[BreachExchange] Popular Dark Web hosting provider got hacked, 6, 500 sites down

[Inga Goddijn]

https://www.zdnet.com/article/popular-dark-web-hosting-provider-got-hacked-6500-sites-down/

Daniel's Hosting, one of the largest providers of Dark Web hosting
services, was hacked this week and taken offline, *ZDNet* has learned from
one of our readers.


The hack took place on Thursday, November 15, according to Daniel Winzen,
the software developer behind the hosting service.

"As per my analysis it seems someone got access to the database and deleted
all accounts," he said in a message posted on the DH portal today.

Winzen said the server's root account was also deleted, and that all 6,500+
Dark Web services hosted on the platform are now gone.

"Unfortunately, all data is lost and per design, there are no backups,"
Winzen told *ZDNet* in an email today. "I will bring my hosting back up
once the vulnerability has been identified and fixed."

"As of now I haven't been able to do a full analysis of the log files and
need to further analyze them, but based on my findings so far I believe
that the hacker has only been able to gain administrative database rights.
There is no indication of having had full system access and some accounts
and files that were not part of the hosting setup were left untouched,"
Winzen told us.

"I might re-enable the service once the vulnerability has been found, but
right now I first need to find it," he added.

And for the past two days, Winzen has been doing just that, looking at
possible vulnerabilities that the hacker might have exploited to gain
access to his server.

Currently, he identified one flaw, a PHP zero-day vulnerability. Details
about this unpatched vulnerability were known for about a month in Russian
PHP programming circles <https://www.youtube.com/watch?v=M2hzLzfqZj8>, but
the flaw gained a lot of attention among the wider programming and infosec
communities, on November 14
<https://www.reddit.com/r/netsec/comments/9wzwgw/0day_bypassing_disabled_exec_functions_in_php_via/>,
a day before the hack.

But Winzen told *ZDNet* that he doesn't believe this to be the hacker's
actual point of entry.

"It is a vulnerability reported as a possible point of entry by a user and
my setup was, in fact, vulnerable," he told us. "However I would deem it as
unlikely to have been the actual point of entry as the configuration files
with database access details were read-only for the appropriate users and
commands run by this vulnerability shouldn't have had the necessary
permissions."

Until then, Winzen promised more updates on the DH portal as his
investigation continues. The German developer also told *ZDNet* that the
hack might also be "an opportunity to improve some bad design choices of
the past and start with an all new and improved setup, which I expect to be
able to provide in December."

After the Anonymous hacker collective breached and took down Freedom
Hosting II
<https://www.bleepingcomputer.com/news/security/anonymous-hacks-and-takes-down-10-613-dark-web-portals/>,
another popular Dark Web hosting provider, in February 2017, Daniel's
Hosting became the largest hosting provider for Dark Web services.

The service has been used to host everything from malware operations to
political blogs, and the list of suspects who might have been interested in
hacking DH ranges accordingly, from rival cybercrime gangs to nation-state
hackers looking to track down dissidents and political activists.

The hack might have also been facilitated by the fact that the DH service's
source code has always been open-sourced on GitHub
<https://github.com/DanWin/hosting> and might have provided attackers with
a more broad look into the service's inner guts.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20181120/c712e89c/attachment.html>