Team Ghost Shell returns

While doing a bit of reading recently I ran across this interesting story about Teamghostshell an active hacking group that has come back to life on June 29th after a couple of years of silence. The groups recent exploited an extensive list of sites, which they disclosed on pastbin. 

If you read the hacker team's extensively long diatribe you will get an impression that their motives are pure and for the benefits of society, but like all disclosures the only people that suffer are the victims found in the data drop. You can also distill from the dialog that they probably used several COTS exploit kits, and it seems that these involved extensive use of cross site scripting attacks.

What interested me in particular is that in 2012 when the team supposed 'peace treaty' and extensive hiatus they included a data dump of a host that they compromised.  The host information was listed as -

  

Server Type: Apache/2.2.3 (Red Hat)

What is noteworthy to me is that this particular version of Apache had 18 remotely exploitable vulnerabilities and eight of these vulns were cross-site scripting related. Out of these vulnerabilities posted to cve details all  had patches posted to resolved the vulnerabilities.

Fast forward to the most recent exploit, out of the list of sampled files I explored, there was a pattern of similarity  (full disclosure I did not review all the files) but generally it's fair to say that;

• Out of my sampling many of the compromised sites were l running Apache 2.2.3 and older.
• Most likely the attackers where able to use many of the same exploits from their 2012 escapade.
• Servers where generally unpatched and have been easy to exploit.
• Organizations do not have a clear accounting of all the assets they own - per this quote from the hackers log - " The constant expansion of these websites/networks will forever have a lingering aftereffect where some server somewhere will be vulnerable due to it being unpatched etc"

What's the simple takeaway.

• Inventory your assets, know what you own.
• Maintain a current and secure configuration for your servers.
• Patch your systems.. And if you don't know how, find someone who does.