Feeds

Hacktivist vuln still plagues UN.org

Still lazy after all these years

Choosing a cloud hosting partner with confidence

The official website of the United Nations has yet to fix a vulnerability that more than two years ago allowed hacktivists to replace official content with their own activist messages.

According to Errata Security CEO Rob Graham, the same SQL injection flaw that plagued the site in August of 2007 remains unfixed now. It's invoked by doing nothing more than adding a stray character to the ASP parameter of a un.org link, such as http://www.un.org/apps/news/infocus/sgspeeches/statments_full.asp?statID=10'5.

"Despite the fact a high-school intern can fix the bug in 5 minutes, the bureaucracy means that the organization must spend tens of thousands of dollars to fix the bug," Graham wrote. "The other lesson is that the cost of NOT fixing the bug is low. The UN can simply live with the problem, and clean up after every hack."

As The Register reported in 2007, hacktivists used the bug on the UN's Apache-powered website to replace speeches by Secretary-General Ban Ki-Moon with pacifist messages. While that attack appeared to be the work of activist critics of the global organization, it's not a stretch to imagine criminals hacking the site to surreptitiously send visitors to sites that push malicious drive-by exploits.

Messages seeking comment from the UN went unanswered. ®

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.