ISIS Hacks a Client Website
Scurvy bastards! Those degenerate terrorist swine over at ISIS, not content with fighting their unholy war on land, decided to open up a front in cyber-space against one of my clients by hacking their site. They had to make it personal. They had to involve me into it all.
It all started a few weeks ago. I was minding my own business, not doing anything remotely counter cyber-terrorism-y when I get the email. “Something’s up with our slider, can you have a look?”.
The slider I installed on the site has been finicky in the past and I thought this was just another version conflict or updating failure. Things were looking strange on the slider.
After a close inspection of the slider files I noticed something a bit strange. The CSS file had been modified. Hmmm… that’s odd. Knowing the client, I knew it was something that they wouldn’t mess around with. It was time for a closer inspection.
The ISIS Hacked Files
The custom CSS file from the slider plugin had been compromised. Well, that’s putting it a nicely, all the code had been deleted and this:
<body style=’color: transparent;background-color: black’><center><h1><b style=’color: white’>Hacked by Islamic State (ISIS)<title>Hacked by Islamic State (ISIS)<p style=’color: transparent?>
had replaced it.
Right… well, that’s not so difficult to undo. A quick delete and restore from a backup file solved the problem. Problem solved. Now time to stop the problem from happing again.
Stopping Future ISIS Hacks
Apparently, the file permissions were messed up and far too open. Being the dev guy and not systems admin for the client, after my quick fix I shot off an email to the client advising them to review and modify their file permissions on their server. Everything should be good now.
What I Learned
- The dumbasses over at ISIS have made a beginners mistake of confusing HTML for CSS. They added HTML to the CSS file which really didn’t have the intended effect that they wanted of having large white text over a black background. With a bit of a creative mind, it could easily have been done with CSS.
- This slider that I used has some serious security flaws in it.
- In a very small way, I’ve been involved in the war on terror
Of course, I have no way of verifying if this was really ISIS or just some bored, undersexed teenage kid playing around with malicious software or viruses. In any case, now, if I’m bored at a cocktail party I have a story to tell and a fancy title of freelance counter cyber-terrorist to give myself.
