> JapanHacked_
[Resolved][Severity: Moderate][Intrusion]

Nagasaki City: the Nagasaki atomic bomb memory portal was tampered with, showing unrelated English text and a link to malware

Unrelated English text and a link to download a suspicious file were planted on a peace and atomic bomb site. The city took the site down to investigate.

Disclosed

2020-12-05

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. Around this time, staff noticed that unintended English text and a link that downloads a program had been added to the portal Nagasaki Memories of the Atomic Bomb. The site was taken down around 23:00. [1] [2]

  2. The city also took down its Peace and Atomic Bomb general page, which linked to the portal, as a precaution although no damage was found there. [1] [2]

  3. At 11:00 the city resumed the general page after adding a WAF at the server entrance and confirming the software was current. The portal stayed closed for emergency maintenance. [1] [2]

Impact

Only one place was altered, showing unrelated English text and a link that led to a site that downloads a suspicious file. The date and cause of the intrusion were still under investigation, and the city told ScanNetSecurity they were not yet known. [1] [2]

Timeline

  1. Detected 2020-12-03
  2. Disclosed 2020-12-05
  3. 2 days

Attack or cause

Method
[Intrusion]
Impact
[Site defacement]
Entry point
Web app

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][News]ポータルサイト「長崎原爆の記憶」が改ざん被害 - 長崎市Security NEXT · 2020-12-08
  2. [2][News]長崎市「平和・原爆総合ページ」の一部ページが改ざん被害ScanNetSecurity · 2020-12-09 08:00