SUHAKAM Website Defaced by Indonesian Hackers

Here's something for your lunchtime reading pleasure. The website of SUHAKAM - Suruhanjaya Hak Asasi Malaysia (Human Rights Commission of Malaysia), the human rights watchdog, has been defaced by Indonesian hackers. The defacement was done on the English page of the website. The screen captures of the website are below (click on the image to view original size):







Interestingly, even the main page (the Bahasa Malaysia version) of the website contains (at the time of blogging), database related errors:





This error was triggered by simply browsing to the URL http://suhakam.org.my/bm/media/senarai.asp?type=PRESS, or from the navigation/menu on the main page (Media->Kenyataan Media). This error reveals a few things:

• Suhakam's website is using SQL Server as the database backend
• The SQL server is currently inaccessible, i.e. it may not be running or the username and password used to access the SQL server are invalid
• The location of the webroot of Suhakam's website in the server is D:\DOMAINS\SUHAKAM.ORG.MY\WWWROOT"

So what is really wrong here? For one, the vendor did not handle errors properly. Any errors generated by the servers (in this case, the error displayed is direct from the database server) are goldmine to hackers.





And, as I expected, this is not the first time that SUHAKAM's website has been defaced. Just take a look at the screenshot from Zone-H below:





I am not sure how the website is defaced, but since the entire page of the English version was defaced (compared to the Barisan National website defacement, I willing to bet that the hackers managed to upload files to the server via vulnerabilities in the server or the web application. Now, let's see how fast Suhakam can mitigate this. As of now, six days after I blogged about the Barisan National website defacement, the webpage is still "down".