Highlights

• ProPakistani faced hacking attempt
• ProPakistani remained down due to a Wordpress Bug
• Attacker was traced by ProPakistani team
• Mr.c0d3r, who allegedly launched DOS on ProPakistani is Lahore based
• He is allegedly involved in defacing Rehman Malik’s website, FIA, Geo NEWS and various other websites
• Its Pakistan’s first case study on hackers that has been traced with all the forensic procedures being followed, systematically.

Details

As you may know, on January 18^th, 2009 at 11:15 PM, ProPakistani website stopped responding web requests. Most of the visitors were given a 500 html error – also database connection error.

We were able to bring back a optimized form of ProPakistani pretty soon, however ProPakistani server remained critical for next 48 hours – During which, we remained down for some time for maintenance.

We thank our visitors, who remained intact with us during all this and showed their tremendous concern though emails, phone calls, Facebook queries and so on.

We had promised our readers that we will public everything regarding the down time, cause for the problem and other relating information.

ProPakistani faced Hacking Attempt

The news is that ProPakistani had an unsuccessful hacking attempt, and attacker remained un-successful in defacing ProPakistani. However, he managed to do a DOS attack.

Good News: We Have traced the Hacker

Good News is that we have tracked the attacker, with all the proofs. Its first time in history of Pakistan that a hacker had been traced with all the forensic procedures being followed, systematically.

Security Operations were lead by renowned Muhammad Ali Raza. We thank Sohaib Ather for his extra ordinary services for Database and Server Optimization during this.

Below are complete details for your information only.

What had happened?

Immediately, after the attack was launched at 11:15, we thought it was a usual SQL server crash; however, server reboot and Dabatase repair and optimization didn’t work and crashed again very soon.

Database tables kept crashing, despite re-boots and repairs, even backup got crashed when restored. With-in first 30 minutes we had known that this is not software or database glitch, and it was some external attack.

ProPakistani servers are DDoS proof, so there were little chances that someone was launching a DDoS attack. After diagnosis, we were able to determine that was a DOS attack, instead of DDoS attack.

It happened due to a Wordpress Bug!

We identified that Wordpress version 2.9.1 is vulnerable from DOS attack. Bug lays in its coding that uses cache stressing with random parameter on multiple requests. Wordpress has been notified about the issue; however, bug is still pending resolution. But we have secured ourselves, thanks to alternate technologies.

How Attacker Impacted?

The web requests (from attacker) were not coming from multiple hosts rather it were coming from a single host with random parameter on multiple web requests (dozens of them per second). These requests were of bad or long SQL requests, ending up with a database crash.

As the bug was in its core of Wordpress so we couldn’t pull Wordpress down. We had to come up with different solution. We tried moving the entire server to a new place, did tons of Database optimization, server optimization and all other options that we could avail.

While Shoaib Ather and his team were busy with database and server optimization, Ali Raza remained busy with tracing the route of attacker. He was able to trace back to the attacker successfully. However, information that we got was pretty shocking for us.

On 20^th January, 2009 ProPakistani was working back with normal broadcast.

Who was Attacker?

Note: We didn’t penetrate into any personal computer/system, and used all publically available information for tracking.

We only had source IP at that time (through our Apache Error Logs).

Source IPs of attacker included:

• 66.96.219.37
• 64.22.101.106
• 66.219.58.34
  

When sought, these IPs were registered in the name of an American ISP. When inquired, ISP was kind enough to give us the name of company who had been allotted these IPs.

As per American ISP, these IPs were registered in the name of a company called, ImageFi (www.imagefi.com). While IPs were mapped against the same VPS that hosted www.imagefi.com

American ISP also confirmed us traffic routing from above mentioned IPs to ProPakistani.PK – they assured us they will provide us logs, if asked.

WHOIS of www.imagefi.com revealed that mr.c0d3r@hotmail.com had the ownership of one of those domains.

It was further shocking for us when we found out other websites that are hosted on same VPS, check below screen shot for proof…!

When searched on Google, Mr.c0d3r was found as a crew member of pakbugs.com. However, reportedly, he is no more associated with Pakbugs.

Digging further into Google, we disproved more interesting facts about this mr.c0d3r. He is running a torrent portal and trace leads us to India.

Googling this email mr.c0d3r@hotmail.com revealed tons of other information and soon we were able to find out that this guy is not from India.

When you Google with this particular query “mr.c0d3r country:PK” its shows that he has involvement with a local blog and forum.

So this mr.c0d3r is the guy who owns PKforums and PkReaders.com

We already have notified NR3C, with all the proofs and details to do the prosecution.

We do have all server logs saved. We do have phone numbers and address details of this person too. Will be given to concerned authorities during investigation.

This case study has been prepared by ProPakistani team.

Special thanks to Fahad Aziz and Sohail Abid for their support

Related posts:

• FIA Blocks Hack Attempts on its Website
• This Time PID's Website Got Hacked
• OGRA's Website Defaced – Just a Warning Message
• How Malicious Code Damage a Website and its Visitors?
• Be-aware: Your Mobile may Get Hacked!

By Adeel

Billions of mobile phone users around the world are at risk of having their calls intercepted and recorded after hackers broke the encryption used to protect 80 per cent of the world’s mobiles.

People regularly trading in confidential information, such as Government officials and executives, would be the most likely eavesdropping targets but virtually anyone with enough skills and determination could harness the research for nefarious means, security experts warn.

German computer engineer Karsten Nohl told a hacker conference in Berlin that he and his team decoded the GSM (Global System for Mobile Communication) encryption algorithm to draw attention to gaping security holes in the technology and drive mobile operators to patch them.

About 80 per cent – or 3.5 billion – of the world’s mobiles are based on GSM, which is over 20 years old.

Nohl, who has published the secret GSM encryption code online, told the Chaos Communication Congress that a skilled eavesdropper using basic equipment and free software could be recording phone calls within 15 minutes.

Find more detail here

Related posts:

• 3G Encryption Got Hacked too!
• Warid Goes Down At Large
• Warid's Network Got Wrecked in Lahore
• Warid Expands its Network to 480 Cities
• Ufone’s Network Outage Reported, Countrywide

ProPakistani got a chance to catch Country’s top security expert, Qazi Misbah Ahmed, CEO PakCERT, to have discussion over security issues including personal and corporate security, hacking, trainings, ethical hacking and many other concerning topics.

Qazi Misbah (MBA-MIS/CISSP/CPTS/CEH/ITIL/COBIT/AMBCI’s Experience) is Pakistan’s top security professional having over 9 years of hardcore Information Security experience of consultancy and training for clients from Military, Energy, Shipping, and Telecom sectors in Pakistan and abroad.

View Qazi Ahmed’s LinkedIn Profile here

Below is the video Interview (Best viewed at 512 KB DSL)

Dial Up users can down Audio of this interview by Clicking This Link (4.8 MB – WMA File)

Click here to view the embedded video.

Related posts:

• Winners of Share Your Idea & Win A Trip to Dubai by Wi-Tribe Announced
• Pakistan's 1st Online PR Distribution Website Launched
• Interview: Ali Moeen Nawazish, World Record Holder
• Ufone Gets New VP, Customer Care
• Interview: Abdul Aziz, President & CEO Ufone

Just an hour ago the website of Federal Board of Intermediate and Secondary Education (FBISE) was hacked by some hacker named TZ – GEO Tv reported. Tomorrow at 11:30am FBISE was going to announce the result of HSSC part-1 examinations. The hacker stole the entire result data from FBISE’s servers and uploaded them to this fake site. The news spread like fire and shocked the administration of FBISE. Almost every student saw his/her result before time. This has happened for the first time that entire result was stolen and uploaded before time. But now this fake site is down may be due to the traffic load or have been taken down by FIA. FBISE is investigating the security breach but the result is still scheduled to be announced in the morning at 11:30am. It shows how poor security measures they had taken to keep this data secured. I think its time that they should hire some security experts and get their website audited by them.

We will keep you informed of any updates.

Share your thoughts and marks if you have come to know about them. So we can compare tomorrow with real results to see if it was actually a real hack or just a prank.

Related posts:

• Get your Federal Board HSSC Results Online or with A single SMS
• OGRA's Website Defaced – Just a Warning Message
• PTCL's SMART TV Website Got Hacked
• A Message from PCA (Pakistan Cyber Army)
• Online SSC/HSSC Results 2008, for all Education Boards of Pakistan

Pakistani Hackers (reportedly settled in Saudi Arabia) today put down Google’s search page (http://www.google.com.ma) specialized for Morocco.

Domain name remained down for many hours, while people got enough chance to record plenty of screenshots here and here.

TechCrunch says that there’s a bit of confusion about how the hack was performed exactly, but it appears as if the hackers found a way into NIC.ma , which controls the DNS for the country, and targeted the Google domain name especially. The domain was pointed to a different server, and the web page above was shown when people tried to access the search engine. Google apparently at one point automatically relayed visitors from Morocco to Google.com instead of Google.co.ma, but it took a while to get the latter functioning correctly again.

PAKbugs.com leads to a forum where Pakistan hackers hang out, and they’re being proud what they did today here.

Related posts:

• Google Mobile App for BlackBerry now available
• PKNIC's Domination and Imperfections
• Google Maps Now Gives Driving Directions in Pakistan
• Get Free yourname@yourdomain.com Email Addresses Just like Gmail
• Thousands of Websites Hacked by Muslims hacker to Protest Gaza Attacks

“ispr.gov.pk” got defaced today – it was a general (un-targeted) hack by some un-identified hackers.  that’s the only news I have got to share with you guys today.

I remember my last post on ProPakistani was in January 2009. The reason i stopped posting such news was because people started getting interested in hacking in a negative way – they had started this defacement thing for fun and for fame.

Since my last post on ProPakistani, there have been too many defacements – some were spacial (huge ones) while others were normal sites; but the interesting thing is that people didn’t understand the importance of security awareness and never learned the lesson from experiences.

Related posts:

• PTCL's SMART TV Website Got Hacked
• OGRA's Website Defaced – Just a Warning Message
• A Message from PCA (Pakistan Cyber Army)
• Website Of FBISE Gets Hacked – Result Of 1st Year Leaked Out
• This Time PID's Website Got Hacked

The Federal Investigation Agency, which has been looking in parallel to other law enforcement agencies into allegations of Pakistanis’ involvement in Mumbai Attacks, has successfully blocked multiple hack attempts on its website. Reportedly, these hack attempts were launched with-in minutes of the interior ministry’s disclosure of its preliminary findings.

When contacted, FIA officials said that hacking attempts occurred on Thursday, the day the prime minister’s adviser on interior Rehman Malik held a press conference on initial findings regarding Mumbai Attacks.

Officials further told that they recorded multiple hack attempts since Thursday.

FIA has successfully not only identified hackers, which were of Turkish Origin, but they are taken care of, with involvement of Interpol, added FIA official.

Related posts:

• This Time PID's Website Got Hacked
• ZoNG Free GPRS Hack : No More
• OGRA's Website Defaced – Just a Warning Message
• Website Of FBISE Gets Hacked – Result Of 1st Year Leaked Out
• Another Website Got Hacked

This is a Guest Post by Nazakat Hussain

I’d like to divert your attention towards an important but unsung mobile security issue i.e. hacking of your mobile phone where hacker can get access to your private information like Contacts, Messages, Photos, Videos etc using Bluetooth. Ironically, the damage can be done by simple and freely available mobile software.

Mostly the hacking software are available to be installed in Nokia S60 series phones. What this software does is that if the Bluetooth of your phone is turned on, the hacker can access your phone without your permission or Acceptance. Yes! It wont even ask you to Accept.

I’d like to share my experience. A few days back, one of my office colleagues hacked my mobile phone while sharing data through powered on Bluetooth feature. He had installed hacking software in his Nokia device.

And just to show off his expertise in hacking, he dialed another colleague’s number sitting next chair but using my phonebook contacts. I was shocked to see dialing on my device screen. He had access to my messages, audios, videos and photographs stored in my device. He could have copied all the data stored in my phone device and memory card to his mobile phone.

Although, he  hacked my mobile phone for fun only, but his act was unexpected for me.

These are suggested precautions that can save you from major privacy theft or data loss:

• Use Bluetooth only when required
• Do not allow connectivity to everyone
• Turn it off when not in use

Related posts:

• Google Morocco Defaced by Pakistani Hackers
• Caution: Your Cell Phone Can be used by Terrorists
• India – Pakistan in State of Cyber War
• This Time PID's Website Got Hacked
• OGRA's Website Defaced – Just a Warning Message

Generally, in Pakistan we don’t care much about security, and this is truly due to lack of education for Information security in the country. Though there are few people who work really hard and put their best efforts to protect their data/computers/web servers from hacking attempts.

I have raised the issue several times about hacking, I mentioned the reasons about why they hack websites, how do they think and so on…! But unfortunately, I see very little change in peoples’ mind and how they treat security concerns.

It’s not about personal websites, but we have seen plenty of corporate websites (including banks/Government

websites) getting compromised. By the way, three banks got compromised in Pakistan since November 2008. We covered one of them in detail, while other hacks were of minor size.

Similarly, today Press Information Department (PID) got hacked – accompanied by some other websites too, which include

http://www.pid.gov.pk/

http://www.pwdajk.gov.pk/

Again, my request to corporations, government institutes and other web server owners is to get their security audit done. Getting security done of a web server is equally important when compared to safeguarding your physical business.

It’s a matter of fact that all these websites, which are being hacked, had low security, and a kid can deface them. So at-least do some basic security, hire some-one and get on the safer end.

You must be wondering, why I am not telling you the steps to secure your web servers; my answer to this question is that I can’t public this information – for a reason that doing a security audit is somewhat similar to hacking, and I don’t want to get punished for giving hack lessons to all of you.

So the idea is to go ahead and hire a company… I hope people will understand and take necessary steps as well.

Related posts:

• PTCL's SMART TV Website Got Hacked
• OGRA's Website Defaced – Just a Warning Message
• A Message from PCA (Pakistan Cyber Army)
• Website Of FBISE Gets Hacked – Result Of 1st Year Leaked Out
• India – Pakistan in State of Cyber War

Israeli strike against Gaza has irked civilized world, Professionals from every religion or region are protesting against US and Israel. Doctors, teachers, students, worker and hackers, yes, Muslim hackers around the globe have started protested in their own way.

As we all know that the media link with Gaza has been lost so all bloggers are doing the news coverage but Turkish hackers have gone one step ahead and they have started hacking US and Israeli websites.

The statistics tells that around 16634 web sites have been defaced from the day Israel attacked Gaza and there are around 2469 special defacement which involve .gov and army website or some really big sites.

The Turkish hackers, headed by Agd_Scorp hacked and defaced the US Army Mil website mdw.army.mil and NATO Parliament www.nato-pa.int protesting for the Israeli attacks on the Palestinian territory.

The defacements (viewable by clicking here and here) reports messages in Turkish in support of the Intifada as well as an English message stating:

“Stop attacks u israel and usa ! you cursed nations ! one day muslims will clean the world from you”

More information will be added soon

PEACE

Related posts:

• Gaza to Loose International Communications
• Palin’s Yahoo Mail Account Hacked – A Lesson to Learn
• This Time PID's Website Got Hacked
• Be-aware: Your Mobile may Get Hacked!
• Website Of FBISE Gets Hacked – Result Of 1st Year Leaked Out