Web Sites on Alert for Hacker Contest

Security experts have warned that the holiday weekend could bring an onslaught of defacement attacks on U.S. Web sites, not as a result of anti-American sentiment, but instead because of a purported contest among domestic hackers.

"The Defacers Challenge" reportedly is a race to see which computer hacker can be the first to deface 6,000 different Web sites in a six-hour period on July 6th, potentially impacting thousands of corporate sites.

Despite the rumors, however, the security community does not agree on how much of a threat really exists. Some speculate that the contest, publicized briefly on a site that was taken offline by Wednesday afternoon, is little more than a hoax.

Just in Case

Still, most gurus are urging companies to take extra security precautions heading into the weekend -- a logical time for such an effort, since many corporations will be all but shut down starting July Fourth.

Internet Security Systems (Nasdaq: ISSX) raised its alert level for potential Web attack activity to 2 on a scale of 1 to 4 because of the contest, though it said its experts still are attempting to "determine the effect the competition may have on the Internet."

Pete Allor, manager of the X-Force threat intelligence service at ISS, said system administrators are "strongly encouraged" to ensure that "all known security issues have been addressed."

"Companies shouldn't wait until Sunday, because by then it might be too late," he added.

Be Prepared

Likewise, Stuart McClure, CTO of network security firm Foundstone, told the E-Commerce Times that regardless of whether or not the threat is real, "enterprises have a responsibility to make sure the proper security measures are in place to protect themselves."

McClure said Foundstone is urging large organizations and government agencies that may be the most likely targets of such attacks to take precautions. For example, they should ensure that the latest patches and service packs have been applied to all software and should change default passwords to unique ones.

"Security is an ongoing battle," he said. "It is imperative that companies see threats through to remediation to ensure that their network is protected."

Waiting, Watching

Although the Computer Coordination Center, which handles official security advisories, has not issued a formal warning, the FBI reportedly is monitoring the event. Other security firms also say they have seen increased scanning of Web sites for vulnerabilities, a possible indication that hackers are scouting for sites that can be easily defaced Sunday.

Some hackers view Web site defacement as a harmless prank that could win them accolades from hacker publications, such as 2600.com, but there have been recent international prosecutions for the crimes, which can cost companies thousands of dollars in repair time and lost revenue from Web sites. For instance, authorities have brought charges in connection with the defacement of the Al-Jazeera English-language Web site during the Iraq war.

ISS and other firms said steps to combat the potential threat include checking that firewalls are working properly, ensuring that Internet intrusion detection logs are checked regularly and updating all antivirus software.

The anonymous sponsors of the purported contest are said to be offering the winner free Web space.