"Hackers" defaced the United Nations Web site early Sunday with messages accusing the U.S. and Israel of killing children. As of late afternoon, some sections, including the area devoted to Secretary General Ban Ki-Moon, remained offline.
The attack, spelled out by an Italian software developer on his blog and later reported by the BBC, replaced blurbs of recent speeches by Ban with the following text, which was attributed to a trio of would-be hackers:
HACKED BY KEREM125 M0STED AND GSY
THAT IS CYBERPROTEST HEY A¯SRAIL AND USA
DONT KILL CHILDREN AND OTHER PEOPLE
PEACE FOR EVER
NO WAR
The section of the U.N.'s site dedicated to Ban was still offline as of 5 p.m. Eastern time Sunday. It sported a message reading: "This site will be temporarily unavailable due to scheduled maintenance."
Giorgio Maone, a software developer from Palermo, Italy, noted the incident timeline and posted several screenshots of the defacement on his blog. Maone pegged the attack as a SQL injection exploit, which let the attackers add their own HTML code to the site. SQL injection attacks are a common tactic by defacers and have been used against numerous government and commercial sites worldwide. In June, Microsoft Corp.'s U.K. Web site was defaced by a SQL injection.
"There's a technical reason for the missing apostrophe [in DON'T], though, because messing with this very character (') is part of the technique apparently used by the attackers," said Maone in his blog post Sunday. "The [U.N.'s] site is vulnerable to [a SQL injection] attack... this is a very well known kind of vulnerability, fairly easy to avoid and very surprising to find in such a high-profile site.
"Moreover, the hole seems not to be patched yet, thus the site could be defaced again at will," Maone added.
In the past, "Kerem125," "m0sted" and "gsy," are names that have been used by would-be hackers claiming to be from Turkey, said the BBC. An Australian insurance company, for example, had its site defaced in late July by a group that included kerem125.
The U.N. could not be reached Sunday for comment.
While defacing Web sites is common, large-scale attacks have been rare. Last year, however, nearly 1,000 Danish sites were defaced by Islamic attackers who protested controversial cartoons that featured the Prophet Mohammed. And in 2001, a month-long defacement dustup raged between Chinese and U.S. entities after a U.S. spy plane was forced down by Chinese fighters.
Read up on the latest ideas and technologies from companies that sell hardware, software and services. Email Archiving Implementation: Five Costly Mistakes to Avoid
Achieving the impossible: Unlimited application scalability
Taking On Demand CRM Integration to the Next Level
Making the Business Case for IT Consolidation
Solve Exchange Mailbox Storage Issues Once and for All
Delivering the Power of Choice with Microsoft Dynamics CRM
Data grids and service-oriented architecture
Business Intelligence and Enterprise Performance Management: Trends for Emerging Businesses
Zones provide focussed content from Computerworld and leading technology partners.Discover how SOA can create smarter outcomes for your business.
Attend and learn:
- How SOA is helping leading companies to become more agile
- Where you should be applying SOA processes in your company
- The top SOA implementation mistakes to avoid
Click here for more information.
- +
Computerworld Live Podcast #97: The Future of Enterprise Networking 25/07/2008 09:45:36
This week CW Live chats with Mark Thompson, global sales and marketing manager for HP ProCurve, on the future of the enterprise networking. Mark discusses the trends we can expect to see in the near future and how the right infrastructure can ensure your enterprise network is secure. - +
Computerworld Live Podcast #96: Security at the Edge 11/06/2008 09:22:22
CW Live speaks with Amol Mitra, HP ProCurve Director of Marketing for Asia Pacific and Japan. Today's topic: how enterprises are starting to shift away from simply controlling security via server logins, firewalls and moving to more adaptive security frameworks. - +
Data Management Edition #10: Multi-Petascale Systems 02/05/2008 09:12:33
This week we look at sustainability and the development of multicore technologies to build multi-petascale systems. - +
IT Security Edition #11: How to poison the Storm botnet 01/05/2008 08:51:55
This week CW Live presents a case study on how to poison the notorious Storm botnet . Plus we take a look at Cisco's plans for Ironport. - +
IT Security Edition #10: Cyber-battles fought and won 24/04/2008 11:09:47
Vendors bow to end user pressure to improve product security, and we take a look at the latest concepts shaping the cyber-battlefield of the future.
AOC Launches 18.5” Widescreen Green 16:9 LCD Monitor in Australia and New Zealand 2008-12-03 15:30:00+11
FrontRange Solutions eases software license management with new License Manager 3.0 2008-12-03 14:56:00+11
Progress Software's Cure for Managing Services-based Applications 2008-12-03 14:42:00+11
S3 Graphics Unleashes Full OpenGL® 3.0 API Support with Beta Driver for Chrome 500 Series GPUs 2008-12-03 14:08:00+11
Informatica Powercenter added to Nec Infoframe Solution Suite 2008-12-03 11:36:00+11
Strategies for Eliminating .PST Files
Join industry expert Martin Tuip to discover best practice strategy for the archival and removal of .PST files using email archiving. Learn how to ensure long-term email records are there when needed, and reduce the risk to your business and clients.












