Feeds

Link-spamming spreads to NHS, police

Home Office harbouring hentai - how humiliating!

Top 5 reasons to deploy VMware with Tegile

Hot on the heels of spam-linked local government and pwned parish Council sites, El Reg has discovered that central government is not immune to infiltration by spammers.

To schools we must now add NHS, Police and Fire Brigade. If Altavista is to be believed, not only have the Home Office crime reduction pages been encouraging a dubious interest in hentai, but the Met also has been making its own contribution to racial harmony with links to "asian video porn" and "interracial movies".

As the list grows, we are left to wonder at the consistency of a government that has criminalised possession of some categories of material, particularly porn or "terror"-related, while having such a poor track record when within its own domains. Karma – not to mention "duty of care" - leaves us wondering whether the Home Office should not now be hauled up in front of its own shiny new laws.

If readers would like to assist with the important task of cleaning up Government websites, it is not hard to do. Pick your favourite search engine and load a search that is something like "site:dom.uk +porn", where "dom" equals the appropriate official designation. So far we have looked at "gov.uk", "sch.uk", "nhs.uk" and yes, "police.uk".

Not all search engines give the same result: in some cases, Altavista returns a more comprehensive search than Google. While "porn" is the obvious term of choice when it comes to hunting down spam, it can pay to be creative: "tramadol" and "vicodin" will also score.

Let us know what you find, but be careful and be responsible. Don’t click through to links, unless you wish to risk infecting your computer with illegal material or a nasty piece of malware. If you encounter what looks like real links to child porn, inform the relevant site admin and/or the Internet Watch Foundation. Don’t go looking at it.

While our first survey revealed that most of this material is no more than link spamming – spam designed to sit on pre-existing poorly moderated boards and boost site ratings – in a few instances, sites have been more deeply hacked. Hidden directories have been created on the site server and unauthorised software installed. These are far more serious, possibly allowing hackers to access other confidential information on that site.

When it comes to compromised sites, step forward, under the "sch.uk" banner, Cardiff, Brent, cantonian.cardiff and sidious.kingsbury.brent. That may not sound like many, but a search on "porn Guestbook site:sch.uk" adds another 30 or so.

Welcome also Thorpe Greenways and Bishopton/ Redmarshall Infant Schools. We’re not sure what’s going down on the Lamberhurst School Notice Board, but it certainly does not look appropriate for kids. The fact that the site is "under construction" suggests strongly that the server may have been hacked.

Congratulations - kinda - to Yorkshire and Humberside Fire Brigade, who also make the list. That site joins around 15 NHS sites, ranging from individual practices, such as Strawberry Gardens up in Morecambe, through to the entire Cornwall Region, which currently holds a spam overhead of some 2,300 pages. Lothian Referrals and Wired for Health were also, at one point, victims of this practice – but now look to be clear.

However, what the last link reveals is that the NHS seems to be more at risk than other government departments. The Gold Standards Framework is a national programme: that has been infiltrated. Wired for Health looks like the precursor site to Healthy Schools, which was also the locus for infection of Worcestershire County Council's site.

Likewise, according to Altavista, the NHS FOI site (do not download the .csvs). However, pride of place in the embarrassment stakes must go to the Met and the Home Office, both briefly spammed.

Denying that the material in question had ever been hosted on their site, a Home Office spokeswoman blamed OSCommerce software used to host a publicity catalogue. She said: "This feature was withdrawn... because it was discovered that it could be exploited by third parties to circumvent spam filters."

The Department for Health reassured us that it takes internet security seriously, and that its own website had not been compromised.

A spokeswoman said: "The problem identified seems to be with poorly managed or unmoderated open discussion forums and message boards. The main DH website does not have this functionality and comes up clean on search engines.

"The nhsidentity website contains guidelines for nhs.uk sites, which advise that websites should follow COI/Cabinet Office guidelines - these include security and operations guidelines on running message boards."

We waited in vain for the Met to respond, but at time of writing have heard nothing from them.

Update: All three sites featured in our last report on this subject promptly took their site down. Over in Worcestershire El Reg was pleased to be invited to join an early morning phone-in on the topic, where we heard one local councillor claim that material hosted on the worcestershire.gov.uk site wasn’t, er, actually on the Worcestershire site. Still, the best form of defence is attack, as another local councillor demonstrates very well. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.