So Lieberman's site was hacked previously...

[EarlG]

...according to his webmaster. I did a quick Google search to find out what that looked like.

See if you can spot the difference:

JULY 10, 2006



Source: http://www.michaelbrazellmurray.com/wordpress/?p=123

AUGUST 8 (ELECTION DAY), 2006

Morning



Source: http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=132x2762979

Lunchtime



Source: http://journals.democraticunderground.com/Skinner/115

Afternoon

[Scout1071]

1. Big difference. But, I don't expect the media to notice. They've already

made their mind up about the evil bloggers.

[Richard Steele]

2. Can't see what you are getting at. No doubt FOX News will explain it to me

:sarcasm:

[Occulus]

3. Looks like someone who was "hacked" actually does have access

A "suspended page" message, actually being a press release (sort of)?

Last time I knew, hosting sites don't let you put messages to your visitors on the hosting site's "suspended" page. Maybe I'm wrong, but that "lunchtime" messge just doesn't sit well with me at all.

[KittyWampus]

6. So "Lunchtime Message" was AFTER they paid their bill?

?

Curiouser and curioser.

[QuestionAll...]

10. would they need to pay the bill?

does Joe have other sites, is this one just for this campaign?

[salvorhardin]

8. No they don't

Hosting companies don't allow you to put your own message on the "suspended page".

Because the "suspended" web page is not under control of the website owner. It's owned by the hosting company. On a CPanel system when an account is suspended anyone requesting a page on the suspended account is redirected to the hosting company's "suspended" page.

Edit for clarification.

[EarlG]

9. Yeah, see Skinner's thread

It means that they had server access today in order to put up that index page. The order of play appears to be:

1. Server account suspended.
2. Server account is restored, Lieberman's webmaster accesses the server to put up an index page lambasting Lamont's campaign.
3. Index page disappears, replaced with standard "This account is under construction" page, which is the default page displayed if no index page is present in the directory.

No mysterious messages from "TheHacker" today, unlike July 10.

[salvorhardin]

11. Exactly! n/t

[TahitiNut]

13. July 10 looks like they were rooted.

Today looks like the ISP suspended them. It could, however, be a scramble/fumble by the ISP in doing a redirect. Hard to tell.

[EarlG]

14. Indeed

Or they went way over their allocated bandwidth, which is likely. The site would naturally get busier as election day approached, and this morning they went over the top. So they tried to cover up the error by blaming it on the hacker/Lamont campaign. Since it looks like they already got hacked for real back in July, this is a good excuse. Plus they can legitimately say that they've contacted the cops and the Attorney General. Sure, they might have done this after the July 10 attack, but there's no harm in reiterating it, eh?

[TahitiNut]

17. The ol' difference between 'is' and 'was' strikes again.

How 'handy' to have the July 10 rooting to obfuscate today's run-over. When will we actually have people representing us who take responsibility? The freaking half-cocked finger-pointing is a global epidemic. Joe's people are behaving shamefully - true to form.

[mhatrw]

16. If they were SQL hacked a month ago, why didn't they protect

themselves against this sort of grammar school hack?

It's as simple as not accepting a few dangerous character patterns of user input.

[TahitiNut]

19. Seems obvious. They're not pro's.

More than 80% of the people doing "web" stuff are drones who merely do plug'n'play and couldn't code their way out of a wet paper compiler listing. They do a good job of changing the "eyewash" (deludes the tech-ignorant customer) but have almost no comprehension of what's under the hood or how to tune/repair/build it.

You get the same thing on the 'hacker' side - more than 80% are merely "script kiddies" using stuff the more savvy hackers package.

[mhatrw]

23. "Nobody ever considered an SQL hack."

"Nobody ever considered planes running into buildings."

"Nobody ever considered Hussein might not have WMDs."

"Nobody ever considered the levies wouls break."

"Nobody ever considered Iraq would devolve into civil war."

Hmmm, notice any trend?

[mcscajun]

4. The NYT is calling for links to screen captures of the billing issue

Zap 'em over to: [e-mail]

[Junkdrawer]

5. Obviously the Site Admin had no choice but to modify the hacker's page...

when he constructed his "Under Construction" page.

I mean, if your website were hacked, wouldn't that be what you would do?

[EarlG]

12. There was nothing about a hacker message today

The first anyone heard of this was the "Account suspended" page, which is not the page you'd get if you simply removed the index page. It's the page you'd get if you didn't pay your bills or ran over your allocated bandwidth - the latter scenario is quite likely considering that the site would naturally attract more traffic as election day got closer.

If you pull the index page, visitors would see the the default "Account under construction" page. Which is what's there now. After Lieberman's webmaster removed the index page lambasting the Lamont campaign.

The way it looks right now, they could put anything they want back up on the server at any time. For some reason they're choosing not to.

[Swamp Rat]

15. "For some reason they're choosing not to."

That is the entrance into the rabbit hole. ;)

[im10ashus]

18. Who's running his campaign?

Rove? This is such a Rovian tactic, to blame others for your failings.

[EarlG]

20. I should add

It's possible that they're getting DOSed and can't replace the index page. As someone pointed out in Skinner's thread, the link to the statement attacking Lamont comes from server1.myhostcamp.com, not joe2006.com.

But it doesn't change the fact that they were able to put the message up. The Lieberman spokesman was on MSNBC moaning about how this was going to ruin their GOTV plans. But if they were able to put up a message attacking Ned Lamont for the "hack" then they could just have easily put up a message with emergency information and phone numbers for their GOTV operation.

[TahitiNut]

21. A redirect would be SOP for an ISP getting DOS'd.

:shrug:

[QuestionAll...]

7. is this what this means?

joe's website won't be needed after today, so he got a notice to renew the contract from his host, which he has no need to.

sneaky joe thinks this has can be twisted into a ''Ned the Hacker Did It!" - and posts a notice on their 'hacked' front page website crying about their troubles.
but how the Hell did they post it to the server if it is 'down'.

someone just a bit wiser than whoever dumbass came up with that, called and told them to take it down, fast.

so everything is removed, and you get the 'construction' message.

pathetic weasel tactics.

[Junkdrawer]

22. More info here:

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=364x1849083

[Festivito]

24. I don't know. We should concentrate on getting the hacker.

The hack may have alerted support more so than billing.
Mad, someone from Joe's puts up an angry message.
Someone else says take the angry message down.

Leaving it as "under construction" at this point is questionable.

I'm curious. 1. Did they contact AG. 2. Will the AG look for someone.

As good citizens we should be calling LOUDLY for a complete investigation and prosecution.