At the time of writing these websites are still defaced, with a black page written TurkguvenLigi and “4 Sept. We TurkGuvenligi declare this day as World Hackers Day - Have fun ;) h4ck y0u”.
What do ups.com, vodafone.com, theregister.co.uk, acer.com, betfair.com, nationalgeographic.com and telegraph.co.uk have in common? They all use NetNames as their registrar. It appears that the turkish attackers managed to hack into the DNS panel of NetNames using an SQL injection and modify the configuration of arbitrary sites, to use their own DNS (ns 1.yumurtakabugu.com and ns 2.yumurtakabugu.com) and redirect those websites to a defaced page.
We have just learned that your service is being used to display false, or "spoofed," PayPal.com pages, in an apparent effort to steal personal and financial information from consumers, and defraud PayPal users. Specifically, it appears that a PT. Master Web Network user is sending unsolicited messages which misrepresent the sender as PayPal, and making false statements that encourage the recipient to go to a page hosted by you at
Ip server 119.235.xx.xx http://indonesiandefacer.org/shop
asking to enter personal and account information. The purloined information is then sent to an email account and, based on our investigation of similar schemes, used to steal accounts and commit other fraudulent acts including international credit card and wire fraud. !
06/01/2011 Written by Admin (Indonesian), erikcyber (fasthacker)
Last year the Indeves archived a sad record number, we archived 1.419.203 websites defacements. Why and how this is happening If you are looking at on the stats, the things remain the same: file inclusion, sql injection, Jumpung server, webdav attacks and shares misconfiguration are still at the top ranks of the attack methods used by the defacers to gain first access into the server. As an important factor influencing the stats we consider the fact that last year brought a very high number of the local linux kernel exploits.
Since many years ago, Linux became the most used OS for webservers and of course the preferred target for the defacers. Last year we archived 1126.987 attacks against websites running on the Linux systems. The most used exploit by the defacers is the CVE-2011 is 3301 that was fixed in 2007 and was mysteriously reintroduced in 2008 in a large pile of kernel versions x8664 But should be the out-of-date Linux server the only reason of this huge amount of defacements?Yes and no.
INDEVES is a free, safe and legal training ground for hackers to test and expand their hacking skills. More than just another hacker wargames site, we are a living, breathing community with many active projects in development, with a vast selection of hacking articles and a huge forum where users can discuss hacking, network security, and just about everything. Tune in to the hacker underground and get involved with the project.