Microsoft Site Defacement Spurs IIS Flaw Rumors

By | June 19, 2006

Microsoft´s Web site for France was defaced by digital graffiti artists over the weekend. Normally, I wouldn´t call attention to this kind of childish and illegal behavior, except in this case the attacker appears to be only breaking into sites that run Microsoft Internet Information Services (IIS) server 6.0 on Windows Server 2003 installations.

The murmurs are basically that If Microsoft can´t secure its own site against defacements, then perhaps there is a previously unknown security flaw in MicrosofWeb server software being exploited here. I have no reason to believe this is the case; it seems more likely someone at Microsoft simply misconfigured the server. Either way, I´ve put a query in to the folks at Microsoft, and I will update this blog post once I hear back from them.

The Microsoft France site is still down as of this writing, but you can see a screenshot of the message left by the attacker here. This hacker or hacker group, which goes by the handle “TitHack”, has been busy lately, as evidenced by the hundreds of other sites running Server 2003 that have suffered the same attack recently.Read Full Story

Leave a Reply