Daniel's Hosting or DH, is one of the largest hosting providers for dark web websites. On November 15, it got hacked and have been taken offline.
The hack, according to Daniel Winzen, the software developer behind the hosting service, was caused by a hacker that got access to the database.
Winzen said that the hacker managed to access the server's root account and deleted all of the accounts contained within it. As a result, over 6,500 dark web websites hosted on the platform are gone.
"As per my analysis it seems someone got access to the database and deleted all accounts." he said
"Unfortunately, all data is lost and per design, there are no backups," adding that "I will bring my hosting back up once the vulnerability has been identified and fixed.
"As of now I haven't been able to do a full analysis of the log files and need to further analyze them, but based on my findings so far I believe that the hacker has only been able to gain administrative database rights. There is no indication of having had full system access and some accounts and files that were not part of the hosting setup were left untouched."
"I might re-enable the service once the vulnerability has been found, but right now I first need to find it," he added.
After analyzing and diagnosing the issue, Winzen identified one flaw: a PHP zero-day vulnerability.
Details about this unpatched vulnerability were known for about a month in the Russian PHP programming communities, but the flaw gained a lot of attention among the wider programming and infosec communities. That happened on November 14, or a day before DH got hacked.
But Winzen said that he doesn't believe that to be the reason for the hacker to hack DH.
"It is a vulnerability reported as a possible point of entry by a user and my setup was, in fact, vulnerable," Winzen said. "However I would deem it as unlikely to have been the actual point of entry as the configuration files with database access details were read-only for the appropriate users and commands run by this vulnerability shouldn't have had the necessary permissions."
Winzen also believed that the hack was possible because the source code of DH was available as an open source on GitHub. As an open community for developers, hackers can dig into the code and get the idea how to attack DH's system.
“The scripts are open source on GitHub and anyone is welcome to take it as a base to build a new hosting service or help find the vulnerability,” Winzen stated.
While the hack caused DH severe damage, its mail and XMPP service, including the static content and the short link service that were hosted on Daniel’s Hosting Raspberry Pi 3, remained unaffected.
DH is only one out of the many dark web hosting providers in the market. Because they deal with websites with copious amount of illegal content, those hosting providers have been frequently targeted by both the authorities and hackers.
DH is said to have hosted everything from malware operation to political blogs, and to also suspects of state-sponsored hackers and others.
It was only after the Anonymous hacker group collectively breached and took down Freedom Hosting II, another popular Dark Web hosting provider, in February 2017, that made Daniel's Hosting the largest hosting provider for dark web websites.
