A source e-mailed me, then met me at a cafe with wireless internet and proceeded to demonstrate how easy it was to take control of the webserver of Riga International Airport. My source, an IT specialist employed by a respectable company, said it would probably be easy to get into the airport's intranet or internal web, as well as its mailserver. Sensitive information with regard to security, anti-terrorist precautions, etc., could probably be found on both. One reason for this could be that the webserver, at least, was running Windows NT4, as installed in 2000 and that there seemed to be no apparent security precautions.
What was demonstrated to me was how to command the server to access an image from another website, an indication that other commands given by non-authorized parties could be executed or inserted remotely, including malicious code and malware. This will be in my day job newspaper on November 10.
Above is a screenshot of the "experiment". The person in the image has nothing to do with any of this, it was randomly lifted from www.face.lv, a social networking site.
9 comments:
Big news. Expect to see a lot of shouting and finger-pointing? NT4, installed in 2000, no patches, servicepacks, updates, nothing? Somebody is getting the sack for this.
>>IT specialist ... said it would probably be easy to get ... could probably be found ... could be executed .
I do not understand where is the hack? Anyone can detect remote OS by using free internet scanners (example: http://uptime.netcraft.com/up/graph?site=www.riga-airport.com). By the way, this Win-server with IIS is behind a linux firewall.
Hacking is the act of gaining unauthorised access to a computer system. Access the image from another web-site isn't a hacking.
Seems that young IT admin from the respectable company has found "Hack for dummies" manual and is trying to make the name for himself.
The "hack" was that he could order the Riga Airport server to fetch the image. Admittedly, it is difficult to double check if you are not an IT person yourself, but the source worked for a serious company and didn't look like he had flipped out. If he needed the publicity, he would have used his name.
It is not a hack. Your admin demonstrated how to open remote URL in a specific frame.
Ask him to deface this site or show remote passwords. And you will receive an answer: it is not possible.
appli, you're wrong. There are lots of possibilities if external content can be imported. This is a pretty old vulnerability, though.
That is not ar really hack. nothing serious. Like - http://www.riga-airport.com/index.php?view=html&id=///&lang=http://fight.eclub.lv , doesn mean that i have access to data on server, lilt correction in URL and woila!
If there is such possibility, to show contents of different webpage inside RIX website, I bet there are other vulnerabilities too. If developer of that site thinked about security issues, he would not allow such things to be possible.
Kindly tell me if they capture biometric data of passengers landing at Riga Airport. If "yes", how is it done, eg by taking fingerprints or photos of passengers at Passport control desk, etc
Regards
nastasiaprincess@gmail.com
Очень интересно!
Расскажите мне больше об этой заброшенной дороге/ах, по которой/ых можно пересечь границу. И о неохраняемых местах белорусской границы.
nastasiaprincess@gmail.com
Very Interesting!
Can u plse tell me of more abandoned and unguarded border crossings on the totality of the Belarus border?
nastasiaprincess@gmail.com
Post a Comment