The Sun Reporting Murdock Dead

[NickFitz]

BTW, I thought LulzSec had disbanded?

They had, but:

Thank you for the love tonight. I know we quit, but we couldn't sit by with our wine watching this walnut-faced Murdoch clowning around.

[MarillionFan]

They had, but:

Thank you for the love tonight. I know we quit, but we couldn't sit by with our wine watching this walnut-faced Murdoch clowning around.

What's good for the goose.

[OwlHoot]

Could be an inside job, or security details passed on, if any techies have recently been laid off.

[DaveB]

Could be an inside job, or security details passed on, if any techies have recently been laid off.

Nah, just crap / non-existant security.

Never attribute to Malice that which can be explain by stupidity.

[DaveB]

... at one of Her Majesty's less salubrious establishments, if they get caught. If only there were more Met officers available to investigate ...

Thats an extreemly big If.

The impressive thing about these guys is not so much what they have done, most of it is down to lapses / incompetence on the part of the site owners in not fixing known vulnerabilities, it's the fact that they havn't been caught.

So far they have managed to evade the security services and law enforment agencies of at least 2 countries for several months, and maintain a high public profile while doing it. That's the impressive bit.

[Sysman]

Grauniad: How the hack was done

Oops #1

However as far back as 2009 a weakness was found in the "Contact us" form of the Sun's site that meant that it could be used to attack the database holding emails for the system.

Oops # 2

The server hosted the outdated "new-times.co.uk" site put up when the Times was building its paywall.

NI should really have taken "new-times.co.uk" offline once they were done with it.

[fullyautomatix]

How was the hack achieved ? It was not a straight forward file system hack because the home page would show for about 5 seconds before a redirect happened. Was it a XSS attack ?

[DaveB]

How was the hack achieved ? It was not a straight forward file system hack because the home page would show for about 5 seconds before a redirect happened. Was it a XSS attack ?

Nope, from the Grauniad article there were fundamental flaws in the new-times.co.uk website that allowed them to carry out an SQL injection and File Inclusion attack that gave them control of the server and from there into the CMS used to maintain the Sun website. From there it was trivial to add a redirect on the home page. The delay was probably just down to server lag due to the volume of traffic hitting it once the hack went public.

Trivial stuff in terms of complexity of the hack and entirly due to stupidity/negligence on behalf of NI techies.

[SueEllen]

Trivial stuff in terms of complexity of the hack and entirly due to stupidity/negligence on behalf of NI techies.

If they treated the techies like the journalists then it wasn't stupidity/negligence.

[fullyautomatix]

Nope, from the Grauniad article there were fundamental flaws in the new-times.co.uk website that allowed them to carry out an SQL injection and File Inclusion attack that gave them control of the server and from there into the CMS used to maintain the Sun website. From there it was trivial to add a redirect on the home page. The delay was probably just down to server lag due to the volume of traffic hitting it once the hack went public.

Trivial stuff in terms of complexity of the hack and entirly due to stupidity/negligence on behalf of NI techies.

If it was such a complete control of the server/CMS/file system whatever, why didnt they just modify the home page of "Sun" and put the story up there ? Why a redirect? and why not a server side redirect rather than a client redirect ?