addition to long-distance hacking, U.S. experts are concerned Chinese-made computer equipment could be sabotaged in ways that are undetectable, the so-called Trojan horse attack.

“My fear is that there are many, many Trojan horses, many, many malicious codes in a large number of our critical systems,” Saydjari said. “And that there are just waiting to be activated through some trigger at some time.”

The White House says it is asking for $6 billion in the latest budget to increase cybersecurity.

Original URL: http://blogs.abcnews.com/theblotter/2007/09/from-china-with.html

That done, the hacker posted a video of his exploits on YouTube to celebrate his “achievement” (the video has subsequently been taken down). In response, eBay and LiveWorld—the third-party software firm that operates eBay’s web-based forums—took the entire Trust and Security forum offline while they looked into the problem. The forum was taken down 90 minutes after the posts first hit the Web and was put back online later that day.

eBay issued an official statement on its eBay Chatter forum, stating that while the posts appeared to contain credit card information, the posted numbers did not correspond to credit card information that eBay had on file for those users. Nevertheless, the user names and contact information were accurate, and eBay claims they are attempting to get in contact by phone with each of the 1,200 users to ensure that they can protect themselves from any attempts at hijacking their accounts. At this time, eBay is unclear as to whether or not the accounts have been fully compromised. It is also not certain that only these 1,200 accounts are affected.

While the original posts and the YouTube video showing the list of names have been removed from the Web, an eBay member has grabbed as many of the account names as possible and posted them on a personal web site so that people can easily check to see if their account was one of the original 1,200. So far, the operator of this list has not been asked by eBay to take it down.

While this particular attack may not have revealed customers’ credit card information, there are plenty of fraudsters about who are trying their hardest to scam people out of their money: a helpful eBay forum member even posted a list of an astonishing 36 common scams currently being perpetrated against eBay users. Most of these involve social manipulation and phishing scams rather than direct attack, but clearly they are effective: videos of hacked accounts posting over 60,000 items for bid show what the bad guys are likely to do once they have your account information. It’s always a good idea to practice skeptical computing, but eBay users should take even greater care to ensure that they are not taken in by any of these scams.

An eBay representative did not return our request for a comment in time for publication.

Original URL: http://arstechnica.com/news.ars/post/20070926/…/more.html