Members
  • Total Members: 14176
  • Latest: toxxxa
Stats
  • Total Posts: 42871
  • Total Topics: 16080
  • Online Today: 3894
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)









Author Topic: Department of Homeland Security website hacked!  (Read 5258 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Department of Homeland Security website hacked!
« on: 28. April 2008., 08:59:46 »


The sophisticated mass infection that's injecting attack code into hundreds of thousands of reputable web pages is growing and even infiltrated the website of the Department of Homeland Security.

While so-called SQL injections are nothing new, this latest attack, which we we reported earlier, is notable for its ability to infect huge numbers of pages using only a single string of text. At time of writing, Google searches here, here and here showed almost 520,000 pages containing the infection string, though the exact number changes almost constantly. As the screenshot below shows, even the DHS, which is responsible for protecting US infrastructure against cyber attacks, wasn't immune. Other hacked sites include those belonging to the United Nations and the UK Civil Service.

The attack causes infected sites to redirect visitors to destinations that attempt to install malware on vulnerable machines. At time of writing, the malicious payloads attacked vulnerabilities that already have been patched. And in any case all three of the redirection sites were down, possibly because they were unable to handle the demand. But should the attackers get their hands on a newer exploit - say, one targeting a zero-day vulnerability in QuickTime - it would be relatively easy for them to swap out the payload.

One reason the infection has spread so widely is the attackers have managed to find a single attack string that seems to work on tens of thousands of different sites. Most web applications are custom -built for a particular site, so attackers likewise have to custom design attack parameters to exploit weakness. Not so here.

"These guys look like they've found a methodology to get a successful SQL injection generically across [many] websites," said Jeremiah Grossman, CTO of WhiteHat Security, which helps companies secure web applications. "That right there is like a skeleton key."

The script is also notable for its ability to slip past web application defenses. The SQL query is mostly made up of HEX code, allowing it to obscure itself, at least to apps that use Microsoft SQL. MySQL and PostgreSQL are less easily fooled, according to researcher Ronald van den Heetkamp.

Sites are getting pwned because they fail to sanitize user supplied data. DHS security pros scrubbed the page clean the same day it got infected and took steps to make sure the same attack couldn't succeed against other parts of the DHS website, spokeswoman Amy Kudwa said.

"We're well aware of the fact that intrusions happen all the time and that's why we are doing all that we are to secure the .gov domain," she said.

In a recent interview with The Register, Greg Garcia, the DHS's assistant secretary for cybersecurity and telecommunications said: "our networks really are only as strong as the weakest link and because we are so interconnected, if there are companies that are not doing what they need to do to protect their networks, that in turn may be jeopardizing the security of companies that very well may be doing the right thing." (For the full interview, click here.)

While the number of pages that have been infected is high, not all are able to launch an attack once a user visits them, according to Roger Thompson, chief research officer of anti-virus provider AVG.

"Very often they're on a page but the stuff doesn't actually fire when you get there," he said. "This is not a cunning, premeditated task; it's just a blast. They're just planting the stuff where they can and the result is a lot of pages [that] don't do anything."

But webmasters should not be complacent about removing the injected code from their sites and fixing buggy web apps to make sure more don't spring up.

"It's the cleanup effort that's just going to be monstrous," said Grossman, who said affected companies will have to either remove each overwritten table record one at a time, or revert to a recent backup. "Either way, it's going to take forever."

Security workers better get cracking.

(Copyright by The Register)

Samker's Computer Forum - SCforum.info

Department of Homeland Security website hacked!
« on: 28. April 2008., 08:59:46 »

Berbe

  • SCF Member
  • **
  • Posts: 26
  • KARMA: 1
Re: Department of Homeland Security website hacked!
« Reply #1 on: 07. October 2009., 22:46:27 »
"Homeland Security"... The Web isn't yet a state... That maybe better like that!

Crimzhy

  • SCF Newbie
  • *
  • Posts: 1
  • KARMA: 0
Re: Department of Homeland Security website hacked!
« Reply #2 on: 16. October 2009., 06:40:21 »
This is very terrible incident. They must provide or strengthen there security system to avoid problems in the future.


Fireberg

  • SCF Advanced Member
  • ***
  • Posts: 176
  • KARMA: 22
Re: Department of Homeland Security website hacked!
« Reply #3 on: 16. October 2009., 14:57:55 »
it´s mean thats ther´s no exist safety or security after all!!!

stingrayrush

  • SCF Member
  • **
  • Posts: 15
  • KARMA: 1
Re: Department of Homeland Security website hacked!
« Reply #4 on: 29. October 2009., 16:43:11 »
just goes to show that no matter how smart the government tech guys are, there's always someone smarter on the outside

Samker's Computer Forum - SCforum.info

Re: Department of Homeland Security website hacked!
« Reply #4 on: 29. October 2009., 16:43:11 »

redjge

  • SCF Member
  • **
  • Posts: 30
  • KARMA: 2
Re: Department of Homeland Security website hacked!
« Reply #5 on: 29. October 2009., 19:54:22 »
security is as good only as its creators.

there always someone with a great idea that can find flaws and break security

Samker's Computer Forum - SCforum.info

Re: Department of Homeland Security website hacked!
« Reply #5 on: 29. October 2009., 19:54:22 »

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising