New Zealand Herald falls victim to XSS prank

The hack caused the site's text to be reversed and photos and graphics to rotate clockwise

The New Zealand Herald's website had spinning photos and backwards text on Friday morning after it evidently was the victim of an amusing cross-site scripting attack.

The New Zealand Herald's website had spinning photos and backwards text on Friday morning after it evidently was the victim of an amusing cross-site scripting attack.

The New Zealand Herald's website had spinning photos and backward text on Friday morning after it evidently was the victim of an amusing cross-site scripting attack.

Cross-site scripting is an attack in which a script drawn from another website is allowed to run that shouldn't. In the case of the newspaper, the attack appeared to pull a piece of Javascript from the website of a Los Angeles-based software developer, David Lynch.

Lynch describes himself on his LinkedIn profile as working for deviantART, a social network for artists. He couldn't immediately be reached for comment, but it appears the batch of code, named "eyewonder.js," wasn't specifically intended to target the newspaper website, but rather is a general script designed to manipulate elements on a Web page.

Cross-site scripting, abbreviated as XSS, is one of the most common coding flaws in Web pages but can also have much more dangerous impacts than what visibly affected the New Zealand Herald. An XSS vulnerability can be used to steal data from a website or cause other malicious code to run.

The newspaper, which is owned by APN Holdings NZ Limited, could not immediately be reached for comment.

It may be coincidental, but a hacking conference called Kiwicon is due to kick off tomorrow in Wellington. Kiwicon's blog mentioned the New Zealand Herald's hack on Friday morning, along with two other security-related incidents: a Wi-Fi outage on an airport bus and payment system problems in Wellington.

It's not unheard of for hackers to show off their skills during conferences by attacking infrastructure or even the computers of other conference attendees. Kiwicon runs through Sunday.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

2015 State of The IT Channel Survey : IT'S TIME!!! Fill in this year's State of the IT Channel Survey and be in the running to win great prizes. CLICK HERE

Join the ARN newsletter!

Error: Please check your email address.

Tags securityAPN Holdings NZ LimitedExploits / vulnerabilities

More about APN

Show Comments
 

Latest News

Mar 27
AppSense takes the wraps off its new analytics platform
Mar 27
SugarCRM beefs up its global executive team with three new hires
Mar 27
'Do Not Call' spam phone call legislation passed
Mar 27
HubOne lands its first channel partnership in Australia
More News
30 Mar
Australian experts to address cybersecurity challenges and solutions at Canberra...
21 Apr
APJ Progress Spark Conference
22 Apr
2015 Innotribe Startup Challenge
27 Apr
Disruptocon
View all events