[ISN] Hacker derails tax site

[InfoSec News]

http://miva.sctimes.com/miva/cgi-bin/miva?Web/page.mv+1+local+798546

By Kirsti Marohn
Mar. 10, 2005

A computer hacker derailed a portion of Stearns County's Web site for
about 13 hours this week.

Internet users who clicked on a feature that usually allows them to
search for information about their property and taxes were redirected
to another site.

The problem began about 9:30 p.m. Tuesday and was corrected by
Wednesday morning.

It was the first time the county's site has been the victim of
hackers, said George McClure, information services director.

Like many Web sites, the county's Web server uses Microsoft software,
a favorite target of hackers. The company frequently distributes
patches to correct software problems.

A vendor that manages a portion of the Stearns County site apparently
didn't correctly install a patch, McClure said. That led to a hacker
targeting government sites - those with addresses that end in "us" -
to redirect visitors to a page with a picture of a Turkish flag.

"It's more of a nuisance than malicious," McClure said.

County workers were alerted to the problem Tuesday night via e-mail
from a Sauk Centre resident. They installed the patch, changed several
passwords to guarantee the site was secure and got it back online by
about 10:30 a.m. Wednesday, McClure said.

While this is Stearns County's first experience with hackers or a
virus, they are fairly common, McClure said. Keeping up with the
patches is an ongoing battle, he said.

Internet users who want to pay their property taxes online needn't
worry, McClure said. The payment feature is managed by a different
company and is an encrypted connection, he said.

No financial or credit card information is stored on the county's
site.