3 ms·

Not to say that Huthos are innocent, but I don't see any concrete proof that they are behind this attack. The fact that they are hosting a server provisioning s

Not to say that Huthos are innocent, but I don't see any concrete proof that they are behind this attack. The fact that they are hosting a server provisioning script is hardly crazy, given that they are a hosting provider. What's to say that the ACTUAL attacker didn't just come across the provisioning script and decide to use it for themselves? The script URL is listed publicly online: http://yandicunk.blogspot.co.uk/2015/03/cara-setting-dan-instal-vps-centos-6-32.html http://yandicunk.blogspot.co.uk/2015/03/cara-setting-dan-ins... & http://huthos.com/tutorial/autoscripthuthos.html http://huthos.com/tutorial/autoscripthuthos.html "It also appears that the hackers attack machine may be hosting an unauthenticated web proxy" makes it sound like the attacker owns the machine they were connecting from. IMO, chances are that "49.213.23.171" is just another compromised box.

lqdc13 12y ago
Should have waited for customers for proof. I bet it would actually run as a proxy/VPN to post spam on forums.
andrewballs 12y ago
Hi, thanks for your comment. It wasn't really my objective to find the smoking gun and bring Huthos' operation crumbling to the ground. Like you, I don't definitively know that the operators of the website are the same people that broke into my honeypot without permission. It seems more likely than another totally-unrelated bad guy knowing where the file paths are to the Huthos provisioning scripts when directory listing isn't enabled, as well as other small nuances that I gathered while investigating this attack (the operators of the website posting videos of them exploiting Shellshock on their youtube channel, etc).
- MichaelGG 12y ago
  Your article definitively implies Huthos is behind this. If you're serious about not bringing them down, you should change the title and put a disclaimer at the top explaining the uncertainty.
- JosephRedfern 12y ago
  Agreed - after doing a little more digging myself, it does seem likely that they are selling access to hacked machines - however, I'm sure there are other cases of attackers using legitimate scripts to provision their servers! Also - has anyone seen how cheaply access is being sold for!? It's pennies!
  - pavel_lishin 12y ago
    Legitimate scripts that take a screenshot of your desktop every time you run bash?
    - JosephRedfern 12y ago
      I agree - if that's what the script was doing, then it would be dodgy. But that's not what the script does. `screenfetch` prints out system info in a pretty, ASCII-arty way, like this: http://i.imgur.com/TgaPHqa.png http://i.imgur.com/TgaPHqa.png echo "screenfetch" >> .bashrc just causes system info to be printed to the screen with every new bash session.
      - pavel_lishin 12y ago
        Oh, derp, I completely misread the github repo. :/
    - MichaelGG 12y ago
      I guess if they were really doing this and you wanted to fuck with them, you could honeypot until a few clients are on, then start putting up illegal-in-Indonesia content (shouldn't be too hard). Might make them think twice.
- deleted 12y ago
  [deleted]

lqdc13 12y ago

Should have waited for customers for proof. I bet it would actually run as a proxy/VPN to post spam on forums.

andrewballs 12y ago

Hi, thanks for your comment. It wasn't really my objective to find the smoking gun and bring Huthos' operation crumbling to the ground. Like you, I don't definitively know that the operators of the website are the same people that broke into my honeypot without permission. It seems more likely than another totally-unrelated bad guy knowing where the file paths are to the Huthos provisioning scripts when directory listing isn't enabled, as well as other small nuances that I gathered while investigating this attack (the operators of the website posting videos of them exploiting Shellshock on their youtube channel, etc).

MichaelGG 12y ago
Your article definitively implies Huthos is behind this. If you're serious about not bringing them down, you should change the title and put a disclaimer at the top explaining the uncertainty.
JosephRedfern 12y ago
Agreed - after doing a little more digging myself, it does seem likely that they are selling access to hacked machines - however, I'm sure there are other cases of attackers using legitimate scripts to provision their servers! Also - has anyone seen how cheaply access is being sold for!? It's pennies!
- pavel_lishin 12y ago
  Legitimate scripts that take a screenshot of your desktop every time you run bash?
  - JosephRedfern 12y ago
    I agree - if that's what the script was doing, then it would be dodgy. But that's not what the script does. `screenfetch` prints out system info in a pretty, ASCII-arty way, like this: http://i.imgur.com/TgaPHqa.png http://i.imgur.com/TgaPHqa.png echo "screenfetch" >> .bashrc just causes system info to be printed to the screen with every new bash session.
    - pavel_lishin 12y ago
      Oh, derp, I completely misread the github repo. :/
  - MichaelGG 12y ago
    I guess if they were really doing this and you wanted to fuck with them, you could honeypot until a few clients are on, then start putting up illegal-in-Indonesia content (shouldn't be too hard). Might make them think twice.
deleted 12y ago
[deleted]