There are some things that I can not abide. One of them is when a vendor tries to quietly patch a product all the while hoping that no one happens to notice. This is the quandary that the folks from F-Secure found themselves in when their forums site was defaced by a group of apparent Turkish hackers. I also find it interesting that anyone still defaces sites. I would imagine after Attrition and Alldas.de stopped posting defacement news that it would have been a clue that it had played out. But, I guess with Zone-h (great site) still carrying this sort of news that there is motivation for defacers.
From F-Secure:
Quite embarrassing. So how did this happen? The server itself is quite well hardened, but the web forum software had an unannounced security patch silently released by the vendor nine days ago. The defacement gang learned of the vulnerability and went through the net searching for vulnerable forums and changed the front page of such forums to their “greeting”.
Bad luck that. Their forum site is now back online.
[tags]F-Secure Defacement, Software Security, Application Security[/tags]
