Defacing public institutions’ official sites

The last days of 2009 and the beginning of 2010 reveal the latest frenzy for hackers - vandalizing the official sites of public institutions.

The first attacks hit several official Philippines government Web sites, prior to Christmas and New Year's holiday. December 17^th, users visiting the Department of Health homepage could find a defaced picture of the Health Secretary Francisco Duque III. If, in the original picture, he was blowing on a "torotot", in the vandalized picture he was apparently holding male genitals towards his mouth. Other porn words were written next to the picture.

Next day, the official site of the Department of Social Welfare and Development was the target of hackers. A couple of days later, the Philippines National Disaster Coordinating Council's official Web site was also under attack.

This trend seems to continue in 2010: the very first days of January brought new victims - the Spanish EU presidency site and the official site of the Iranian president.

January 4^th, hackers took advantage of the XSS vulnerabilities to compromise the Spanish presidency, replacing the photo of the Spanish prime minister Zpatero with the lookalike Mr. Bean's funny image.

Next day, the Iranian presidency Web site was vandalized, the intruder posting a message which called for President's death: "Dear God, In 2009 you took my favourite singer - Michael Jackson, my favourite actress - Farrah Fawcett, my favourite actor - Patrick Swayze, my favourite voice - Neda. Please, please, don't forget my favourite politician - Ahmadinejad and my favourite dictator - Khamenei in the year 2010. Thank you."

Although the damages were just related to some official (and institutional)"images", although the problems were soon solved, these attacks are prompting Internet security experts to question the officials' ability to protect sensitive information and remind users worldwide that no Web site is 100% hackproof.