Feeds

Hacktivist vuln still plagues UN.org

Still lazy after all these years

Top 5 reasons to deploy VMware with Tegile

The official website of the United Nations has yet to fix a vulnerability that more than two years ago allowed hacktivists to replace official content with their own activist messages.

According to Errata Security CEO Rob Graham, the same SQL injection flaw that plagued the site in August of 2007 remains unfixed now. It's invoked by doing nothing more than adding a stray character to the ASP parameter of a un.org link, such as http://www.un.org/apps/news/infocus/sgspeeches/statments_full.asp?statID=10'5.

"Despite the fact a high-school intern can fix the bug in 5 minutes, the bureaucracy means that the organization must spend tens of thousands of dollars to fix the bug," Graham wrote. "The other lesson is that the cost of NOT fixing the bug is low. The UN can simply live with the problem, and clean up after every hack."

As The Register reported in 2007, hacktivists used the bug on the UN's Apache-powered website to replace speeches by Secretary-General Ban Ki-Moon with pacifist messages. While that attack appeared to be the work of activist critics of the global organization, it's not a stretch to imagine criminals hacking the site to surreptitiously send visitors to sites that push malicious drive-by exploits.

Messages seeking comment from the UN went unanswered. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.