Feeds

Link-spamming spreads to NHS, police

Home Office harbouring hentai - how humiliating!

High performance access to file storage

Hot on the heels of spam-linked local government and pwned parish Council sites, El Reg has discovered that central government is not immune to infiltration by spammers.

To schools we must now add NHS, Police and Fire Brigade. If Altavista is to be believed, not only have the Home Office crime reduction pages been encouraging a dubious interest in hentai, but the Met also has been making its own contribution to racial harmony with links to "asian video porn" and "interracial movies".

As the list grows, we are left to wonder at the consistency of a government that has criminalised possession of some categories of material, particularly porn or "terror"-related, while having such a poor track record when within its own domains. Karma – not to mention "duty of care" - leaves us wondering whether the Home Office should not now be hauled up in front of its own shiny new laws.

If readers would like to assist with the important task of cleaning up Government websites, it is not hard to do. Pick your favourite search engine and load a search that is something like "site:dom.uk +porn", where "dom" equals the appropriate official designation. So far we have looked at "gov.uk", "sch.uk", "nhs.uk" and yes, "police.uk".

Not all search engines give the same result: in some cases, Altavista returns a more comprehensive search than Google. While "porn" is the obvious term of choice when it comes to hunting down spam, it can pay to be creative: "tramadol" and "vicodin" will also score.

Let us know what you find, but be careful and be responsible. Don’t click through to links, unless you wish to risk infecting your computer with illegal material or a nasty piece of malware. If you encounter what looks like real links to child porn, inform the relevant site admin and/or the Internet Watch Foundation. Don’t go looking at it.

While our first survey revealed that most of this material is no more than link spamming – spam designed to sit on pre-existing poorly moderated boards and boost site ratings – in a few instances, sites have been more deeply hacked. Hidden directories have been created on the site server and unauthorised software installed. These are far more serious, possibly allowing hackers to access other confidential information on that site.

When it comes to compromised sites, step forward, under the "sch.uk" banner, Cardiff, Brent, cantonian.cardiff and sidious.kingsbury.brent. That may not sound like many, but a search on "porn Guestbook site:sch.uk" adds another 30 or so.

Welcome also Thorpe Greenways and Bishopton/ Redmarshall Infant Schools. We’re not sure what’s going down on the Lamberhurst School Notice Board, but it certainly does not look appropriate for kids. The fact that the site is "under construction" suggests strongly that the server may have been hacked.

Congratulations - kinda - to Yorkshire and Humberside Fire Brigade, who also make the list. That site joins around 15 NHS sites, ranging from individual practices, such as Strawberry Gardens up in Morecambe, through to the entire Cornwall Region, which currently holds a spam overhead of some 2,300 pages. Lothian Referrals and Wired for Health were also, at one point, victims of this practice – but now look to be clear.

However, what the last link reveals is that the NHS seems to be more at risk than other government departments. The Gold Standards Framework is a national programme: that has been infiltrated. Wired for Health looks like the precursor site to Healthy Schools, which was also the locus for infection of Worcestershire County Council's site.

Likewise, according to Altavista, the NHS FOI site (do not download the .csvs). However, pride of place in the embarrassment stakes must go to the Met and the Home Office, both briefly spammed.

Denying that the material in question had ever been hosted on their site, a Home Office spokeswoman blamed OSCommerce software used to host a publicity catalogue. She said: "This feature was withdrawn... because it was discovered that it could be exploited by third parties to circumvent spam filters."

The Department for Health reassured us that it takes internet security seriously, and that its own website had not been compromised.

A spokeswoman said: "The problem identified seems to be with poorly managed or unmoderated open discussion forums and message boards. The main DH website does not have this functionality and comes up clean on search engines.

"The nhsidentity website contains guidelines for nhs.uk sites, which advise that websites should follow COI/Cabinet Office guidelines - these include security and operations guidelines on running message boards."

We waited in vain for the Met to respond, but at time of writing have heard nothing from them.

Update: All three sites featured in our last report on this subject promptly took their site down. Over in Worcestershire El Reg was pleased to be invited to join an early morning phone-in on the topic, where we heard one local councillor claim that material hosted on the worcestershire.gov.uk site wasn’t, er, actually on the Worcestershire site. Still, the best form of defence is attack, as another local councillor demonstrates very well. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Oz bank in comedy Heartbleed blog FAIL
Bank: 'We are now safely patched.' Customers: 'You were using OpenSSL?'
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.