Lady Gaga fansite, NBC entities defaced in pre-Guy Fawkes Day hacker stunt
Hackers calling themselves Pykic apparently exploited forum software.
A number of pages on the NBC.com website were defaced Sunday with a reference to Guy Fawkes Day and a claim that user names and passwords for the site had been compromised. The defacement appears to be the work of one hacker who exploited a security flaw in the community software used to manage user's accounts.
The defacement included part of a traditional Guy Fawkes Day poem ("Remember, remember, the fifth of November / The Gunpowder Treason and plot"). It affected NBC's homepage, its video homepage, and the site for Saturday Night Live among others. As of 3:00pm EST today, the site had been restored—though some pages were re-defaced as NBC attempted to repair the damage over the course of the day. (With all the issues, NBC has disabled user logins.) The defacement also included a claim user accounts and passwords had been compromised ("User info exposed, passwords dumped").
The attack appears to have exploited a vulnerability in community forum software used by NBC. The same hacker or hackers call themselves Pykic. They used the same defacement on Gaga Daily, a Lady Gaga fan site, and used cross-site scripts pulled from a Norwegian fisheries and marine biology website's discussion board server. NBC, the Gaga site, and the Norwegian site all use software from Invision Power Services to power discussions on their sites. Invision posted a critical security update to their online community software on October 25. Invision and NBC were unavailable for comment.
(Link contains Photos of these hacked web pages.
Lady Gaga fansite, NBC entities defaced in pre-Guy Fawkes Day hacker stunt | Ars Technica