Hacker News new | past | comments | ask | show | jobs | submit login
MIT website hacked by Lulzsec (mit.edu)
112 points by Skywing on Jan 22, 2013 | hide | past | favorite | 81 comments



It's worse than that:

   $ whois mit.edu
      
   Domain Name: MIT.EDU
   
   Registrant:
      Massachusetts Institute of Technology
      Cambridge, MA 02139
      UNITED STATES
   
   Administrative Contact:
      I got owned
      Massachusetts Institute of Technology
      MIT Room W92-167, 77 Massachusetts Avenue
      Cambridge, MA 02139-4307
      UNITED STATES
      (617) 324-1337
      cunt@mit.edu
   
   Technical Contact:
    OWNED NETWORK OPERATIONS
      ROOT
      US
      DESTROYED, MA 02139-4307
      UNITED STATES
      (617) 253-1337
      owned@mit.edu
   
   Name Servers: 
      FRED.NS.CLOUDFLARE.COM      
      KATE.NS.CLOUDFLARE.COM      
   
   Domain record activated:    23-May-1985
   Domain record last updated: 22-Jan-2013
   Domain expires:             31-Jul-2013
http://whois.educause.net/


I just checked, 1:05 Eastern, Jan. 22, 2013 and I'm getting the correct registry info from Network Solutions.


That may've been TTL-dependent -- though the record was only restored a minute or two ago. Educause is the EDU authoritative host.


Pretty quick, eh?


This post has 78 points at the time of me writing this, and yet, it suddenly disappeared from the front page. Older posts with fewer votes are still on it. Was this post flagged? Any particular reason?


Perhaps the mods didn't want readers clicking through to a page that is still possibly compromised? Or maybe enough people flagged it for said reason...


How can a domain name with incredible value like MIT.EDU expire in July of this year? Is an ivy-leage school with a $9 billion endowment renewing their domain name year by year? It looks like the domain registration is not managed well. My guess is the exploit was guessing a weak password at the registrar.


Please don't lump us in with the Ivy League!


I don't even care about the cause behind this. But the fact that this was yanked off the front page is fucking despicable.


It was likely yanked off the front page because going to a compromised website is dangerous and a security risk.


> ...going to a compromised website is dangerous and a security risk.

...Well, that depends on your system, really.

I think it's more likely that it was ganked because linking to compromised websites is against etiquette: they don't want to encourage that sort of thing by drawing attention to it.


Wow, this link was the top one on the frontpage for me about 2 minutes back. Now it has completely disappeared off it. How does this happen?


Looks like a moderator nuked it. Great justice.


Free speech is not so important, it seems.


It was on the front page for me.


I'd just like to take the time to point out, that this is a direct link to a compromised page.

Sure, the message is championing a tragic victim, but do you see how this isn't exactly the wisest move?

Do I need to call attention to the recent Java zero-day exploit?

http://thenextweb.com/insider/2013/01/10/new-java-vulnerabil...


Who runs java?


Everyone at MIT (required to do a bunch of kerberos related shit)


As if no other software has 0days.


Well, it's just an example. When a page is still compromised, and under the control of someone unexpected, you can't really anticipate the state of the page, and what it might deliver to your computer. I pointed that one out because it's a pretty recent drive-by exploit. You dig?


Was this story just removed from the frontpage of HN?


Yep, I think so. Interesting enough, there's almost no mention of it by anyone else. Instead, the top article is something about a hacker news radio. Hmmm.


Wow, what an incredible hack. Pwnd page well designed and thought out. What a way to make a tribute to Aaron.

EDIT: Imgur link in case it gets taken down http://imgur.com/3AADDRT


This post disappeared from the HackerNews front page. What's going on? Flagged by admins?


I would love to hear how this could have happened. Social engineering at the DNS provider? Unpatched server? If someone knows, please do tell. I love hearing about how people pull off these things. Maybe even an inside job? a lot of people are sympathetic to the cause, maybe one of those people just left the window open or something?


Their registrar was probably vulnerable (or socialed), because the nameservers were changed. This is not uncommon.


Almost all of MIT's network administration happens within MIT, so you can't hack it by social engineering an outsider.


You can if the target is the registrar, which this was.


I doubt it was a social of educause (the edu registrar); more likely some credentials specific to MIT were compromised.


Yet another example how misguided modern day internet-cowboys with their tar-and-feather vigilante justice are.


What I really love is how they point to Aaron's wonderful piece on morality (and I mean this sincerely). Aaron points out that you can logically justify almost any evil if you think only of the overall good.

Had I read the piece when it was posted I would have thought it was a call to figure out how philsophers (especially utilitarian philosophers) solve the dilemma of "the ends justify the means" in such a way that you wouldn't optimize for committing minor sins to effect major benefits.

But based on hacktivism since, now I'm not so sure. Aaron seemed to fall into his own philosophical quandry, but if we assume that Aaron was justified in what he did then we could use the same logic to say that this defacement is justified as long it achieves some greater good.

I personally don't agree with that logic, and I think it's because it tends to justify things like this defacement. Whenever you're lead by logic to a false conclusion it means either your logic wrong or your axioms were wrong. Now I'm almost confusing myself though; I'm not even sure what axioms we'd be using for this...


It's impossible to really measure how and how much something achieves in the long run. Not that I want to compare this defacement to that, but just to point out the impossibility to measure such things: does the photography of James Nachtwey help to improve the world? I'm thinking "of course it does, there is no way it doesn't", but nobody can know how much.

If this made just 10 people reflect a bit on stuff they otherwise wouldn't have reflected on, how much trouble and costs would this have to cause to not have been worth it? Everybody fuzzes this kind of "math" for themselves based on their perception and biases, there is just no clean, objective way to go about it IMHO.


Best to just do nothing when your government oversteps the mark.

That's a good citizen.

Back to work with you.


While I don't really approve defacement, that was not the point in my comment. If the defacement would have been done to DOJ (or whatever front the prosecutors have) website, I might have disapproved but still at least I would have found the target appropriate.

As you self say, it is the government that was "overstepping the mark". Attack them instead of MIT which was pretty much the least evil party in the whole case best to my knowledge.


You're thinking of JSTOR. MIT wanted Aaron to rot in prison.


Not really. You should read what information is available on the case, and the MIT report when it comes out in the near future.


Seems like someone hijacked the domain.


This must get pretty frustrating for MIT students...


As a university student, how many times did you find yourself visiting the school's public-facing web site? In my case, I can count my visits on one hand.

Now, all the other crap-- course scheduling, grades, classwork --is likely not living on the same server. Many of these things aren't even hosted inside the school's network but provided by some outside company.


The rogue DNS servers are reporting MIT's main web server IP for all DNS name queries (other than for the main web server's name) to people that are off campus. So, to someone outside MIT (depending on DNS caching), it looks like everything is down.

Also, ASP/SAAS companies in the .edu space often use a DNS name that is part of the school's domain in their model.


I don't know much about this stuff but different server or not - if the domain is hijacked then everything is broken, no?

E.G. if they had blackboard (course docs, homework, etc.) on blackboard.mit.edu then that would be hosed right now, wouldn't it?


If you're on the internal network, you're most likely using an internal DNS server which would not care that the registrar claims some other DNS server is now authoritative.

I suppose it could be a problem if you're not on campus; or if any third-party services are not using their own domains (e.g. mit.blackboard.com)


As a student I don't think its very frustrating. I only visit the main MIT site when I see posts like this really or news articles. I am surprised by how ready people are to exploit given a reason though.



Yeah, they can't see the MIT website they never use.


From http://3down.mit.edu/3down/

Tuesday January 22 2013 12:19:

The MIT.EDU domain has been compromised and sites external to MIT are currently being redirected elsewhere. We are working with the domain registrar to get this fixed.


Lots of MIT stuff is reachable by IP. They have a /8 so they don't really worry very much about virtual webservers. http://18.7.28.68/3down/

EDIT: If you need to reach an MIT service, contact their native DNS servers:

bitsy.mit.edu 18.72.0.3

strawb.mit.edu 18.71.0.151

w20ns.mit.edu 18.70.0.160


Gizmodo sez they stole educause creds from an MIT admin with a "browser exploit":

http://gizmodo.com/5978039/hackers-incoherently-deface-entir...


The defacing message is pretty deep, too. This is copied from the website, and is not my own. I'm just pasting it so that it's readable here, too:

  I used to think I was a pretty good person. I certainly didn’t kill people, for example. But then Peter Singer pointed out that animals were conscious and that eating them led them to be killed and that wasn’t all that morally different from killing people after all. So I became a vegetarian. Again I thought I was a pretty good person. But then Arianna Huffington told me that by driving in a car I was pouring toxic fumes into the air and sending money to foreign dictatorships. So I got a bike instead. But then I realized that my bike seat was sewn by children in foreign sweatshops while its tubing was made by mining metals through ripping up the earth. Indeed, any money I spent was likely to go to oppressing people or destroying the planet in one way or another. And if I happen to make money some of it goes to the government which spends it blowing people up in Afghanistan or Iraq. I thought about just living off of stuff I found in dumpsters, like some friends. That way I wouldn’t be responsible for encouraging its production. But then I realized that some people buy the things they can’t find in dumpsters; if I got to the dumpster and took something before they did, they might buy it instead. The solution seemed clear: I’d have to go off-the-grid and live in a cave, gathering nuts and berries. I’d still probably be exhaling CO2 and using some of the products in the Earth, but probably only in levels that were sustainable. Perhaps you disagree with me that it’s morally wrong to kill animals or blow up people in Afghanistan. But surely you can imagine that it might be, or at least that someone could think it is. And I think it’s similarly clear that eating a hamburger or paying taxes contributes — in a very small way; perhaps only has the possibility of contributing — to those things. Even if you don’t, everyday life has a million ways that are more direct. Personally, I think it’s wrong that I get to sit at a table and gaily devour while someone else delivers more food to my table and a third person slaves over a stove. Every time I order food, I make them do more carrying and slaving. (Perhaps they get some money in return, but surely they’d prefer it if I just gave them the money.) Again, you may not think this wrong but I hope you can admit the possibility. And it’s obviously my fault. Off in the cave, I thought I was safe. But then I read Peter Singer’s latest book. He points out that for as little as a quarter, you can save a child’s life. (E.g. for 27 cents you can buy the oral rehydration salts that will save a child from fatal diarrhea.) Perhaps I was killing people after all. I couldn’t morally make money, for the reasons described above. (Although maybe it’s worth helping fund the bombing of children in Afghanistan in order to help save children in Mozambique.) But instead of living in a cave, I could go to Africa and volunteer my time. Of course, if I do that there are a thousand other things I’m not doing. How can I decide which action I take will save the most lives? Even if I take the time to figuring out, that’s time I’m spending on myself instead of saving lives. It seems impossible to be moral. Not only does everything I do cause great harm, but so does everything I don’t do. Standard accounts of morality assume that it’s difficult, but attainable: don’t lie, don’t cheat, don’t steal. But it seems like living a moral life isn’t even possible. But if morality is unattainable, surely I should simply do the best I can. (Ought implies can, after all.) Peter Singer is a good utilitarian, so perhaps I should try to maximize the good I do for the world. But even this seems like an incredibly onerous standard. I should not just stop eating meat, but animal products altogether. I shouldn’t just stop buying factory-farmed food, I should stop buying altogether. I should take things out of dumpsters other people are unlikely to be searching. I should live someplace where others won’t be disturbed. Of course all this worrying and stress is preventing me from doing any good in the world. I can hardly take a step without thinking about who it hurts. So I decide not to worry about the bad I might be doing and just focus on doing good — screw the rules. But this doesn’t just apply to the rules inspired by Peter Singer. Waiting in line at the checkout counter is keeping me from my life-saving work (and paying will cost me life-saving money) — better just to shoplift. Lying, cheating, any crime can be similarly justified. It seems paradoxical: in my quest to do good I’ve justified doing all sorts of bad. Nobody questioned me when I went out and ordered a juicy steak, but when I shoplift soda everyone recoils. Is there sense in following their rules or are they just another example of the world’s pervasive immorality? Have any philosophers considered this question?
  
  R.I.P Aaron Swartz
  
  Hacked by grand wizard of Lulzsec, Sabu
  
  GOD BLESS AMERICA
  
  DOWN WITH ANONYMOUS
  
  reddit sucks, k hacked by aush0k and tibitximer
Screenshot, too: http://i.imgur.com/TCRteRw.png



I don't know hacker culture, but would Sabu really do this and use his own name after his true identity has been revealed and turned informant?

http://en.wikipedia.org/wiki/Sabu_(hacktivist)

Seems like it would jeopardize whatever arrangement he had with the feds.


Of course it's not actually hacked by Sabu, the entire message is sarcastic.


Doubtful, and what's the alternative? Somebody else hacking MIT in Sabu's name to make life difficult for him sounds much more likely, and hilarious.


wasn't Sabu working for the government? and the most affected pages were the MIT opensourceware, libraries and iniciatives, concidence?


fixed formatting, broke into paragraphs

I used to think I was a pretty good person. I certainly didn’t kill people, for example. But then Peter Singer pointed out that animals were conscious and that eating them led them to be killed and that wasn’t all that morally different from killing people after all. So I became a vegetarian. Again I thought I was a pretty good person. But then Arianna Huffington told me that by driving in a car I was pouring toxic fumes into the air and sending money to foreign dictatorships. So I got a bike instead. But then I realized that my bike seat was sewn by children in foreign sweatshops while its tubing was made by mining metals through ripping up the earth. Indeed, any money I spent was likely to go to oppressing people or destroying the planet in one way or another. And if I happen to make money some of it goes to the government which spends it blowing people up in Afghanistan or Iraq.

I thought about just living off of stuff I found in dumpsters, like some friends. That way I wouldn’t be responsible for encouraging its production. But then I realized that some people buy the things they can’t find in dumpsters; if I got to the dumpster and took something before they did, they might buy it instead. The solution seemed clear: I’d have to go off-the-grid and live in a cave, gathering nuts and berries. I’d still probably be exhaling CO2 and using some of the products in the Earth, but probably only in levels that were sustainable.

Perhaps you disagree with me that it’s morally wrong to kill animals or blow up people in Afghanistan. But surely you can imagine that it might be, or at least that someone could think it is. And I think it’s similarly clear that eating a hamburger or paying taxes contributes — in a very small way; perhaps only has the possibility of contributing — to those things. Even if you don’t, everyday life has a million ways that are more direct. Personally, I think it’s wrong that I get to sit at a table and gaily devour while someone else delivers more food to my table and a third person slaves over a stove. Every time I order food, I make them do more carrying and slaving. (Perhaps they get some money in return, but surely they’d prefer it if I just gave them the money.) Again, you may not think this wrong but I hope you can admit the possibility. And it’s obviously my fault.

Off in the cave, I thought I was safe. But then I read Peter Singer’s latest book. He points out that for as little as a quarter, you can save a child’s life. (E.g. for 27 cents you can buy the oral rehydration salts that will save a child from fatal diarrhea.) Perhaps I was killing people after all. I couldn’t morally make money, for the reasons described above. (Although maybe it’s worth helping fund the bombing of children in Afghanistan in order to help save children in Mozambique.) But instead of living in a cave, I could go to Africa and volunteer my time. Of course, if I do that there are a thousand other things I’m not doing. How can I decide which action I take will save the most lives? Even if I take the time to figuring out, that’s time I’m spending on myself instead of saving lives.

It seems impossible to be moral. Not only does everything I do cause great harm, but so does everything I don’t do. Standard accounts of morality assume that it’s difficult, but attainable: don’t lie, don’t cheat, don’t steal. But it seems like living a moral life isn’t even possible. But if morality is unattainable, surely I should simply do the best I can. (Ought implies can, after all.) Peter Singer is a good utilitarian, so perhaps I should try to maximize the good I do for the world. But even this seems like an incredibly onerous standard. I should not just stop eating meat, but animal products altogether. I shouldn’t just stop buying factory-farmed food, I should stop buying altogether. I should take things out of dumpsters other people are unlikely to be searching. I should live someplace where others won’t be disturbed. Of course all this worrying and stress is preventing me from doing any good in the world.

I can hardly take a step without thinking about who it hurts. So I decide not to worry about the bad I might be doing and just focus on doing good — screw the rules. But this doesn’t just apply to the rules inspired by Peter Singer. Waiting in line at the checkout counter is keeping me from my life-saving work (and paying will cost me life-saving money) — better just to shoplift. Lying, cheating, any crime can be similarly justified.

It seems paradoxical: in my quest to do good I’ve justified doing all sorts of bad. Nobody questioned me when I went out and ordered a juicy steak, but when I shoplift soda everyone recoils. Is there sense in following their rules or are they just another example of the world’s pervasive immorality? Have any philosophers considered this question?

R.I.P Aaron Swartz

Hacked by grand wizard of Lulzsec, Sabu

GOD BLESS AMERICA

DOWN WITH ANONYMOUS

reddit sucks, k hacked by aush0k and tibitximer


Just thinking out loud (k, so "on keyboard")...

Your question inevitably comes to the issue of priorities and of personal accountability to those priorities regardless of moral influence.

Personal case in point: My 4 year old daughter contracted Streptococcus Pneumoniae Meningitis; serotype 19a. An extremely antibiotic resistant disease with a mortality rate of 20% with 48 hours of initial contraction (most people dont begin to show symptoms until 12 to 24 hours after initial contraction basically leaving them with about 24 hours to live). Of those who survive 80% are left with mild to severe mental disability. Her life was saved and she made a full recovery with no disability at all. Even the doctors were shocked at how well she recovered.

The antibiotic she was given is a synthetic drug that was developed in a lab and was allowed to go to human testing only after testing it on animals to determine it's safe dosage levels (some levels are considered corrosive and fatal). I could be wrong, but I'm pretty sure many animals suffered and died during that particular phase of its development.

Ergo, numerous animals suffered and died so that my daughter (and many others that needed that medication) could live and return to a normal life.

I fully respect and understand someone's choice to not eat meat, even to go so far as to avoid animal based products. I don't believe animals should be made/allowed to suffer needlessly. However it seems to me that it comes to an issue of priorities (whether influenced by morals or not). In this case I find it morally wrong to make animals suffer, however my daughter's health is a much higher priority. Therefore, if an animal must suffer and die in order for my daughter live then so be it. The priority overrules the moral.

To anyone who would maintain that a conscious animal holds the same intrinsic and/or perceived value as a human I would simply ask this: would you allow someone you love to die so that you could prevent the suffering of an animal, or at the very least, not be a benefactor from the suffering of an animal?

Another, friendly way of putting it could be this: What are your priorities, not morals, regarding animal testing vs. human benefit and how influential are your morals when it comes to the establishment of those priorities?

While I used the issue of animal testing the basic logic can be applied to any area of your questioning.

Example: I find it immoral to kill people. Those I know and love are a higher priority than those I do not. Someone wishes to harm those I know and love. If needed I will end the life of someone I dont know to protect the life of someone I do know even though my morals say to not kill. My predetermined priority (keep those I love safe at all cost) overrules my moral inclination (do not kill).

But this brings us to the core problem with societies of any size and as a whole: What if the person who wished to do harm instead did what is moral because they made the choice to set their priorities according to a moral standard and hold themselves personally accountable to those priorities? Then I would not have my priorities overrule my morals because there would be no need; the example above would not have taken place.

You say it seems impossible to do what is moral but you're viewing morality at a level that you have no control over. If you focus on making your priorities line up with a moral standard and have personal accountability to those priorities then you will begin to see that, while you cant save the whole world, you can at least save a small part of it, yourself included.

Now imagine if everyone focused on making their priorities line up with a moral standard and saving their own small part of the world. Therein lies the strength and ability to save the world from itself.

Unfortunately the choice to hold to priorities that don't compromise (at least most) moral standards is a choice that society can only make as a whole.

ie. you decide you don't want to blow me up anymore; I can now follow my moral of "do not kill" without it being overruled by my priority of "dont get blown up".

True this doesn't help with the original example of animal testing to develop cures that save human lives, but if you find a way to instill moral standards in bacteria I will gladly nominate you for as many science awards as I can.

-FE


I certainly agree with Singer that animals are non-human persons, with some animals even having a higher moral standard than some humans.

Intelligent non-human persons like pigs are capable of suffering, and the factory farming, experimenting on and killing of animals is one of mankind's greatest crimes.

I'm not open to debate about this (sorry) but I have work to do anyway.


Having observed numerous animals, from domestic to naturally wild to feral, I can confidently say animals do not follow a moral system of any nature. Their priorities are survival and propagation (terms used in the broadest of sense).

Don't believe me? Go to the zoo. Go to a big cat enclosure, preferably one with a window that allows you to get "face to face" with them. Look that animal in the eye and see if here is any morality in there.

Really try to get face to face, nose to nose. While there, take note of your subdued instincts telling you "get away, get away now". They're telling you that for a reason.


The site that usually shows which MIT services are down/unavailable has evidently been hacked, too:

http://3down.mit.edu/


Google fonts, html5 doctype, oh my, times have changed.


And the page is down. I currently only get a Cloudflare error page.


So the cops are going to bust whoever did this.

And MIT will scream "NO, let them go!" hoping to make up for what they didn't do with Swartz.

Except they'll just be showing to the world that they still don't get it.


Website is back up (for how long?). Registrar information is still erroneous tho.


Registrar shows nameservers as the compromised ones still, so I guess that's just on your end.


how completely childish.


I have a 10 year old daughter who is quite childish at times and other times she's brilliant. Still, the immaturity is expected. She's a kid!

This was expected as well. MIT had their part to play in it.


I'm sure she is, to you. But this wasn't done by a 10 year old, and using your daughter as a metaphor is completely inaccurate and irrelevant.

It was a stupid, childish stunt designed to show off. This does nothing to change anything. MIT's involvement is unchallenged, all this does is inconvenience MIT students and makes the person/people responsible for the hack look childish and callous for using Aaron's tragedy to garner publicity and stroke their ego.

If the hacking community really wants to get behind this MIT bashing, how about we all boycott any software under MIT license for a while?? It's easy defacing a website, but I bet nobody is willing to give up their MIT software.

It also further tarnishes the "hacker" image as a bunch of pimply teenage boys trying to wave their disco sticks around in the only way they know how.

It's just plain embarrassing.


wasn't Sabu working for the government? and the most affected pages were the MIT opensourceware, libraries and iniciatives, concidence?


Also plays "The Star Spangled Banner"...


And the page title has a "Hackers" reference: http://www.youtube.com/watch?v=21lUsGr6YMQ


It's back now.


aush0k is back??


it's back up


This is how children react (which is what I think of lulzsec).


To me this is just graffiti. Yeah it's vandalism, that's the point, and I'm not sure if I wanted to live in a world completely devoid of it.

"Every normal man must be tempted at times to spit on his hands, hoist the black flag, and begin to slit throats." - H. L. Mencken

Men slit throats, door posts do nothing, children paint and sing. Count me in with the children.


There is a great difference between being tempted to do something and actually doing it. Not following your temptations (blindly) would be one of the greatest strengths of men.


To resist a temptation you have to have it in the first place; people who don't have certain temptations don't really get to judge those who didn't resist theirs.

And then there is the fact that "temptation" and "aspiration" are both equally valid to describe anything depending on your personal moral compass. For example, how is being indignated about "criminal vandalism" that nobody directly affected seems to be quite as upset about not a temptation, too?


There is no correlation between this and graffiti. Graffiti does not prevent you from using service. This is criminal vandalism.


Graffiti prevents you from looking at the bleak, clean surface. And this has already been cleared up, while graffiti often requires more then a few keystrokes. Graffiti can really destroy surfaces, and they will never be as before. Then there's tagging, which is just the equivalent of dogs peeing everywhere; as opposed to people actually trying to make a statement... to the law that distinction doesn't even exist, to me it does, and it does make a difference.

This is criminal vandalism

Graffiti isn't exactly lawful, so that's quite redundant? Unless of course you wanted to stress that your outrage is completely guided by "is it lawful", as opposed to, say, "is it good".

Oh, and unless you're a student of MIT, or anyone who was actually inconvenienced by this, or at least know someone who was, I really wonder where this is coming from, and where it's supposed to go. I mean sure, by all means criminally persecute a bunch of "children", that surely must be the ticket, that's the lesson here. Lock them away!


You'll find that people will justify even that, as long as the target of vandalism is hateful enough.


You forgot, "get offa my lawn."




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: