5 ms·
TechCrunch Hacked
- suhail 17y agoyep.
- rms 17y agoWell played, anonymous hacker. I even respect your lack of political posturing. For when this gets fixed, right now techcrunch.com is an empty html page that contains <a href="http://nottherealurl.com/ http://nottherealurl.com/ title="rapidshare downloads">rapidshare downloads</a> Edit: now it is a blank html page that contains only "hi". Someone from HN rehacked it? Or it's about to be fixed.
- NZ_Matt 17y agoIt was linking to dupedb .com when I looked a minute ago. Now all I see is text saying hi
- decadentcactus 17y agoBefore that, it (automatically redirected?) was some affiliate link. I came page to the tab to see 'this offer is not available in your country'.
- timdorr 17y agoLooks like it's switching around depending on what backend their load balancer throws you to. It's jumping around for me, which suggests they don't have any session affinity. Interesting, but I guess it's not required for their kind of app.
- mahmud 17y agosite, for their kind of site.
- olefoo 17y agoThese days, that's a distinction without a difference. All websites that couldn't usefully be delivered as PDFs are applications by definition.
- Skeuomorph 17y agoTechcrunch could be delivered as a PDF. I get it on my Kindle. Just as most new web sites are not startup companies, most existing web sites are not apps. The distinction and difference is that a software application helps a user perform manipulation or transformation of data as useful work. Most websites, despite simple interactivity (e.g. search), are still published as "content" for consumption within a content access application, not for manipulating work|play|creative output.
- Sukotto 17y agoThe line between those two words blurs more every day
- deleted 17y ago[deleted]
- krav 17y agoA hack for the sake of hacking - gotta respect.
- jvdh 17y agoEither they've been hacked again, or they're really onto it now. The page is now blank with the text: "We'll be back soon."
- ashishbharthi 17y agoI saw "We'll be back soon." page once when I submitted comment on one of he article.
- deleted 17y ago[deleted]
- deleted 17y ago[deleted]
- deleted 17y ago[deleted]
- dryicerx 17y agoI am surprised this news wasn't posted on TechCrunch before... oh wait.
- chaosmachine 17y agoOne day too early, if they were going for maximum damage.
- drenei 17y agoWho ever is behind this is changing the html page, 4 mintues ago it was <a href="http://dupedb.com/ http://dupedb.com/ title="rapidshare downloads">rapidshare downloads</a>. Now the source says "hi". Strange times.
- deleted 17y ago[deleted]
- melvinram 17y agoHope they have backups and don't loose data. As much as I hate that their quality has gone down, I hate to see someone's hard work get killed by something like this.
- jrockway 17y agoMaybe people will finally stop using the duct-taped spaghetti called "wordpress".
- olefoo 17y agoWhat would you suggest as an alternative?
- NateLawson 17y agoJekyll outputing a static HTML blog, with Disqus for comments. I have a rule of no dynamic content on my webserver. http://jekyllrb.com/ http://jekyllrb.com/ (Yes, my blog is currently hosted at wordpress.com, but I'm evaluating Jekyll as part of the next round of server migrations. I started with wordpress.com years ago when I didn't want to run WP on my own server, but wanted the ease of a blog.)
- olefoo 17y agoThat's not a bad rule. I've actually been considering using sphinx http://sphinx.pocoo.org/ http://sphinx.pocoo.org/ for my blog reboot. Mostly because I'd like to offer visitors a choice of formats, read bits and pieces on the web or grab the whole thing as a PDF or reasonably priced e-book.
- est 17y agofrom my experience, wordpress itself is quit solid, most vulnerability are from third party plugins.
- 17y ago
- Technophilis 17y agoWas techcrunch hosted in indonesia or is this a DNS attack ? http://bit.ly/5QgDUa http://bit.ly/5QgDUa
- kierank 17y agoThat is wrong.
- DaveHanna 17y agoredirected me first time to http://www.twply.com/ http://www.twply.com/ then it came up next time with "hi"
- CalmQuiet 17y agoA page which politely invites you to enter your Twitter user name & pw. [ I politely declined. ]
- tumpak 17y agowell this sucks. but i feel the hack was done today instead of tomorrow to let them know the hackers displeasure on something. but not to really hit them when it matters... (which is tomorrow for apple presentations ) maybe its just a warning perhaps. I am sure techcrunch is working on this... wordpress systems are pretty stable but all systems have a loophole.. on many systems, you can't avoid the hacking because it is the human errors (or negligence)
- ryanwaggoner 17y agoApple event is Wednesday, not tomorrow.
- J_McQuade 17y agoI always let out a disappointed sigh when I have to remind people of things like this, but tomorrow is Wednesday for a lot of the world.
- ryanwaggoner 17y agoYes, I'm aware of that. However, it's not for any of the relevant parties in this story (TC, HN, Apple), and the Apple event is a fixed number of hours away, regardless of what time zone you're in, and that number of hours is sufficient that the event is not "tomorrow". Or I'm up way too late and not thinking clearly :)
- BrandonWasHere 17y agoMore likely it was an automated attack carried out by bots. I'm still putting my money on the recent rash of non-secure FTP exploits (client side).
- dangrossman 17y agoThis was no automated attack. The page was updated with a series of what could only be hand written messages as TC tried to overwrite what the hacker was uploading. At one point the whole page turned to "o_O".
- paulitex 17y agoAnd.... We're back. Now, how long til we get Arrington's spin?
- deleted 17y ago[deleted]
- riffraff 17y ago30 mins later, no we're not
- melvinram 17y agoNow it's back. Restored. Glad nothing disappeared.
- vaksel 17y agoall I'm seeing is "we'll be back shortly" it could be the hacker changing it
- deleted 17y ago[deleted]
- deleted 17y ago[deleted]
- NZ_Matt 17y agoIt has just been hacked again.... The html: <title>LOL HACKED</title> <center><h1><b>WHAT A FUCKING USELESS HACK ISN'T IT? BLEH.</b></h1></center><br> <h1><a href="http://dupedb.com/ http://dupedb.com/ title="rapidshare downloads">http://dupedb.com/</a></h1><br> http://dupedb.com/</a></h1><br>
- todd3834 17y agonow it says, "We'll be back shortly."
- deleted 17y ago[deleted]
- mrclark411 17y agoNo word from them: http://twitter.com/techcrunch http://twitter.com/techcrunch
- NZ_Matt 17y agoDaniel Brusilovsky is on the case: http://twitter.com/TechCrunch/team http://twitter.com/TechCrunch/team
- kyro 17y agoAt one point, the source said <!-- WP Super Cache is installed but broken. The path to wp-cache-phase1.php in wp-content/advanced-cache.php must be fixed! -->
- amvp 17y agoVisitors should be awake that visiting tc.com rightnow is equivalent to visiting an suspicious, untrustred site. It could serve malicious content that takes advantage of unknown vunerabilities even on fully patched systems... although i'd hope the hn audience is savvy enough to know this.
- NateLawson 17y agoYou generally don't wipe out the main page before serving malicious content.
- dotBen 17y ago"Visitors should be awake that visiting tc.com rightnow is equivalent to visiting an suspicious, untrustred site" Surely that's the case every day??? LMFAO
- dotBen 17y agoWOW, de-karma'd for that! Someone needs to find a sense of humor.
- imok20 17y agoReally? Let's call this "cracked," not "hacked" – we're only furthering the misunderstanding by using the incorrect term here, too.
- houseabsolute 17y agoHow about hackers everywhere give up on reclaiming this term. It's not going to happen. That way I don't have to see this post on every single story about malicious intrusion that comes up on social news sites.
- imok20 17y agoThe difference is that this site is called "Hacker News."
- andrew1 17y agoI appreciate that whoever runs the site can call it whatever they like, but I wish they hadn't chosen 'Hacker News'. I know that it's my own prejudices at play here but it's simply embarrassing to have 'Hacker News' staring out from the top of my browser window. It's so ridiculous I can't even bring myself to say it, when I discuss links with a friend who also checks this site the conversation starts with 'did you see that article about X on the, er, the YCombinator news site?'.
- InclinedPlane 17y agoAlso note that it's possible for a single word to have multiple meanings depending on context, this includes even opposite meanings with opposite connotations. In the context of news.yc.com the term "hacker" generally has a different meaning than the term has elsewhere, especially in the context of unauthorized, malicious intrusion into a computer system. Similarly a term such as "killer" may have an extremely negative connotation in the context of a grisly homicide yet the same word may have a positive connotation and a completely different meaning (dominant, superlative, desirable) in other connotations. Such is the dynamic, flexible, and adaptive nature of language (outside the realm of the pedant).
- faramarz 17y agoCould be a widespread WP security hole..
- mahmud 17y agoNever attribute to a platform bug what can be explained by misconfiguration.
- deleted 17y ago[deleted]
- jasonrojas 17y agohttp://www.techcrunch.com/wp-cache-phase1.php?plugin=shell http://www.techcrunch.com/wp-cache-phase1.php?plugin=shell whooops?
- buro9 17y agoThat's very possibly the vector. If you can place a .php file in the plugins directory located here: http://www.techcrunch.com/plugins/ http://www.techcrunch.com/plugins/ And then if you call the script as per your example, then it appears that plugin is loaded (and evaluated). Someone else more versed in PHP might want to cast their eyes over the wordpress plugin to see whether I'm right: http://wordpress.org/extend/plugins/wp-super-cache/ http://wordpress.org/extend/plugins/wp-super-cache/ But it appears it's a case of globals not being checked prior to use: http://php.net/manual/en/security.globals.php http://php.net/manual/en/security.globals.php So at first glance and with limited info... it's a plugin. Not that this surprises me, I still use vBulletin and I spend a lot of time code-reading the plugins for that before I use them. Mostly to make sure they don't do silly things like have SQL inside a loop over potentially lots of items, but also for the obvious security holes. register_globals is an old one though, should be disabled: http://drupal.org/node/222343 http://drupal.org/node/222343
- olefoo 17y agoThey had register_globals on? @_@ I hope they go for the radical openness option and do a full public post-mortem. A teachable moment like this should not be wasted. register_globals was known to be a bad idea in 1999 for crying out loud.
- raffi 17y agophew I don't feel bad now. I wrote a HTML preprocessor in 1999 to allow PHP-like embedding of Perl in webpages. It did the equivalent of register globals. I still have it up on my website but with a big warning that says "this has known security issues, don't use it". At least someone else made the same mistake around that time :)
- 17y ago
- leelin 17y agoI sure hope this isn't the case, but everyone saying 'outage would caused more damage Wed. morning' might get their wish.
- karteek 17y agoDid Apache behind TechCrunch always add "X-Pad=avoid browser bug" header ? Apparently few Apache 1.x installations use to send this header as part of some fix for few versions Netscape. Edit: TC seems to acknowledge the hack now. Also, the header X-Pad is missing now. "Earlier tonight techcrunch.com was compromised by a security exploit. We're working to identify the exploit and will bring the site back online shortly."
- jgrahamc 17y agoWasn't me: http://www.jgc.org/blog/2009/07/techcrunch-skating-on-thin-ice.html http://www.jgc.org/blog/2009/07/techcrunch-skating-on-thin-i... Will be interesting to hear the details. TC has done a lot to secure their site, but they were using WordPress.
- lut4rp 17y agoAbout time they shifted to Drupal. WP seems to be going down on security pretty bad.
- yannis 17y agoWhy not Ruby/Rails? Django/Python? you don't hear these sites being compromised so easily?
- antidaily 17y agoIs that because there are less of them?
- whalesalad 17y agoDrupal is such a complex pig, a custom solution would be much better. Especially for someone as big as TechCrunch.
- lut4rp 17y ago"... for someone as big as TechCrunch" Huh? How does "big" make them deserve a custom solution? Huge behemoths like nowPublic.com and spreadfirefox.com run Drupal. Heck, economist.com is >>> techcrunch, and they're dropping their custom solution and shifting to Drupal. IMO, "big" is the least of their concerns if they want to switch to Drupal. TC is perfect example of a website wanting content management. Content is what they deal with. But, I will say Drupal is not the answer to all problems. For example: if your application deals primarily with data that can't be classified broadly into "content". Like last.fm or chesspark.com or etherpad.com... you get me.
- InclinedPlane 17y agoSee also: whitehouse.gov (which uses drupal)
- tptacek 17y ago
- sankara 17y agoAs of now, TC is back. There is no mention of what went wrong though.
- jsz0 17y agoI heard Mike Arrington actually developed all the IP for the hack. True fake story.
- tmsh 17y agohttp://twitter.com/arrington/status/8230803684 http://twitter.com/arrington/status/8230803684
- wesley 17y agoback up. Looks like they even found the time to add interstital ads on techcrunch.com.. (Direct link: http://www.techcrunch.com/welcome.html http://www.techcrunch.com/welcome.html)
- noarchy 17y agoIs TechCrunch simply preparing to merge with Twitter, at last?
- sucuri2 17y agoThat shows how bad security is on most places… The bad guys just need to find 1 mistake to get in, while we have to protect at all places. That’s why covering all angles is important… --dd http://sucuri.net http://sucuri.net
- NateLawson 17y agoAdvertise much?
- sucuri2 17y agoyeah, yeah... couldn't resist
- petercooper 17y agoCorrect me if I'm wrong.. but did I just see an interstitial ad page when going to that link?