[ISN] MS UK 0wn3d by hackers. Again

[InfoSec News]

http://www.theregister.co.uk/2004/05/25/ms_uk_defaced/

By John Leyden
25th May 2004 

D'oh. Microsoft's UK Web site was defaced early this morning by
previously unknown hackers called the OutLaw Group.

Headings on a page (www.microsoft.com/mspress/uk) plugging tech
manuals were altered to "Owned by OutLaw Group" during the brief
period the site was defaced. A Microsoft's spokeswoman confirmed a
page dealing with technical text books was "briefly replaced by
unauthorised content". Microsoft is investigating the incident. Beyond
stating it's confident that no customer data was jeopardised by the
hack, Microsoft is staying schtum about the embarrassing security
breach.

Successful hack attacks on Microsoft Web sites are nothing new, but
previous attacks have focused on spraying digital graffiti across the
front page of sites, especially those hosted by third party companies
at the time. The latest attack is a more subtle data poisoning assault
- the digital equivalent of urinating on Microsoft's back porch. It's
unclear what attack mechanism was used to inject the rogue content
onto the site, which runs IIS 6.0 on Windows 2003.

The timing of the attack couldn't be much worse for Microsoft. At
yesterday's TechEd conference the software giant was talking up the
capabilities of its Internet Security and Acceleration (ISA) Server
software in preventing security breaches. Today's attack does nothing
to help MS's pitch that the latest version of ISA Server is gaining
traction with server vendors and giving more traditional software
firewall vendors, such as Check Point, a run for their money.