Computerworld
'Hackers' deface UN site
Some sections still offline hours after Turkish trio uses SQL injection attack
Gregg Keizer  14 August, 2007 08:36

"Hackers" defaced the United Nations Web site early Sunday with messages accusing the U.S. and Israel of killing children. As of late afternoon, some sections, including the area devoted to Secretary General Ban Ki-Moon, remained offline.

The attack, spelled out by an Italian software developer on his blog and later reported by the BBC, replaced blurbs of recent speeches by Ban with the following text, which was attributed to a trio of would-be hackers:

HACKED BY KEREM125 M0STED AND GSY
THAT IS CYBERPROTEST HEY A¯SRAIL AND USA
DONT KILL CHILDREN AND OTHER PEOPLE
PEACE FOR EVER
NO WAR

The section of the U.N.'s site dedicated to Ban was still offline as of 5 p.m. Eastern time Sunday. It sported a message reading: "This site will be temporarily unavailable due to scheduled maintenance."

Giorgio Maone, a software developer from Palermo, Italy, noted the incident timeline and posted several screenshots of the defacement on his blog. Maone pegged the attack as a SQL injection exploit, which let the attackers add their own HTML code to the site. SQL injection attacks are a common tactic by defacers and have been used against numerous government and commercial sites worldwide. In June, Microsoft Corp.'s U.K. Web site was defaced by a SQL injection.

"There's a technical reason for the missing apostrophe [in DON'T], though, because messing with this very character (') is part of the technique apparently used by the attackers," said Maone in his blog post Sunday. "The [U.N.'s] site is vulnerable to [a SQL injection] attack... this is a very well known kind of vulnerability, fairly easy to avoid and very surprising to find in such a high-profile site.

"Moreover, the hole seems not to be patched yet, thus the site could be defaced again at will," Maone added.

In the past, "Kerem125," "m0sted" and "gsy," are names that have been used by would-be hackers claiming to be from Turkey, said the BBC. An Australian insurance company, for example, had its site defaced in late July by a group that included kerem125.

The U.N. could not be reached Sunday for comment.

While defacing Web sites is common, large-scale attacks have been rare. Last year, however, nearly 1,000 Danish sites were defaced by Islamic attackers who protested controversial cartoons that featured the Prophet Mohammed. And in 2001, a month-long defacement dustup raged between Chinese and U.S. entities after a U.S. spy plane was forced down by Chinese fighters.

Comments

Post new comment

Login or register to link comments to your user profile, or you may also post a comment without being logged in.
The content of this field is kept private and will not be shown publicly.
Enter the fully qualified URL, eg. http://www.example.com/
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

Zones
Zone logoZones provide focussed content from Computerworld and leading technology partners.
Newsletter Subscription
Newsletter Subscription
Sign up for our Computerworld newsletters!
Syndicate content
 

Computerworld Webinar

Thursday, June 11th, 2009
10:30am EST (Sydney, Australia)
Screening at your PC

Computerworld is hosting a 30 minute live webinar to help you to learn how unified communications can save you money, foster innovation and business agility by making it easier for people to find, reach and collaborate with one another.

Register Now

Computerworld Community Comments
Whitepaper

Data Centre Assessments: The First Step to Optimisation

A well-designed and executed assessment supports the ability to respond to a change in the business environment. Help make good management decisions by knowing what you have, what it can and can't do, and where investment gives the greatest returns. Read on.

Enterprise IT Buyer's Guide
Find Technology Vendors Fast
 
Find vendors by name | Find by category
Sponsored Links
 
Send Us E-mail | Privacy Policy
Features List | Media Kit | Advertising | Contact Us

Copyright 2009 IDG Communications. ABN 14 001 592 650. All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.