Comments on: Comments on 21093

Post number 21093

namespan — Fri, 25 Oct 2002 10:57:26 -0800

Blogger Hacked A slashdot reader reported (on slashdot) that "Blogger has been severely hacked into, with users' passwords and e-mail addresses being replaced with 'hacx0redbyme' or 'hax0redbyme.' " Perhaps the most amusing comment in the ensuing discussion says "I'm glad I don't use a blog... I wouldn't want some l337 hax0r coming in and reading everything about my personal life!" But levity aside, is there some serious implication that a widely used web service is hacked? Is Pyra safe to use?

By: bondcliff

bondcliff — Fri, 25 Oct 2002 10:59:24 -0800

Let's hope they fixed the "template not found" error so I can finally update my damn blog.

By: mkelley

mkelley — Fri, 25 Oct 2002 11:07:02 -0800

Blogroots thread on this.....

By: namespan

namespan — Fri, 25 Oct 2002 11:08:37 -0800

One other thing... it's really interesting that almost every time blogs are discussed on slashdot, there's a large variety of comments about the merits of blogs in general, and they're usually pretty negative. One from this discussion was "Hacking a blog is like littering in a dump." I'm not sure what to make of this... it's clear that many blogs suck, but then again, lots of indie music sucks too, in much the same way, and most slash discussions venerate it. And it's clear there are some fantastic weblogs out there. What do you make of it?

By: tsarfan

tsarfan — Fri, 25 Oct 2002 11:08:58 -0800

friggin hackers. not only are people waiting for me to tell them what i thought about survivor last night, but i had such a good Friday Five for everyone! :(

By: mkelley

mkelley — Fri, 25 Oct 2002 11:12:05 -0800

I haven't been going to /. as much, simply because all of the links of interest to me wind up here or on BoingBoing...or MacSlash.....and if it's blog related Blogroots.

By: soyjoy

soyjoy — Fri, 25 Oct 2002 11:13:14 -0800

It's a good thing Metafilter can't be hacx0redbyme. It's reassuring to know that hacx0redbymehowie has a lot more on the hacx0redbyme than those hacx0redbyme at pyra. Keep up the good hacx0redbyme!

By: Hildago

Hildago — Fri, 25 Oct 2002 11:16:24 -0800

There are obvious variations in the quality of blogs, as there is in everything else. These guys are rabid because they are into something besides blogs. It's why people who drive Fords hate Chevys, PC users hate Mac users, et cetera: it's not enough to not use something and leave it alone, you have to attack the other tribe.

By: falameufilho

falameufilho — Fri, 25 Oct 2002 11:19:37 -0800

Metatalk thread from last years christmas hack. IIRC, this hack is getting much more attention from outside the realm of Blogger.com users than the previous one. That can have two reasons: first, it was the holidays, and people had more important stuff to worry about in "real life", and second, Blogger now has paid users, and got lots of attention throughout 2002.

By: HTuttle

HTuttle — Fri, 25 Oct 2002 11:21:39 -0800

All your blogs are belon....Oh nevermind.

By: Postroad

Postroad — Fri, 25 Oct 2002 11:40:49 -0800

Excuse my ignorance, but what exactly is a "blog"? I hear the word used a lot.

By: The Jesse Helms

The Jesse Helms — Fri, 25 Oct 2002 11:42:43 -0800

If your server runs Microsoft-IIS/5.0 on Windows 2000, expect major security issues.

By: AaRdVarK

AaRdVarK — Fri, 25 Oct 2002 11:49:37 -0800

Best comment from Slashdot... scumdamn says "Blogs are what seperates us from the animals!" and gowen responds: "Thats true. You never see dogs boring each other witless with the irrelevant minutiae of their lives. Mind you, dog's can lick actually their own genitals, which is pretty much what blogging is a substitute for..."

By: chill

chill — Fri, 25 Oct 2002 11:51:01 -0800

bondcliff, I had that error. I created a new template, and everything's fine now. Not an ideal situation, but at least you can get up and running again.

By: jasonshellen

jasonshellen — Fri, 25 Oct 2002 11:54:28 -0800

...and we are back up.

By: barkingmoose

barkingmoose — Fri, 25 Oct 2002 11:56:47 -0800

...and we are reading all about it. Is it true that all publicity is good publicity? Nah, I didn't think so.

By: mkelley

mkelley — Fri, 25 Oct 2002 11:56:58 -0800

"Mind you, dog's can lick actually their own genitals" ...nah too easy. oh what the hell. If I could do that I wouldn't be blogging :)

By: yhbc

yhbc — Fri, 25 Oct 2002 11:59:14 -0800

...and we are back up. Cool. Did they find my archives?

By: boogah

boogah — Fri, 25 Oct 2002 12:05:25 -0800

not only am i a paid blogger user, but i plan on being one when my subscription comes up. this "hack" doesn't frighten me at all seeing as how i change my ftp password once a month, limit the ip addresses that my systems trusts to connect to my server and have the shell on the ftp account set to /bin/false. now i just have to reset my password a couple days early. sure i could run movable type, slash, pmachine or whatever else one would run when having their own server but i'll admit that i'm horribly lazy and don't have the time to deal with running server side software. blogger offers accountability and saves me a lot of time and effort when it comes to upgrades. although their service isn't the most reliable at times, the unreliability often works to my advantage. no, i'm not kidding. often one spews mental diarrhea when they can post on something that's pissing them off. something so trivial that it'd be better kept inside. either way, i'm still holding out for that "new version" that everyone at pyra is buckling down to get out. hopefully it'll be unix based and a bit tighter on security. [btw: has anyone noticed that blogger is back up quicker this time around? no doubt it's from having more than just ev on a dial-up from bfe, but it's still not as bad.]

By: dhartung

dhartung — Fri, 25 Oct 2002 12:46:05 -0800

There are even disparaging comments made about blogging on MeFi. As if posting on MeFi were any less of a waste of time ...

By: perplexed

perplexed — Fri, 25 Oct 2002 12:52:07 -0800

Boogah: You aren't lazy! Changing your password once a month, limiting IP's to trusted servers, and and killing the FTP shell sounds like pretty good maintenance if you ask me. When I used Blogger in the past, I had a dummy account for it to log in as, but when i started seeing a bunch of wu-ftpd exploits I decided it was just too much of a risk. I think if you're going to hand your password out to anyone you need to acknowledge the risk that goes with it.

By: boogah

boogah — Fri, 25 Oct 2002 13:35:11 -0800

perplexed: i absolutley loathe wu - which is why i run proftp. and thanks for saying i'm not lazy...

By: justgary

justgary — Fri, 25 Oct 2002 13:51:29 -0800

sure i could run movable type, slash, pmachine or whatever else one would run when having their own server but i'll admit that i'm horribly lazy and don't have the time to deal with running server side software. blogger offers accountability and saves me a lot of time and effort when it comes to upgrades. although their service isn't the most reliable at times, the unreliability often works to my advantage. no, i'm not kidding. often one spews mental diarrhea when they can post on something that's pissing them off. something so trivial that it'd be better kept inside. Sounds like a commercial. You should demand money =)

By: boogah

boogah — Fri, 25 Oct 2002 14:58:45 -0800

perhaps i should demand money, but i just love blogger that much. i suffer from big ol' stupid ammounts of brand loyalty. the ammusing thing is, as much as i flog blogger we're going to be implementing movable type at the isp i work at for our "slash tilde" cusomers. upon my recomendation. oh, and i'm a paid livejournal user too. and i have an open weblog [influenced by metafilter, sitting in practical decay] that runs it's own backend software - which will one day hopefully be open sourced when the developer feels safe about unleashing it on the general public. so i've used other weblogging tools, but i still like blogger. maybe i should do a "switch" commercial...

By: feelinglistless

feelinglistless — Fri, 25 Oct 2002 16:03:41 -0800

I don't know. I go out to work and then the theatre and all this happens. Don't things move fast there days?

By: rusty

rusty — Fri, 25 Oct 2002 20:54:32 -0800

It's a good thing Metafilter can't be hacx0redbyme. It's reassuring to know that hacx0redbymehowie has a lot more on the hacx0redbyme than those hacx0redbyme at pyra. Keep up the good hacx0redbyme! "hacx0redbyme" is the new "smurf". On another note, I'm surprised to find that in 2002 so many people are still using ftp. How quaint. :-)

By: namespan

namespan — Sat, 26 Oct 2002 19:52:01 -0800

rusty: What do you use? scp? rsync? sftp? I've played with rsync and like it, but it's definitely not as straightforward as ftp.... when I don't want to think about the behavior of my client, I use ftp...

By: rusty

rusty — Sun, 27 Oct 2002 15:06:23 -0800

namespan: I like scp, personally. Ftp is fine and all, if you don't need any security. But to see people worried that the security of their ftp account may have been compromised... I just find it amusing. :-) On preview, for anyone who doesn't know what the hell I'm talking about: FTP sends your password in clear text over the network. Unless you have full control of both ends of the transmission and every node in between (like you're FTPing a file between your desktop and your laptop over a firewalled home network) you must assume your FTP password is already public knowlege. If you've stored it on a server you don't own (like say the Blogger server) you may be doubly or triply certain it's public knowlege. There are various tunneling tricks you can do with ssh to make ftp actually secure, but it's a pain in the ass, especially when there's scp already available. Plus scp runs through the standard sshd, elminating any need to run another exploitable daemon like an ftpd. FTP was obselete three years ago. Move on. :-)