Vivisector
Public Discourse => Article Discussion => Topic started by: Pi on January 08, 2011, 04:42:57 pm
-
Wherein I throw a portscan at FurAffinity's two netblocks and wax technical about the results (http://www.vivisector.org/vivblog/index.php?/archives/32-FA-Technical-Expose.html#extended).
For those interested, the raw nmap results (http://www.vivisector.org/~pi/fa_2011/) are available. Ignore the "open/tcpwrapped port 21" stuff; that's an artifact of my home network's FTP proxy.
-
Things aren't blocked because they were too busy making the router say UPLINK TO PANTS (http://twitpic.com/1c8djq)! LOLOLOLOLOL
Also, I'm trying to figure out what equipment they're running. Does anyone recognize the make/model/manufacturer of the top two servers in this picture (http://twitpic.com/17gwxl)? For the record I believe the top one is Figment, the "application" server that doesn't do anything. Apparently it's serving the ads (http://twitter.com/furaffinity/status/10945808193) and is supposed to be the hosting server (http://twitter.com/furaffinity/status/10203450025) for the service that was supposed to launch months ago (http://twitter.com/furaffinity/status/10942579229).
-
I go away for a month, and I miss all the fun. And some of it was even on my birthday.
>:(
-
Dax is the Kevin D. in "kevindproductions". He only has a high school diploma and he's running around the data center of a major web retailer in NoVA generally getting paid way too much to screw around (he's come close to getting fired several times). He also rivals Dragoneer in the "doing dumb things with money" category—he's a gadget whore almost as bad as 'Neer and he has a Subaru WRX that he pays/paid for on a credit card. Looking through his Twitpic (http://twitpic.com/photos/bloowuff) reveals the sort of stuff he spends his time doing.
He also has an annoying habit of randomly jetting off to random places, dropping hundreds of dollars on a plane ticket days in advance, to visit random furfag friends of his.
Also, looking at those nmap files...is it possible to NFS-mount stuff off of FA's servers? Because if so, Christ.
-
I get this on IRC out of the blue:
[03:11:55] <Dragoneer> Regarding the Sikrain/sirkain.net from your tech expose, the reason they point to a Comcast IP is because they're no longer a part of our hosting. We were hosting them externally for a while, but they're not related to the site.
Really, this asks more questions than it answers. If they're "no longer part of [their] hosting", why is it racked? Why does it have an IP assigned? Why isn't it firewalled?
And, oh look, here's net-cat being passive-aggressive again:
[08:18:52] <net-cat> So, this: http://www.vivisector.org/vivblog/index.php?/archives/32-FA-Technical-Expose.html
[08:19:03] <net-cat> Would you actually care to know?
Also, looking at those nmap files...is it possible to NFS-mount stuff off of FA's servers? Because if so, Christ.
I didn't try. But leaving those things open is like sticking a Windows box on the 'net without firewalling the SMB ports.
-
I can't think of one good reason why you'd have more than 80/443 and maybe 22 be open to the Internet on a Web server, but what do I know, I don't run a furry porn site. Oh, and if you open 22, use pubkeys and disable keyboard-interactive or whatever SSH calls password auth. Because...well, one word: "hysterix"
-
[12:09:25] <net-cat> 66.231.180.81-83: InfoRelay's Hardware.
[12:09:43] <net-cat> 66.231.180.84-87: Correct
[12:11:01] <net-cat> 70.33.186.194,196,200,202: Correct.
[12:11:35] <net-cat> 70.33.186.204: Vitrualization host.
[12:12:07] <net-cat> 70.33.186.211-220: Hosted virtual machines.
[12:12:37] <net-cat> 70.33.186.221: Correct.
[12:13:36] <net-cat> 70.33.186.222: Not our server. They are paying us.
[12:14:12] <net-cat> 208.115.128.10: Dax's personal server. Not hosted in our rack.
[12:19:20] <net-cat> Also, than you for pointing out 1023. That was supposed to have been turned off some time ago.
[12:27:08] <net-cat> Ack, sorry. 70.33.186.210 is also a virtual machine.
[12:29:42] <net-cat> Also, all the staff have @furaffinity.net email addresses. Some of us opt to not use it. It is not, as you say, a "paid privilege."
So. a good chunk of that table isn't a waste of hardware, just a waste of ipv4.
This still doesn't explain why the default page on 70.33.186.200 (Trogdor xD) is still kicking out redirects to the Moldovan electronics retailer. If this were my server, that'd be a cause for moderate alarm.
-
Would Yak have anything to gain by doing that? Or rather, would that electronics retailer have anything to gain by paying Yak to do that?
-
Would Yak have anything to gain by doing that? Or rather, would that electronics retailer have anything to gain by paying Yak to do that?
I don't want to speculate any further on this.
[16:01:19] <net-cat> Oh, also. Novastorm doesn't expose a MySQL port because it doesn't need any public incoming connections.
…and the thing you call the 'primary backup server' somehow does?
-
[12:29:42] <net-cat> Also, all the staff have @furaffinity.net email addresses. Some of us opt to not use it. It is not, as you say, a "paid privilege."
Not related to any of this hosting business but this is fucking bullshit. I highly doubt any of them have @furaffinity.net e-mail addresses, considering how much they run through staff members, it'd be a "waste" to them. Plus I don't think any of the admins had ever listed their so-called @furaffinity.net address on their profile at ALL.
Though, if what he says he's true, the people that "opt out" of using a server side e-mail address are fucking idiots. "Oh, a more secure server side e-mail service that can be shut down easily if anyone were to tamper with it? Fff, fuck that, let me use my highly insecure Yahoo e-mail address for my administrative accounts, because no one on the internet could possibly know my birthday/real name/zip code and the name of my pets/the town I was born in!!! Besides, gotta show off my bejeweled highscore. HEH."
-
Not related to any of this hosting business but this is fucking bullshit. I highly doubt any of them have @furaffinity.net e-mail addresses
Well, hey, look, their mailserver lets me interrogate who has an account there!
vrfy sdfsdf@furaffinity.net
550 5.1.1 <sdfsdf@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
vrfy root@furaffinity.net
252 2.0.0 root@furaffinity.net
vrfy dragoneer@furaffinity.net
252 2.0.0 dragoneer@furaffinity.net
vrfy chase@furaffinity.net
252 2.0.0 chase@furaffinity.net
vrfy irreverent@furaffinity.net
252 2.0.0 irreverent@furaffinity.net
vrfy pinkuh@furaffinity.net
252 2.0.0 pinkuh@furaffinity.net
-
Though, if what he says he's true, the people that "opt out" of using a server side e-mail address are fucking idiots.
The person who's letting them "opt out" of using the official email that doesn't have a password reset button is a fucking idiot.
Pinkuh and Dragoneer are the only two I've seen advertise their @furaffinity.net addresses.
Well, hey, look, their mailserver lets me interrogate who has an account there!
vrfy sdfsdf@furaffinity.net
550 5.1.1 <sdfsdf@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
vrfy root@furaffinity.net
252 2.0.0 root@furaffinity.net
vrfy dragoneer@furaffinity.net
252 2.0.0 dragoneer@furaffinity.net
vrfy chase@furaffinity.net
252 2.0.0 chase@furaffinity.net
vrfy irreverent@furaffinity.net
252 2.0.0 irreverent@furaffinity.net
vrfy pinkuh@furaffinity.net
252 2.0.0 pinkuh@furaffinity.net
See how many former staff members still have an account. That should be good. Nevermind!
New admin Summercat is not on there... Damaratus still is though!
-
Well, hey, look, their mailserver lets me interrogate who has an account there!
vrfy sdfsdf@furaffinity.net
550 5.1.1 <sdfsdf@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
vrfy root@furaffinity.net
252 2.0.0 root@furaffinity.net
vrfy dragoneer@furaffinity.net
252 2.0.0 dragoneer@furaffinity.net
vrfy chase@furaffinity.net
252 2.0.0 chase@furaffinity.net
vrfy irreverent@furaffinity.net
252 2.0.0 irreverent@furaffinity.net
vrfy pinkuh@furaffinity.net
252 2.0.0 pinkuh@furaffinity.net
lmfao told ya. So lets see, chase has one and isn't an admin anymore and irreverent has one and may not be staff anymore (doesn't have admin permissions but is still on the staff page?), so that just leaves Pinkuh and Neer, a junk address and the root one.
What a thing to lie about.
The person who's letting them "opt out" of using the official email that doesn't have a password reset button is a fucking idiot.
That too.
-
So lets see, chase has one and isn't an admin anymore and irreverent has one and may not be staff anymore (doesn't have admin permissions but is still on the staff page?), so that just leaves Pinkuh and Neer, a junk address and the root one.
The junk address was rejected, and "root" is a standard account on UNIX systems. The rest were the only ones I tried.
Conan, who did you try out?
-
The junk address was rejected, and "root" is a standard account on UNIX systems. The rest were the only ones I tried.
You know, I wonder if postmaster@ and abuse@ and other addresses work...
vrfy postmaster@furaffinity.net
252 2.0.0 postmaster@furaffinity.net
vrfy abuse@furaffinity.net
252 2.0.0 abuse@furaffinity.net
vrfy info@furaffinity.net
550 5.1.1 <info@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
vrfy support@furaffinity.net
252 2.0.0 support@furaffinity.net
vrfy preyfar@furaffinity.net
252 2.0.0 preyfar@furaffinity.net
vrfy jheryn@furaffinity.net
550 5.1.1 <jheryn@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
vrfy alkora@furaffinity.net
550 5.1.1 <alkora@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
vrfy aerak@furaffinity.net
550 5.1.1 <aerak@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
vrfy vitae@furaffinity.net
550 5.1.1 <vitae@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
vrfy verix@furaffinity.net
550 5.1.1 <verix@furaffinity.net>: Recipient address rejected: User unknown in local recipient table
Hmm. I wonder what sort of a response I'd get if I sent mail to abuse@ and support@, let alone everything else.
-
The junk address was rejected, and "root" is a standard account on UNIX systems. The rest were the only ones I tried.
Conan, who did you try out?
Re: Junk addy. Right, read it wrong, my bad.
Though in all honesty, the folk could be using an alternate name as opposed to their FA signup name.
-
So lets see, chase has one and isn't an admin anymore and irreverent has one and may not be staff anymore (doesn't have admin permissions but is still on the staff page?), so that just leaves Pinkuh and Neer, a junk address and the root one.
The junk address was rejected, and "root" is a standard account on UNIX systems. The rest were the only ones I tried.
Conan, who did you try out?
Some of the ones I tried have now been posted, but I tried Damaratus (account still active) and Summercat (User unknown), then some standards: DMCA (User unknown) and Legal (User unknown).
-
Witchiebunny also advertises having an @furaffinity.net address on her page, in case anyone was wondering.
-
HEAD http://70.33.186.200 --> 302 Moved Temporarily
HEAD http://70.33.186.200/index.php --> 404 Not Found
Now it's just broken, not "looking like it was compromised"! Progress!
-
Somewhat relevant: sometime today they jumped into the code and proceeded to...
... make 75 journals display in your control panel. You know, the ones that usually say "Journal deleted by the poster" because they're spam about streams. Meanwhile Commission Information is still offline and the code probably still has as many holes as it did this time last month. Their ports are wide open and Figment is still running 30 VMs and not the hosting service like it was supposed to.
FURAFFINITY: WE PUT THE NO IN INNOVATION.
-
the code probably still has as many holes as it did this time last month.
Confirming that FA is still completely vulnerable to the same attack that caused FAleaks. It'd be slightly more complicated to pull off, but that's all.
-
Could you guys explain what you're talking about in a slightly less nerdy fashion?
Oh, who am I kidding, I know enough about webmastering to figure it out myself.
-
Could you guys explain what you're talking about in a slightly less nerdy fashion?
Oh, who am I kidding, I know enough about webmastering to figure it out myself.
I just narrow everything down from context to, "here's another area where the coders fucked up" and call it good.
From the sound of things, I can take solace in knowing that I'm only slightly less web coding literate than the people who actually do the coding for FA, though.
-
furaffinity.net. 172800 IN NS ns23.worldnic.com.
furaffinity.net. 172800 IN NS ns24.worldnic.com.
;; Received 119 bytes from 192.43.172.30#53(i.gtld-servers.net) in 298 ms
www.furaffinity.net. 7200 IN A 70.33.186.196
;; Received 53 bytes from 206.188.198.12#53(ns24.worldnic.com) in 173 ms
So, they have their own router and switches, in addition to their colo facility's router and switches. They're even running a couple of BIND nameservers facing the internet (on their mailserver and their ASKCOW PROJECT MANAGEMENT server (both of which are virtual machines (so if their VM box keels over they lose dns (great job!)))).
But they aren't actually running their own DNS! Wow.
-
I updated the article a bit to take the information provided by net-cat and otherwise dug up around here into account.
-
furaffinity.net. 172800 IN NS ns23.worldnic.com.
furaffinity.net. 172800 IN NS ns24.worldnic.com.
;; Received 119 bytes from 192.43.172.30#53(i.gtld-servers.net) in 298 ms
www.furaffinity.net. 7200 IN A 70.33.186.196
;; Received 53 bytes from 206.188.198.12#53(ns24.worldnic.com) in 173 ms
So, they have their own router and switches, in addition to their colo facility's router and switches. They're even running a couple of BIND nameservers facing the internet (on their mailserver and their ASKCOW PROJECT MANAGEMENT server (both of which are virtual machines (so if their VM box keels over they lose dns (great job!)))).
But they aren't actually running their own DNS! Wow.
Some of this I understand, some I don't, but from my point of view it seems really stupid to not be running a physical Dns, and given the resources they do have, less essential services should have been virtualized instead.
-
As I've said many times before, I'm not a network-type, but it seems to me that for what FA supposedly does (web site), virtualization isn't necessary, especially when you have exclusive control over the hardware, and you own it. Of course, as we've seen from the article, apparently several people get to use FA's resources for whatever personal endeavors they see fit, so FA's "purpose" isn't so singular, I guess.
-
$ rpcinfo -p 70.33.186.200
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 52212 status
100024 1 tcp 35550 status
391002 2 tcp 643
Holy shit, SLIGHT IMPROVEMENT! They're still exposing the actual service that has had security problems (http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=portmap&filter_exploit_text=&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=), but now they're not binding as many things to it!
-
As I've said many times before, I'm not a network-type, but it seems to me that for what FA supposedly does (web site), virtualization isn't necessary...
I can understand if they're sticking certain infrastructure services (like mail, DNS, etc.) into their own logical containers, but the application and the database, not to mention other components that may (or, in this case, may not) comprise FA like memcache, MogileFS, et al., really don't make a whole lot of sense when run inside separate logical containers like that.
-
As I've said many times before, I'm not a network-type, but it seems to me that for what FA supposedly does (web site), virtualization isn't necessary...
I can understand if they're sticking certain infrastructure services (like mail, DNS, etc.) into their own logical containers, but the application and the database, not to mention other components that may (or, in this case, may not) comprise FA like memcache, MogileFS, et al., really don't make a whole lot of sense when run inside separate logical containers like that.
Containers, yes. Solaris zones (I think), and Linux has some stuff along these lines. My understanding was this was VMware or some shit, which is a waste of resources, imho.
-
Containers, yes. Solaris zones (I think), and Linux has some stuff along these lines. My understanding was this was VMware or some shit, which is a waste of resources, imho.
Actually, if it were VMware, I'd be pretty happy about it. I deal with a massive VMware ESXi infrastructure at work, and a lot of the measures that it takes to de-duplicate things in RAM is pretty sweet. It makes (sanely) overbooking a node less of a risky proposition.
Also, when I use the word 'container' here, I typically mean 'virtual machine' or 'Solaris Zone' or 'OpenVZ container' or similar. I tend to lump everything together in that respect.
-
That would assume they bought the 'good' licensed VMWare, instead of trying to make due with the shittastic old free version.
-
That would assume they bought the 'good' licensed VMWare, instead of trying to make due with the shittastic old free version.
If memory serves, in order to get the deduplication benefits, you need to purchase ESXi. I don't think any version of Server has it.
Regardless, there were no assumptions: I was making some statements contrary to fact ("If it were...") and marking them off as such by using the subjunctive. Make no mistake: I know that FA isn't competent enough to choose halfway worthwhile pieces of architecture and then, subsequently, maintain them properly. Given their experiences with this kind of thing, even if they were to run ESXi, there's nothing preventing them from letting every single last one of their VMs balloon while also not giving a single fuck about it. "Oh, that VM's running slow? Wait, it's thrashing I/O! Oh, the VM's ballooned... :effort:"
-
I've said it before, but that crowd are not "software" people. They are unlikely to spend money on it (whatever that may mean), and I kind of doubt they have the skills and experience necessary to appreciate quality software if they see it. And that's not even getting into their own remarkable inability to produce it. On the other end of things, it's easy to impress any random doofus by pointing to a blinky, shiny box and saying, "that cost five thousand dollars". So that's what they go for.
All that said, I do think some of VMware's lesser products have deduplication or something similar...I remember reading about something of that nature in Workstation. I am sure it is not as sophisticated.
-
I threw another nmap at them last night. (http://www.vivisector.org/~pi/fa_netblocks_20110123.nmap)
Remember what Yak said on the 19th:
<@Pi> how about you give me access to your fucking router
<@Pi> and i put in a firewall
<@Pi> and then i will shut the fuck up about your production credentials and your fucked template system and your buck-passing fucking shit for at least 24 hours
<yak[away]> we're working on redoing FA's entire networking. what is there now is legacy setup that evolved from a two server network
Basically nothing significant enough has changed for me to have cause to update either my diagram or the table in the article. Maybe I'll strike out some of the ports they did manage to close later, but this is getting dangerously close to giving them a SECOND free security audit from a competent professional in the fieldmaking sean piche look bad on the internet. Because that's the only possible reason I could have to be doing this, right?
-
I don't think you should be giving them any free anything. They haven't seen reason
since the "6 years!" thread over on FAF since the dawn of time, and the situation continues on through those people they appoint for positions of power. I'm sure everyone can name a few! I hate to say it, but if they won't listen, it really seems like the attacks FA suffers aren't just nuisances, they're necessary. Watch FA:U roll around and see these problems continue to stack up. Someone will find the 2% of vulnerabilities and really give FA a whopping what-for, not simply downtime.
-
I don't think you should be giving them any free anything. They haven't seen reason since the "6 years!" thread over on FAF since the dawn of time, and the situation continues on through those people they appoint for positions of power. I'm sure everyone can name a few! I hate to say it, but if they won't listen, it really seems like the attacks FA suffers aren't just nuisances, they're necessary. Watch FA:U roll around and see these problems continue to stack up. Someone will find the 2% of vulnerabilities and really give FA a whopping what-for, not simply downtime.
This is largely why I just don't give a fuck anymore. I have a full-time job and a myriad of side-projects I'm trying to kick into gear, and the least of my worries really should be some furry art site that isn't all that relevant in the grand scheme of things.
-
I don't think you should be giving them any free anything. They haven't seen reason since the "6 years!" thread over on FAF since the dawn of time, and the situation continues on through those people they appoint for positions of power. I'm sure everyone can name a few! I hate to say it, but if they won't listen, it really seems like the attacks FA suffers aren't just nuisances, they're necessary. Watch FA:U roll around and see these problems continue to stack up. Someone will find the 2% of vulnerabilities and really give FA a whopping what-for, not simply downtime.
This is largely why I just don't give a fuck anymore. I have a full-time job and a myriad of side-projects I'm trying to kick into gear, and the least of my worries really should be some furry art site that isn't all that relevant in the grand scheme of things.
That's pretty much where I'm at.
I'm content to sit back and laugh. Getting up-in-arms about anything that happens on FA is a waste of my energy. If I get banned, no biggie. If my account gets hacked and the hacker changes everything on my page to say I LIEK CAWKS, no biggie. If FurAffinity implodes into a metaphorical black hole where a furry porn site used to be, no biggie.
-
I'm content to sit back and laugh. Getting up-in-arms about anything that happens on FA is a waste of my energy. If I get banned, no biggie. If my account gets hacked and the hacker changes everything on my page to say I LIEK CAWKS, no biggie. If FurAffinity implodes into a metaphorical black hole where a furry porn site used to be, no biggie.
Fair enough. I'm turning a lot of this geek rage into some shining examples for fellow geeks about how not to run things, so to that end I'm going to keep digging at FA for a bit longer. And if I get banned, they lose their free code review and security auditor. I think they know that, so I think they won't ban me very hard.
Plus, forcibly educating stupid people is something I do all day every day, so it's hard to get out of the habit.
-
And if I get banned, they lose their free code review and security auditor. I think they know that, so I think they won't ban me very hard.
I just hope something actually comes of it. I can be apathetic towards the whole situation but in the long run I'd actually like to see things get better. Maybe someone that can do something about FA will see, and really move to overhaul the site, or maybe someone that can do something TO FA will see, and as I mentioned already, give them a real what-for. If they're so high and mighty that downtime must be minute, then maybe serious downtime is the antidote. Still, I'd much prefer the lesser of two evils, so to speak, 'cause mass gallery deletion (with no backups!) is bad, even if it is funny.
It's unfortunate, though, that even if the site were to get fixed, the administration won't, and I think just abut everyone is well aware of the need for some sort of power-check for the "~*~staff~*~". I am of the opinion that, as shoddy as FA's code could ever be, bigger problem reside in the politics that surround it all.
tl;dr if it brings positive change I'm all for it
-
mass gallery deletion
You know, it'd be horrible if those SunRPC ports were exposed because the gallery data is mounted over NFS, and they were running some insecure version of Linux-NFS or whatever, that didn't entirely authenticate IP addresses....
or worse yet, they've got something suitably dumb, suitably them, in /etc/exports.
-
or worse yet, they've got something suitably dumb, suitably them, in /etc/exports.
Near as I can tell (showmount -e, showmount -a), their /etc/exports had this in it:
That's right, their NFS was running, lights on with nobody home.
Then they stopped NFS but left portmap open, and now portmap is no longer exposed (but probably still running).
si;gh
-
Also, when did "Commission Information" ( http://www.furaffinity.net/user/info/eaglebird/ ) go to a 404 instead of "Multiple XSS vulnerabilities were detected and confirmed! (we're so awesome for investigating things!)"?
-
Also, when did "Commission Information" ( http://www.furaffinity.net/user/info/eaglebird/ ) go to a 404 instead of "Multiple XSS vulnerabilities were detected and confirmed! (we're so awesome for investigating things!)"?
Since that page isn't mentioned at all in the new UI, I'm under the belief they've given up on it.
-
How amazingly fucked up does that thing have to be that after all this time it's still inoperable? I don't ever remember it being there.
Or maybe Dragoneer is just an undisciplined lazy ass, and has never bothered to care about it.
-
How amazingly fucked up does that thing have to be that after all this time it's still inoperable? I don't ever remember it being there.
Or maybe Dragoneer is just an undisciplined lazy ass, and has never bothered to care about it.
The page was never a top priority of theirs, it's been offline for nearly two years. They pretty much said "it'll be fixed eventually, we're working on it".
-
The page was never a top priority of theirs, it's been offline for nearly two years. They pretty much said "it'll be fixed eventually, we're working on it".
They probably kept trying to fix it but other XSS vulnerabilities kept destroying their work. ::)
-
I didn't look into 70.33.186.216/askcow until recently, but it turns out it has its own domain, askcow.org. It used to run DNS but doesn't seem to be responding to it right now, but what's still running is pretty amusing.
PORT STATE SERVICE VERSION
80/tcp open http nginx 0.8.52
3306/tcp open mysql MySQL 5.1.52-rel12.3-log
8080/tcp open http Apache httpd 2.2.3 ((CentOS))
They're listening on MySQL, even though I've told them, repeatedly, that this is a stupid thing to do. Summercat supposedly relayed this information to Yak, but considering that the former has absolutely no idea what he's talking about, I can't imagine my meaning crossed both the idiot barrier and yak's language barrier intact.
There's an Nginx web server on port 80 and an Apache on port 8080, the latter exposed to the world for no reason I can see. Seeing as both the Apache and the Nginx servers seem to be returning the same content, I'm going to venture (here i go, making almost baseless assumptions) that this configuration is cargo-cult administration - there are few reasons to be doing it this way, and I can't think of any of them that would be relevant for a static site, as this appears to be.
Askcow itself appears to be a "project management" piece of vaporware. The domain's whois record states:
Tech Name:Nicolae Odobescu
Tech Street1:Kiev str. 8
Tech Street2:ap. 8
Tech City:Chisinau
Tech State/Province:Chisinau
Tech Postal Code:MD-2068
Tech Country:MD
Tech Phone:+373.79480290
Tech Email:nick.boo@gmail.com
And there's that Moldova stuff again. This is totally inconclusive though; I host semi-abandoned sites for my buddies all the time. (granted, I don't give them whole IP addresses or leave their database port and backend webserver hanging out in public)
And welp.
-
At this point, I could almost stand to think that I could do a better job of running this shit, and I don't know jack about web servers and stuff like that.
-
PORT STATE SERVICE VERSION
80/tcp open http nginx 0.8.52
3306/tcp open mysql MySQL 5.1.52-rel12.3-log
8080/tcp open http Apache httpd 2.2.3 ((CentOS))
Brilliant! Let's expose the MySQL version to the world as well so we all know what exploits it's vunerable to. Also, I don't think that site is that old since it's running a fairly recent release of Percona Server: Percona Server 5.1.52-12.3 (http://"http://www.mysqlperformanceblog.com/2010/12/13/percona-server-5-1-52-12-3/") (of course this is guessing) - even then, that version of MySQL came out in October so it's been a fairly recent addition.
I think it's entirely plausible that Yak saw us notice another his sketchy Moldovan websites and prevented the site from returning.
-
<Pi> yak, why was the backup server redirecting to new.maximum.md
<Pi> i am still wondering this
<yak[work]> easy. the server was idle, i was demoing a website there that you didn't quite figure out how to get working
<Pi> also why was that so hard to answer
<Pi> "i was using furaffinity's idle boxes for personal shit"
<yak[work]> i didn't feel the need to. no offence but it's none of your business.
<Pi> well, you see, from an infosec standpoint, when unused boxes are redirecting to eastern european domains, that usually indicates something has been compromised
<Pi> in this case, your sense of professional ethics :P
<yak[work]> I agree. And you've brought that up to attention. But you never asked me directly, which I could have easily replied ages ago if you did.
I'm pretty sure I've asked him, repeatedly and directly, about why in fuck this was happening, but I certainly could be wrong.