# MA-063.012004: MyCERT Alert - Mass Web Defacements of Malaysian Websites

**Date:** 19 Jan 2004  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-063.012004  
**Advisory ID:** MA-063.012004

---

With regards to the above matter, over the weekends MyCERT had received report of mass web defacements of about 157 websites, involving the .gov, .net,.com, .edu and .org. About 98% of the web defacements involved Linux machines and the rest involved Windows 2000 machines.
MyCERT observed two hacker groups, probably Brazilian hacker groups which actively involved in these mass web defacements, the ^XRed Eye^Y and the ^XIr4dex^Y. MyCERT noticed that the ^XRed Eye^Y group targeted the .gov websites and the ^XIr4dex^Y group targeted the .com, .edu, .org and .net websites. MyCERT is not sure if this could be a web defacing competition between the two hacker groups or it could also be a joint venture web defacing between two of them.
MyCERT also received information from the APCERT team members regarding the ^XRed Eye^Y group, which has been targeting at a number of global government web sites, as well. Besides Malaysia, MyCERT received information that many .gov websites in China, Hong Kong and Taiwan were defaced by the ^XRed Eye^Y group.
Based on MyCERT^Ys analysis and findings of previous incidents, majority of web defacements were due to vulnerable and unpatched services running in the server. Web defacements involving Linux machines are due to running older versions of Apache servers, PHP scripts and OpenSSL. Like the IIS web servers, web defacements were commonly due to Microsoft IIS extended Unicode directory traversal vulnerability, Microsoft Front Page Extension vulnerability and WEBDAV vulnerability.
Details of the above vulnerabilities and solutions are available in recently released MyCERT Quarterly (Q4) summary which is available at:
[https://www.mycert.org.my](https://www.mycert.org.my/)
MyCERT would like to urge all System Administrators and owners of websites to upgrade and patch softwares/services/applications they're currently running on. In addition, it is also recommended to disable unnecessary/ unneeded default services supplied by vendors. MyCERT encourages system administrators to consult MyCERT for further advises and assistance, if they have difficulties in proper securing and hardening of their servers.
MyCERT can be reached at:
Tel: 03-89961901
Fax: 03-89960827
Email: [https://www.mycert.org.my](https://www.mycert.org.my/)