United Nations hacked - email addresses and passwords leaked

Filed Under: Data loss, Vulnerability

United NationsPasswords and login details belonging to the United Nations have been published on the internet by a hacking group who believe that the UN is guilty of corruption.

The TeaMp0isoN hacking gang has leaked over one hundred usernames, email addresses and passwords that appear to belong to individuals at the United Nations Development Programme (UNDP), Organisation for Economic Co-operation and Development (OECD), UNICEF, World Health Organisation (WHO) and other groups.

The gang noted, when publishing their stash on PasteBin, that some of the userids appeared to have a blank password, news which will make many a system administrator groan and roll their eyes in exasperation.

TeamPoison posted the password details on the internet

The suspicion is that the hackers were able to take advantage of a vulnerability on the United Nations Development Programme website to extract the IDs, email address and passwords of users.

UN Development Programme website

TeamPoison included alongside its haul of stolen login details a taunt directed at the UN's online security team:

// The question now is... how?... We will let the so called "secutiy experts" over at the UN figure that out. . . .
------ Have a Nice Day....-

The TeamPoison hackers has previously made the headlines by defacing the RIM Blackberry blog in the wake of the London riots, and publishing private information about Tony Blair.

TeamPoison recently announced they were joining forces with Anonymous on a new initiative dubbed "Operation Robin Hood", targeting banks and financial institutions.

For more information on securing your website download our technical paper "Securing Websites" published by SophosLabs. In addition to advice on common attack techniques including SQL injection, the paper also discusses establishing a secure foundation for your site and how to deal with external service providers.

, , , , , ,

You might like

4 Responses to United Nations hacked - email addresses and passwords leaked

  1. Interested Observer · 1409 days ago

    Like Lulzsec did and th3j35t3r does, Team Poison merely use an unpatched apache exploit to gain access to their sites.

  2. Daniel Cooper · 1409 days ago

    This is probably just usernames and passwords from some online community, rather than to email accounts. The UNDP runs hundreds of these and they're effectively unmanaged.

  3. pr0f · 1409 days ago

    Rubbish, Interested Observer. They use SQL injection, which is actual to do with database configuration as opposed to anything else, and isn't really a true "exploit".
    I cannot stand TeamPoison.

  4. kick rox · 1409 days ago

    Script Kiddies.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at https://grahamcluley.com, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley