CRO website hacked


20 Feb 2007

Share on FacebookTweet about this on TwitterShare on LinkedInShare on Google+Pin on PinterestShare on RedditEmail this to someone

Share on FacebookTweet about this on TwitterShare on LinkedInShare on Google+Pin on PinterestShare on RedditEmail this to someone

The Companies Registration Office (CRO) website was hacked last December, resulting in the agency having to suspend publication of its gazette.

The CRO has confirmed that the defacement was discovered on 17 January by a member of staff who reported it to management.

Evidence of the attack can also be seen at Zone-H.org, an independent archive of cyber crime incidents which is maintained by security professionals. The CRO’s site is among the most prominent victims listed on the archive, although several other defaced Irish sites are also referenced.

The alleged attacker’s nickname is listed on the Zone-H site but their real name is not. It appears from the archive that the person has broken into many sites indiscriminately and the attack does not seem to have been targeted specifically at the CRO. A spokesperson for the agency said it did not know why it had been attacked.

The CRO website was not taken offline as a result of the defacement and it remains accessible to visitors. However, the agency has opted not to publish its gazette until a contractor has finished work on improving IT security on the website.

According to Owen O’Connor, vice-chairman of the Information Systems Security Association in Ireland, a website defacement like the one suffered by the CRO is not uncommon. “Although this has obviously had a significant impact on the CRO as an organisation, and on their customers, issues of this scale are occurring at a range of Irish organisations on a regular basis,” he told siliconrepublic.com.

He said that the issue should serve as an example to other organisations to begin preparing now to decide how they would respond to a similar problem. Last month the ISSA released a survey on cyber crime in Ireland and the results showed that in a quarter of all cases it took more than 50 man-days to respond to a cyber crime incident.

By Gordon Smith