The much-advertised Free WiFi of the Greek State, according to EXCLUSIVE information from SecNews, has been put under the control of the hackers Greek Electronic Army, due to a weakness they identified on the statistics website!
Only a few days have passed since the end was officially announced. Deputy Minister of Infrastructure - Transport and Networks Christos Spirtzis stated that Antonis Samaras' announcement of WiFi throughout Greece, and put an end to access to free wireless Internet in public spaces.
However, it seems that the problems were much greater for this announcement and everything was done carelessly for the “free network in public places”. SecNews became aware of anonymous information, according to which hackers gained access to the infrastructure for the development of Public Wireless Broadband Internet Access Points!
As the editorial team of SecNews was informed, by an anonymous user with the nickname 0xyg3n, leader of the hacker group Greek Electronic Army, the said group and specifically the hacker with the nickname HackoManGR gained access to the web portal www.publichotspots.gov.gr.
The Greek Electronic Army has been involved several times in the past, such as in the case of Vangelis Giakoumakis where they targeted school network nodes in protest.
The portal targeted by the Greek Electronic Armywas created within the framework of the project "Study, development and operation of the AAA System" with the aim of showcasing the 195 wireless access points of the project "Development of Public Wireless Broadband Internet Access Points (Public Hotspots)", while it is served by the SYZEFXIS network.
At the electronic address www.publichotspots.gov.gr , the geographical map of the Hotspots is presented as well as their statistics in real time.
According to the data that the Greek Electronic Army shared with SecNews, the hacker HackoManGR , using a SQL Injection software vulnerability on the website, managed to gain access to usage statistics and to the users of the statistics management system (Cacti).
As proof of their claims, they sent relevant screenshots that demonstrate the unauthorized access they obtained. Significant details have been hidden so as not to fall victim to unauthorized exploitation by other hackers.
According to SecNews associates who evaluated the relevant screenshots, it is considered inconceivable that a website in the .gov.gr domain would be so exposed.
It seems that whoever created the website did not take into account basic application protection issues. The website was created completely haphazardly, while as experts tell us, the weakness identified by the Greek Electronic Army is particularly common and can be detected with tools that are available on the world wide web to anyone.
The hackers clearly had no difficulty in gaining access since the vulnerability is very simple and can be exploited by anyone. It is also inconceivable that while the entire PublicHotSpots operation cost no more than €4,900,000.00, not the slightest security measure has been taken!!!
The responsible administrators must IMMEDIATELY restrict access to the website and analyze the details of the attack to determine whether, in addition to the application, the server located within the Syzefxis infrastructure or other internal systems have been affected.
We also note, with reservation, that according to their statement, the Greek Electronic Army report every vulnerability they find and inform the administrators BEFORE PUBLIC DISCLOSURE.
The editorial team of SecNews thanks the anonymous user 0xyg3n and HackoManGR, members of the Greek Electronic Army, for the timely and accurate information.
[Update1:21.05.2015-15:22] Absolute Confirmation of the EXCLUSIVE information of SecNews.It seems that the administrators reacted extremely immediately & proceeded to IMMEDIATELY restrict access to the website after the publication of the incident on our website. The website is currently not accessible and the visitor sees the following image on Publichotspots.gov.gr
