Hello, I'm a long time reader of this list and have never really had the need
to post here. However, recently a webserver that I do minimal administrative
work for was attacked. We're still unsure exactly what had been done. Most of
the logs have been either cleaned or wiped completely (either by log rotate or
by the attacker). I was gone for the weekend so I sorta came back to this. I
don't really have questions about the attack per se, we're doing pretty well at
the recovery process.... one question I do have however is this.
The attacker (either manually or using a program) replaced all index.html/htm
and index.php files they had permission to replace with a UDP flooder. I
extracted some of the information from the flooder using the strings program
and heres what I get:
!HELP! beta version.
!HELP!
!HELP! #brazil@efnet - eleet team
!HELP! + code by bonny ::: bonny@hacker.com.br
!CREDITS! * creditos aos amigos e a quem me ajudou.
!CREDITS!
!CREDITS! * none (root@suid.net) ::: Brazil
!CREDITS! packet spoof
!CREDITS! * cyclone (cyc@pop.com.br) ::: Brazil
!CREDITS! parceiro das hackadas, aprende rapido
!CREDITS! * mariana (mazinha@brasnet.org) ::: Brazil
!CREDITS! minha leet girl, exclusiva :)
!CREDITS! * alcaloide (root@faggot.net) ::: Brazil
!CREDITS! super lamer, versao 3 pra pacotar ele
* Opcao invalida! * %s para maiores informacoes.
!AJUDA!: %s -help
CREDITS: %s -credits
!USAGE!: %s (host/ip) (size) (loops)
(host/ip) == host do babaca a ser fudido.
(size) == bytes a serem enviados.
(loops) == tempo da fudecao/s.
CTRL-C - ACAO CANCELADA!
FUDEDOR (v3.0) by bonny - PRIVATE!@#!
host desconhecido: %s
Maximo de bytes permitodos: 65535.
A maquina nao tem memoria suficiente.
FUDENDO A VERA %s COM %s bytes...
pronto maneh, o babaca foi fudido! :)
My question to anyone out there who can answer it is this, do you know of any
kind of automated attack that replaces index files for websites with such a
flooder? It doesn't seem like this hack was extremely well thought out, or
done by anything more than a script kiddy... if it was, why would they replace
these files with this binary program? Why not replace it with a new index.html
file saying we got hacked?
