<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>The Dark Visitor &#187; defaced</title>
	<atom:link href="http://www.thedarkvisitor.com/tag/defaced/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.thedarkvisitor.com</link>
	<description></description>
	<lastBuildDate>Wed, 08 Jun 2011 03:15:53 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Sunwear hacks metasploit.com?</title>
		<link>http://www.thedarkvisitor.com/2008/06/sunwear-hacks-metasploitcom/</link>
		<comments>http://www.thedarkvisitor.com/2008/06/sunwear-hacks-metasploitcom/#comments</comments>
		<pubDate>Mon, 02 Jun 2008 18:07:12 +0000</pubDate>
		<dc:creator>jumper</dc:creator>
				<category><![CDATA[Hacker Hunting]]></category>
		<category><![CDATA[US attacks]]></category>
		<category><![CDATA[defaced]]></category>
		<category><![CDATA[metasploit]]></category>
		<category><![CDATA[Sunwear]]></category>

		<guid isPermaLink="false">http://www.thedarkvisitor.com/?p=594</guid>
		<description><![CDATA[Heike and I have reported on the well-known Chinese hacker sunwear several times: People&#8217;s Armed Police Officer Hacking? Sunwear Picture Proclaimed a Joke Chinese Hacker&#8230;repeat offender! Top Chinese Veteran Hackers A forum posting on eviloctal from sunwear shows a screenshot of a hacked metasploit.com with his mark:  &#8220;hacked by sunwear ! just for fun&#8221;.  Here is [...]]]></description>
			<content:encoded><![CDATA[<p>Heike and I have reported on the well-known Chinese hacker sunwear several times:</p>
<p><a href="http://www.thedarkvisitor.com/?p=125">People&#8217;s Armed Police Officer Hacking?</a></p>
<p><a href="http://www.thedarkvisitor.com/2007/12/sunwear-picture-claimed-a-joke/">Sunwear Picture Proclaimed a Joke</a></p>
<p><a href="http://www.thedarkvisitor.com/2008/05/chinese-hackerrepeat-offender/">Chinese Hacker&#8230;repeat offender!</a></p>
<p><a href="http://www.thedarkvisitor.com/2008/05/top-chinese-veteran-hackers/">Top Chinese Veteran Hackers</a></p>
<p><a href="http://www.thedarkvisitor.com/wp-content/uploads/2008/06/metasploit_evil_octal_sunwear_hack.jpg"><img class="alignnone size-medium wp-image-595" title="metasploit_evil_octal_sunwear_hack" src="http://www.thedarkvisitor.com/wp-content/uploads/2008/06/metasploit_evil_octal_sunwear_hack-300x223.jpg" alt="sunwear vs. metasploit.com" width="300" height="223" /></a></p>
<p>A forum posting on eviloctal from sunwear shows a screenshot of a hacked metasploit.com with his mark:  &#8220;hacked by sunwear ! just for fun&#8221;.  Here is a link to the <a href="http://forum.eviloctal.com/redirect.php?tid=33254&amp;goto=lastpost#lastpost">eviloctal.com</a> forum posting.  Thanks to <a href="http://sunbeltblog.blogspot.com/2008/06/metasploit-hacked.html">sunbelt for the news</a>.  <strong>No way to tell if it was a hoax or real just yet.</strong> The metasploit site seems to be normal at the time of this writing.  The forum post was made by sunwear on June 3.</p>
<p><strong>Update (June 3 2003hrs GMT):</strong><span style="text-decoration: line-through;"> One reader commented that the site was indeed hacked and that he was redirected to the evil octal forums.</span></p>
<p><strong>Update from HD at Metasploit:</strong> The issue was that someone hacked a machine on the same subnet and was ARP spoofing the gateway. The metasploit.com machines were not compromised, but all HTTP requests coming into the ISP network were passed through a MITM defacer that inserted that HTML. Once I as able to set a static ARP entry and notify the ISP, the problem was resolved. So, to make things clear, the metasploit.com servers were not hacked, the ISP’s network was.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.thedarkvisitor.com/2008/06/sunwear-hacks-metasploitcom/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
	</channel>
</rss>

