dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


Dataloss.net: How we defaced www.apache.org

May 05, 2000, 20:14 (3 Talkback[s])

[ Thanks to S.Ramaswamy for this link. ]

"This paper does _not_ uncover any new vulnerabilities. It points out common (and slightly less common) configuration errors, which even the people at apache.org made. This is a general warning. Learn from it. Fix your systems, so we won't have to :)"

"This paper describes how, over the course of a week, we succeeded in getting root access to the machine running www.apache.org, and changed the main page to show a 'Powered by Microsoft BackOffice' logo instead of the default 'Powered by Apache' logo (the feather). No other changes were made, except to prevent other (possibly malicious) people getting in."

"Note that the problems described in this paper are not apache-related, these were all config errors (one of 'm straight from BugZilla's README, but the README had enough warnings so I don't blame the BugZilla developers). People running apache httpd do not need to start worrying because of anything uncovered herein."

"We hacked www.apache.org because there are a lot of servers running apache software and if www.apache.org got compromised, somebody could backdoor the apache server source and end up having lots of owned boxes."

"We just couldn't allow this to happen, we secured the main ftproot==wwwroot thing. While having owned root we just couldnt stand the urge to put that small logo on it."

Complete Story

Related Stories: