Update (Tuesday, 00:10): According to a statement of the Spanish government, there has been an XSS weakness in the presidency website.
However, this resulted not in a manipulation of the content of the site itself but in a manipulation of what the user was seeing on the screen (as you can see on the screenshots below). These manipulated websites are supposed to be only accessible through the specific URLs they are linked with and are thus no general threat for the users, the officials say in the statement. I hope I have translated this correctly; the original version applies.
There is also a very informative blog post in Spanish explaining the factual and technical background of this story (via a tweet of the Spanish state secretariat for communication), including the shortcomings and misinterpretations in the coverage of this story.
Update (20:10): The Spanish secretary of state for communication has been issuing a message on Twitter saying that the pictures below are photomontages.
However, these are original screenshots from subpages (not the frontpage!) of the presidency website (the links to these subpages are below in the text although they don't reproduce the original shots anymore). Other users on Twitter confirm this here and here.
More important than the Mr. Bean photo that has been taken up by many was the "hi there" window that opened in my browser when opening the second link provided below - this was definitely some kind of code because it triggered a direct browser activity, and I then had to close the little window that you see on the screenshot.
As I have said in my post, I am no technical expert and I cannot say how grave such kind of things are, but they happened in front of my eyes.
Update (11:30): It seems like the problem has been fixed, both the picture of Mr Bean and the "hi there" message have been removed, the links provided below just show ordinary "no results" pages now.
I am no expert in IT security, but it seems like the website of the Spanish EU Council Presidency is not secure, despite the fact that
At the following web discussions - here, here and here - people say that the site can be attacked due to XSS, and they provided two links - here and here - that brought the following two results on the actual web page of the presidency (though on sub-sites, not on the frontpage), apparently externally embedded code showing a picture of Mr Bean and a message saying "hi there" (both screenshots made at 03/01/2010 23:00):
I suppose that this is no minor problem and needs rapid fixing.
PS.: I was made aware of this problem by alvaromillan on Twitter.
Update: I tried to send an email informing about the issue to the contact address of the Telefonica web team - ue2010 [..at..] telefonica.es - as provided on the Contact site of the presidency website, but the email was returned as "Unknown user". Very, very strange...
Update: At around 10 am I have sent an email to the Communication Advisor of the Spanish Representation informing about the issue.
15 comments:
For Spaniards it's especially funny that the image that appears is that of Mr. Bean, as parodies often our president Zapatero for his resemblance to the British humorist ;)
Good start for the Spanish presidency... ¬¬
Julien,
As I noted in an 'obiter dictum' on my blog yesterday, the Spanish presidency website was down in the morning, Sunday.
But last time I looked, events had appeared, so all news is not bad.
Well, we noted the calendar thing on Twitter during the day yesterday.
But a security weakness that allows the inclusion of external code (if this is what actually happens) is a different kind of problem.
I've now sent an email to the webmaster since it seems the problems has still not been solved (both links work at 9:20 am).
Julien,
The European Digital Agenda I've been writing about lately is in the hands of the Spanisch EU Council presidency.
It would be reassuring to know that they are able to structure, fill and manage even their own website in a meaningful and secure manner.
I suppose the adequate response should be: LOL.
Julian, just for curiosity, have you received any reply to your mail?
Not yet.
Julien,
The Spanish presidency website must be jinxed; I tried repeatedly just before 14:40 EET, and the pages were down again.
Julien,
To Bean, or not to Bean ... but I hope that the Spanish government starts looking at the more serious issues of how its presidency pages aren't up to best standards with regard to materials, navigation etc.
That's not hacking. It's just searching for an HTML fragment.
I have never said it was hacking, I reported the discussions in the web fora, including the links, and made screenshots of what I actually saw, because there seemed to be some kind of issues I was not qualified to judge but still able to witness.
I also noted already that the main email adress of the Spanish presidency is non-functional :(
What I found interesting: German media reports that the website contract for the 6 months costs about 12 mio Euros. This is the real shame, given its low level quality.
PS: Your story got a link in the FT Brussels blog
Still Woking, would you like to see more secured content?, hahaha
Here the resukt,
http://editurl.com/733
the site is down again (18:40 CET Tuesday)...
rosetta stone spanish discount
Post a Comment