New Zealand Herald falls victim to XSS prank

The hack caused the site's text to be reversed and photos and graphics to rotate clockwise

The New Zealand Herald's website had spinning photos and backwards text on Friday morning after it evidently was the victim of an amusing cross-site scripting attack.

The New Zealand Herald's website had spinning photos and backwards text on Friday morning after it evidently was the victim of an amusing cross-site scripting attack.

The New Zealand Herald's website had spinning photos and backward text on Friday morning after it evidently was the victim of an amusing cross-site scripting attack.

Cross-site scripting is an attack in which a script drawn from another website is allowed to run that shouldn't. In the case of the newspaper, the attack appeared to pull a piece of Javascript from the website of a Los Angeles-based software developer, David Lynch.

Lynch describes himself on his LinkedIn profile as working for deviantART, a social network for artists. He couldn't immediately be reached for comment, but it appears the batch of code, named "eyewonder.js," wasn't specifically intended to target the newspaper website, but rather is a general script designed to manipulate elements on a Web page.

Cross-site scripting, abbreviated as XSS, is one of the most common coding flaws in Web pages but can also have much more dangerous impacts than what visibly affected the New Zealand Herald. An XSS vulnerability can be used to steal data from a website or cause other malicious code to run.

The newspaper, which is owned by APN Holdings NZ Limited, could not immediately be reached for comment.

It may be coincidental, but a hacking conference called Kiwicon is due to kick off tomorrow in Wellington. Kiwicon's blog mentioned the New Zealand Herald's hack on Friday morning, along with two other security-related incidents: a Wi-Fi outage on an airport bus and payment system problems in Wellington.

It's not unheard of for hackers to show off their skills during conferences by attacking infrastructure or even the computers of other conference attendees. Kiwicon runs through Sunday.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

FILL IN THE SURVEY - AND YOU COULD BE A WINNER: ARN wants to hear from YOU. Tell us how you run a successful business and you could win an adrenaline-fuelled adventure of your choice. COMPLETE THE ARN SURVEY.

Tags securityAPN Holdings NZ LimitedExploits / vulnerabilities

More about APN

Comments

Comments are now closed

 
Computerworld
CIO
Techworld
CMO

Latest News

02:52PM
Australians are aware, educated about Big Data: MapR
09:45AM
Synnex named Apple’s third iPad distributor
09:27AM
Oakton: Most organisations have dug themselves an ERP hole, according to survey
08:12AM
Datacom Australia takes a hit, while group profits and revenue grow
More News
08 Sep
ITIL Foundation (incl. Exam)
10 Sep
CPX 2014
10 Sep
IT Leaders Lunch
16 Sep
Ingram Micro SMB Favourites Roadshow
View all events