The hacking group Greek Insane Society carried out a double attack with simultaneous data extraction against the National Technical University of Athens (ntua.gr) and the Panhellenic School Network (Sch.gr)!
According to EXCLUSIVE information brought to the attention of the SecNews editorial team and confirmed with evidence, hackers with the pseudonym GIS (Greek Insane Society) managed to gain access to sensitive servers belonging to both the National Technical University of Athens and the infrastructure of the Panhellenic School Network of the Ministry of Education, Lifelong Learning and Religious Affairs.
Specifically, according to the information shared with SecNews and which we publish with all reservations, the Greek Insane Society gained unauthorized access to the NTUA Network Center and to the infrastructure of the Panhellenic School Network. The NTUA NOC, which was targeted, has undertaken all obligations related to the organization and operation of the NTUA network, including the Digital Certificate Service, the network connection registration application, the identification service, the VPN remote access services and the entire management of the central servers.
Correspondingly, the Panhellenic School Network SCH.GR is the largest public network that interconnects all schools, teachers and a number of administrative services and supervised bodies of the Ministry. It also supports the administrative work of Education, as it has e-governance applications for the management of education, such as for example for the collection of data on student and teaching staff, for the planning and implementation of teacher recruitment and their payroll, for the distribution of books, etc. We remind you that SCH.GR has been targeted in the past by hacker groups several times.
Attack details
According to the analysis of the data provided to the SecNews editorial team by the Greek Insane Society, it was found that both attacks were carried out using SQL Injection vulnerabilities that led to the additional extraction of data and information. The data and information extracted include usernames and passwords as well as personal data. According to what is evident in the screenshots - evidence that has been sent to SecNews and that cannot be disputed, Publicly available tools such as SQLMAP . With an appropriate structuring of the SQL Queries, it is possible to recover passwords and website data. We list the data that GIS made public, having proceeded to the relevant concealment of data/personal data so that they are not used by third parties.(Editor's Note: The data that was communicated to us, upon request of GIS, is available to any competent person who wishes from the NTUA.GR+SCH.GR services that were targeted).
Evidence of a cyber attack on NOC.NTUA.GR
Evidence of a cyber attack on SCH.GR
The exact URL and the vulnerability that granted access to the Greek Insane Society are not made public for obvious reasons.
From the analysis of the SecNews technical team on the data sent, it was found that there are numerous weaknesses in multiple parameters of the websites, which makes them accessible to anyone with an average or low level of knowledge and the use of publicly available tools!
The Greek Insane Society has been busy in the past with their attacks on the NSA and FORTH (forth.gr) as well as identifying weaknesses in TAXISNET. In the manifesto they sent to the editorial team regarding their latest double attack, they state, among other things:
We are not black-hats even though we have such members. Our goal is to inform and help as much as we can without causing damage! The goal of the GIS group is a better Greece and a safer cyberspace, so that we do not allow third parties to invade the computing infrastructures... Greece has not taken security seriously, it would be good to shake it up a bit.
All members of the Greek Insane Society group are young in age and everything we do is only for a good cause, (white hacks).
We would like all these security gaps that we identify to be made public to the authorities, without causing misunderstandings and naturally creating any problems. We know that what we are doing is illegal, I simply believe that Ethical Hacking in Greece should not be punished, but rather rewarded in some sense. Especially when we do not tamper with anything in the slightest and we never have malicious intentions.
Our main goal is to immediately inform citizens about "Troop Greece", at least as far as the computer systems, for which we have all paid, are concerned! And no one in charge or responsible seems to be interested as they should be.
The responsible administrators must IMMEDIATELY proceed to check the websites that were targeted and take immediate action to repair and change all administrator passwords. In addition, the extent to which personal data of teachers and professors of the Panhellenic School Network has been exposed must be investigated since it is not clear what type of data was obtained. It is inconceivable that central services such as the NTUA NOC would be so exposed since important university systems could be put under the control of hackers. In general, the Network Operation Center is responsible for managing all services in an educational institution.
SecNews thanks the Greek Insane Society for the timely and accurate information
