iGuRu.gr, after a notification e‑mail, announces the hacking and defacement of several websites of the National School Network hosted on the SCH.GR domain.
As it turns out, several subdomains of the school network have been defaced. The hacker's message below states that they have full access to SCH.GR and therefore can alter every page hosted on the server.
Read the message:
Hello,
My nickname is Nyo, I am involved in hacking and I belong to the white hat hackers.
For the memory of Vangelis Giakoumakis and for all the children who experience daily bullying, I have carried out the following defacements.
My goal is not destruction.
But I also, in my own way, to protest and leave a message.
As you will notice, most of the alterations have been made in schools and in general in primary and secondary education.
This is a sample, we have full access to SCH.GR and we can at any time alter any page on the server.
The source code of the distorted websites is encrypted and appears to link to the domain *queryapi.info which has a detection ratio of 7/62 on the Virus Total.
The group behind so many defaces responded that they encrypted the HTML code with the encryption service offered by the website htmlobfuscator.com.
However, the encryption seems to be detected as malware by some well-known antiviruses.
The group promised that they will change the source code of the defaced websites as their intentions are not to harm the public but to convey a message.
The defaced domains included in the e‑mail we received are the following:
https://dekaraki.gr/ https://6epal-ioann.ioa.sch.gr https://2iek-ioann.ioa.sch.gr/ https://1sek-ioann.ioa.sch.gr https://1epal-ioann.ioa.sch.gr https://sde-ioann.ioa.sch.gr https://vivl-ioann.ioa.sch.gr/ https://eparogi.pronoianet.gr/ https://creta-events.gr https://pyrgoskymis.gr/ https://zotiko.gr/ https://15dim-kalam.thess.sch.gr/ https://dide-peiraia.att.sch.gr/ https://dipe-peiraia.att.sch.gr https://kesyp.ker.sch.gr/ https://syfak.gr/ https://iek-galats.att.sch.gr https://1epal-alimou.att.sch.gr/ https://1lyk-amarous.att.sch.gr/ https://1lyk-ag-anarg.att.sch.gr/ https://1epal-aigal.att.sch.gr
The article was updated to add our response to the comment about Virus Total and the “malicious” code. Also recipients of the same original notification e‑mail about the alteration of the sch.gr websites were our friends from SecNews.gr.
