Tech

Popular Dark Web hosting provider got hacked, 6,500 sites down

Hosting provider is still looking for the hacker's point of entry.

Written by Catalin Cimpanu, Contributor Nov. 17, 2018 at 1:39 p.m. PT

Daniel's Hosting, one of the largest providers of Dark Web hosting services, was hacked this week and taken offline, ZDNet has learned from one of our readers.

Special feature

Special report: A winning strategy for cybersecurity (free PDF)

This ebook, based on the latest ZDNet/TechRepublic special feature, offers a detailed look at how to build risk management policies to protect your critical digital assets.

Read now

The hack took place on Thursday, November 15, according to Daniel Winzen, the software developer behind the hosting service.

"As per my analysis it seems someone got access to the database and deleted all accounts," he said in a message posted on the DH portal today.

Winzen said the server's root account was also deleted, and that all 6,500+ Dark Web services hosted on the platform are now gone.

"Unfortunately, all data is lost and per design, there are no backups," Winzen told ZDNet in an email today. "I will bring my hosting back up once the vulnerability has been identified and fixed."

"As of now I haven't been able to do a full analysis of the log files and need to further analyze them, but based on my findings so far I believe that the hacker has only been able to gain administrative database rights. There is no indication of having had full system access and some accounts and files that were not part of the hosting setup were left untouched," Winzen told us.

"I might re-enable the service once the vulnerability has been found, but right now I first need to find it," he added.

And for the past two days, Winzen has been doing just that, looking at possible vulnerabilities that the hacker might have exploited to gain access to his server.

Currently, he identified one flaw, a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month in Russian PHP programming circles, but the flaw gained a lot of attention among the wider programming and infosec communities, on November 14, a day before the hack.

But Winzen told ZDNet that he doesn't believe this to be the hacker's actual point of entry.

"It is a vulnerability reported as a possible point of entry by a user and my setup was, in fact, vulnerable," he told us. "However I would deem it as unlikely to have been the actual point of entry as the configuration files with database access details were read-only for the appropriate users and commands run by this vulnerability shouldn't have had the necessary permissions."

Until then, Winzen promised more updates on the DH portal as his investigation continues. The German developer also told ZDNet that the hack might also be "an opportunity to improve some bad design choices of the past and start with an all new and improved setup, which I expect to be able to provide in December."

After the Anonymous hacker collective breached and took down Freedom Hosting II, another popular Dark Web hosting provider, in February 2017, Daniel's Hosting became the largest hosting provider for Dark Web services.

The service has been used to host everything from malware operations to political blogs, and the list of suspects who might have been interested in hacking DH ranges accordingly, from rival cybercrime gangs to nation-state hackers looking to track down dissidents and political activists.

The hack might have also been facilitated by the fact that the DH service's source code has always been open-sourced on GitHub and might have provided attackers with a more broad look into the service's inner guts.