Friday, June 18, 2021

Lookout Warning Issued for Site Defacements

The Internet Security Systems’ X-Force unit has sounded an alarm for an
increase in hacker activity between July 6-7 to coincide with a contest
encouraging defacements of Web sites around the world.

ISS raised its current threat level to ‘AlertCon 2’ to coincide with the
site defacement competition, which awards prizes to intruders who
successfully compromise an organization’s Web server and deface its Web
pages.

Analysts monitoring the so-called hacking challenge warned that it could
disrupt normal Internet activity and cause mass defacements and shutdown of
affected Web pages.

The group said intelligence showed hacker groups are conducting
“reconnaissance-scans” prior to the “contest” to identify vulnerable
systems. “Major activity won’t publicly surface until the early hours of
July 6, 2003,” X-Force said, encouraging enterprises to review existing
security policies, especially on outward facing Web servers.

The competition in question appears to be targeting HP-UX, Apple and
IBM-AIX systems, which have limited exposure as Web-hosting platforms.

The New York State Office of Cyber Security and Critical Infrastructure
Coordination (CSCIC) also issued an advisory
in anticipation of the attacks and recommended that certain preventative
measures are taken to protect vulnerable systems.

The CSCIC recommendations include:

  • Ensure default passwords are changed. This should include web servers
    and any other servers (e.g. database servers) that the web server has a
    trusted relationship with.
  • Remove sample applications (CGI scripts, Active Server Pages, etc.)
    that are not being used from production web servers.
  • Lock down Microsoft Front Page Extensions. By default Front Page
    Extensions are installed such that everyone can use them to author web pages
    even through proxy servers. Note that this also applies to Front Page
    Extensions installed on Unix platforms.
  • Turn web server logging on. Logs are essential to determining how a
    defacement was accomplished so a recurrence can be prevented. Preferably
    extended log format should be enabled.
  • Ensure you have a current backup of your web server. In the event of
    a defacement, a good backup is essential to timely remediation.
  • Apply the latest security patches for your web server and underlying
    operating system after appropriate testing.
  • Similar articles

    Latest Articles

    GDPR Compliance & Requirements...

    The General Data Protection Regulation (GDPR) has positioned itself as one of the strictest laws for the privacy of consumer data, and it's still...

    HIPAA Compliance & Regulations...

    The Health Insurance Portability and Accountability Act (HIPAA) is one of the most well-known pieces of legislation in health care and related industries. But...

    Top Data Visualization Tools...

    The amount of data generated and consumed by organizations is growing at an astounding rate. The total volume of data and information worldwide has...

    The Data Capture Market

    Data capture is the process of collecting, ingesting, or otherwise acquiring structured and unstructured data and either converting it into a data format usable...