Original URL: http://www.channelregister.co.uk/2007/12/17/f_secure_defacement/
Turkish hackers last week succeeded in defacing a security discussion forum established by web security firm F-Secure.
The digital graffiti attack was of little importance, but no less embarrassing for F-Secure despite its triviality.
"The server itself is quite well hardened, but the web forum software had an unannounced security patch silently released by the vendor nine days ago," a posting on F-Secure's security blog explains (http://www.f-secure.com/weblog/archives/00001336.html).
The developers behind Snitz released a security package on 1 December only to withdraw it before re-releasing it on 4 December.
"We immediately implemented the patch. However, what we didn't know at the time was that a discussion was ongoing in the development forum. Not only was an improved fix recommended but there was also discussion that potential extensions to the forum might be vulnerable as well," F-secure said. "Turns out that's exactly what happened to us. While the main forum itself was patched it was the private messaging module that made the defacement possible," it added.
Hackers learned of the vulnerability (http://forum.snitz.com/forum/topic.asp?TOPIC_ID=66005) in the Snitz Forums 2000 forum software used by F-Secure and others. They then searched the web for vulnerable sites, finding a tempting target when they discovered the Finnish anti-virus firm's site was yet to be upgraded. The Turkish Nationalist defacers subsequently changed the front page of hackable forums to their "greeting".
F-Secure took the forum offline following the discovery of the hack on Thursday. It has since rebuilt the forum. ®
Comcast hack leaves users without email (29 May 2008)
http://www.channelregister.co.uk/2008/05/29/comcast_hack/
Spanish police cuff web defacement crew (19 May 2008)
http://www.channelregister.co.uk/2008/05/19/defacement_crew_cuffed/
Scotland Yard careers website defaced (25 February 2008)
http://www.channelregister.co.uk/2008/02/25/met_police_defacement/
Indonesian hacker touches souls by bringing down police website (20 December 2007)
http://www.theregister.co.uk/2007/12/20/tuscon_police_website_defacement/
Hacker defaces temples to OS X (27 November 2007)
http://www.theregister.co.uk/2007/11/27/mac_site_defacer/
Cyber-jihad fails to materialise (12 November 2007)
http://www.channelregister.co.uk/2007/11/12/cyber_jihad_awol/
Website for computer security experts hacked (8 November 2007)
http://www.channelregister.co.uk/2007/11/08/forensic_forum_hack/
Saudi hackers scalp MS UK (2 July 2007)
http://www.channelregister.co.uk/2007/07/02/ms_uk_defacement/
Defacement archive Zone-h gets defaced (23 January 2007)
http://www.channelregister.co.uk/2007/01/23/zone-h_defaced/
Skype malware scam targets Turkey (10 August 2006)
http://www.channelregister.co.uk/2006/08/10/skype_spyware_scam/
© Copyright 2008