Hacker Threads - merged

[dmyre]

It appears that the dnjournal.com has been hacked:

http://www.dnjournal.com/

 

[Adam DickerAdam Dicker is verified member.]

and it appears he is coming after dnforum next.

-=DCG=-

 

[Adam DickerAdam Dicker is verified member.]

Just left a message for Ron, I hope dnjournal is fine!

-=DCG=-

 

[Mr. Pim]

Stupid scriptkiddie defacers !

 

[iBizStart]

Wow that sucks. Hope to see it back online soon. Are you gonna take any extra precautions DCG?

 

[SouthernTn]

stop reporting domain hijackers..... oh boy . pitiful

 

[dvestors]

.

 

[Adam DickerAdam Dicker is verified member.]

Wow that sucks. Hope to see it back online soon. Are you gonna take any extra precautions DCG?

Already have!

But if he wants to pull us down, he will.

I have good backups though and done 4 times a day,

-=DCG=-

 

[Xia]

How does this hijacking work and what must one do to prevent this? Is locking your domain enough?

 

[Adam DickerAdam Dicker is verified member.]

How does this hijacking work and what must one do to prevent this? Is locking your domain enough?

You must block all your server ports and make sure you have the latest version of php, apache and mysql if you run linux as well as any other updates.

-=DCG=-

 

[droplister]

what a fool, what a foolish request, hope this guy is taken down.

Any one contact him through his contact info?

 

[Xia]

so it's a 'real' server hack, not a 'domain hijack' (through registar) etc?

 

[GeorgeKGeorgeK is verified member.]

The hacker is "online" in Yahoo Messenger, according to:

http://profiles.yahoo.com/dnjournal2005

Perhaps Yahoo abuse can track down the IP address, or something, and compare that to DNForum.com webserver logs.

 

[Adam DickerAdam Dicker is verified member.]

so it's a 'real' server hack, not a 'domain hijack' (through registar) etc?

Correct.

-=DCG=-

 

[mikesherov]

What a noob... if you want to be taken seriously, don't build your warning message in Frontpage!

 

[Keyboard Cowboy]

Haha mike, I just noticed that too

What a moron. He knows how to hack, but not html... Seems fishy to me

 

[scorpio]

Got him online on yahoo Messanger. tried to do netstat but as no direct connection was there:..

Rajat: Hello
dnjournal2005: hi
Rajat: Whats your purpose of this ?
dnjournal2005: i'm said in dnjournal.com
Rajat: Yes.but is this fair.
dnjournal2005: ok
Rajat: yes
Rajat: U seem to be quite intelligent
Rajat: and not 16 year old
dnjournal2005: ok
dnjournal2005: i'm 2 high school
dnjournal2005: not important
Rajat: does iran have lot of domains.
dnjournal2005: yes
Rajat: how u hacked the site ?
dnjournal2005:
Rajat: Please explian , i am curious
Rajat: I can pay u if u explain me .
dnjournal2005: Sorry
Rajat: do u hijack domains ?
dnjournal2005: yes
Rajat: whats your best hijacked name ?
dnjournal2005: sorry i can not give you information
Rajat: oh .
Rajat: how many names have u hijacked ?
dnjournal2005: over 120 K
Rajat: 120K
Rajat: 120 000
dnjournal2005: yes
dnjournal2005: top domain names
Rajat: serious ?
dnjournal2005:
Rajat: do u sell them ?
dnjournal2005: yes
dnjournal2005: but
dnjournal2005: not all
Rajat: what price u sell them?
dnjournal2005: totally about 100 K
Rajat: how u find buyer ?
Rajat: wow 100K $ or Iran Rs.
dnjournal2005: in Sedo.com
dnjournal2005: $
Rajat: u must be rich .
Rajat: did u use keylogger on the dnjournal guys comp to get password ?
dnjournal2005: Lol
dnjournal2005: no
Rajat: how then?
dnjournal2005: i'm server manager
Rajat: 16 years and server manager
dnjournal2005: and i can find bugs
dnjournal2005: yes
dnjournal2005: linux/2003
Rajat: Does Iran have fast internet access
dnjournal2005: no
dnjournal2005: or
dnjournal2005: 56
dnjournal2005: 40
Rajat: how u do it then ?
dnjournal2005: ..
Rajat: on dialup
dnjournal2005: !
dnjournal2005: i'm working with pc and internet about 4years
Rajat: do u sell names on dnforum
Rajat: ?
Rajat: or only sedo
dnjournal2005: no
dnjournal2005: dnforum never
Rajat: how many websites have u defaced
dnjournal2005: one
dnjournal2005: dnjournal only
dnjournal2005: becuse
dnjournal2005: i'm looking money only
dnjournal2005: i do not need deface web site
dnjournal2005: becuse can not help me to earn money
dnjournal2005: and
dnjournal2005: i'm hacking domain name
dnjournal2005: and selling domains
dnjournal2005: ok?
Rajat: whats your best domain name ?
dnjournal2005: i can not give you any name
Rajat: did u delete all dnjournal files ?
dnjournal2005: yes
dnjournal2005: from coffe net
Rajat: coffe net
Rajat: whats that
dnjournal2005: internet caffe
dnjournal2005: !
Rajat: why delete ?
Rajat: did u hijack domain or just webhosting ?
dnjournal2005: both
Rajat: omg
Rajat: u got into his enom account or what ?
dnjournal2005: busy

 

[Dimva]

To bad to hear... Hope everything gets solved..
Darn hackers!

 

[DomeBase]

http://www.teachnet.k12.ca.us/Teachers on Web/loren/

If it is of any help in the investigation, this might be the source of the viper image. I do not think that this webmaster of this site would likely be involved, but perhaps a student got it from this site? Just an idea -- a possible lead -- I am not even sure if this image is elsewhere on the web, but it may be a lead?

 

[Zeeble]

I spoke to him too. What an idiot. He basically said the same thing when I asked why he did it......