S'pore PA site breach signals more to come

SINGAPORE--The security breach earlier this week affecting Web sites operated by government statutory board, People's Association (PA), may be "random" but more attacks on government sites are set to come, and loopholes exposed in the country's IT security posture must be fixed.

A government entity which promotes racial and social cohesion in Singapore, PA's Web site was hacked and defaced on Sunday by hacker group "HighTech Brazil HackTeam". The hackers also attacked 16 other sites operated by PA's subsidiaries. As of Wednesday, 9 out of the 17 sites had been restored, according to local news reports.

Stree Naidu, vice president of Imperva Asia-Pacific, said the attack had been committed by hacktivists motivated by a desire to "humiliate" their targeted victims, which is why HighTech Brazil Hack Team did not shy away from taking responsibility for the attack.

There were also no unique campaigns or reasons as to why these targets were selected, he remarked. The PA sites were targeted primarily because of their high visibility as government and they were widely-used community sites, Naidu said.

Ngair Teow-hin, CEO and founder of SecureAge, warned more attacks are set to come, especially with hackers who want to "show off" their skills to the world. "They will pick Singapore randomly just like they do with all the other governments. Specifically, they will attack any site they can penetrate," Ngair said.

Naidu agreed, adding hacktivists can strike again in the future, especially after this week's high-profile incident involving the PA sites, along with more severe consequences such as financial losses due to the breach and data thefts.

Gaps in Singapore's IT security must be plugged
While information on the breach is currently unknown, all PA sites had been compromised at the same time because they were built by the same vendor who had used the same software and system configuration, Ngair noted. This allowed the same security hole to be exploited for one single attack, he said.

The incident also indicated there were still gaps in Singapore's IT security infrastructure which needed to be plugged, Naidu observed.

Elaborating, Eric Chan, Southeast Asia and Hong Kong regional director of Fortinet, said the breach occurred because hackers exploited weaknesses and vulnerabilities in the organization's networks and applications. This showed their systems had not been robust enough to cope with the ever-changing threat landscape, he explained.

It underscores the need for businesses to upgrade their Web security defenses with next-generation secure Web gateways and reverse-proxy tools to protect Web servers, advised Jon Andresen, chief product evangelist at Blue Coat Systems.

Ngair added the Singapore's computer emergency response team (CERT) could also play a bigger role in engaging government agencies to ensure their systems are continually updated to prevent newly discovered vulnerabilities.

While contacted for comments, PA did not respond in time for this report.

Singaporeans mostly apathetic about future breaches
Not all Singaporeans felt there was cause for worry following the PA hack, which was the first breach to hit a government site in 13 years.

Marketing executive Olivia Chu, for one, said she "didn't really care" about potential future hacktivism attacks on government Web sites. "It's no use worrying, the hackers will still come whether we like it or not," she said.

Student Jasper Tan, too, said it was "not a cause for concern" because it did not affect a critical government agency such as the Ministry of Defense. "It was probably a one-off incident in which hackers were having fun and not planning future attacks", he said.

Rasheed Abu Bakar, a public relations executive, was less apathetic. While he felt "safe" in Singapore's IT environment, the fear of getting hacked will always be on the back of his mind after this incident, Rasheed noted.

Another Singaporean, Peace Chiu, described the recent breach as "very worrying". "It really makes me wonder what these hackers are looking for. Since it doesn't seem to be money, I'm pretty sure they will be back," Chiu said.