A section of the National Oceanic and Atmospheric Administration website has been stuffed with a few dozen pages containing promotions for a muscle relaxant.
NOAA Cracked By Russian Pill Hackers
NOAA's old Climate Monitoring and Diagnostics Laboratory website has some unwelcome Russian squatters sitting in its directory. The pages all appear to have been loaded into the site on March 3rd.
Thor Schrock blogged about how he discovered the Russians had invaded the government website:
Tonight I received a spam post on our customer support forum that I normally would have deleted and forgotten about, but this one was different. It was the usual pill-pushing post with a couple dozen links. But these links went back to a .gov website - a highly unusual occurrence for this kind of scheme.
It appears that either an authorized agent of the NOAA or a hacker has infiltrated the website and used that access to plant more than 70 pages about the prescription drug Soma - a muscle relaxer.
The directory at http://www.cmdl.noaa.gov/hotitems/soma/ lists these pages, though we expect this will be taken down quickly.
Schrock noted how the pages are all cross-linked together, and more importantly enjoy a .gov backlink to boost their authority on search engines like Google. He also said the banner ad code displaying what appear to be Russian language ads comes from a London-based ad network called Wizard Rules.
The webmasters at NOAA should also be concerned at how their Apache web server returns information to the viewer of a directory page. First, people should not be able to see a page like this; it's an easy configuration change in Apache to prevent visitors from seeing a directory page.
Second, the server returns some information about itself, namely the server version and the operating system underneath it.
As site problems go, this one isn't as bad as the Houston Chronicle's colossal blunder we reported last week. It's still not encouraging to see a government website so easily hacked by spammers, and we hope federal webmasters get their acts together on site security.
iEntry 10th Anniversary
RSS
Archive
