Dark Web Hosting Service Hacked, Some Data Was Stolen

Deep Hosting — a Dark Web hosting service — admitted yesterday to suffering a major security incident during which “some sites have been exported.”

The hack took place on Saturday afternoon and was carried out by a hacker calling himself Dhostpwned, the name he used when he spoke with Bleeping Computer earlier today.

Hacker used PHP shell to take over hosting provider
According to a wiki page published by the Deep Hosting team, the hack took place after the hacker registered a shared hosting account on their service, and used it to upload two shells on their servers, one written in PHP and one in Perl.

A Deep Hosting investigation into the events that preceded the hack showed that the attacker was not able to execute the Perl shell, but the PHP version worked just fine.

“A large part of the PHP shell is unusable since a certain number of functions are blocked on the shared servers but one function was not blocked,” Deep Hosting wrote in a wiki page detailing the security incident. “The attacker was able to access the server and execute a commands [sic] with limited rights.”

According to a timeline of their investigation — embedded below — it took the Deep Hosting almost a full day to understand what really happened, detect the point of intrusion, and change FTP and SQL password for all user accounts.

“We believe that some sites have been exported,” Deep Hosting admitted at the end of their wiki page. “It is possible that the linked databases were also recovered.”

At least 91 Dark Web portals affected
Dhostpwned shared with Bleeping Computer a list of all the sites he managed to reach from the Deep Hosting server he initially hacked. The list includes 91 websites and is embedded at the end of this article. Most of these sites are now down, after the hosting provider reset MySQL passwords.

The list includes all sorts of Dark Web services, ranging from drugs marketplaces to malware repositories, and from hacking forums to carding shops.

“I hacked them,” Dhostpwned told Bleeping Computer in a private conversation today. “Their shared hosting was appauling [sic] in terms of security.”

“I’ve got the majority of files hosted from the site, all of their sql dbs,” the hacker added. “[sic] There was an assassination network hosted on it but i didnt end up getting into that since it was a vps hosted by them and they didnt have any sort of panel to access the vps.”

Hacker accidentally brings down Dark Web marketplace
On the other hand, Dhostpwned managed to gain access to other servers, including the one hosting the M.N.G Market, a marketplace that sold various illegal products. He uploaded the following text file in the server’s public root folder to prove his claim.”We believe that some sites have been exported,” Deep Hosting admitted at the end of their wiki page. “It is possible that the linked databases were also recovered.”

At least 91 Dark Web portals affected
Dhostpwned shared with Bleeping Computer a list of all the sites he managed to reach from the Deep Hosting server he initially hacked. The list includes 91 websites and is embedded at the end of this article. Most of these sites are now down, after the hosting provider reset MySQL passwords.

The list includes all sorts of Dark Web services, ranging from drugs marketplaces to malware repositories, and from hacking forums to carding shops.

“I hacked them,” Dhostpwned told Bleeping Computer in a private conversation today. “Their shared hosting was appauling [sic] in terms of security.”

“I’ve got the majority of files hosted from the site, all of their sql dbs,” the hacker added. “[sic] There was an assassination network hosted on it but i didnt end up getting into that since it was a vps hosted by them and they didnt have any sort of panel to access the vps.”

Hacker accidentally brings down Dark Web marketplace
On the other hand, Dhostpwned managed to gain access to other servers, including the one hosting the M.N.G Market, a marketplace that sold various illegal products. He uploaded the following text file in the server’s public root folder to prove his claim.

Moments after he uploaded his text file, the M.N.G Market went down, as Dhostpwned admitted to accidentally wiping their hard drive’s MBR.

According to Dhostpwned, the M.N.G Market team also used a VPS server to host their portal, but unlike others, had forgotten to change their default password for the VPS box.

This is not the first time a Dark Web hosting provider has been hacked. In February this year, members of the Anonymous hacker collective breached and dumped the database of the Freedom Hosting II free Dark web hosting service. They said they hacked the hosting provider because they found out that Freedom Hosting II knew customers were hosting child abuse forums on their service but did nothing about it. Freedom Hosting I was hacked for the same reason in 2011.

At the time of writing, Dhostpwned has not dumped any data from Deep Hosting or its clients, and said he doesn’t plan to.

Source:https://www.bleepingcomputer.com/news/security/dark-web-hosting-service-hacked-some-data-was-stolen/