CHAPTER 1 SPOTLIGHT ON CYBER THREATS NO. OF DEFACED SINGAPORE WEBSITES REPORTED IN 2018 WEBSITE DEFACEMENTS 129 85 69 64 57 47 36 36 14 JAN FEB MAR APR 3 10 IN CSA detected 605 cases of website defacement in Singapore in 2018, a 70 per cent decrease from 2,040 in 2017. These websites belong to a range of organisations – from government agencies, businesses, and media companies. Two Singapore Government websites were among those defaced. While most affected websites belong to Small and Medium Enterprises (SMEs), larger organisations were also hit. WEBSITE DEFACEMENTS (2016 – 2018) 1,750 Year 2016 2,040 Year 2017 Year 2018 605 For example, the Singapore website of a major Japanese advertising firm was compromised and replaced by a message “Sec == ‘0’” in January 2018. A spike in defacements observed in November 2018 was likely caused by an attacker exploiting vulnerabilities in an unpatched web server. 101 websites belonging to various businesses hosted on this server were compromised by the same attacker in a single day. Defacements are indicative of vulnerabilities present in a website’s underlying infrastructure. This may be a harbinger of more damaging cyberattacks, such as hosting malicious content on the website or using it as a platform to launch attacks. Defacements usually take place when unpatched/ outdated websites and their hosting servers are attacked. Common methods of intrusion include Structured Query Language (SQL) injections, websites were defaced previously In January 2018, the Singapore website of a major Japanese advertising firm was compromised, with its homepage replaced only with the message “Sec == ‘0’”. MAY JUN 20 JUL AUG SEP 28 OCT 20 NOV DEC where malicious code is inserted into the webbased application, and by gaining access to the web servers. Websites published on the WordPress platform remained the most targeted for defacements in 2018, continuing a trend observed since 2016. In Singapore, over a third of the websites defaced were built on WordPress. A WordPress file deletion vulnerability, first disclosed on 26 June 2018 and affecting all versions of WordPress up to then, could allow an attacker to have full control over the website. WordPress released an updated platform version that fixed the vulnerability on 5 July 2018, and SingCERT published an alert a week later, advising WordPress website owners and web hosting providers to update to the latest version immediately.2 However, as of March 2019, about 40 per cent of the defaced WordPress websites had yet to be patched to the latest version. Worryingly, 185 of the defaced websites – or about 30 per cent of the cases – were defaced previously. Re-defacements suggest that website owners have yet to take appropriate security and patching measures to protect their websites, even after being attacked before. The variety of intrusion and compromise methods underlines the importance of using stronger login credentials and timely patching of known vulnerabilities. 2 “[SingCERT] Alert on WordPress 4.9.7 Security Release,” SingCERT Advisories & Alerts, 12 July 2018, https://www.csa.gov.sg/singcert/news/advisories-alerts/alert-on-wordpress-4-9-7-security-release. 12 13