Sepang F1 Website hacked!

Sepang F1 Website, soaped!
By Hazimin Sulaiman

BARELY fourteen hours before the start of another exciting Formula 1 Grand Prix at the Sepang circuit in Kuala Lumpur, Malaysia, someone else beat favourites Räikkönen, Kovalainen and Rosberg. Well, on the headlines at least. On the last 20 March, F-Secure, Malaysia engineers checking out the malaysiangp.com.my Website were greeted by a box of detergent.

The defacement of the official homepage, just hours before the start of the race however, did not effect the Webserver; it was found to be running on its original IP address.Fans looking for the last minute Malaysia F1 Grand Prix ticket information to catch the race, end up getting a picture of the laundry detergent box mentioned. According to Chia Wing Fei, Security Response Team Manager, F-Secure Security Labs Kuala Lumpur "The original site was still intact and reachable using the IP address, only the DNS record was modified to point to a different host – a free hosting website.

Everyone who wanted to visit the website would simply just type in the DNS name of the website – malaysiangp.com.my instead of the IP address because hardly anyone would go through the hassle of typing in the IP address of the website." Chia reckons that the hijacker either discovered the password to the DNS Server; or with the use of social engineering, managed to get the provider to change the host record since it was a Malaysian public holiday on the day the incident occurred and "maybe there wasn’t full staff at office."

The hijacker it seems however, did it certainly for bragging rights and fame.No actual compromise to the site was made to host malware and no malware was hosted on the redirected site. If malware were hosted, it would have been a disaster given the amount of traffic the site would have received from all over the world.Malaysiangp.com.my has nameservers under five different providers. At the time of the defacement, some of them still pointed to the original or real site. Some of them pointed to the defacement page hosted at a free hosting service, oxyhostsfree.com.

Yet another FUD piece on hackers...

Tippingpoint security experts outline top threats for Asia Pacific region
By Hazimin Sulaiman

"FROM January 21 to March 21, 2008, there have been 3840 attacks specifically targetted to Malaysia," says Rohit Dhamankar, Project Manager, SANS Top 20 Vulnerability List and Senior Manager, Security Research, TippingPoint DVLabs. This trend is worrying with as Dhamankar cites the reported attacks in other Asian countries: China with 25,179,463 attacks, Singapore 4,353 attacks, Indonesia 5,489 attacks, Philippines 20,181 attacks and India 1,701,895 attacks.

From research conducted, it seems that most of the infected systems in Malaysia are compromised by Windows RPC Worms and Web attacks which utilise 'PHP File Include' attacks. The list also includes compromises caused by the SQL Slammer Worm, HTTP Connect Tunnel (Spam), LSASS Active Directory Interface Overflow nad Fusion News Command Injection.The key areas of concern according to Dhamankar would be the network downtime attacks, financially motivated attacks and critical infrastructure (cyber-terrorism and political) attacks.

The modern security model as Tippingpoint proposes, requires security automation. Security automation offers all-round 24 hours per day security and requires network stability, transparency and no impact upon overall performance. TippingPoint is currently conducting seminar series until May, across 11 Asia Pacific countries and cities to create awareness among media and security executives to address the top network attacks and emerging threats and provide security recommendations for comprehensive enterprise defense and risk compliance. Tippingpoint focus is on emerging trends across the threat landscape. The series offer insights into attack techniques used on Web application servers, which are becoming an attractive financial target for criminals due to their accessibility to back-end database servers. Other sophisticated and dangerous attacks targeting critical network vulnerabilities including VoIP and SCADA will be covered. The growing sophistication of cyber threats and system vulnerabilities provides a daunting task for IT administrators working to protect critical data while meeting regulatory compliance.

“The past two years have been a rich play of application vulnerabilities from the server to user perspective,” according to Dhamankar. Attackers Dhamankar says, have started turning towards Web applications for compromise since both open source and custom Web applications have been found to be riddled with numerous vulnerabilities. Web server vulnerabilities have, in turn, fueled the compromise of desktop systems via user application vulnerabilities. It has become an easy trick to take over a Web site or host a malicious Web site remotely and attack any users directed to the site. Tippingpoint also wants to bring to attention the emerging technologies and business trends in information security and their potential business impact.

Neal Hartsell, TippingPoint's worldwide vice president of marketing explains that a more innovative approach platform is required by organizations who want to evolve to better secure their networks.“The three principle concerns of organizations center on keeping bad traffic off the network; controlling who and what accesses the network; and ensuring critical data does not leave the network,” says Hartsell. Hartsell agrees however that, that's a large and seemingly disparate charter, so the question becomes how these topics are related and how they can be addressed through a cohesive network security solution model that is technically and economically viable.