Sophos Cloud Optix
Passwords and login details belonging to the United Nations have been published on the internet by a hacking group who believe that the UN is guilty of corruption.
The TeaMp0isoN hacking gang has leaked over one hundred usernames, email addresses and passwords that appear to belong to individuals at the United Nations Development Programme (UNDP), Organisation for Economic Co-operation and Development (OECD), UNICEF, World Health Organisation (WHO) and other groups.
The gang noted, when publishing their stash on PasteBin, that some of the userids appeared to have a blank password, news which will make many a system administrator groan and roll their eyes in exasperation.
The suspicion is that the hackers were able to take advantage of a vulnerability on the United Nations Development Programme website to extract the IDs, email address and passwords of users.
TeamPoison included alongside its haul of stolen login details a taunt directed at the UN’s online security team:
// The question now is... how?... We will let the so called "secutiy experts" over at the UN figure that out. . . .
------ Have a Nice Day....-
The TeamPoison hackers has previously made the headlines by defacing the RIM Blackberry blog in the wake of the London riots, and publishing private information about Tony Blair.
TeamPoison recently announced they were joining forces with Anonymous on a new initiative dubbed “Operation Robin Hood”, targeting banks and financial institutions.
For more information on securing your website download our technical paper “Securing Websites” published by SophosLabs. In addition to advice on common attack techniques including SQL injection, the paper also discusses establishing a secure foundation for your site and how to deal with external service providers.
Like Lulzsec did and th3j35t3r does, Team Poison merely use an unpatched apache exploit to gain access to their sites.
This is probably just usernames and passwords from some online community, rather than to email accounts. The UNDP runs hundreds of these and they're effectively unmanaged.
Rubbish, Interested Observer. They use SQL injection, which is actual to do with database configuration as opposed to anything else, and isn't really a true "exploit".
I cannot stand TeamPoison.
Script Kiddies.