Astalavista.com hacked, including details (opens in new tab)

They did have off-site backups, which the hacker found and erased.

One strategy that I employ to mitigate this is to have my backup service connect to the production server, rather than the other way around. That way if your production services are compromised, your backups remain untouched (on a machine that's running no services, behind a firewall, etc, and for all intents invisible).

It looks like they first buffer overflowed Litespeed to spawn a shell (which was ironically running as a user 'apache'). The http headers that are being returned from Astalavista are consistent with this theory (in addition to the obvious output of the first binary run). Apparently Litespeed has a pretty dodgy security record after doing a cursory search.

Far more interesting was the root escalation exploit. 2.6.18 is a relatively recent kernel, and I haven't heard of exploits publically disclosing something of that caliber. Has anyone seen anything on securityfocus/bugtraq/milw0rm etc regarding this?

I'm thinking I was not the only one reading the title as altavista.com and I was really shocked.

Thanks for the background info on the site.

Offtopic, but please, don't use 'virii'. The correct plural is 'viruses'. 'Virii' is wrong for two reaons:

1) The Latin plural of word ending in -us is not -ii. -i at best.

2) 'Virus' doesn't have a Latin plural, because its meaning is like (in the sense of not having a plural) 'sand': it already denotes a multitude.

Brutal indeed. Not only did they expose all aspects of astalavista, they actually trashed and dropped everything.

As bad as astalavista is, is it right to reciprocate and trash their server? It seems as if the hacker sunk to their level.

Are there legal ramifications to something like this?

you're mistaking astalavista.box.sk with astalavista.com.

astalavista.com stole their name to ride on their popularity.

hell, i tend to find any reasonably detailed description of the process of exploiting something to be pretty interesting.

gives a fairly good idea of how to not make the same mistakes, if applicable.

That seems like a decent security precaution.

However, since astalavista was the site in question, you will probably be safer to visit after the hack.

I doubt quality folks such as the one's participating here at HN would ever post a link to a site, even a defaced one, that would potentially harm anyone visiting it. </circlejerk>

I especially liked "philip"... one of the 100 most common boy names.

dark side of me: I wonder how many of those passwords work to get into those e-mail accounts...

mysql> drop database ... (x9 databases)

My jaws literally dropped when I got to that part.. that's gotta suck, even for a crude site like Astalavista.

Indeed. I figured this particular piece of news would interest both types of hackers, as it contains technical details you wouldn't expect from a standard defacement. It's rather similar to the urge to rubberneck at a car crash: it's both horrific and exciting at the same time.

If my assumption is incorrect and no one is interested, I will humbly tuck my metaphoric tail between my legs and refrain from posting such things again.

Yes and the fact that there are always smarter people with more time on their hands than you out there on the internet.

i think that was the point: Astalavista is also an IT security company, yet they can't even keep themselves from being hacked in every way possible, using the simplest of prepackaged exploits available.

The tool they were downloading appears to have been private. Hence the anonymized IP and hostname (anti.sec.labs).