Commentary From: Editor InfoGuerra (editor@infoguerra.com.br)


I would like to comment that xl.com was defaced many times between Saturday and Wednesday, not only two times. I wrote an article about it, too, but, as you may remeber, my articles are only in Portuguese. But I'd like do explain a little bit more about it.

In fact it was a series of redefacements, but related to a company like Lucent it shouldn't happen, for sure. Safemode has two mirrors, and I have the others. You can see it at:

Saturday (07/21/2001), by Demoniados.Br -
http://www.safemode.org/mirror/2001/07/21/xl.com/

Monday (07/23/2001), by Quarai Hack Force -
http://www.infoguerra.com.br/defaced/xl.com

Tuesday morning (07/24/2001), by Feltonspray -
http://www.safemode.org/mirror/2001/07/24/xl.com/

(it seems there was another redefacement again by Quarai Hack Force, after Feltonspray redefacement, but I didn't see it)

Tuesday night (07/24/2001), by an unknown person -
http://www.infoguerra.com.br/defaced/xl2/xl.com/

Wednesday (07/25/2001), again by Quarai Hack Force -
http://www.infoguerra.com.br/defaced/xl3/xl.com/

All the defacements at InfoGuerra's site I saw. Wednesday I called the Lucent's Brazilian Director and he couldn't explain what was happening. He suggested that I should contact US Lucent, so I did it by e-mail, but I haven't any response.

There's another thing. VNUNet says the site runs Netscape-Enterprise on Irix. Well, this is half the truth. What runs this system is http://www.xl.com . This URL was online and normal all the time (and still is). But http://xl.com, wich was defaced, aparently runs IIS. This URL was defaced one month ago by the sadmind/IIS worm (http://www.safemode.org/mirror/2001/06/20/xl.com/).

In fact, there are two servers, one for http://www.xl.com, wich is located at Lucent's network, and one for http://xl.com , wich is located at Excel Switching Corporation, bought by Lucent.

I also would like to say that I don't run a mirror site and don't intend to do it. InfoGuerra is a news site, but sometimes, when it's convenient, I take some mirrors. And last, but not least, these commentaries are just for your knowledge and have no other intentions. I respect Attrition's work and just wanted to share some information with you : ).

Best Regards.

Giordani Rodrigues
InfoGuerra's Editor
http://www.infoguerra.com.br



---
© 1999, 2000, 2001 Copyright Brian Martin
Permission is granted to quote, reprint or redistribute provided the text is not altered, and the author and attrition.org is credited. The opinions expressed in this text are not necessarily the opinion of all Attrition staff members.

To subscribe to this list, send mail to majordomo@attrition.org with subscribe defaced-commentary in the BODY of the mail.