Did Techcrunch get Hacked? | Hacker News Reader

Did Techcrunch get Hacked?

technews.techcrunch.com

59 pointslivestyle18 comments

I was doing a search for Reddit's open source version and stumbled upon this article http://techcrunch.com/2008/06/18/introducing-technews-our-own-reddit-clone/ and when I followed the link this Asset Management group website popped up?

Open articleView on HN

The two subdomains (technews and primaries) both have the same IP of 70.32.92.201, a MediaTemple IP. TechCrunch used to host at Media Temple according to DomainTools Hosting History. There is probably an A record in the DNS pointing those subdomains to those specific IPs.

The IPs have just been recycled and are being used by MediaTemple hosting customer.

Probably caused by pointing to an old IP in their DNS, which is now reused for a different site. And because that server doesnt know about that domain, it shows the default vserver: http://70.32.92.201/

Still bad though, since they now have access to the cookies/local-storage of techcrunch.com itself.

I called them, and they had no clue that it exited. I also called their umbrella organization, Resource Horizons Group, and they to had no clue.

But overall they were simply confused as to why I cared to tell them.

"were simply confused as to why I cared to tell them"

So true. They can't even appreciate what is going on here and probably thought you were trying to sell them something.

The truth is that SEO wise the techcrunch site comes up when "blackoak asset management" is the search string. Not blackoakam.com (see contact page).

But someone should sell them some help with getting this straightened out so they don't disappear once TC fixes the DNS.

I had a problems with a hosting provider in the past that lead to something similar happening with one of my websites.

Basically rather than explicitly binding each IP address for their servers to the server's MAC address itself they just allowed IP addresses to be assigned on the servers themselves essentially creating IP address conflicts if the same number was assigned by the administrators of 2 servers on the same LAN.

This first manifested itself when I accidentally assigned the wrong IP address to one of my servers and received angry emails telling me that I had taken someone elses site offline. Obviously I was embarrassed by this , apologized and corrected the address and didn't think much else of it.

Months later , after I had a server go down and rebooted it I found that my website was now pointing to some scam site.

Turns out that someone had got a server on the same LAN (rented or hacked I don't know) and assigned it every possible IP address just waiting for another server to go down so that they could steal the address.

Possibly what happened here?

I had a similar problem when doing support hosting. Static routing wasn't set up on cluster of servers and two ones with almost identical software configurations were colliding. It was particularly nasty because once you had logged in to both, you couldn't really identify which machine you were hitting.

The solution ended up being to drive to the DC, plug a monitor into the machine, and see Windows' "IP Address Conflict" dialog box on the screen >_<.

That's pretty nasty, hence why I always set different wallpapers & motd files on each server I run! :)

My first thought was, it was some kind of joke, trying to take a more original / off-kilter approach to the whole blackout thing.

I mean, "Black Oak" on SOPAs "Black Out" day?

But maybe I'm just giving them too much credit...

Also: Pretty messed up (on TCrunches part) that this Black Oak site would now have access to cookies/LS from techcrunch, as one person points out.

Looks like just a new owner of 70.32.92.201 where they still have some old dns records pointed..and what you see is the default vhost on new owner's site, blackoakam.com. Nothing to see here.

It's available as normal on the main site so I suspect not:

http://techcrunch.com/

This subdomain also has the same content:

http://primaries.techcrunch.com/

http://technews.techcrunch.com/

I'm pretty sure both of these subdomains aren't ever used though.

And that second URL is the first hit if you google for the company name.

http://www.google.co.uk/search?q=black+oak+asset+management

Quite perturbing fact is that only those two techcrunch related domains seems to be pointing on that host : http://www.bing.com/search?q=ip%3A70.32.92.201&go=&q...

...and after the AOL acquisition, nothing of value was lost.

Are they still using these domains? Looks like they just stopped using them but didn't update the DNS records and now someone else has that IP address.

it appears to have been around for 4+ years

http://wayback.archive.org/web/20070915000000*/http://primar...

So the assumption I'm making here is that they set this (sub)domain up and had the IP as their old servers, the servers have changed hands (since they moved to Wordpress vs. self hosted) and the new owner has a wildcard host entry set up.

Did Techcrunch get hacked? Lets hope so.

I took a look at the about page (http://technews.techcrunch.com/about-us/) and figured it must be satire. Then I read the comments here and it seems like these guys are real. But I still think Arrington and McWorther have a striking similarity.

Reply on news.ycombinator.com