Big Go-Daddy hosting attack



In what feels like a continuation of recent bad news related to major hacks and data losses…..George Ou reports on a BIG hack of GoDaddy hosting customers. There was also a big hack-athon by Turkish hackers over the last week that will be recorded as the biggest mass-web-site-defacement on record… There seems to be a lot of GoDaddy customers hacked by the very same method….


38,500 sites were defaced in a single day by hacker iSKORPiTX who used an automated mechanism to attack what appeared to be an exploit in a sloppy implementation of ASP code (more than 21,000 sites listed here). But when I dug a little deeper (and courtesy of reader Toadlife’s link), it appears that the exact same type of hack by the same hacker using the same exploit may have happened over a year ago to a GoDaddy ASP hosting customer in April of 2005. When I randomly sampled and inspected 40 of the defaced sites in the massive list, nearly everyone one of them were being hosted by GoDaddy hosting services.

It goes on…. he found a user in Lockergnomes forums that had a hacked site and has his correspondance which threw the blame to an unpatched vulnerability in Microsoft’s IIS….

Within one week of signing up for a $10 GoDaddy Deluxe Windows IIS hosting account I noticed a file in an “SSFM” subdirectory on my FTP / website. I did not create the directory or the file. The file itself read “HACKED BY iSKORPiTX” and had a Turkish flag and some other language on it. GoDaddy claimed that the SSFM subdirectory was required by their servers (so I couldn’t just delete it & be done with it) and, in regards to the hack itself, said:
Thank you for contacting Hosting Support.

This email is in regards to the issue that you escalated on xx xxxxx 2005. The ssfm hack is not something we can really defend against. It is a vulnerability in the Microsoft IIS webserving system. As Microsoft uses closed source software, we are dependant on them for a fix to this issue. They have not, as of yet, issued a patch for this vulnerability. Rest assured that your passwords have not been compromised. The attacker does not need these to insert his file into the account as it is done through a hole in the IIS system (and this is the only directory that they would have access to).
If you have any other questions or concerns please feel free to contact our customer support team.
Sincerely,
Advanced Support

A Google search did not reveal anything useful. Anybody know what SSFM is for, or have any more info that could help me shed a light on this? Other than this I have been happy with the company in the brief time I’ve used them.

The kicker is the forum post was from April of 2005 – so the identical hack (to this latest wave) has been in practice for over a year. George talked to GoDaddy and it sounds like he went in circles and is waiting to hear from Microsoft. He has now heard from Microsoft who says that it’s not an ASP flaw… it’ll be interesting to see if this is something in Godaddy’s hosting software, or just sloppy ASP programming as originally claimed….

Related Posts

Blog Traffic Exchange Related Posts
  • How Microsoft could patch VML vulnerability before October's patch day SO, there's the second big vulnerability exploit for Internet Explorer making the rounds in about a week and Microsoft's advisory says that the most recent flaw will likely be patched on October's patch day ("unless the need arises...") So, what would trigger that need? Lot's of browsers being subjected to......
  • How accessible is the Open Document Format? Part of the big debate in Massachussetts over the Open Document Format has been it's accessibility by persons with disabilities. The opponents have maintained that it will increase the difficulty of those people with disabilities in gaining access to vital public information. It's also claimed that a Microsoft solution would......
  • Asheville based Web Design, VPS Hosting and SEO Services [/caption] Change is constant. The last couple of years I have been doing less onsite computer service. Health has been one large reason for that. I have been focusing on other things though. One of the things that I've been working on is now going live. I've redesigned my web......
Blog Traffic Exchange Related Websites
  • The Reality Of Online Search Engines Paving The Success For Businesses Instead of calling up or meeting with a company to purchase something either a local or foreign product, more and more shoppers and potential clients use the services of search engines. It is very important to establish a strong online presence especially now that there is an influx of Internet......
  • Trackbacks for Corporate Blogs Explained If you are just getting started in the world of corporate blogging, you are probably already aware of the fact that there is a lot to take in, and plenty for you to learn. One of the concepts that you need to understand when turning your corporate blog into a......
  • 16 Top Tips For Using Social Media By Adam Singer of toprankblog.com: Guidelines for marketing with social media aren’t all that new. In 2006 five members of the digital marketing community collaborated on 16 rules for “social media optimization”. Fast forward to nearly 2010 and social media has begun to take a more significant role in the......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site