# MA-052.072003: MyCERT Alert - Mass Web Defacement Contest

**Date:** 04 Jul 2003  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-052.072003  
**Advisory ID:** MA-052.072003

---

#### MyCERT received news regarding a mass web defacement contest which will be held on Sunday 6th July 2003.
The "defacement challenge" challenges defacers from all around the world to deface as many as 6000 web sites in the shortest time as possible.
Detail on this news is available at:
http://www.zone-h.org/en/news/read/id=2986/
MyCERT would like to alert and advise all system owners to take precautions to patch and secure their servers in order to avoid their servers to be defaced.
Some of the steps that could be taken are:
1. Apply latest patches released by the software vendors.
2. Harden your servers.
3. Close all unnecessary applications.
4. Close all unnecessary ports.
5. Download one of the many vulnerability scanners and run a security check on your systems.
In addition to the above preventive measures, we also advise System Administrators to check their system in case their system has been installed with any backdoors or Trojan programs prior to the contest day:
1. System administrators are advised to regularly monitor / check their systems.
2. Check for any newly added user account in the userlist. You may check at the shadow file, sam file etc.
3. Check for any suspicious connection on the open ports, esp on bigger port number.
4. Scan your server for any kind of backdoor. Use tripwire to check for any signs of backdoor or trojan.
Pls refer to:
http://www.tripwiresecurity.com
5. Check and look for any suspicious shell programs.
According to Zone-H, the most recently exploited vulnerabilities used by defacers are in the following packages/services:
- Openssl
- Samba
- Webdav
- Frontpage extension misconfiguration
- Aix ftpd
- Solaris telnetd
- Sendmail
- Wuftpd
- Proftpd
- Phpnuke (not for massdefacement but still a ever present one)
- OmniBack II
- Cpanel
Pls check on the above vulnerabilities and make sure measures are taken to fix any such vulnerability that may present in your system. We advise System Administrators to contact MyCERT via [email/24x7](/report_incidents/online_form.html) pager service immediately if they detected defacement to their web site.