Hackers Benefit from Flaws on Websites of London Mayoral Candidates

Criminals are trying to make some monetary gains from Londoners seeking information about the three principal candidates, contending in the Mayoral election, as opportunist cyber-squatters register a number of domain names applicable to Boris Johnson, Ken Livingstone and Brian Paddick, according to SecureTest, a penetration testing organization.

The fraudulent sites display pay-per click advertisements designed to cash in on unsuspecting visitors. Brian Paddick, a candidate from Liberal Democrat, who although hired Jerome Armstrong, the US 'blog father', to boost his Internet campaign, has faced minimal cyber-squatting.

On the other hand, Boris Johnson and Ken Livingstone have encountered the maximum attempts of cyber-squatting during the online election campaign. However, the criminals' targeting the two candidates quite differently. Livingstone has encountered a lot of negative cyber-squatting as is evident from the domain registrations such as kenlivingstone.org and ihatekenlivingstone.org.

Moreover, in the current hacking incident, both Ken Livingstone's and Boris Johnson's campaign sites suffer from XSS (cross-site scripting) vulnerabilities that enable hackers to divert users to the opponents' Websites.

Vulnerabilities of cross-site scripting nature create a situation, when hackers can insert a malicious script that redirects visitors to an entirely different Website, or insert an 'iframe' on account of which the infected site is forced to display a third-party Website's content.

On exploiting the XSS vulnerabilities, an image of Johnson appears on Livingstone's Website and vice versa. The vulnerabilities on both the candidates' sites are exploited via a common redirect. This is the search utility in the instance of Johnson's site.

Ken Munro, Managing Director, SecureTest, however, said that the mischief with the picture does not include hacking attempts on either site, as reported by ChannelRegister on May 1, 2008.

Munro further explained that it only involves passing someone a URL link that draws content off a different site, while the visitor thinks it is from the site he originally accessed.

SecureTest's team of penetration testers discovered these flaws after similar vulnerabilities were found on the Websites of Barrack Obama and Hillary Clinton in the United States. The current Internet prank is a typical and could potentially cause highly damaging consequences.

Related article: Hackers Redirect Windows Live Search to Malicious Sites

» SPAMfighter News - 5/7/2008