MI5 Website Breached By Hacker

Jack Spine writes "UK intelligence agency MI5 has admitted that its website security was breached by hacker group Team Elite. A member of the hacker forum posted details of the hack last week, which took advantage of a cross-site scripting vulnerability in the site's Google embedded search. MI5 admitted the breach on Wednesday, but said that the flaw had not been exploited maliciously."

Better headline

[BadAnalogyGuy]

MI5 allows websurfing on critical computers.

Seriously. How else would you get hit by CSS?

meh

[Anonymous Coward]

It's a sort of script-injection vulnerability where you'd have to click on someone else's link to the MI5 site. I suppose it could steal cookies from someone stupid enough to click on a long link from an unknown person, but it's not like the site itself was hacked or anything, which is what "website breached by hacker" strongly implies.

A bit misleading ...

[crowemojo]

I see this and think the word "Hacked" gets thrown around a bit too easily. This is an example of non-persistent (also referred to as reflected) cross site scripting. This means that in order to take advantage of it, they have to convince a target to visit their specially crafted link. To me, "Hacked" sort of implies "They got in!" or "Data was breached!" or other such bad things and that simply isn't the case here.

So what does this type of XSS do? Mostly embarass people because defacement examples are posted to "look what I can do" forums (which is basically what happened). Think about the attack vector here, they have to get a victim to visit their specific url that includes their attack. How is that done? Malicious email, posting the link to some website or forum and hoping they find it and visit, embedding the link in other sites that have been hacked or something like a banner ad, or whatever. All of these involve the target going out of their way to visit this maliciously crafted url. When you consider that they could still do all these things without XSS and simply host malicious code themselves, all this reflected XSS is doing is making it a bit harder for an end user to spot that this is something non-standard and dangerous.

Think of it this way, "With reflected XSS, I can send them a link, and if they visit it, I can do bad things to their computer!" but then again, you can do that without XSS too, it just isn't quite as effective. How many users are taking the time to carefully look at a link before clicking on it, checking to make sure it contains the domain name they expect and not just an IP address, or a domain name that is similar, but not quite right, etc. A user who is doing this sort of thing will more likely fall victim to this XSS attack, but most users, who don't scrutinize things at that level, were just as susceptible to a classic phishing/malicious linking attack anyways.

Re:meh

[morgan_greywolf]

The exploit is that people, especially in the U.K., will tend to trust results of a search that appear to be emanating from the MI5 website [imageshack.us], and hence, with a well-formed set of "search results," a site could be setup that mimicks MI5's, thus tricking people into revealing passwords, credit card numbers, etc.

Yeah, it's the work 4m4t3ure p0s3rz, but hey, what did you do last week?

Re:Shit it's Neo

[Chrisq]

How could they ever abuse this "hack" anyway? "Hey man check the MI5 website by following my link here, it's a really cool governmental agency really. Please click!"

Hey, did you know that someone on the MI5 site with your name is listed as a terrorist. He lives in the (your city) region as well. I'd watch out if I were you, someone might get the wrong idea. Here's a link [mi5.gov.uk] so you can check it out yourself.

Re:NSA anyone ?

[gad_zuki!]

I doubt the NSA cares. Their public websites arent hosted or even maintained by the people who do their cracking. The probably have a hosting service and if the site gets defaced or goes down, its no big deal. Its not exactly sitting on some high security LAN.

Websites are the low hanging fruit in the hacker community. Its like spray painting my garage. You can be a jerk if you want to, its just not worth it to obsess over protecting said garage.

Re:Competence

[Shakrai]

It's hardly surprising since the pay at MI5 is abysmal. I requested an information pack during my last year of university but lost interest when I found MI5 was about the worst paying graduate recruiter and especially bad for central London

That's not really that unusual for Governmental agencies. I would imagine that most people who go to work for MI5/CIA/Mossad/etc are not doing it for the money.

Re:meh

[jeremyp]

No. James Bond works for SIS aka MI6.

This would never have happened before Colin was murdered.

http://en.wikipedia.org/wiki/Colin_Wells_(Spooks) [wikipedia.org]

Re:A bit misleading ...

[maxwell demon]

You mean links like this? http://www.mi5.gov.uk/ [slashdot.org]