US Government Site Hacked - Now Serving Up Spam

The offending pages are still readily available more than 12 hours after reporting.

Account Hijackings are fairly routine, Quick actions to counteract are not.

(SALEM, Ore.) - I regularly get spam comments, but this morning I got one that gained my attention. The link was to a US Government Website. I won't give the full link (see images below) in text form but it was on http://collaborate.nist.gov/ which seems to be some sort of invitation only collaboration / wiki site.

I notified the webmaster address on the main NIST site at about 8:00 a.m. this morning ( August 7th 2009) and received a response by 8:30 a.m. asking me for my domain.

I was not sure of the relevance here, as the offending spam page they were so graciously hosting had been supplied. I responded and by then had another comment with another NIST page providing the spammers with free advertising.

Now more than 12 hours later I have still not had another email and the offending pages are still readily available.

The most likely cause is probably weak user passwords; that is what allows most hacking to take place. We like to imagine geniuses sitting in dark basements typing away until they break through, but usually it's just an automated program trying different username / password combinations.

Now it is expected that from time to time that Websites or computers will be taken over, hijacked, or defaced but what is particularly offensive is when reports to Government or large organizations do not result in a quick correction of the problem.

Image of Spam page

Click For Larger

Warning any links you may type in out of these images may take you to malware / spam sites and should only be viewed with javascript disabled (firefox)

Second Spam Page

Click For Larger

It is especially disturbing when the failure to be vigilant on security comes from such a technological Government organization as the NIST.

From the main NIST website

Founded in 1901, NIST is a non-regulatory federal agency within the U.S. Department of Commerce. NIST's mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. nist.gov: National Institute of Standards and Technology

Note: Another email listed on nist.gov has been contacted in the hopes it does not take weeks to simply delete the offending pages and secure the accounts compromised.