Partner With Us
























Lookout Warning Issued for Site Defacements

Enterprise IT admins are urged to review existing security policies, especially on outward facing Web servers.

July 3, 2003
By Ryan Naraine: More stories by this author:

The Internet Security Systems' X-Force unit has sounded an alarm for an increase in hacker activity between July 6-7 to coincide with a contest encouraging defacements of Web sites around the world.

ISS raised its current threat level to 'AlertCon 2' to coincide with the site defacement competition, which awards prizes to intruders who successfully compromise an organization's Web server and deface its Web pages.

Analysts monitoring the so-called hacking challenge warned that it could disrupt normal Internet activity and cause mass defacements and shutdown of affected Web pages.

The group said intelligence showed hacker groups are conducting "reconnaissance-scans" prior to the "contest" to identify vulnerable systems. "Major activity won't publicly surface until the early hours of July 6, 2003," X-Force said, encouraging enterprises to review existing security policies, especially on outward facing Web servers.

The competition in question appears to be targeting HP-UX, Apple and IBM-AIX systems, which have limited exposure as Web-hosting platforms.

The New York State Office of Cyber Security and Critical Infrastructure Coordination (CSCIC) also issued an advisory in anticipation of the attacks and recommended that certain preventative measures are taken to protect vulnerable systems.

The CSCIC recommendations include:

  • Ensure default passwords are changed. This should include web servers and any other servers (e.g. database servers) that the web server has a trusted relationship with.
  • Remove sample applications (CGI scripts, Active Server Pages, etc.) that are not being used from production web servers.
  • Lock down Microsoft Front Page Extensions. By default Front Page Extensions are installed such that everyone can use them to author web pages even through proxy servers. Note that this also applies to Front Page Extensions installed on Unix platforms.
  • Turn web server logging on. Logs are essential to determining how a defacement was accomplished so a recurrence can be prevented. Preferably extended log format should be enabled.
  • Ensure you have a current backup of your web server. In the event of a defacement, a good backup is essential to timely remediation.
  • Apply the latest security patches for your web server and underlying operating system after appropriate testing.






  • Business Archives | 7 Day InternetNews Summary | Contact Ryan Naraine | Back to top

    Add internetnews.com
    to your browser search box.

    IE 7 | Firefox 2.0 | Firefox 1.5.x
    Receive news
    via our XML/RSS:
    feed



    More InternetNews.com


    Hardware Software Mobility Web Content
    Search Government Developer Business
    Storage E-Commerce Networking Security



    internet.commediabistro.comJusttechjobs.comGraphics.com

    Search:

    WebMediaBrands Corporate Info

    Legal Notices, Licensing, Permissions, Privacy Policy.
    Advertise | Newsletters | Shopping | E-mail Offers | Freelance Jobs