Feeds

They've only gone and HACKED the WEATHER

Hackers punch into NOAA, in 'vengeance for Stuxnet'

Website security in corporate America

Hackers have lifted potentially sensitive data from the US National Weather Service after exploiting a vulnerability in the weather.gov website.

A previously-unknown group called Kosova Hacker's Security claimed credit for the hack in a lengthy post on pastebin, containing a stream of data lifted as a result of the hack. Leaked data includes a list of partial login credentials, something that might give other hacking crews a head start in attacking the website, as well as numerous system and network configuration files.

The leaked information appears to consist only of system files and the like rather than scientific data, something that strongly distinguishes the breach from the so-called ClimateGate hack against the Climatic Research Unit (CRU) at the University of East Anglia back in November 2009.

The hacking crew said it took advantage of "local file inclusion vulnerability" that allowed it to ransack the weather.gov servers. Kosova Hacker's Security said the hack was carried out in retaliation for American aggression against Muslim nations, including the Flame and Stuxnet malware attacks against the Iran nuclear program.

"They hack our nuclear plants using STUXNET and FLAME like malwares, they are bombing us 27*7, we can't sit silent - hack to payback them," The Hacker News quotes the hackers as saying.

KHS' supposed grievance makes weather.gov a bit of of an odd target. However the group threatened to carry out further attacks against US government systems.

The weather.gov website was back up and running at the time of writing on Friday afternoon.

A post on Sophos's Naked Security blog reports that the local file inclusion vulnerability was quickly patched but at least one other vulnerability, a cross site scripting hole, was subsequently discovered on the site. It's unclear if the XSS vulnerability, which is the sort of thing that's most useful for those interested in running phishing attacks rather than punching through web servers to hack into back-end databases, has been fixed as yet.

Weather.gov is run by the US National Weather Service, part of the National Oceanic and Atmospheric Administration (NOAA). NOAA is a unit of the US Department of Commerce in charge of providing "weather, water, and climate data, forecasts and warnings for the protection of life and property and enhancement of the national economy". It's also well known as custodian as one of the three main databases used to measure global warming: the other two belong to NASA and the British Met Office's Hadley Centre. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.