Popular Hackforums Website Defaced by Egyptian Hacker

[Petrovic]

Content source

http://thehackernews.com/2014/08/popular-hackforums-website-defaced-by_27.html

Hackforums - one of the popular hacking forum in the world - has been hacked and defaced by the famous Egyptian hacker with the online handle Eg-R1z.

HackForums is popular among both whitehats and blackhats. On one end of the spectrum, HackForums helps over 110,000 hacking community members to remove dangerous malware off of their computers, as well as promotes research and learning of various malwares.

But on the other end, it servers as a great platform for hackers and cyber thieves as well, who posts infected material in order to victimize others. The website is hosted in Europe on a server and expected to be earning an estimated $7,316 USD on a daily basis.
Last night, hackforums.net went dark with a defacement message that reads:

"[403 Forbidden Error] - You might be blocked by your IP, Country, or ISP."
That's really nasty msg guys , don't u think so?!
Just sending greets from Egypt
i-Hmx , H3ll C0D3 , Egyptian.H4x0rZ
./Eg-R1z Cr3w

It is still unclear, how hacker managed to get into server and which type of vulnerability or weakness has been exploited. But, it seems that the hacker just exploited some flaw and defaced the website and then hosted the image on hacked server which was displayed on the defaced page.
Reason behind the defacement of the website is still unknown, but with the deface message, one can predict that the hacker is warning the HackForums admin about security.
The forum was unavailable for few hours last night, but at the time of writing, the site was back to its normal form, but site performance is still facing some issues. You can check the defacement mirror of the hack at Zone-h as a Proof of Hack.

It’s not first time HackForums website got hacked. In past, HackForums website was also hacked by various hackers with online handles imLulzPirate, b0x, SYRIAN-HACKER and KTN.

 

[AtiTude]

Thanks for the report Petrovic. Interesting but, not sensational news so might not get media coverage in USA. Only communities such as this would notice and most people would not even care. I agree with your assessment that it was a 'friendly' warning to the forum. Also quite ironic in that it was HackForums that was hacked.

 

[SkyboundSteven]

HackForums was an 455h0l3 for blocking all IPs not from European countries.

When I go there, I get CAPTCHA, then "403 FORBIDDEN - YOU ARE NOT ALLOWED TO ENTER THIS PAGE." pops up.

 

[Smart3go]

Seriously guys what is friendly about this?
Obviously HackForums banned Egyptian IP's from accessing the foums and gave the Egyptian hackers this message:
"[403 Forbidden Error] - You might be blocked by your IP, Country, or ISP."

So the Egyptian hackers replied by the "friendly" defacing: "That's really nasty msg ..." and sent them greets Egypt!

The question is what made HackForums ban whole of Egypt and force true hackers of Egypt to deface their servers.
It's not what who when or where ... it's why. That's the report. Ask Barry White Petrovic! Thanks for the news though.

 

[Malware1]

HackForums was an 455h0l3 for blocking all IPs not from European countries.

When I go there, I get CAPTCHA, then "403 FORBIDDEN - YOU ARE NOT ALLOWED TO ENTER THIS PAGE." pops up.

You must register an account.

 

[SkyboundSteven]

You must register an account.

I cannot even get to the registration page either.

 

[Malware1]

I cannot even get to the registration page either.

Then change your user agent to Google Bot.

 

[MalwareHunter]

That pro hackers.As I heard, they just changed the DNS at the registrar so this:

has been hacked and defaced

isn't really correct.

 

[MalwareHunter]

expected to be earning an estimated $7,316 USD on a daily basis.

How a forum can earn that money daily? I need some $$, please tell me.
(Anyway, I don't think that it's true...)

 

[SkyboundSteven]

Then change your user agent to Google Bot.

It's impossible now; they actually blocked traffic from Tor.

 

[Malware1]

It's impossible now; they actually blocked traffic from Tor.

Not from tor, I'm talking about Google Bot.

 

[SkyboundSteven]

Not from tor, I'm talking about Google Bot.

How do I do that? I was unable to do that.

 

[Malware1]

How do I do that? I was unable to do that.

https://support.google.com/webmasters/answer/1061943