Commentary From: Editor InfoGuerra (editor@infoguerra.com.br)
I would like to comment that xl.com was defaced many times between
Saturday and Wednesday, not only two times. I wrote an article about it,
too, but, as you may remeber, my articles are only in Portuguese. But I'd
like do explain a little bit more about it.
In fact it was a series of redefacements, but related to a company like
Lucent it shouldn't happen, for sure. Safemode has two mirrors, and I have
the others. You can see it at:
Saturday (07/21/2001), by Demoniados.Br -
http://www.safemode.org/mirror/2001/07/21/xl.com/
Monday (07/23/2001), by Quarai Hack Force -
http://www.infoguerra.com.br/defaced/xl.com
Tuesday morning (07/24/2001), by Feltonspray -
http://www.safemode.org/mirror/2001/07/24/xl.com/
(it seems there was another redefacement again by Quarai Hack Force, after
Feltonspray redefacement, but I didn't see it)
Tuesday night (07/24/2001), by an unknown person -
http://www.infoguerra.com.br/defaced/xl2/xl.com/
Wednesday (07/25/2001), again by Quarai Hack Force -
http://www.infoguerra.com.br/defaced/xl3/xl.com/
All the defacements at InfoGuerra's site I saw. Wednesday I called the
Lucent's Brazilian Director and he couldn't explain what was happening. He
suggested that I should contact US Lucent, so I did it by e-mail, but I
haven't any response.
There's another thing. VNUNet says the site runs Netscape-Enterprise on
Irix. Well, this is half the truth. What runs this system is
http://www.xl.com . This URL was online and normal all the time (and still
is). But http://xl.com, wich was defaced, aparently runs IIS. This URL was
defaced one month ago by the sadmind/IIS worm
(http://www.safemode.org/mirror/2001/06/20/xl.com/).
In fact, there are two servers, one for http://www.xl.com, wich is located
at Lucent's network, and one for http://xl.com , wich is located at Excel
Switching Corporation, bought by Lucent.
I also would like to say that I don't run a mirror site and don't intend
to do it. InfoGuerra is a news site, but sometimes, when it's convenient,
I take some mirrors. And last, but not least, these commentaries are just
for your knowledge and have no other intentions. I respect Attrition's
work and just wanted to share some information with you : ).
Best Regards.
Giordani Rodrigues
InfoGuerra's Editor
http://www.infoguerra.com.br
---
© 1999, 2000, 2001 Copyright Brian Martin
Permission is granted to quote, reprint or redistribute provided the text is not
altered, and the author and attrition.org is credited. The opinions expressed
in this text are not necessarily the opinion of all Attrition staff members.
To subscribe to this list, send mail to majordomo@attrition.org with
subscribe defaced-commentary in the BODY of the mail.