Cyber Hack or Political Hack?
I’ve been watching this story on Joe Lieberman’s web site being attacked with mixed feelings; while it could be a legitimate attack on Lieberman’s web site, it could just as easily be inflicted by someone supporting Lieberman–perhaps even more likely. To have something like this happen on the eve of an election is always sticky: there is not enough time to confirm what is actually happening, so voters get the impression that they hear the most in the media, without the benefit of evidence to say what is in fact the truth.
It started with Lieberman’s site (www.joe2006.com) going dark, showing only a message saying, “This Account Has Been Suspended: Please contact the billing/support department as soon as possible.”
Immediately the Lieberman campaign released the news about the site being down and claimed the site was hacked. Lamont’s people expressed skepticism, noting that the Lieberman site had crashed before due to excess traffic, and suggesting the possibility that Lieberman’s people forgot to pay their hosting bill–noting that the Lieberman story had a screenshot (“Under Constructiuon”) different than the “Suspended” one that could be viewed publicly. The Lieberman camp then showed an email from their web host saying that it was a denial of service attack and that all bills had been paid in full and in advance (though such an email cannot be relied upon–they’re working for him, and likely would say anything he wanted them to, true or not). Then screenshots started surfacing as if the site were hacked (“Thehacker Ownz you System”),” which flies in the face of the prior claim of a denial-of-service attack–besides which, that sig has appeared on sites for weeks.
Lieberman’s site could have just failed due to too much traffic, and since his site’s been down, the legitimate requests for it have probably surged even more, causing more outages.
But now the Lieberman campaign is accusing “political opponents” for the “cyberattack,” despite lacking any evidence, and is calling for a criminal investigation. Meanwhile, they are using this as a broadsword to attack Lamont:
“We call on Ned Lamont to make an unqualified statement denouncing this kind of dirty campaign trick and to demand whoever is responsible to cease and desist immediately.”
Frankly, I find it impossible to believe that Lamont would have anything to do with this, or have any influence with whomever carried this out; I think it’s certain that the Lieberman people know this full well, and released the statement to trap Lamont. If Lamont calls for the attacker to cease, it will look like the attack came from his “side”; if he calls for it to stop and it does, it will look like he is connected to it; and if he doesn’t call for it to stop, it looks like he condones it.
But there is just as much reason, if not more, to suspect someone affiliated with Lieberman’s campaign. A hack attack like this can only make Lamont look bad, making it an incredibly stupid move if it came from his supporters. Unlike the Republican dirty trick a few years back of jamming Democratic phone lines, this attack is highly visible to the public and is guaranteed to backfire, especially on election day.
The fact that Lieberman’s people jumped on this so quickly and so effectively adds to the suspicion. Besides which, on election day, the web site and email are not as critical at this point; having them crash and being able to attack Lamont for dirty tricks is a thousand times more valuable to Lieberman than having a functioning web site at this point. Not to mention that this has all the hallmarks of a Republican dirty trick, from several possible angles; it matches what has been done in the past in several ways, and Lieberman has strong Republican support.
Other facts cloud the subject: why has the site been down for 24 hours now? A DoS attack shouldn’t do that. The site still is down, and any attempt to go to joe2006.com resolves to http://server1.myhostcamp.com/suspended.page/. Just as suspicious, an attempt to access “myhostcamp.com” brings up a suspended page address which redirects to an address which redirects right back, causing a failure to open the page. A hacker could do that, but only for a very short time indeed. Any web host worth their salt, especially in such a do-or-die situation, would have fixed the issue hours ago, by any variety of means. So why not?
If we look at this from the viewpoint of who has the most to gain, all evidence points to Lieberman’s side as the engineers. But we cannot discount human stupidity, a possible idiotic and unthinking eager-beaver hacker believing he’s doing Lamont a favor.
In the end, it’s not good for Lamont, even though it is all but certain he had no part in this, even despite the fact that odds say it was a reverse-dirty trick by someone on Lieberman’s side.

Highly suspicious of Lieberman…
I will do some research and post back.
joe2006.com
Appears to have been registered with theplanet.com
http://www.theplanet.com/ (info from networksolutions.com WHOIS)
myhostcamp.com
Appears to have been registerd with godaddy.com
to **** ********* (info from networksolutions.com WHOIS)
The method of the attack is not a Denial of Service.
Which gives intermittent service due to an overload of requests.
It is most likely an application redirect, meaning
code or configuratoin as changed on the Lieberman web
server to redirect traffic to the new site.
Another possibility is a change to their firewall
configuration but it looks like a tracert to joe2006.com
resolved to a ip address at theplanet
82.81.3845.static.theplanet.com [69.56.129.130]
It appears requests and traffic are making it to the
original ip address.
ADDITIONAL INFO
myhostcamp.com is registerd to ***** ********* (*****@*********.com) (info from networksolutions.com WHOIS)
IT IS POSSIBLE HE HAD NO KNOWLEDGE THAT TRAFFIC WAS BEING
REDIRECTED TO HIS SITE…
********* has his own site at *********.com
Appears to be an alumnus of Northern Arizona University and
Eta Iota (Sigma Nu) Alumni
http://dana.ucc.nau.edu/~sn-p/alumni.html
Encompass is a creative design firm based in San Diego
that has *a* ***** ********* that appears to be a principal
Network Solutions WHOIS
Lists Registrant as…
***** *********
** *** ***** ****
San Diego, California 92112
United States
Photo of *A* ***** ********* on Flickr
http://www.flickr.com/photos/kritikal/***********/
JUST TO BE CLEAR – IT IS TECHNICALLY POSSIBLE HE *****
********* NO KNOWLEDGE THAT TRAFFIC IS BEING REDIRECTED
TO HIS SITE…
Could you be a bit more concise and a bit less technical? Are you saying that Lieberman’s site is not hosted at MyHostCamp? Or something else?