5 ms·

Not all that's involved. Sometimes "hacking" involves creative pranks. For example, one prank I pulled (which was admittedly pretty basic and silly) was a crea

by froo 17y ago

Not all that's involved. Sometimes "hacking" involves creative pranks. For example, one prank I pulled (which was admittedly pretty basic and silly) was a creative redirection using .htaccess for a certain someone's fixed IP address who used to lurk a site I ran last year. This person had an extreme distaste for me, because of the existence of the site and she would publicly slander me for something I never did at every available chance. So I decided to have a little fun with her. I set up a page with her (publicly available) photo with large text headline saying that she had been hacked, which the redirection went too. Total time to setup - less than 3 minutes. Having her write me a lengthy email me telling me that she was going to call the police (in Australia) and have me arrested was pretty interesting. I never responded. I think I would be freaked out too if the next time I visited someone's blog (which I was hypothetically consistently leaving trolling/nasty comments on) there would be my picture there, exclaiming how I'd been hacked. Sometimes the illusion of having "hacked" someone is just as satisfying as the real thing, without the messy potential of jail-time.

jacquesm 17y ago
Remind me to stay on your good side. We pulled a similar prank on a guy working on implementing 'verified by visa'. Every morning he'd walk in to the office and read the same news site. So, three days before completing the project we cloned the news site and posted an article that VISA had decided to abandon VBV. He walks in to the office, starts reading the headlines (-- expletive deleted --) slams his coffee down and walks out of the office. To his credit within 20 paces he started laughing like mad, knowing he'd been had. Pretty clever dude, it would have taken me a bit longer... :) To protect the guilty and the innocent alike, no further references, but rest assured that a few words were addressed to VISA execs that were not exactly pc. Lots of fun with the DNS.
- jgrahamc 17y ago
  You could do a load of damage with DNS redirection. If you look at the market penetration of Google Analytics you'll see that a very, very large number of sites are embedding JavaScript pulled from google-analytics.com in web pages. Now imagine if you redirected that one domain and served your own JavaScript. You could include the GA JavaScript as well, but add your own stuff which would then run in everyone's (within that DNS area) web pages and your JavaScript could start doing all sorts of nasty things.
  - jacquesm 17y ago
    Absolutely, I don't think it will be long before there will be a major hack like this at some large ISP. The temptation is just too large. DNS is one of the weak links of the way the web is put together, and javascript embedded from third party sites nicely exposes that Achilles heel. Another reason to mistrust open wifi connections :)
  - froo 17y ago
    You wouldn't even need to do too much damage on the client side for an effective attack vector. Imagine redirecting scripts for googleadservices.com and implementing their JS code with your own publisher ID there. That would make some of those adsense cheques Markus Frind has shown off look like lunch money. EDIT - if you really wanted to make something like this cool, you would instead use the publisher ID of some random charity (or even cycle through an array of charities) that could be easily obtainable by viewing source code in pages. Just a thought... EDIT #2 - Or, some more Internet Justice - just have it ignore the clicks that would otherwise go to domain parkers (with the revenue heading to charity). You cut off that air supply and eventually a lot of domains will start becoming available again. That way, the Internet Wins.
- froo 17y ago
  "Remind me to stay on your good side." :) I sold the site earlier this year, but the subdomain I set up is still live, so the "hack" (if you could really call it that) is still live. Gives me a giggle, everytime - I know it was malicious, but it was damn funny. Another thing I did to this person was embed a flash banner on her forums using google's adwords that would loop an 8 bit rickroll. She ended up disabling advertising on her site for a short while, instead of blocking the ad itself. It drove her users nuts. Among the best 80 cents I ever spent. Good times.
vidarh 17y ago
Back in the day I was running an ISP, and when we did a website redesign at some point we added reverse lookup of the users IP address followed by a quick little dictionary lookup to add a "Back to [users ISP]" link (we did not have much business/marketing sense) if it matched any of the major ISPs. Two days later we got a frantic call from someone at another ISP to tell us that someone had hacked our server and added a link to them - he wanted to make sure we didn't think it was them that had done it.

by froo 17y ago

jacquesm 17y ago

Remind me to stay on your good side. We pulled a similar prank on a guy working on implementing 'verified by visa'. Every morning he'd walk in to the office and read the same news site. So, three days before completing the project we cloned the news site and posted an article that VISA had decided to abandon VBV. He walks in to the office, starts reading the headlines (-- expletive deleted --) slams his coffee down and walks out of the office. To his credit within 20 paces he started laughing like mad, knowing he'd been had. Pretty clever dude, it would have taken me a bit longer... :) To protect the guilty and the innocent alike, no further references, but rest assured that a few words were addressed to VISA execs that were not exactly pc. Lots of fun with the DNS.

jgrahamc 17y ago
You could do a load of damage with DNS redirection. If you look at the market penetration of Google Analytics you'll see that a very, very large number of sites are embedding JavaScript pulled from google-analytics.com in web pages. Now imagine if you redirected that one domain and served your own JavaScript. You could include the GA JavaScript as well, but add your own stuff which would then run in everyone's (within that DNS area) web pages and your JavaScript could start doing all sorts of nasty things.
- jacquesm 17y ago
  Absolutely, I don't think it will be long before there will be a major hack like this at some large ISP. The temptation is just too large. DNS is one of the weak links of the way the web is put together, and javascript embedded from third party sites nicely exposes that Achilles heel. Another reason to mistrust open wifi connections :)
- froo 17y ago
  You wouldn't even need to do too much damage on the client side for an effective attack vector. Imagine redirecting scripts for googleadservices.com and implementing their JS code with your own publisher ID there. That would make some of those adsense cheques Markus Frind has shown off look like lunch money. EDIT - if you really wanted to make something like this cool, you would instead use the publisher ID of some random charity (or even cycle through an array of charities) that could be easily obtainable by viewing source code in pages. Just a thought... EDIT #2 - Or, some more Internet Justice - just have it ignore the clicks that would otherwise go to domain parkers (with the revenue heading to charity). You cut off that air supply and eventually a lot of domains will start becoming available again. That way, the Internet Wins.
froo 17y ago
"Remind me to stay on your good side." :) I sold the site earlier this year, but the subdomain I set up is still live, so the "hack" (if you could really call it that) is still live. Gives me a giggle, everytime - I know it was malicious, but it was damn funny. Another thing I did to this person was embed a flash banner on her forums using google's adwords that would loop an 8 bit rickroll. She ended up disabling advertising on her site for a short while, instead of blocking the ad itself. It drove her users nuts. Among the best 80 cents I ever spent. Good times.

vidarh 17y ago

Back in the day I was running an ISP, and when we did a website redesign at some point we added reverse lookup of the users IP address followed by a quick little dictionary lookup to add a "Back to [users ISP]" link (we did not have much business/marketing sense) if it matched any of the major ISPs. Two days later we got a frantic call from someone at another ISP to tell us that someone had hacked our server and added a link to them - he wanted to make sure we didn't think it was them that had done it.