Vandals burn out defacement-tracking site

In an interview with CNET News.com, founder Stefan Wagner said that dealing with system administrators who blamed Alldas.de for their defaced sites and denial-of-service attacks launched by the petty online criminals made the labor of love quickly lose its blush.

"All this combined with seeing my social life flow away can be pretty frustrating," he said.

The announcement that the founder of the last major defacement mirror, as such sites are known, will retire because of "total burnout and frustration" raises the specter that the annual increases in online vandalism may lead to the demise of those groups that chronicled the phenomenon.

Though Alldas.de has temporarily shut down, it will publish again from the first week of March after a move to the domain name Alldas.org. The site will be run by two other staff members and, Wagner hopes, many more volunteers.

"Since running a mirror is more than a full-time job, I hope they get some good support soon," he said. "Losing the last and most comprehensive defacement mirror on the Net would be a big loss."

Such services, in addition to providing archived copies of defaced Web sites, calculate statistics regarding the frequency of defacements based on, for example, geographic region and operating system of the victims. In the security world, where data are notably scare, such statistics help to define the scope of the problem.

In May, defacement recorder Attrition.org stopped actively logging sites that had been hit by digital graffiti; it had been in operation for nearly three years. In January, another large defacement mirror, Safemode.org, closed its virtual doors as well.

In 1998, Alldas.de began searching the Internet for the latest defaced pages and archived them for posterity. Now the online vandals go direct, sending e-mail to mirror sites immediately after defacing their victims, claiming responsibility.

Shoot the messenger
Such immediacy often caused problems with the people responsible for the computer systems that got defaced. Occasionally, administrators would blame Alldas.de, Attrition.org and Safemode.org for the actual defacements.

"Seeing administrators ignore or not being able to understand our statistics and the other information we provide that could have helped them in the past or future is a sad story in and of itself," Wagner said. "It's simply boring to tell them, 'No, we didn't attack your system nor any of the other nearly 30,000 systems we archived in the past four years' for the hundredth time."

Brian Martin, a staff member for Attrition.org, agreed.

"Since we would notify admins of the defacement, we would have to deal with their mail," he said. "Add all that up and it's quite a bit of hassle, and that's on top of 100 or so valid defacements every day."

Among the savages
And dealing with the petty criminals who defaced sites wasn't much fun either, Martin said. Occasionally, vandals upset at their treatment on the mirror's pages would level a denial-of-service attack against the site, trying to take it down in a flood of data.

"There were at least a couple that put us offline for several days because the ISP (Internet service provider) would unplug us," Martin said.

The mirror sites' staff would have to sort through the e-mail reporting defacements because nearly a third ended up being false reports.

Some indicators point to a slowing in defaced Web sites following the closure of each mirror.

In May 2001, the month Attrition.org closed, defacements were at a high of nearly 3,400 sites, according to stats published by Alldas.de. In the following months, that number dropped. Now, the monthly number of sites hit by online vandals hovers around half that amount.

Yet Martin doesn't think the slowdown in online defacements will last. Instead, he argues, more defacements will get missed.

"When Attrition.org was down, we still saw defacements," Martin said.

Wagner agreed that a slowdown in activity is unlikely.

"As far I know, none of the defacers really cares about the mirrors; they do it to feed their own ego (and) to show off to their friends," he said.