The free content management system (CMS) used by the FBI on its official website was breached by CyberZeist, who managed to gain access to more than 150 accounts that include email addresses and encrypted passwords.
CyberZeist breached the Plone CMS, used by the FBI, in late December using a zero-day discovered by someone else, and explains that there are still many other organizations and services vulnerable to attacks, such as the EU Agency for Network Information and Security and the Intellectual Property Rights Coordination Center.
After hacking the FBI.gov website, CyberZeist discovered a database dump that appears to include email addresses and SHA1 encrypted passwords.
The hacker reports that the site was hosted on a VM and this stopped him from gaining root access, but he nevertheless managed to retrieve some server information; the FBI server was running FreeBSD version 6.2_RELEASE from 2007 with custom settings as the hacker noted.
“With the breach of FΒI.GOV, it was clearly evident that their webmaster had a very lazy attitude, as he had kept the backup files (extensions .bck) in the same folder where the site root was (Thanks Webmaster!), but I still haven't leaked all the content of the backup files. Instead of that I tweeted my findings and thought to wait for the FBI's response,” said CyberZeist.
Additionally, the hacker reported that the zero-day exploit has already been sold via Tor, so he will not share further details until it is no longer available for purchase.
https://twitter.com/Amnesty_Schweiz/status/816680016507498497
Amnesty International, one of the organizations that use the same CMS software, has already recognized the vulnerability. The FBI has not published any comment on this hack so far.
Meanwhile, CyberZeist reported that the FBI was trying to fix the vulnerability on New Year's Eve, which is why he believes the CMS is now secure.
