Ohio Gov. Kasich’s website, dozens of others defaced using year-old exploit

"High risk" exploit patch was issued in May of 2016.

Attachment 5772

The official website of Ohio Governor John Kasich and the site of Ohio First Lady Karen Kasich were defaced on June 25 by a group calling itself Team System DZ. The group is a known pro-Islamic State "hacktivist" group that has repeatedly had its social media accounts suspended for posting IS propaganda videos and other activity. Kasich's site was but one of a number of state and local government websites that were hijacked by Team System DZ early this week, all of which had one thing in common: they were running on an outdated version of the DotNetNuke (DNN) content management platform.

DNN Platform is a popular content management system (particularly with state and local governments) based on Windows Server and the ASP.NET framework for Microsoft Internet Information Server. DNN Platform is open source and available for free—making it attractive to government agencies looking for something low cost that fits into their existing Windows Server-heavy organizations. A review of the HTML source of each of the sites attacked by Team System DZ showed that they were running a vulnerable version of the content management system DNN Platform—version 7.0, which was released in 2015.

A critical security update issued by DNN in May of 2016 warned that an attacker could exploit vulnerabilities to create new "superuser" accounts through the content management system, giving them unfettered remote access to modify websites. DNN urged customers to upgrade to the latest version of the software at the time. A May 2015 alert also warned that an attacker could use the software's Installation Wizard page for some server configurations to create new user accounts on the Windows Server host.

Attachment 5770

Attachment 5771


Each of the government sites attacked by Team System DZ were defaced with the same message. Along with a "Team System DZ" logo bearing the Arabic script of the Shahada, the Islamic creed, the defaced pages included the text: "You will be held accountable Trump, you and all your people for every drop of blood flowing in Muslim countries... I love Islamic State." A tally of the sites defaced was updated on a Facebook account associated with the group. The tally includes the Ohio sites and sites for:

The Rhode Island Department of Education,
Washington State Department of Health
Howard County, Maryland
Several New York state townships, including Brookhaven, Highlands, New Windsor, and Cornwall
A Jordanian government website
Ars attempted to contact DNN for comment, as well as the affected state and local agencies. We have not yet received a response.

This sort of exploit of well-known Web vulnerabilities is all too common with government websites, which are often configured by contractors and hosted remotely by large service providers or on small local servers. In 2012, members of the "Antisec" hacker collective took over a Web server belonging to the Federal Trade Commission by using a Plesk hosting management platform exploit. Weaknesses in a Drupal site's configuration at the University of Maryland allowed a hacker to use a PHP-based remote shell backdoor to access the university's LDAP directory and the university president's Social Security number. And access to other compromised government servers across the world is sold illicitly every day through hacker marketplaces such as xDedic.