In what feels like a continuation of recent bad news related to major hacks and data losses…..George Ou reports on a BIG hack of GoDaddy hosting customers. There was also a big hack-athon by Turkish hackers over the last week that will be recorded as the biggest mass-web-site-defacement on record… There seems to be a lot of GoDaddy customers hacked by the very same method….
38,500 sites were defaced in a single day by hacker iSKORPiTX who used an automated mechanism to attack what appeared to be an exploit in a sloppy implementation of ASP code (more than 21,000 sites listed here). But when I dug a little deeper (and courtesy of reader Toadlife’s link), it appears that the exact same type of hack by the same hacker using the same exploit may have happened over a year ago to a GoDaddy ASP hosting customer in April of 2005. When I randomly sampled and inspected 40 of the defaced sites in the massive list, nearly everyone one of them were being hosted by GoDaddy hosting services.
It goes on…. he found a user in Lockergnomes forums that had a hacked site and has his correspondance which threw the blame to an unpatched vulnerability in Microsoft’s IIS….
Within one week of signing up for a $10 GoDaddy Deluxe Windows IIS hosting account I noticed a file in an “SSFM” subdirectory on my FTP / website. I did not create the directory or the file. The file itself read “HACKED BY iSKORPiTX” and had a Turkish flag and some other language on it. GoDaddy claimed that the SSFM subdirectory was required by their servers (so I couldn’t just delete it & be done with it) and, in regards to the hack itself, said:
Thank you for contacting Hosting Support.
This email is in regards to the issue that you escalated on xx xxxxx 2005. The ssfm hack is not something we can really defend against. It is a vulnerability in the Microsoft IIS webserving system. As Microsoft uses closed source software, we are dependant on them for a fix to this issue. They have not, as of yet, issued a patch for this vulnerability. Rest assured that your passwords have not been compromised. The attacker does not need these to insert his file into the account as it is done through a hole in the IIS system (and this is the only directory that they would have access to).
If you have any other questions or concerns please feel free to contact our customer support team.
A Google search did not reveal anything useful. Anybody know what SSFM is for, or have any more info that could help me shed a light on this? Other than this I have been happy with the company in the brief time I’ve used them.
The kicker is the forum post was from April of 2005 – so the identical hack (to this latest wave) has been in practice for over a year. George talked to GoDaddy and it sounds like he went in circles and is waiting to hear from Microsoft. He has now heard from Microsoft who says that it’s not an ASP flaw… it’ll be interesting to see if this is something in Godaddy’s hosting software, or just sloppy ASP programming as originally claimed….
Related PostsRelated Posts
- How Microsoft could patch VML vulnerability before October's patch day SO, there's the second big vulnerability exploit for Internet Explorer making the rounds in about a week and Microsoft's advisory says that the most recent flaw will likely be patched on October's patch day ("unless the need arises...") So, what would trigger that need? Lot's of browsers being subjected to......
- IE 7 INCOMPATIBLE with WORDPRESS blogs using the stattraq plugin I've FINALLY tracked down what was causing the issue with displaying my page in Internet Explorer 7 (RC1). It turns out that the stattraq plugin in wordpress (stattraq site) is part of the problem. Now, I don't understand exactly WHY... because I do have stattraq on each of the sites,......
- Workaround for the critical WMF zero-day exploit The Windows Meta File (WMF) zero-day (0-day) exploit is apparently, VERY nasty, no user intervention required (unless running firefox or opera). Just VISITING a malicous site (viewing a malicious email with image...) would be enough to get the system owned. It sounds as though a FULL reinstall is the best......
- Quality Web Seo Services For Enhance Your Business As the popularity of the web advertising is gaining momentum, the record of internet sites on the World Extensive Internet can be getting longer even at a faster pace. This ever rising competitors is making it difficult for the websites to realize top positions and be seen on the end......
- Trackbacks for Corporate Blogs Explained If you are just getting started in the world of corporate blogging, you are probably already aware of the fact that there is a lot to take in, and plenty for you to learn. One of the concepts that you need to understand when turning your corporate blog into a......
- What Is Reseller Hosting Reseller hosting and shared hosting are somewhat similar. There are many web hosts who offer both service. The common between both the service is the word shared, that is to share of resources. In a reseller account, you cab resell your server resource. You can create your own web hosting......
- Internet Explorer 0-day (take 2 of the last few days…)
- Internet Explorer zero-day exploit?
- Google Hack honeypot
- Update on Internet Explorer Exploit in the wild
- Mac Wireless driver Security vulnerability revisited