Greek “hackers” deface CERN’s LHC-related website

Digital Forensics and Security

It may surprise the audience how someone who’s forehead-deep in writing their research report under a tight deadline can find the time to keep an ear out on the whispers of the underground community, but interesting things do come out of there.

Note: I may be a Digital Forensic researcher, but I am ALSO a Network Security researcher. As such, its my job and responsibility to know these things.

Such is the case of this interesting bit of news which came to surface only today, but which I’ve been told about a few hours after it happened…

Apparently, then, a Greek hacking group calling themselves Greek Security Team defaced the lxplus.cern.ch web server (mode of entry unknown at present time) and replaced the main page with a statement in the Greek language.

Although the IT Pro website and the Daily Telegraph posted articles on this, which can be found in http://www.itpro.co.uk/606150/cerns-lhc-network-hit-by-greek-hackers and http://www.telegraph.co.uk/earth/main.jhtml?xml=/earth/2008/09/12/scicern312.xml , they contain quite a few inaccuracies with regards to the content of the speech and the purpose of the hack.

So, given that I despise misinformation, lets see what they ACTUALLY said in there!!

Line-by-line translation:

————————————

10/09/08

At this time an experiment attempt is being performed in CERN.

The reason we chose this page is to remind you of some things.

It [the deface] did not happen due to a conflict between us and CERN’s system administration team but because of the expected increase in number of visitors in the page in the next few days.

Some data from the base:

[...a c/p of the process listing follows...]

and some e-mails:

[...a c/p of e-mails follows...]

The ** have simply been placed so that we don’t expose people who has done nothing to anger us.

As we stated in the preamble, we do not want to destroy either the [operating] system or the website… Our purpose is to show, through action, our reaction to a lot of “active” members of the GHS [Greek Hacking Scene] which has become arrogant (litteral translation of the phrase “Καβαλήσει το καλάμι”, riding the stick) without offering anything…

Stupid cliques get created simply to insult and cause trouble (translated from “τραμπούκος”, insulting troublemaker, “τραμπουκίζω”, cause insult & trouble) through either words or IRC channel banning people who are not considered, by them or their flunkies, worthy of their knowlege and their image.

Some others, the 1337 (leet, elite) of the “scene”, only chat over cups of coffee and don’t do anything practical, as they are good at gossiping…but of “security”…what is that? we are 2600…don’t mess with us.

IRRELEVANT AND QUAINT!

Stop salivating and licking and start keyboarding! But, of course, criticising is easy especially when you have many 20year-olds around whispering “2600″-”2600″. Get yourselves in insomnia.gr and start gossiping (litteral translation of “θάβετε με μεγάλο φτυάρι”, burrying people through gossiping with a big shovel)…But it will also bear the seal of GST.

We are everywhere…because unlike you we don’t spend our nights writing songs or “rapping” away in public squares…nor do we laugh at what we cannot touch…

We don’t publicly expose you (translated from “ξεβρακώνουμε”, pulling your underpants down, Greek expression) because we don’t want to see you all running like mad and naked trying to find a hiding place and because we are not like you. You should, however, expect the response when you were laughing at things you had never considered doing…but we have spent enough time dealing with a bunch of schoolkids who learned about hacking through Hollywood movies and their dumb American culture of the neo-geek who reads hacking magazines while trying to crack his girlfriend’s e-mail account to see if she’s being unfaithful and has Linux on dual-boot to pose (translated from “ψαρώνει”, Greek expression) to his mates who also read neo-hacking mania-inspired magazines.

The entire Greek Internet is riddled with holes…some of the biggest government sites don’t even know the term “security”…since they assign the design of their sites to irrelevant companies.

SECURITY IS NOT CONDUCTED BY PAY-OFFS.

We are everywhere…

We salute the real hobbyists and the fanciers of the art of computers. Some old ones who stopped because they were bored and tired not with this art but with the stuck-up attitude (translated from “κόμπλεξ”) of all those “specialists” in the field!! And the young ones who don’t say many words but work with their heads down because what they care about is knowledge, and only knowledge!!

Dear CERN admins we patched the biggest BUG in your webpage so it doesn’t turn into a Dork and gets defaced every day with the silliness of every wannabe hacker.

Don’t try to find us…We will find you…pretty soon!!!

Tnx Mr Server [lxplus.cern.ch]

_Greek Security Team_ – [.GST]

——————————–

IMPORTANT NOTE 1: This was simply a Greek-to-English language translation of the statement. DO NOT shoot the messenger (me)!!!!

IMPORTANT NOTE 2: I neither condone nor share GST’s sentiments. Nor am I in the job of publishing defaced websites (eg like zone-h). I am only writing this because the ITPro and Daily Telegraph articles were, in my honest opinion, mistaken about what this whole defacement represented.

So, then…. This was not about the GST warning CERN, there was no altruism involved….

What I can safely say (without it getting a PG rating) is that they just wanted to impress the Greek underground scene with a “high profile” hack. For the love of whichever deity you wish to name, they wrote the whole thing in the Greek language!!! Their ONLY target audience was, therefore the Greek skiddies (script kiddies).

Furthermore, you will notice references to purely Greek websites and IRC servers and channels. Which leads us to the conclusion that there were simply venting spleen at their opponents, whoever those people are.

Clearly, then, Mr Highfield and Mr Wattanajantra, the GST group didn’t actually describe CERN’s technicians as high-school kids (I don’t remember seeing that word in the text, but I do remember GST saying they had nothing against the aforementioned technicians!). Nor did they refrain from pulling CERN’s technicians pants down. Nor was there any political, religious, fear-filled or whatever of this sort meaning in what they said. Nor did they target internal servers. It was a web server they defaced.

A couple of comments with regards to what those people (the GST) said, and I’m done for the night.

During the last few years, the Greek Hacking Underground has been plagued by what I would call “turf wars” between rival script kiddie groups/crews waged on GRNet IRC (http://www.irc.gr) channels and Greek Hacking and Security-related discussion forums. The reasons for those wars are, as always, who’s the cooler of the lot. Furthermore, these “turf wars” managed to anger the old-school generation, which ultimately resulted in bigger chaos, as all sides started fighting with each other. The old-schools told the skiddies they were lamers, the skiddies told the old-schools they were a whole lot of bad things. Some of this spilled into the outside world in the form of speech-oriented defacements.

It is, thus, unfortunate that CERN’s LHC webserver got hacked as a result of the aforementioned “turf wars”, but they too are responsible for the mess they found themselves in. I sincerely hope they learn from this incident and make sure to, in future, secure and patch even those servers which are at the outside tier of their network and thus visible to the public.

As I keep telling my students, Security and Forensics ones alike, servers on the outside of a DMZ may be less important but they too require TLC (Tender Loving Care)!!!

DarkSYN @ September 13, 2008