Cryptome Hacked; All Files Deleted 170
eldavojohn writes "Over the weekend, the whistle blowing site Cryptome was hacked and vandalized, resulting in all 54,000 files being deleted and two days worth of submissions lost. Cryptome reported that its EarthLink e-mail account was compromised in ways unknown, and once the attacker was inside there, they were able to request a new password from the administration console for Cryptome at their hosting provider, Network Solutions. Once the attacker had that password, they deleted the ~7 GB of data that Cryptome hosted in around 54,000 files. Cryptome was able to eventually restore the site, as they keep backups ready for cases like this and stated that they 'do not trust our ISP, email provider and officials to tell the truth or protect us.'"
Editing! (Score:4, Insightful)
Holy cow, please edit the submissions before posting them.
*sigh* I'll get modded down for having the nerve to ask for a baseline of professionalism, won't I?
Earthlink? Network Solutions? (Score:4, Insightful)
Not hacked! (Score:3, Insightful)
The controversy about hacker vs. cracker is old and unsolved. But this case really does not warrant the use of the word "hack/hacked" under any meaning of the word whatsoever. This is a act of pure vandalism, nothing more.
Re:Super secret password (Score:2, Insightful)
Didn't they tell you to use both uppercase and lowercase letters? Had you used "Passw0rd" instead, nobody would have found out!
Hack (Score:5, Insightful)
Is a social engineering attack a hack? It sounds like someone called over to EarthLink and got an e-mail password reset. Then, once holding the e-mail account, called over to Network Solutions. This sort of thing wouldn't be difficult at all.
Re:Backups for the win! (Score:5, Insightful)
But they weren't smart enough to mirror submissions to other servers and so two days of submissions were lost. Those two days could easily have been the target. If so, then mission accomplished.
Professional vs. Amateur Hour (Score:5, Insightful)
A professional organization that knows its web presence is its life is going to have a bit better setup than a server that someone else (Network Solutions in this case) has control over. The right solution is a co-located server that is controlled exclusively by the organization. The hosting company doesn't need to have any passwords. They are also going to have their email processed by their own server and not be relying on an ISP for anything at all except connectivity.
However, a completely amateur operation is going to use shared virtual hosting because it is cheaper and the hosting company will be doing backups for them. And controlling passwords. And all other security. Oh, and using a non-domain based email setup from an ISP.
I guess it is pretty obvious into which category Cryptome falls, right?
Yes, it would cost $2000 a year or more for a co-located server whereas shared virtual hosting is dirt cheap.
Re:Editing! (Score:4, Insightful)
Professionalism? How about a baseline of a spelling, grammar and general writing skills?
/ Kill me with moderation, William "B.J." Blazkowicz, I am in a Grammar Nazi mood today.
Re:Earthlink? Network Solutions? (Score:5, Insightful)
and you're an idiot if you post anything there expecting to be anonymous.
Why? If I really wanted to post something anonymously, I would set up a network of proxy SSH severs paid for with prepaid debit cards (purchased using cash), change the wireless MAC on a throwaway secondhand laptop (purchased using cash off Craigslist), walk down to the local Starbucks, access my proxy setup through Tor, and then be reasonably confident that I would be able to do anything anonymously. Of course, I would only post plain text files.
So I don't really understand why you would be an idiot for expecting anonymity if you went to the pains of taking care of it.
Re:Professional vs. Amateur Hour (Score:5, Insightful)
Being a non-profit organizatino, Cryptome's status as a professional organization or an amateur organization probably depends on the size of their donation base. For a website group trying to get by on a shoestring budget... well, maybe this little stunt will help them raise awareness to get the donations for a better server setup. (Not that I actually know the size of their donation base, and maybe they do have enough money for that sort of setup and they're just stingy/stupid.)
Re:Hack (Score:3, Insightful)
Is a social engineering attack a hack? It sounds like someone called over to EarthLink and got an e-mail password reset. Then, once holding the e-mail account, called over to Network Solutions. This sort of thing wouldn't be difficult at all.
FYI - 'Hacking' never is, never has been, and likely never will be. The kind of amazing tricks you're imagining under that term lie within the realm of security research, espionage, etc. 'Hackers' are, by definition, hobbyists, and hobbyists are generally doing it for the love of the game, for the fun of it, etc. The guys doing the stuff that might actually amaze you are being PAID to do so. Otherwise they'd give it up and move on to something easier, until such time as nothing easier actually exists. So you say that exploiting a social gap isn't '1337' enough to make the grade? How is utilizing a published Windows exploit any better? SQL injection? Nobody buy nobody is divining their own security-breaking code from tiny mystical oracles found at the bottom of Mountain Dew cans.
In short, the movie 'Hackers' bears zero resemblance on reality.
Re:Editing! (Score:1, Insightful)
No, because you followed Slashdot Tip for Getting Modded Up #1: "Whine about getting modded down in your post."
Re:Colo vs Home Server vs Virtual Machine, and bac (Score:4, Insightful)
Also... only 8G of data? That's it?
how much data do you expect them to host? it's not like they store multi GB long videos of events or anything.
Re:...what? (Score:3, Insightful)
Re:Backups for the win! (Score:4, Insightful)
Re:A little paranoid. (Score:3, Insightful)
Wikileaks doesn't harm western democracies - they do inconvenience the administrations, but the whole concept of leaks are great for the society, citizens, and especially the democracy part; silencing leaks would harm western democracy and destroy the whole meaning of it. I don't care about Chinese government cheating their citizens - that's their problem, I want to be informed about the failures and lies of *my* officials that I elected and that affect my country. I don't want to improve country reputation by simply hiding unflattering things, I want to improve the reputation by fixing the faults. Lying to ourselves about bad stuff not happening is the domain of North Korea, not the western world.
And what do you mean about "journalistic discretion" ? The big newspapers that are following your so-called "journalistic discretion" shouldn't be allowed to call themselves journalists because of this anymore. In earlier times they did proper journalism, dug up the dirt themselves, interviewed informants, cared about their reputation of protecting the anonymity of their sources and fought for the right of publishing facts for the society, even and especially if the goverment claims to be harmed by the facts - for example, the Pentagon papers case. Now wikileaks has picked up the slack where the "journalists" are failing their role in society, and it's a shame - but a shame for the publishing industry.