Mass defacement hits 1000 sites

Over 1000 websites were defaced in a single attack this weekend by an almost unheard of Argentinean web defacement group.

The last few months have seen mass defacements become far more common, typically with hundreds of sites being hit in a single strike, but this attack is by far the biggest.

Carried out by a group calling themselves Kebracho, the 1000-site hit will make the group's name known among hacker circles. Kebracho has only struck five times to date, resulting in about a dozen defacements. The group seems to have been operating since May, but its members may have gone by another name before.

Kebracho compromised a Solaris web server, Root-dns.com, at Californian firm Vital Stream, and then presumably used a script to overwrite all index pages with the attacker's own - a somewhat mocking photo of what might be one of the hackers wearing a scarf to cover his face.

The compromised machine was 'virtually hosting' over 1000 sites, which means they were all packed onto the same machine. Because breaking into one virtual host gives access to all the sites running on it, defacers can chalk up dozens, or in this case hundreds, of hits in minutes.

Kebracho also broke into another server yesterday run by the same company, this time at Publichost.com, which only resulted in a further four defacements. A full listing of the affected sites can be found here.