Hackers deface UN website in protest over US and Israel

gallery

The website of the United Nations became the victim of hackers when it was defaced with messages accusing Israel and the US of killing children. The attack led some sections of the site, including part of it devoted to the UN general secretary Ban Ki-Moon, being offline for most of Sunday.

Visitors to the website would have seen speeches by Ban replaced with text posted by the gang of hackers.

According to Giorgio Maone, a software developer from Palermo, Italy, the attack was a result of SQL injection vulnerability on the website. Maone tracked the defacement, which saw the hackers post this political message:

HACKED BY KEREM125 M0STED AND GSY

THAT IS CYBERPROTEST HEY ÝSRAIL AND USA

DONT KILL CHILDREN AND OTHER PEOPLE

PEACE FOR EVER

NO WAR

Maone said the message gave a clue to how the attack was carried out.

"There's a technical reason for the missing apostrophe, though, because messing with this very character is part of the technique apparently used by the attackers," he said.

"The site is vulnerable to an attack called SQL Injection. This is a very well known kind of vulnerability, fairly easy to avoid and very surprising to find in such a high profile website," Maone added.

He said that if only prepared SQL statements were used properly, this embarrassing incident would never have happened. Maone added that prepared statements are available even in the very obsolete ASP "Classic" and ADODB Microsoft set up the UN uses on its website.

The site appears to have been restored following the attack. The hackers also thought to be behind hacking incidents on the websites of Harvard University, the UN environment programme, Toyota and Nestle.

Email to a friend

Print this page