A few days ago I got a tweet that my personal blog was hacked. I checked it out and found an animated Turkish flag and some text where my blog used to be. My hosting company had already noticed what had happened and only minutes later everything was back to normal again.
The WordPress install that I used on my personal blog turned out to be old and vulnerable. The hacker had managed to replace my private emailaddress with a temporary hotmail address and used that to gain access and replace my index.php file.
At first I shrugged it off and was ready to forget about the whole thing but then I decided to email the hacker and ask for an interview. I was wondering why he picked my blog, what his goals were and why he used that turkish text and flag.
I didn’t expect any answer but within a few hours the hacker replied and agreed to an interview via MSN.
Here it is, verbatim:
Hey!
Hi
Sorry, was busy for a moment there. So how are you today?
Fine and youy?
Very good. Can U ask you a few questions about hacking my blog? Will use it for a blogpost on TheNextWeb.com
Yes you can
Cool. First: how did you do it?
Well, I used a vulnerability to bypass the admin account.
A vulnerability in an old version of PHPMyAdmin, right?
No in the wordpress itself.
Really? Cool. And that allowed you to reset the master emailaddress?
Yes, exactly.
So how did you find out my blog was vulnerable and why did you pick my blog?
Well, I just searched with google some blogs and I found yours.
You searched for blogs running older versions of WordPress? There must me millions of those right?
Yes, but they are not all vulnerable and I didn’t hacked just your website.
Ah, so how many websites do you hack a week and how many have you hacked in total?
Well, in total I don’t know but in a week if I have time I can hack a maximum of 50 thousand website, it depends if I found a vulnerability or not.
50,000 websites??? Amazing! So why do you do it?
Well, we are a hacking team so we do this to protest against somethings, for example the last month I think there was a genocide agains the Uygurs in the west of China and we just hacked around one thousand websites of the chinesse government.
Our web page is: www.ayyildiz.org
On my website you replaced my blog with a Turkish text (which i couldn’t read) and an animated GIF of the turkish flag, right? What was that for?
Well, it was a power demonstration operation against our ennemies so that’s it.
Enemies? Who are your enemies then? Are they Turkish?
Well, we have a lot of ennemies, our bigest ennemies are Russian hackers and Brazilian hackers.
How much traffic or attention does it get you to hack blogs? I mean, it seems not so effective to go through all the trouble of hacking blog and then displaying a message that only Turkish people can read, right?
Yes, of course your right, but it was because of a power demonstration, we hacked the United Union this year and there was a message to them, if you want you can search about it, I saw it in the European press.
Okay, that sounds like you could learn a lesson in marketing if you ask me. If I would hack 50,000 blogs a week I would make sure to have a multi-language message there, a link to my website and a cool design. Next question: do you know how long blogs stay hacked on average? My host restored my blog within the hour and I’m wondering how long it generally takes before blogs get restored?
Well, it depends, in general it takes 2 or 3 days.
Do you have a link to a blog you hacked this week that hasn’t been restored yet?
Wait a moment I will look.
There is one I think: http://www.serviaduanas.com/
Are you ever ashamed or burdened for causing so many people so much trouble? I’m sure you really ruin some peoples day, or even week, with this. Doesn’t it ever bother you?
Well :D, actually if I don’t hack those websites some other people will find the vulnerability and hack it so I don’t think about it. But yes I know it ruins some peoples day because I had also I website hacked.
That really isn’t a good excuse right? You can always make the personal choice not to do it. Just because some people steal doesn’t mean you have to do it too? But okay, next question: how old are you?
I’m 17 years old.
What are your plans for the future?
Well, I’m a student and I’m in the economie section of my school, in the future I would like to be a broker or something like that but I won’t stop hacking because it’s just like a game for me.
A game that could get you jailed and annoys a lot of people? Next question: You mentioned that you were surprised that I contacted you. Why? How many people contact you when their blogs get hacked?
Well, generally if somebody contacts me he or she just insults me and his or her situation becames more bad. So yes I was surprised to be contacted for a short interview.
I see, and if they insult you you take that as an invitation to hack them again?
There’s an article about the UN but it’s Turkish: http://www.haberturk.com/haber.asp?id=161133&cat=180&dt=2009/07/27
Well, yes and sometimes I just bomb their e-mail account so that they can’t use it more.
You sounds like a skilled hacker. Don’t you think you could use those skills for more interesting stuff? Like starting a company online or working as a developer?
Yes, of course I think I can start a company but for starting a company we need time and that’s the biggest problem, as I’m a student I have to study.
But you do find the time to hack 50,000 websites a week? :-) So, thank you for your time. Is there anything you would like to tell me or our readers?
Well, I thank you too for spending your time and no I don’t want to say something special to your readers.
Well, I do have one last request: please don’t hack me anymore…
Okey :)















Really interesting…
What an interesting idea, to interview the person (guy? girl?) who hacked your account and great that they were open to answering your questions. It’s hard to believe they hacked 50,000 accounts unless the process was somewhat automated. I imagine the person will continue until they realize that there are ways they can use their talent to earn money. I hope they find a constructive use for their skill & not enter the world of phishing & spamming.
Gnif, dat is dan wel weer stoer. Laat wel weer zien dat de hacker geen hardcore evil person is. Gewoon iemand met een boodschap die hij op wat voor manier dan ook laat zien.
he has some mental problems
Nothing earth shattering.Though the reasons why mirror the same as others. If he only realized at 17 how much potential he has to a) do something worthwhile with his abilities and b) make money. Nevertheless, great insight.
sue the bastard! this is not a cute 17 year old boy but a criminal and a member of a criminal organisation. don’t let his apperent innocence fool you.
Really interesting actually. Great that you talked to him, seem like a nice guy, with potential :)
if a 17 year old can do it for fun, he can do a lot as a professional .
really interesting… shows just how clever these kids are doesn’t it? Shame their potential can’t be harvested. They could be brought in to advise government in the UK who simply haven’t got a clue. They wouldn’t know what a wordpress blog even is. The kids just do IT. The politicians bury their heads in the sand and hope IT goes away.
Very interesting! A 17 year old that probably could be making big money with websites…sounds like smart guy tho!
It’s not a surprise, WordPress is the most used blog engine on the planet, most of the users are non techie and don’t apply security updates when they come out.
Even technies don’t do them often…
Hope his mother steps in soon and gets him to clean up his mess!
Well, you don’t have to be very skilled to do this. A lot of these wordpress blogs are (_very_) outdated, and have a lot of publicly known security vulnerabilities. This is just digital vandalism and has very little to do with hacking.
A few notes for the more technically minded:
Contrary to his statements, the logs seem to indicate that he used the PhpMyAdmin installation to gain access to the database. He replaced the email address of the only account in the wp_users table and had a new password sent to his address.
After logging in, he uploaded a php script, which in turn was used to make changes to the index.php of both websites under the account. The php file was removed after the hacker was done, so the contents will remain a secret.
It isn’t as worse as robbing people ore beating some one. So in that way you can do a lot worse.
“Just because some people steal doesn’t mean you have to do it too? But okay, next question…”
I find these smug, rhetorical asides really irritating. He’s seventeen, not seven. He obviously isn’t hacking sites purely out of peer pressure, and if you sincerely wanted to understand his motivations, you wouldn’t talk to him as if you had already decided that they couldn’t possibly be valid.
booring. :D
Stefan is right, it doesn’t take a lot of skill to abuse known vulnerabilities in outdated software installations. Also, if he only ‘thinks’ there was a genocide, I think he’d better spend time on checking his facts and/or studying rather than ‘hacking’.
Some one needs to cut off his hands.
If i ever meet a hacker in the real world, I will beat the living shit out of him, breaking bones in his face with a cement curb between his teeth and my foot stomping on the back of his head. The I’ll cut off his hands. Carve “Hacker” into his forehead. Then send him home to his “team”.
he sounds like a skiddy.
It’s the hacker who finds out about these holes. A white hat hacker warns the developer and a black hat hacker uses it for his own gain. There is more then this…
This is probably just a script kiddy wandering on public sites like milw0rm.
Come on Boris you can do better like this! There are more worlds above and under the ground then this thing called marketing.
Shame on you Boris running old unsecure versions. You of all people should know this is important. I wonder how this site is doing in the security department. I might check it out so hurry!
btw. This is not a criminal. This is a kid!
At least he could have put some affiliate links in there to get people to click and get some $$$ out of it :-P
This isn’t a hacker at all, it’s just a stupid script kiddie.
Not worth any attention.
NEXT!
I agree with Bram. He is skilled hacker as car thief mechanic is skilled engineer. He runs automated scripts that he found on web. Nah!
I would have expected greater degree of maturity from a 17 year old. His answers felt like something a 13 yr old would say.
great idea to interview this young hacker and really hope he/they will spare you in the future. Unfortunately, short after the last hacking of my wp self-hosted blog, I was forced to host my blog on the free WordPress.com blogging service. I was very tired of restoring my blog after every monthly successful hack of my bog and being paranoid of the daily hacking attempts.
Wp is a great tool, but very insecure even if you are using the last version, especially if you become a target of politically motivated hacking.
for all those who do the domain.com/phpmyadmin etc attempts, create a folder with that name and a autoban honeypot in it.
Dude he sounds WAY cool to me. I like it.
Russs
http://www.be-anonymous.cz.tc
Interesting article, saw it on Digg and decided to check this out. Your blog is very renowned – 6k Alexa rank? Very impressive, kudos to the hacker
Turkish is capitalized, pig. Show some respect.
“But you do find the time to hack 50,000 websites a week?”
that a good one.
I think he got too much time and no life
Awesome interview!! i should appreciate that hacker for his talent. And the words i like most “I can hack a maximum of 50 thousand website”….. Brave guy!!
Again one deep anger i found on the words of the hacker “Well, we are a hacking team so we do this to protest against somethings…”
Interesting… Although he himself was hacked he seems to show no remorse for the problems he is causing others. I can’t help but wonder if this is because of his age, or just a general apathy. Beating the crap out of him might be fun, probably deserved, and even entertaining. Yet I have a feeling that with kids like this it would not resolve the problem. Because they would not associate the beating as a penalty for their actions; it’s almost a diconnect if you will. Rather it would take something personal, such as making them spend time repairing the damage that they have done.
He sounds fucking retarded
Ya man its not hacking, Its just a idiotic script.
I lost everything to a hacker, about $100,000 worth of domains and sites.
You just gave an interview to all hackers. Hack my site and I will get you fame by interviewing you :D
well, i got to say its an interesting interview. i got hacked a year back and found out that my web host provider did not use proper security measures.
The person not only hacked my site (only the index pages of my site and my blog) but also those who had account with the web host provider. after that it took about 2-3 days to get it fixed.
I changed my web host provider after that incident. I sincerely hope that this kid realizes his/her true potential and does something useful with that.
1) Your interview questions are more like statements of your own beliefs than actual questions to the ‘hacker’….
2) You should obscure the URLs he provided. They may contain malware that could infect your readers.
I had the same thing happen to me. My Dutch provider let one client do something and made us all vunerable in one go. I was super angry when it happened and my provider apologized profusely.
http://www.gadgetcastle.com
how INCREDIBLY boring!
He’s not intelligent. He’s just a script kiddie. Nothing more. Nothing less.
Technically a lame script kiddy, personally an a**hole. Don’t waste you time on those poor guys!
Sounds like a script kiddie. All you people saying he has huge talent and can make money are as naive as he is.
Script Kiddie != HackerHacker != CrackerCracker > Script Kiddie..
I think some people have too much time on their hands…
the kid is in learning process..that why he do it over and over again…is it worth to learn something if you don’t apply it? he learn as well as you too about security.
Just a random moronic script kiddie. He isn’t a ‘skilled hacker’. Please don’t stroke the fools ego, he has no idea what real hacking is.
Most of the hacks this group utilizes are automated through bots. I personally know one of their attacks was using something similar to the zeus botnet as it was logging into poorly secured IIS/FTP sites with weak usernames/passwords and inappropriate write permissions; automatically uploading index and other pages and injecting certain file types (.html, .htm, .js, etc) with hacked iframes to propagate the malware and harness more bots. Quite surprising that they actually accepted the interview. There was a server at my work that was getting “hacked” by the same group since 2002. I say “hacked”, because it’s not really hacking, but just writing files to the server due to poor configuration by the admin who essentially gave anyone in the world access to write files.
Hacking peoples bogs is not funny, I just LOST my blog due to a similar “hacker”. I just got done REPOSING all my old posts from a txt file… what a huge pain, lost all my comments and it has destroyed all my darn backlinks! My host can’t be found so I can get my DB… it’s a real pain and when you hack a developers blog doesn’t it ever come into your mind that they too might know how to hack…
Please if your going to hack someones hard work.. at least make a backup for them!
(I lost countless hours of work on my blog)
Having been in the “hacking scene”, I might be able to clear up a few points as to what this kid’s motivation is. Most people believe that hackers are destructive, annoying, and must not feel remorse for what they do. This is not true.
One thing that every hacker can relate to is the hacker’s manifesto: http://www.mithral.com/~beberg/manifesto.html
From the hacker’s point of view, exploiting programs like wordpress is like a puzzle. It’s an intellectual challenge. Finding an exploit is all about learning how something works, and finding a flaw in its design.
The victim says “Why would you do this, you’ve caused nothing but trouble?”
Some hackers do it for the challenge. Some for the feeling of power. Some do it because there is no internet police, the internet is their turf. Some do it to post their alias, like grafiti taggers. Some do it purely for destruction (black hat). Some find the exploit and then notify the site owner (white hat). Some even hack for a political agenda.
The hacking culture is very complex. You can read some basic stuff at http://www.hackthissite.org or http://www.enigmagroup.com. They are legal webpages that teach the skills and culture of hacking.
50,000 websites is most likely an exaggeration, but it is possible using a tool that automatically scans for targets and exploits.
I want get to know you where you also live at okay and what your name is okay do you have any boys in your neighborhood.
From this very short conversation you don’t get the idea that s/he did it for financial reasons, more social ones. It sounds similar to the movements of the late 60′s. Small isolated groups of people fighting for a range of loosely-related causes in an inefficient fashion and with no regard to casualties.
Wow, that was lame, he is just a Script Kid, who doesn’t know anything…
He used a script written by someone else to exploit vulnerability found by some one else…
So in reality he is a bored teen with to much time on his hand..
This was a bad interview… It was quite shallow and boring and the fact that you slip in little comments after your subject answers a question is rather annoying.
I can’t help but feel that you interviewed a new Festiva owner thinking that you were actually interviewing an engineer at Ford Motor Corp.
Sounds like you interviewed a script kiddie pal.
Give me a break. Any reasonably intelligent person can be a hacker if he or she so desires.
There are tons of books and internet sites on the subject. The little jerk is nothing but a vandal. We need to stop glorifying these jerks.
wow just reading it was fun! tweeted it … i positively think that this can turn out into a trend… interviewing ppl who hack ur account!
At the risk of sounding like a complete, ass; this kid isn’t a hacker. The term has been portrayed wrongly by the media for years. At the age of 17 you don’t know enough about machines and networks etc to be a ‘real’ hacker.
At this age this kid is a script kiddie. You find a script, you run it, bang, a website is compromised. It is not very difficult and I’ve been doing it to my own sites for years now.
The ‘real’ hackers would never agree to an interview, or even let anyone know they’ve been there. A ‘real’ hacker would simply gain access to this site and then leave it.
In many cases you find the real hackers to be middle-aged men who really know what they’re doing and they do it for fun. Not for recognition, simply because it’s enjoyable for them. They don’t cause anyone any harm, they just enjoy the challenge.
This is just a kid being a stupid kid.
Sorry for the double comment, but on the website the so called ‘hacker’ linked you to it reads:-
“The Administrators do not use any communication method like; Windows Messenger or Email”
So this kid is essentially going against what his “hacking team” lays out on their website.
Right.
Wrong! Turkish hackers with Russian and Brazilian hackers are companions. Inexperienced a friend.
Turkish bastards hacked my site repeatedly until i upgraded my password to a strong one.
When the hackings stopped i realized i better upgrade my passwords everywhere else – like on e-mail etc.
to mr. smartpants (sry interviewer, this is for the skiddie who “hacked” ur site only)
#1. mr “hacker”, ur an idiot
#2 wut u did isn’t hackin, do 3 searches on google about mysql injections, read 2 tutorials and visit 2 scene websites doesn’t make you a hacker
#3 talkin to the website owner?really?dumbass.. also guess wut buddy.. ur ip’s logged easily in the site’s database. use a VPN next time (google it), not a public proxy.
#4 posting ur site = … are u serious?
#5 learn some real programming, then call urself a hacker.. bet u won’t be defacing websites after that..
#6 50 thousand websites?..with ur skill?really?
for the curious minds, this isn’t a hack. you yourself can learn this in 20-30 minutes, just google “deface site” / “mysql injections”
..he calls himself a hacker..rofl
here’s your “hack” – > http://www.mediafire.com/?cz4lgowzwaw
nice article & Really interesting…
what a stupid kid! i would noy have interviewed him i would have shopped him straight to the police the little douchebag!!
SO he wants to be a broker when he grows up… seems like his ethics will fit right in with that profession.
Sounds like a smug piece of sh*t to me. What an arrogant little vandal.
dude, you need to get some interview skills.
good luck.
crazy … someone can do that?
Why in hell do you give this little scriptkiddy-cunt more publicity?
He’s running publicly available scripts and automating his attacks. He does NOT need any skills or programming competence whatsoever to be able todo this kind of stuff.
Their retarded “turfwar” between hackergroups is just a pathetic excuse for wasting peoples time. If he was sincere about it he would write a script that contacted everyone with vulnerable software and let thme fix it without some little retarded turkish kid prying about.
And yes I know about this stuff, because I was a part of the hacking scene once. These people are loathed there.
hm my site got hacked the other day, I just wonder what the purpose of hacking is?
Really Cool
next time someone raped a woman, it will be useful to know why the rapist raped her. :)
He’s 17 and is misdirected. Someone ought to channel his intellect into something more productive. He could use his “talent” in making legit, genuine money , instead of this illegal activity.
You had commandeered the Q & A , expertly. Giving him some lessons to be learned and your two cents’ worth without antagonizing him, and for that I salute you.
i want an authentic hackers contacts.email me your id to chat with u for deals .
He can’t spell, he makes native speakers’ common grammar mistakes, which means he’s just a kid poser. He should be spending his time improving that and curing his complexes.
Lawl script kiddies. He isn’t a hacker, all he does is use google dorks to find a vulnerable site then use an exploit found by an actual hacker. >_>
That’s not a reason he would get a job as a security expert or programmer. Anyone can do what he did.
this guy is just a skid who takes scripts of of milworm and uses them and calls himself a hack. shit ive done it alot before but now i can actually do shit. that faggot cant hack anyhting that isnt found on milworm/google. dude get real and find a target. how about you get root like me?
http://fusionpasses.com/attachment.php?attachmentid=24&d=1259561047
how about you come yourslef over to a real website where you can learn non skiddish ways. madspot.org | fusionpasses.com
Omegle is really good.Talk and walk like a stranger there.Just check this official Info link.
http://omegle-chatwithstranger.blogspot.com/2009/12/what-is-omegle_16.html
http://www.orkutvsfacebook.blogspot.com/
Orkut VS Facebook :which do you prefer?
Social Networking: Facebook vs. Orkut
Facebook has Ranked number one whereas orkut from google is still far behind.To Know more about facts and reasons,click on Info link.
LOts of tips and tricks which make your social networking more easy than easier.
This was a pretty good read though I would of liked more questions about the organization of the hackers and how they finance themselves. From an SEO perspective it seems like they could make quite a bit of money selling ‘hacked links’ on sites that they have access to. For example the site he mentions that is still hacked (it sill is as of this comment) is a Google Pagerank of 4 and would have a pretty hefty link value on the open market.
I am curious if people are actually doing this out there in the SEO world. Any ideas?
please hack one email password. id r_kumari007@yahoo.com. it so greatfull if u help me . its urgent. thank you
Why do you write such kak stuff that ein truh
dude just get a life ma, that “17 Year old kid” you are taliking about aint real man so go and fuck
Interesting.. glad that he has got time to hunt 50000 sites per week and frank to give you this interview..
Ever heard of a script kiddy? LOL, well that is exactly what this n00blet is. He's a script kiddy you gave attention .. you gave him exactly what he wanted he used a simple exploit public on the net to exploit a weakness in the coding of ur wordpress version ; you most likely were on an outdated version needing the latest updates and patches and didn't have them and in the end got pwned. The end, sql injection, simple, effective, n00b prone, script kiddyish'.———————————-
Really interesting post.. thanks. You make some very valid points and it is clear that most people agree with you!
Thanks for posting the information. The most interesting job in the field of computers is being an Ethical Hacker,
By the way for more information on Professional training and Certification for Ethical hacking check this link: http://www.eccouncil.org/certification/certified_ethical_hacker.aspx
He’s a a novice. And a fag.
if any one is real hacker then hack my blog its challenge for every hacker
http://getachange-klmrajas.blogspot.com
this is my blog …………..
I’m not sure giving exposure to those who destroy someones hard work and effort and think nothing of it is a good idea. In my mind it is morally wrong (the hacking, not the exposure).
What a wonderfull life. I am also turkish. but really I hate persons who hack websites for competition. and I dont believe he 17 years old ?. really NO. Look how can wrote english. Perfect and anyway I will visit them website and will see whats going on there
a i need some help on some free cell phone spy software… anyone can help me out
can anyone help me out ?
+1
God people are stupid sometimes.
Welcome to the internet, welcome to total anonymity. The first rule of total anonymity?
There almost zero accountability for your actions, sue? Sue whom?
What are you going to put on the paperwork under the ‘name’ portion “17 year old kid that hacked me” “startemp123456@hotmail.com?”.
You only talking about suing him coz u don’t know whats it feels like doing that at that age.
Personally, I just feel sorry for him coz he’s going to have his eyes opened when its a little late.
U r American aren’t u ? IS this the ‘American Dream’ Sue and Shoot
Yeah… then not only would he go to jail … you would, too.
And… I’d be one laughing hysterically … AT YOU!
(Hopefully you’d be in the same cell as the hacker.)
It’s unfortunate that you were abused as a child, but there’s no need to take it out on others.
You go keyboard warrior!
Yeah I know, a real, living kid-hacker! And he seems like a fun kid!
He’s 17, not 27. At 17 myself and most of my friends didn’t have a fully developed sense of morality. My guess is he hasn’t really thought out the consequences of his actions in full. I know I didn’t at that age. Then again, the asides most likely won’t help him to do that.
Welcome to the internet, where there isn’t such a thing as “total anonymity”. A proper sysadmin, or even better, a proper hacker (not a script kiddie like this one) would be able to track this kid down.
Stockholm syndrome
http://en.wikipedia.org/wiki/Stockholm_syndrome
HA HA HA, my favorite comment of them all! :-)
And how many blog company’s exactly, actually have the time or money to find a hacker to track the kid down? Not many. Plus I don’t see whats so bad about the fact that he hacked the blog, I mean for one, he just made sure that the blogger and blog company will update their security so there is less of a chance that it will happen again, as next time it might have been a serious internet criminal who will make they’re way into personal details and do worse things.
I don’t get why people say ‘their potential could be used for better things like starting up a company… I would have thought people would realise that a hacker hacks because they don’t want to be stuck in an office having to worry about financial problems etc. They do it for fun or even to get a message across.
This guy doesn’t put people’s or even countries internet defense systems at risk so in my eyes he isn’t the guy everyone should be pissed at.
I agree, I’m all for harvesting kids.
ever heard of Mafiaboy?
Ya, it’s called a script. Which these kids simply find on the web, copy/paste and call themselves hackers… hence Script Kiddies.
Im sorry but this isnt skilled it is a very limited and easy hack. Hardly proves great knowledge!
Reader’s Digest already scored an actual interesting interview with that guy.
The most coolest and inspring blog post i read today.
To the average adult with average computer knowledge and skill, this kid seems like a genius. It is a small percentage of our society, depending on the circles you run in, that can hack anything. That’s why so many people are really impressed with the kid’s ability.
chat
Your point is exact.