Due to be launched on the 5th of May and the first of it’s kind in the world, Dell Swarm by Intel and Dell is an online ordering portal targeted at students and value hunters alike. So it works like a mass order system we usually see taking “lobangs”, only that this time, you are dealing the lobang directly with the supplier. You start by picking the laptop you would like to purchase, which is the “Buy” part, so you are the first buyer to join a Swarm and you’ll enjoy a price lower than dell.com.sg’s best discounted price (after cash rebates). So say your starting price is $899 SGD. You enter and the price drops so $854 SGD.

Dell swarm 2009 site main page

The swarm page

Keep in touch with social networking or SMS

Here comes the good part, for every member you comes in and joins your “swarm” you will get a lower price for every member which comes in, so say after 8 members joined your swarm, the prices drops to $809 SGD. To reach the maximum discount, you can grow the Swarm by Sharing with your friends through social networking sites and functions, such as facbook, tweeter, etc.

When you’re ready to join the Swarm, click on the Buy button, register and the website will contact you once the Swarm ends and the price is finalised. This happens once the limit of 15 buyers or 72 hours is reached.

For users not ready to buy yet. You won’t be left out either with a range of monitoring services available, you can also choose to follow your choosen Swarm through updates via email and SMS.

To test drive the site, visit http://dellswarm.com/sg/ and log in with the following information (Prices shown in beta site are placeholders only.)

Read more about the new spanking new website on the click:

Am updating all scripts on my servers as I type along in this blog post, there is quite much updating to go, I guess I just sneak an update here. After much investigation of the previous hacking attempt in my last blog post, it seems that the DoS problem narrows down to a vulnerability in the roundcube webmail program, so if you have that running on versions before 0.2.1, please do an update.

In layman’s terms, what the hackers did is to exploit a code injection vulnerability in Roundcube towards Apache which causes it to eat up so much resources that it forces Apache run a safety shutdown to terminate the script, thus explaining those sudden SIGTERM disabling all your server’s webservice. But once that happens, it will unable to start itself up again as a Apache is “still” running the service and using the ports, thus resulting in a denial of service.

I’ve updated all my servers and did a full rootkit scan, currently all is running fine and A-OK. (Keeps fingers crossed). Oh yes, do note that roundcube-0.2 requires PHP 5 to run.

I guess, the cool thing about being your system administrator is that you get you get to learn all kinds of shit which comes thrown at your server.

Mmm don’t know should I try to install PHP 6 on my development server, I am sooo liking their new date functions.

Sorry for the 1 hour downtime last night from 12:30am to about 1:30am (Singapore time). The site is up and functional now. I jumped when I got a downtime message from my servers, strange, the server can be reached and pinged, so not a hardware or network problem, but my website cannot be reached. A short search later led me to finding Apache stopped and unable to restart automatically. After viewing my logs, it seems that my server was issued a SIGTERM to terminate Apache, possibility hacked with a Trojan:

A snippet of the logs:

This is like 1 of the 10 trys this hacker from Germany tried to spam my servers with. These bastards seem to trick the server to killing my processes and downloading a Trojan called Kaiten. But based on what I see in the logs, they are unable to run it. Think setting all downloaded files unable to execute in the temp folder was a good choice.

So it’s very much a DDoS attack. It managed to get a service to run under the “apache” username which blocked the ports required by Apache itself. I managed to find the pesky process blocking port 80, killed it, restarted Apache successfully and changed all my passwords. I am puzzled if the file was not run, then how the file managed to kill Apache in the first place.

So if you try to run Apache, you get an error with this message:

for a quick fix to the solution, what you can do is to find the pesky service running by entering the following command as root

The next thing is to do a complete scan of your server for any residual files lurking. Who knows what could be installed with the Trojan, I will be damned how they got in the first place. Now I have to consider whether to reload all my backups and do a fresh install of the OS on the infected servers.

Mmmm, I guess say the wise saying goes “No server is unhackable”, but I think with every such incident, you just get stronger every time you combat them.

Update: Updated post and removed the hacker’s IP to prevent it from getting indexed here.