Hacked Cloud computing host causes US Treasury websites suspension
Four USA Treasury Web sites have been taken-offline after their cloud computing host was hacked. The attack caused users to be redirected to a malicious site in the Ukraine.
The four URLs infected were BEP.gov (Bureau of Engraving and Printing), BEP.treas.gov, Moneyfactory.gov and Moneyfactory.com. The type of attack was a script injection that redirected users. The attack was unusual in that only IP addresses that had not previously visited the Treasury site were targeted, which made it difficult for authorities to track.
Roger Thompson, chief research officer at AVG Technologies, first noticed the attack on Monday (03 May 2010). He is reported as explaining that the hackers added a small snippet of almost undetectable iframe HTML code that redirected visitors to a Web site in the Ukraine. This site then launched a variety of Web-based attacks based on a commercially available attack-kit called the ‘Eleonore Exploit pack’.
The Ukrainian Web site is associated with similar attacks, which targeted a small number of known software bugs, including flaws in Adobe Reader software.
In a statement, the USA Treasury said “The Bureau of Engraving and Printing (BEP)entered the cloud computing arena last year. The hosting company used by BEP had an intrusion and as a result of that intrusion, numerous BEP and non-BEP websites were affected”.
At the time of writing this, the Web sites are still suspended and it isn’t clear how the hackers managed to install malicious code on the Treasury Department Web sites.
.
Final thoughts ….
The headlines suggest that the vulnerability is at the Cloud infrastructure level instead of the individual Web services hosted on it. Exact details aren’t yet know, but let’s hope it isn’t a ‘cloud computing’ issue, as it could impede the deployment of cloud services to companies who are already nervous about jumping into a cloud service provider.
This issue does highlight just how important security is for the underlying cloud infrastructure layer, because an issue at this layer can potentially impact all services running on it.
.
