Re: Rash of navy web site defacements

• Previous message: McCammon, Keith: "ISP Filtering (Survey of Sorts)"
• In reply to: Dan Schrader: "Rash of navy web site defacements"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 30 May 2001, Dan Schrader wrote:

> Browsing the alldas.de defacement mirror I saw that nearly a dozen Navy
> and gov web sites were defaced today. 
> (http://defaced.alldas.de/defaced.php?archives=current&year=2001&month=05&de
> f_day=30) 
> 
> Does anyone know what methods were used to deface those sites? 

	From the looks of things, all the systems were Windows NT.  Based
on the ease with which IIS is exploited, I'd bet dollars to donuts it was
entirely IIS v4.0 and v5.0 bugs for which advisories and patches have been
around for quite some time now.

	Exploiting IIS isn't simply trivial.  You have to tie a board
across your butt to keep from falling in.

- -Jay

  (    (                                                          _______
  ))   ))   .- "There's always time for a good cup of coffee" -.   >====<--.
C|~~|C|~~| (>------ Jay D. Dyson -- jdysonat_private ------<) |    = |-'
 `--' `--'  `---- "Get in.  Sit down.  Hold on.  Shut up." ----'  `------'

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: See http://www.treachery.net/~jdyson/ for current keys.

iQCVAwUBOxZy19CClfiU/BIVAQEe7wQAiueC9F2C9ij3/IwRNYroEbiIUJMNVdzX
2R011RvZIQjywgAO9GiCzFVE6sC06gxyRBtSfqzRcJ3LDVixFQSul3AaJBozzJJm
9kyldkFbdmfuqvnTLYmQoiLOH+/HRD4bGRgdvEGdAro9ql1DBa4XTgjAbAC1+++0
HXdJKQtyfrU=
=eT7q
-----END PGP SIGNATURE-----

• Next message: Ryan Russell: "RE: Dummies got a sample page"
• Previous message: McCammon, Keith: "ISP Filtering (Survey of Sorts)"
• In reply to: Dan Schrader: "Rash of navy web site defacements"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu May 31 2001 - 18:30:27 PDT