Weird HTTP Location header (after hack)

[Riven]

Since the successful hack on JGO
   http://java-gaming.org/
redirects to:
   http://www.java-gaming.org// (note the double slash)

[DzzD]

Since the successful hack on JGO
   http://java-gaming.org/
redirects to:
   http://www.java-gaming.org// (note the double slash)

[Riven]

Faulty redirects are NOT funny



Edit:
Let me add that that HTTP Location header was already b0rked during the hack.

Games published by our own members! Check 'em out!

[DzzD]

funny that you did it, it is that no ? you change the redirection ? perfect for spoofing/fishing

[Eli Delventhal]

Faulty redirects are NOT funny



Edit:
Let me add that that HTTP Location header was already b0rked during the hack.

Well it was messed up anyway. It's probably getting close to JGO needing to migrate somewhere else, actually. With Chris no longer at Sun and now a hack, this might be a logical step.

[Riven]

funny that you did it, it is that no ? you change the redirection ? perfect for spoofing/fishing

I'm not sure what you mean.

If you mean that I was behind the attack: no.



Anyway, that redirect is not really usable for spoofing, as it doesn't really do much, and is noticable by the enduser. If you hack a site, it's much more evil to not deface it, so that people will still login, allowing you to grap their password in plain text (assuming it is salted+hashed in the database).

[DzzD]

ok I was thinking it was a demonstration of hack (that you did).

about spoofing it is very usable as it is the second step after fishing, like if you redirect to www.javagamming.org then grab password and then "spoof the victim"

[Matzon]

why is there no info regarding the defacement?
why are we still running 1.1.5?

fwiw, I am assuming my profile info is already retrieved and that the server may be sending malicious content - so javascript is off for jgo.

[Riven]

ok I was thinking it was a demonstration of hack (that you did).

about spoofing it is very usable as it is the second step after fishing, like if you redirect to www.javagamming.org then grab password and then "spoof the victim"

The hackers replaced /index.php
They were nice enough to copy the original file to /index2.php

That means they had write access to the web-root.
Once you have that, you don't need to spoof anything. You can modify the php script that handles the login, and send every login to an IRC chatroom of your choice. It would (probably) take a long time before anybody would notice that.

[DzzD]

so do we need to change our passwords ?

Games published by our own members! Check 'em out!

[Riven]

so do we need to change our passwords ?

Ofcourse.

[elias4444]

so do we need to change our passwords  ?

I'm pretty sure SMF stores the passwords via a one-way MD5 encryption in the DB. So, probably, no... you don't NEED to.

[DzzD]

I'm pretty sure SMF stores the passwords via a one-way MD5 encryption in the DB. So, probably, no... you don't NEED to.

I suppose it depend when I connected last time, how long does this hack has been running ?

[Riven]

I'm pretty sure SMF stores the passwords via a one-way MD5 encryption in the DB. So, probably, no... you don't NEED to.

Never heard of rainbow tables? The passwords must be salted too, or you can simply lookup most 'one way' MD5 hashes (MD5 encryption does not exist)



MD5 Hash: 7232ae7254ffb527ca0db6cd1ec41152
http://passcracking.com/index.php
This is how easy it is to 'crack' that MD5...

Once a hacker grabs an unsalted hashed table column, most passwords are retreivable this way.

[Riven]

why is there no info regarding the defacement?
why are we still running 1.1.5?

I find the lack of info disturbing... if no admin is posting anything, it might mean that no admin has done anything, and we are still hacked, just not defaced

[Eli Delventhal]

I find the lack of info disturbing... if no admin is posting anything, it might mean that no admin has done anything, and we are still hacked, just not defaced

This is a good point. I tried to email Chris about it but the email I have (a Sun email) no longer works. So does he even know?

[teletubo]

This is a good point. I tried to email Chris about it but the email I have (a Sun email) no longer works. So does he even know?

Minutes after the site came back, I saw ChrisM on the "Latest Active users", so I guess he does .

[kappa]

Minutes after the site came back, I saw ChrisM on the "Latest Active users", so I guess he does .

how do you know that was really him and not the hackers using his account?

[Eli Delventhal]

how do you know that was really him and not the hackers using his account?

Oh noes! It's a conspiracy!

Quick, Chris, tell me something only you would know!

[pjt33bis]

Any status update? I don't dare log in with my real account.

[Riven]

Any status update? I don't dare log in with my real account.

Why not? Who knows how long the site was hacked before the defacement. Changing your password is about as much as you can do.

But yes, it's beyond all reason that none of the admins mentioned the... hack, what happened, and what they did to secure the site (like upgrading from SMF 1.1.5... seriously!)

[princec]

Can't be arsed to change my password. If you see any complete bollocks being posted under my username then you'll know it's a hacker.

Oh, wait, hang on...

Cas

[Roquen]

Ninja'd.  I was about to say something along the same lines!

[Markus_Persson]

For the record, I know nothing, and I can't investigate anything.

[pjt33bis]

Why not? Who knows how long the site was hacked before the defacement. Changing your password is about as much as you can do.

If the site is still hacked then changing your password gives it directly to the hackers, so I'd rather have some credible evidence that it's safe before I do so.

[Riven]

If the site is still hacked then changing your password gives it directly to the hackers, so I'd rather have some credible evidence that it's safe before I do so.

There is nothing of value here for me. Even if they have my password, they can only use it to access JGO.

And if the site is not hacked anymore, it actually was a good move to change your password.

[Riven]

*BUMP*

Please be responsible and at least update the forum software.

[Markus_Persson]

I get the feeling that the server this is on is a bit unmanaged at the moment..

[Riven]

I get the feeling that the server this is on is a bit unmanaged at the moment..

Probably. The invalid redirect is still there, and ChrisM, despite having posted in some other threads, apparantly doesn't think it's even remotely polite to the users of this forum, to explain: what happened, what data was stolen (if any), and how he ensured it won't happen again. Oh well.