Hacking Frontpage Extensions
Today one of those sites I contribute to was defaced by some stupid kiddies that claim that they deface websites because they "hate the world" or whatever. The usual asshole kiddies wanting to be known as "big hacking motherfuckers" (or 1337 h4x0rZ, or whatever they call themselves this days). They defaced something like 500 or so sites in 24 hours, trying to get a good rank in an whatever site that list them, all of them by using the same technique: exploiting frontpage extensions.
Here's a link explaining how someone can exploit those things, and I'm posting it in the hope that you open your eyes and start avoiding using Frontpage Extensions and hosting your stuff in servers with it. For those that aren't interested in reading it, let me leave you with just a quote:
Here's a link explaining how someone can exploit those things, and I'm posting it in the hope that you open your eyes and start avoiding using Frontpage Extensions and hosting your stuff in servers with it. For those that aren't interested in reading it, let me leave you with just a quote:
The FrontPage is a wonderful world full of unexplored exploits and vulnerabilities. Its a shame more time hasn't been spent exploring this more. It also goes to show that the more we try to close doors, the more software vendors open up new ones. Forget BO2k and NetBus, Microsoft did a much better job.
I am a systems admin and I had a problem with a script kiddie myself. They defaced a site that i just started administering. This was an old IT admins fault but I caught the raft of it. Anyhow I came across your article and I hope showing the bossman of this company that others like me really do think that FPSE are a systems admin worst nightmare. On to my question How do you think your website was defaced by the a hole in FPSE. The bossman wants me to find out how the little tittie sucking asshole got into our site and hell I dont have a clue. There were so many holes in our system that the little bastards could have came in planted some bombs and left beer cans behind for me to clean up. If you have some insight to how you troubleshot your defacement then let me in on it. Thanks for the great article.
ReplyDeleteIf you're looking for some forensics work, yu should contact a company dedicated to do such things. Anyway, I think you should be more interested in fixing all your holes than trying to find out which one was the faulty. My first tip: avoid Frontpage Extensions.
ReplyDelete