Hackers deface UN website in protest over US and Israel
By Rene Millman,
The website of the United Nations became the victim of hackers when it was defaced with messages accusing Israel and the US of killing children. The attack led some sections of the site, including part of it devoted to the UN general secretary Ban Ki-Moon, being offline for most of Sunday.
Visitors to the website would have seen speeches by Ban replaced with text posted by the gang of hackers.
According to Giorgio Maone, a software developer from Palermo, Italy, the attack was a result of SQL injection vulnerability on the website. Maone tracked the defacement, which saw the hackers post this political message:
HACKED BY KEREM125 M0STED AND GSY
THAT IS CYBERPROTEST HEY ÃSRAIL AND USA
DONT KILL CHILDREN AND OTHER PEOPLE
PEACE FOR EVER
NO WAR
Maone said the message gave a clue to how the attack was carried out.
"There's a technical reason for the missing apostrophe, though, because messing with this very character is part of the technique apparently used by the attackers," he said.
"The site is vulnerable to an attack called SQL Injection. This is a very well known kind of vulnerability, fairly easy to avoid and very surprising to find in such a high profile website," Maone added.
He said that if only prepared SQL statements were used properly, this embarrassing incident would never have happened. Maone added that prepared statements are available even in the very obsolete ASP "Classic" and ADODB Microsoft set up the UN uses on its website.
The site appears to have been restored following the attack. The hackers also thought to be behind hacking incidents on the websites of Harvard University, the UN environment programme, Toyota and Nestle.
You may also like...
Sponsored Links
advertisement
You may also like...
Latest Security Analysis & Insight
What is your password worth?
Would you be tempted to sell off company passwords for a fee? If not, seems like you're in the minority, acccording to research.
- Macs under attack?
- Intel: security inside
- Are you spending too much on IT security?
- Does the government want to snoop on your data?
- Eurocrats versus the cyber criminals
- The truth about spam
- Google and privacy: What’s the problem?
- Q&A: Symantec’s CISO on the source code hack
- RSA: Back from the breach?
Latest Security Reviews
Check Point 2210 Appliance review
Rating: ![]()
advertisement
Most popular
- Apple iPad 3 vs iPad 2 head-to-head review
- Hutchison denies it will pull plug on Three UK
- EMC World 2012: Tucci declares Documentum is here to stay
- ICO: Fines for cookie law breakers
- EMC World 2012: EMC talks up cloud, security and big data
- Dell PowerEdge R820 review
- Sony Vaio T13 Ultrabook review: First look
- BlackBerry 7 OS certified to carry 'Restricted' UK government information
- Facebook floatation marred by Nasdaq glitch
- CIO: Career is over?
Latest News Videos in Security
IT PRO Podcast: Are UK data protection laws flawed?
We bring in two experts to talk about the problems with UK data protection law and the way it is managed.
Register for IT PRO
You'll get exclusive member benefits including free whitepapers, downloads, Webinars and weekly newsletters full of the latest IT PRO news, reviews, insight and expertise.





