Securing Cyberspace: Government Websites Targeted as Scammers Advertise Hacking Services

 

The incidents you described involve scammers who uploaded advertisements for hacking services onto official websites of various U.S. government entities, universities, and other organizations. These advertisements were in the form of PDF files and were found on .gov and .edu websites. The scammers claimed to offer hacking services for Instagram, Facebook, Snapchat, video games, and the creation of fake followers.

The researcher John Scott-Railton discovered these advertisements, and while it is unclear if the listed websites are a complete list of the affected sites, it appears that they may be connected. The scammers took advantage of misconfigured services, unpatched bugs in content management systems (CMS), and other security vulnerabilities to upload the PDFs to the websites. The PDFs themselves seem to be part of a scheme to generate money through click-fraud. Some of the advertised websites were reviewed by TechCrunch and were found to likely be fake, despite displaying the names and profile pictures of alleged victims.

The organizations affected by this campaign have stated that these incidents were not necessarily the result of a breach but rather the exploitation of flaws in online forms or CMS software, allowing the scammers to upload the PDFs. Some victims mentioned the content management system Kentico CMS as the source of the issue, while others described similar techniques without mentioning Kentico.

The affected organizations have taken steps to remove the PDFs and address the vulnerabilities. The California Department of Fish and Wildlife, for example, had a misconfigured form that allowed the upload of PDFs instead of pictures. The University of Buckingham in the U.K. mentioned old "bad pages" resulting from the use of a form. The Washington Fire Commissioners Association identified a vulnerability related to new members uploading files. Other organizations, such as the town of Johns Creek and the Administration for Community Living, reported removing the pages containing the advertisements.

Although the overall damage caused by this spam campaign is expected to be minimal, the ability to upload content to .gov websites is concerning not only for the specific websites involved but also for the broader U.S. government. Incidents like this highlight the potential risks associated with compromised websites, as demonstrated by previous cases such as Iranian hackers targeting a U.S. city's website in an attempt to alter vote counts. Election officials have expressed concerns about hackers targeting election-related websites as well.