# MA-319.062012: MyCERT Alert - Increase in Web Defacement Incidents

**Date:** 19 Jun 2012  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-319.062012  
**Advisory ID:** MA-319.062012

---

**1.0 Introduction**
MyCERT has observed significant increase in cyber security incidents 
**2.0 Impact**
Successful attack will affect the confidentiality, integrity of information and availability of the websites. This may further impact business activities of the affected organization.
**3.0 Technical Analysis**
Based on our analysis, the attackers are targeting web applications that are vulnerable to known attack techniques. Many of the successful attacks are due to:
- **Weak Password**
Attackers gain access by trying all possible common or default passwords and username combinations . We advise Administrators to use strong passwords and remove default or idle accounts.
- **Vulnerabile Third Party Components or Plug-ins**
Components of plug-ins that give an additional features to the website may be vulnerable to SQL-Injection, Remote File Upload or Remote File Inclusion that may allow the attacker to gain admin access or to upload a web shell. Users are advised to use the latest version of the plugins.
- **Improper File's and Directory's Permission**
Directory permission that are not properly configured may allow the attacker to upload a web shell or write to other directories (i.e. in a mass defacement incident)
- **Vulnerable Content Management Systems (CMS)**
Old version or outdated CMS (i.e. Joomla, Wordpress, etc) may contain known vulnerabilities that can be exploited by attackers. Users should ensure that the CMS that they are using are the latest version.
- **Reuse of Old Backdoor**
Backdoor programs installed by the attacker that have not been removed (from the previous incident) could be used to re-deface the website or gain access to the web server. Users are advised to do a thorough check to ensure that backdoor programs (i.e. web shell) do not exist on the system.
**4.0 Recommendation**
MyCERT advises all system owners to be alert and do the necessary to secure their websites. Please refer to the link in the references section for tips and best practices that can be applied to secure the websites.
Administrators may consider using  Web Application Firewall (WAF) as additional layer of mitigation for the website protection.
If your website is defaced or you observe an anomalous activities within your network, do not hesitate to contact Cyber999 via the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#36554f5453440f0f0f76554f54534445535543445f424f185b4f) or [[email protected]](/cdn-cgi/l/email-protection#432e3a20263137032e3a202631376d2c31246d2e3a)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i. [What you should know about web defacement](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=44279d4e-d0f7-4e49-b6c9-3e001532acc1
)
ii. [Steps for recovering from a UNIX or NT system compromise](http://www.auscert.org.au/render.html?it=1974&cid=1920)
iii. [Intrusion Detection Checklist](http://zeltser.com/log-management/security-incident-log-review-checklist.pdf)
iv. [Guides On Fixing Sql Injections Vulnerabilities](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=57c6ecda-55d1-4839-847d-9e441d1fc6d8
)
v. [How To: Protect From SQL Injection in ASP.NET](http://msdn.microsoft.com/en-us/library/ms998271.aspx)
vi .[ModSecurity](http://www.modsecurity.org/)
vii. [OWASP Top 10 Application Security Risks 2010](https://www.owasp.org/index.php/Top_10_2010-Main)
viii. [Strong Passwords](http://technet.microsoft.com/en-us/library/cc756109%28WS.10%29.aspx)
ix.[Improving Web Application Security: Threats and Countermeasures](http://www.microsoft.com/download/en/confirmation.aspx?id=1330)