日誌

Twitter などが(自称)シリア電子軍の攻撃を受けるの続きです。

Twitter や NYTimes の DNS が乗っ取られた件、レジストラである Melbourne IT が話題になりましたが、その Melbourne IT のサイトがハックされてます。

以下、日本時間

2013-08-28 10:09 PM

シリア電子軍を称するアカウントから、Melbourne IT がハックされた旨、ツイートされる。

Melbourne IT website hacked with a brief message | http://t.co/H1KOPgK5xx #SEA #SyrianElectronicArmy

— SyrianElectronicArmy (@Official_SEA16) August 28, 2013

2013-08-28 10:14 PM

気づいたのアクセスしてみました。

"Hacked by SEA, Your servers security is very weak" http://t.co/d4Fl4gXsdS

— Takayuki KUSANO (@tkusano) August 28, 2013

$ host www.melbourneit.com.au
www.melbourneit.com.au has address 203.27.227.79
 
$ telnet 203.27.227.79 80
Trying 203.27.227.79...
Connected to 203.27.227.79.
Escape character is '^]'.
GET /blog/ HTTP/1.1
Host: www.melbourneit.com.au
Connection: close
 
HTTP/1.1 200 OK
Date: Wed, 28 Aug 2013 13:19:04 GMT
Server: Apache
X-Pingback: http://www.melbourneit.com.au/blog/xmlrpc.php
Cache-Control: max-age=48000
Expires: Thu, 29 Aug 2013 02:39:04 GMT
Vary: Accept-Encoding,User-Agent
Content-Length: 49
Content-Type: text/html; charset=UTF-8
Connection: close
 
Hacked by SEA, Your servers security is very weak
 
Connection closed by foreign host.
 
$ whois 203.27.227.79
% [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html
 
% Information related to '203.27.226.0 - 203.27.227.255'
 
inetnum:        203.27.226.0 - 203.27.227.255
netname:        MELBINFOTECH-AU
descr:          Melbourne Information Technologies Australia Pty Ltd
descr:          Level 2, 120 King St
descr:          Melbourne
descr:          VIC  3000
country:        AU
admin-c:        ACM21-AP
tech-c:         HM155-AP
remarks:        ** Conversion note - reference 'ACM3-AU' changed to 'ACM21-AP'
remarks:        ** Conversion note - reference 'HM155-AU' changed to 'HM155-AP'
remarks:        Record imported from AUNIC as part of AUNIC->APNIC migration
remarks:        Please see http://www.apnic.net/db/aunic/
mnt-by:         APNIC-HM
status:         ALLOCATED PORTABLE
changed:        nobody@aunic.net 19960530
changed:        nobody@aunic.net 20000426
changed:        aunic-transfer@apnic.net 20010525
changed:        hm-changed@apnic.net 20041201
changed:        hm-changed@apnic.net 20041214
source:         APNIC
 
person:         Admin Contact Melbourne IT
address:        Melbourne IT Ltd
address:        Level 2, 120 King St
address:        Melbourne
address:        VIC 3000
country:        AU
phone:          +61 3 8624 2400
phone:          +61 3 8624 2499
e-mail:         domain-admin@melbourneit.com.au
nic-hdl:        ACM21-AP
remarks:        This data originated from AUNIC, and was copied as part of
remarks:        the AUNIC to APNIC migration.  http://www.apnic.net/db/aunic/
remarks:        Original nic-hdl in AUNIC: ACM3-AU
mnt-by:         MAINT-AU-MELBIT
changed:        nobody@aunic.net 20000330
changed:        nobody@aunic.net 20000330
changed:        aunic-transfer@apnic.net 20010523
changed:        hm-changed@apnic.net 20041201
source:         APNIC
changed:        hm-changed@apnic.net 20111122
 
person:         Hostmaster Melbourne IT
address:        Melbourne IT Ltd
address:        Level 2, 120 King St
address:        Melbourne
address:        VIC 3000
country:        AU
phone:          +61 3 8624 2400
phone:          +61 3 8624 2499
e-mail:         hostmaster@melbourneit.com.au
nic-hdl:        HM155-AP
remarks:        Organisation Infrastructure Department
remarks:        This data originated from AUNIC, and was copied as part of
remarks:        the AUNIC to APNIC migration.  http://www.apnic.net/db/aunic/
remarks:        Original nic-hdl in AUNIC: HM155-AU
mnt-by:         MAINT-AU-MELBIT
changed:        nobody@aunic.net 20000330
changed:        nobody@aunic.net 20000330
changed:        aunic-transfer@apnic.net 20010523
changed:        hm-changed@apnic.net 20041201
source:         APNIC
changed:        hm-changed@apnic.net 20111122
 
% This query was served by the APNIC Whois Service version 1.68 (WHOIS2)

2013-08-28 10:17 PM

Melbourne IT website hacked with a brief message http://t.co/RQtsm9VXcR | #SEA #SyrianElectronicArmy

— Anonymous Press (@AnonymousPress) August 28, 2013