Hacktivist vuln still plagues UN.org
Still lazy after all these years
Agentless Backup is Not a Myth
The official website of the United Nations has yet to fix a vulnerability that more than two years ago allowed hacktivists to replace official content with their own activist messages.
According to Errata Security CEO Rob Graham, the same SQL injection flaw that plagued the site in August of 2007 remains unfixed now. It's invoked by doing nothing more than adding a stray character to the ASP parameter of a un.org link, such as http://www.un.org/apps/news/infocus/sgspeeches/statments_full.asp?statID=10'5.
"Despite the fact a high-school intern can fix the bug in 5 minutes, the bureaucracy means that the organization must spend tens of thousands of dollars to fix the bug," Graham wrote. "The other lesson is that the cost of NOT fixing the bug is low. The UN can simply live with the problem, and clean up after every hack."
As The Register reported in 2007, hacktivists used the bug on the UN's Apache-powered website to replace speeches by Secretary-General Ban Ki-Moon with pacifist messages. While that attack appeared to be the work of activist critics of the global organization, it's not a stretch to imagine criminals hacking the site to surreptitiously send visitors to sites that push malicious drive-by exploits.
Messages seeking comment from the UN went unanswered. ®
COMMENTS
Patch (finally) in progress?
Clicking on the (provided) link:
ADODB.Recordset.1 error '80004005'
SQLState: 37000
Native Error Code: 8180
SQLState: 37000
Native Error Code: 170
[MERANT][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near ''.
[MERANT][ODBC SQL Server Driver][SQL Server]Statement(s) could not be prepared.
/apps/news/infocus/sgspeeches/statments_full.asp, line 28
Looks like someone deleted the entire database already...
select * from sysobjects
...is returning nothing!
Wow
Jesus Christ... I could do this hack when I was 14 years old (white hat of course: I learned after 5 minutes of googling how to secure my site against it preemptively). Ridiculous.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
