Feeds

Hacktivist vuln still plagues UN.org

Still lazy after all these years

Intelligent flash storage arrays

The official website of the United Nations has yet to fix a vulnerability that more than two years ago allowed hacktivists to replace official content with their own activist messages.

According to Errata Security CEO Rob Graham, the same SQL injection flaw that plagued the site in August of 2007 remains unfixed now. It's invoked by doing nothing more than adding a stray character to the ASP parameter of a un.org link, such as http://www.un.org/apps/news/infocus/sgspeeches/statments_full.asp?statID=10'5.

"Despite the fact a high-school intern can fix the bug in 5 minutes, the bureaucracy means that the organization must spend tens of thousands of dollars to fix the bug," Graham wrote. "The other lesson is that the cost of NOT fixing the bug is low. The UN can simply live with the problem, and clean up after every hack."

As The Register reported in 2007, hacktivists used the bug on the UN's Apache-powered website to replace speeches by Secretary-General Ban Ki-Moon with pacifist messages. While that attack appeared to be the work of activist critics of the global organization, it's not a stretch to imagine criminals hacking the site to surreptitiously send visitors to sites that push malicious drive-by exploits.

Messages seeking comment from the UN went unanswered. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.