Raise Your Voice hacks most government sites

Raficoo · 2012-04-16T23:36:53+00:00

what they pasted http://pastebin.com/G7Dz01Dc http://www.presidencyinfo.gov.lb http://www.isc.gov.lb http://www.nna-leb.gov.lb http://www.omspa.gov.lb http:...

m0ei

454447415244 wrote@nuclearcat, stop showing how 1337 you and your company are. I can r00t any website YOU "secure"! The company you work for has a well known history in security breaches... :) The thing is that some of the websites are left as they are for a reason and I know what I'm talking about. I know every single file that is being uploaded on any of the servers that host the websites that are currently under attack. We are still coordinating with colonel Elie Bitar (Note that we're not responsible for catching the bad guys, it's the colonel responsibility and we're providing him with enough information to do the job). It is not about securing 5 or x of these websites. If I give my 4 years old little brother the information I know he can surely hack all the websites on these servers and not just the government websites. eg, my little brother could take down http://www.idm.net.lb/ if he wants to... There is no secure hosting in Lebanon and many people know this. Now don't be surprised if some of these websites get hacked again. They could be hacked at any time (the tools are there and could be used by anyone who knows about them, until someone decides to take them off and clean the place...)

Suddenly i just woke up now to look at a "marvelous" post full of hypocrisy.

Such people i believe is the reason why lebanon failed and will fail. Now seriously what a hypocrite you are, "I can r00t any website YOU "secure"!" I always and will always hate such people acting this way as they have super powers that none has.
@nuclearcat can you please link him to a site you are securely hosting, I only need to see if he can "r00t" any site. I'm pretty sure that he wont be able to do anything at all.

Grow up dude, you're living on earth with like "7 billion human like you (unless you don't consider yourself a human)" so no matter what you did and what you will do there will always be people "better" than you.

Such talk "If I give my 4 years old little brother the information I know he can surely hack all the websites on these servers and not just the government websites. my little brother could take down http://www.idm.net.lb/ if he wants to... " made me think that I'm currently replying to a person with a mentality of a 5 years old.

Just to let you know, the so called Sync of yours will fail if you gonna continue thinking this way. #JustSaying Even thought i don't give a shit if they failed or not.

Wasted 5 min of my time replying to a hypocrite!

samer

I was hoping this would be more of a technical discussion.
Alas, this is turning into a typical Lebanese name-calling / finger-pointing contest.
Edgard, you have mentioned recently that you will be publishing an advisory, any ETA on that?
Nuclearcat playfully mentioned that you have failed at securing those websites, instead of clarifying the situation, you have resorted to ad hominem attacks, a sad argumentation tactic.

icemaker

Dear All,

I have been watching this conversation since last week.

This conversation has gone far beyond its main subject.

Consider my reply an official reply and clarification from Sync s.a.r.l.

Any Reply outside the frame of this message will not reflect Sync point of view and is only the opinion of individuals.

1- Sync has signed a maintenance and website renovation contract with NNA on the day(16/04/2012) before hacking happened.

2- Sync is in no means responsible for any security breach that occurred on the NNA website.

3- The exploit and vulnerabilities that were found and available on the NNA server are due to several parties that worked and working on the portal.

4- Sync effort helped the NNA to restore their website and fix some of the security problems last week and reveal the identity of the attackers (its out of scope to know or catch, we delivered the essential information that simulated how the attack happened).

5- Yesterday's attack was expected it was clear that the application is not secured and this was communicated earlier to the appropriate parties.

6- Any Future attack on the NNA website under the current platform and application is not under Sync responsibility until the considerations and suggestions that were given by Sync s.a.r.l. are taken seriously and applied.

7- Sync is not responsible for any other government website that was attacked yesterday.

8- Giving advisory and consultancy to the official parties doesn't not mean our suggestions and findings has been used and applied.

9- Sync is not responsible for securing any governmental website that was attacked lately.

10- Sync is ethically and professionally responsible toward its clients, even-though we are not responsible for the current situation of the NNA application, we will be working hard to fix the security breaches and exploit on the system.

11- A report will be published when things got stable and when we are allowed to discuss more information in public.

Sync s.a.r.l.
Managing Director

if you want to communicate with us kindly you can email us on : info [at] sync.com.lb

Joe

I am with samer on this one.We're a geek forum. You would think that we would be sharing technical details on the security of your typical Lebanese hosting.

Instead we end up with one team bragging about "identifying attackers" and doing "foreinsic[sic] analysis" on the servers; and another team who makes fun of them for not proving their claims.

This debate is becoming boring as hell. Samer calls it Lebanese, but I have seen this name-calling/finger-pointing trolling happen on every imaginable forum on the planet. And it sucks every single time. This is why I will ask: (don't let my position as the "moderator" imply that this is lebgeeks "official" position. It's a personal request).

@Lebgeeks members: Please refrain from attacking Sync on a persona level. They're free to claim whatever they want. Until they show some logs, everything else is meaningless.

@Sync team: Please refrain from posting "we found them". If anything, you're getting bad publicity on this forum, through ad-hominem attacks on nuclearcat or m0ei. We are not interested in the names of the attackers or the name of the Colonel you're helping investigate. We want to know what vulnerability was (is) exploited, how you found it, and how you traced back the attacks. If you cannot show logs, everything else is meaningless.

icemaker

rahmu wrote@Sync team: Please refrain from posting "we found them". If anything, you're getting bad publicity on this forum, through ad-hominem attacks on nuclearcat or m0ei. We are not interested in the names of the attackers or the name of the Colonel you're helping investigate. We want to know what vulnerability was (is) exploited, how you found it, and how you traced back the attacks. If you cannot show logs, everything else is meaningless.

Kindly read what i have said above:

11- A report will be published when things got stable and when we are allowed to discuss more information in public.

Badieh

You are all missing the main point out of all of this, which basically is to tell the government how ridiculous their plans and our way of living is. I for one do hope their website keeps getting attacked over and over again, and if this isn't enough, the Lebanese people should hit the streets. Lebanon isn't a poor country, but it's rich in thefts which keeps dragging us backwards. No one can deny what I said because we all know it's true.

How the government retaliates? By not looking into the main issue here which is governmental flaw, and recruiting some company who is proud of "hacking facebook" to increase their website security....

This is "LEBANON" for you!

nuclearcat

454447415244 wrotehe company you work for has a well known history in security breaches... :)

Give me please any event from those "history" please?
Except stolen password from reseller (from his windows pc, because they put stupid passwords and we cannot enforce them to do different way), that are trivial to do.
And sure password just for this reseller webinterface, not real breach.

nuclearcat

@nuclearcat can you please link him to a site you are securely hosting, I only need to see if he can "r00t" any site. I'm pretty sure that he wont be able to do anything at all.

He can mention by himself, which websites my company are managing, if he "knows everything".

Sup3r

For those who are claiming to be hackers here, i can give you a cpanel with username & password so you will already have a user on the server with ftp access and you can create website on it, simply you will be given a normal user on a linux centos 5.7 box with cpanel access! the challenge would be that you will have to get to other websites on the same server whether you root it or do it in different ways that's your job but let's see how experienced you are in both (server security/hacking).

p.s: none of php,perl,ruby,python backdoors work on the server & any other web applications will work without any problem expect backdoors/local roots/0day's :)

p.p.s: there is another challenges if you would like to play :)

nuclearcat

Still i didnt heard any event from:
"he company you work for has a well known history in security breaches... :)"
As i understand, 454447415244 employee of Sync S.A.R.L.

icemaker

nuclearcat wroteStill i didnt heard any event from:
"he company you work for has a well known history in security breaches... :)"
As i understand, 454447415244 employee of Sync S.A.R.L.

Dear Nuclearcat,

454447415244 is a managing partner and the Technical Director at Sync s.a.r.l.

Let us bring this discussion to its main focus without going into meaningless debates.

nuclearcat

icemaker, sorry, 454447415244 publicly meant my company has security issues in past. I know that we didn't had any. So i am waiting facts, especially if Technical Director are insisting he is professional. Otherwise i expect to hear public apology.
Sure it is under the question, WHICH company, since it am an IT consultant for multiple companies, government agencies and diplomatic entities, and not only in this country. But if he meant that, means he knows which company he is talking about.

Another subject, that "I can r00t any website YOU "secure"!", from Technical director of Sync S.A.R.L., i will leave up to you. Already members of lebgeeks voiced their opinion regarding such behavior.

Sorry for other participants that i am going off-topic, and please for lebgeeks admins to leave this for 1-2 days more (this messages), and sorry you have to read all this, but i really want to know answer to this accusation.

m0ei

@454447415244 and @Icemaker ! So what happened?

<admin edit: reply edited, no need for provocations>

J4D

I can confirm without a doubt that they did not and will not be able to find them. They reached a dead end.

m0ei

Seems like "Sync" failed and will fail.

cruel-c0re

some pages are saying that this site was hacked today : http://www.pcm.gov.lb/
i tried to check it but it kept loading non stop so anyone knows who claimed the responsibility of this act ?
was it RUV again ??

solo220

TV News said that "raise your voice" hacked the cabinet website .

khalil13

seriously, we have a stereotype about the government's IT department, it IS really good, and i am sure of what i am saying, i once met a guy who works there as an "anti-hacker" he told me "ما في قرار حتى نوقفهن" he seemed well educated and knows a lot about telecom, though a bit stupid for giving me such information, but i still doubt if he is lying about working for the gov...

Fischer

i was reading this blog, someone from sync comment 1 MONTH AGO: Hackers got revealed this morning and he posted this link http://bit.ly/Ll6bda

all i can say, is that sync has a good sense of humor. Remember that we last heard from these guys on 20-04-2012, so sync what did you do?

did you copy and paste this article and claimed that you arrested the hackers?

cruel-c0re

@Someone i read the article and i knew there was something wrong with it but i couldn't get more info ,the media didn't give it much attention exp the first day .

do you guys support them ?

speaking about my self i support the cause but those people are risking getting caught and i respect them and i hope we can change this shi*y situation we are living in Lebanon .

« Previous Page Next Page »