Slashdot Mirror


United Nations vs SQL Injections

Giorgio Maone writes "The United Nations web site has been defaced by 3 crackers who replaced the speeches of the Secretary-General Ban Ki-Moon with their own pacifist message. This article briefly analyzes the exploited vulnerability and the technology used on the server, both quite surprising to find in such a high profile site."

144 comments

  1. Hackers vs The General Assembly by MrNaz · · Score: 0, Flamebait

    Given that Israel is the most flagrant violator of UN resolutions, perhaps they'll listen to this. Oh crap, this isn't a political site, is it? *Runs away from the pitchfork weilding mods*

    --
    I hate printers.
    1. Re:Hackers vs The General Assembly by Anonymous Coward · · Score: 3, Insightful

      Shame on you, let me explain why: INFO: As a matter of fact Israel is the only real democracy of the area and is sorrounded by enemy nations for religious matters. The last one is Lebanon (a muppet-state with apparently no powers on its own territory). In lebanon there is a "official" army hitting Palestians refugees and another Islamic army (Hezbolla) which is financed by other nations and likes to advocate the death of israelis and send casual ballistic missiles on "enemy" cities. Palestinians like to detonate on public transport, discos and markets, of course even they have a array of missiles. They are thorn between islamic extremism and extreme terrorism. Iranians one day and the next one are treatening the distruction of Israel. They had a workshop on the allerged Sionist control of the world and are opening working on a Atomic Bomb design with the blessing of the idiotic pacifists of half the world. In this context there you go blaming them for disrespecting all those resolutions that basically say "for the sake of peace let the islamics kill you". So i take that applying the same logic no-one can criticise the USA preventive war on terror which basically is "for the sake of peace we kill them first". Also people tend to forget that with Congo and Sudan it is clear that the ONU it's not doing its job. For your consideration: http://www.youtube.com/watch?v=uhWgZu6tcZU

    2. Re:Hackers vs The General Assembly by Anonymous Coward · · Score: 0

      Yes the Palestinians are way out of line attacking a country that has been killing there people and stealing there land for over 40 years.

      I do not agree with attacking civilians. But sometimes its required, in south Africa during the a partied the 'terrorist' organization that Mandela was part of attacked civilians as well as military targets.

      Israel is one of the main reasons we have a unstable middle east. although that can be highly debated. If you think what Israel does is in defense you are misinformed and my guess is you are either American or an Israelite. The Palestinians do not just attack 'neighborhoods' they attack jewish settlements on Palestinian land as well and as far as I'm aware people under occupation have a right to fight back.

      Israel is not a real democracy its a military nationalist democracy.

      That is only jewish people get a say.
      The military call a lot of the shots.

      I do not agree with a jewish state. I think the idea that jewish people can steal other peoples land because 'god gave it to them' is insane. I would much prefer a secular state.

    3. Re:Hackers vs The General Assembly by Hitto · · Score: 2, Insightful

      I'll bite, anon.
      You may have noticed that in all of Israel's neighbors, you would be hard-pressed to find ONE secular state, or even a functioning democracy.
      Whereas in Israel, fundamentalist nutjobs do get fined or jailed whenever they stir up trouble. They don't get to evade the law when they excise their daughters, slay victims of rape in "honor killings", lapidate adulterers, etc, etc, etc.

    4. Re:Hackers vs The General Assembly by CannonballHead · · Score: 1, Offtopic
      How familiar are you with middle eastern history? The land that Israel is in now is smaller than the land they had 3500 years ago. They took the land from races that no longer exist. Saying that Israel is "stealing" Palestinian land... well, they aren't; the Palestinians are trying to take Israel's land.

      To the point, I might add, that at the moment, Muslims have control of the temple mount... the Hebrew/Jewish temple mount. And they put a mosque on it. They have done numerous things specifically to insult the Jews... for religious reasons. Now, are you going to argue that the Islamic religion is older than the Jewish religion? He lived in the 6th century, AD; Moses lived quite a bit earlier than that. Even secular skeptics will agree that the Old Testament was written before the 6th century AD... I mean, the Jews were persecuted by the Romans, attacked by the Persians, Babylonians, Assyrians... this is ancient history, not 5th century history.

      With that in mind, then, and knowing that the Jewish temple was in place long, long before the Islamic religion existed, how is it that Israel is stealing Palestinian lands... when an Islamic mosque sits on top of the Jews' temple mount itself?

      To argue that Israel is "stealing" Palestinian land... well, if I squatted on your land and kicked you off, I'm not sure you'd think you were stealing it if you decided to try to take it back.

      And again, with that in mind, the way the Islamic countries are fighting Israel is far from humane. Bombings, random missles... well, a previous post summed it up nicely.

      But, strangely enough, as previously mentioned... paper from the UN doesn't really seem to affect the Islamic religious militaries. They don't seem to care. I wonder why? Perhaps it's like a mother who just tells his child over and over that "you're gonna get it if you do that again!" ... but the child very quickly learns that he never DOES get it.

    5. Re:Hackers vs The General Assembly by Anonymous Coward · · Score: 1, Insightful

      I do not deny that the jews was in that area of land before Islam even existed.

      But if the jewish people have the god given right to take the land now owned by someone else because they was there first. A lot of people will have to move out of there own country.

      The 3 main ones off the top of my head -

      America - native Americans
      England - celts
      Australia - aborigines.

      why ain't we giving them back the land? 2 of the 3 mentioned was within the last 300 to 100 years and even in the last century.

      To say they have the right to destroy the government that was in place is insane. They should of done what _any_ civilized society would of done with the situation, immigrated and merged with the current society that was in place.

    6. Re:Hackers vs The General Assembly by Anonymous Coward · · Score: 0

      The Israel apologists dress up the language sometimes, good to see at least one of you is honest in your statement that "might makes right".

    7. Re:Hackers vs The General Assembly by Anonymous Coward · · Score: 0

      No islamic country has been fighting against Israel for a long long time. Individuals an extremist groups try to fight Israel, that's a huge difference.

    8. Re:Hackers vs The General Assembly by CannonballHead · · Score: 1

      But if the jewish people have the god given right to take the land now owned by someone else because they was there first. A lot of people will have to move out of there own country. I believe I entirely left God out of the picture. Partially because you would likely complain that my religion was getting in the way of my politics, or something like that... so I left my religion entirely out of it, and never mentioned God.

      why ain't we giving them back the land? 2 of the 3 mentioned was within the last 300 to 100 years and even in the last century. Indeed.. rise and fall of nations apparently is entirely ... well, mostly based on force. Romans, Greeks, Babylonians, Persians, Medes, Turks, English, American...

      To say they have the right to destroy the government that was in place is insane. They should of done what _any_ civilized society would of done with the situation, immigrated and merged with the current society that was in place. If I remember correctly, they were given the land of Israel by, in fact, the United Nations in 1948... or, well, they approved at least. I guess Britain technically "owned" it.

      So, now that Israel IS in place, can we justify Palestine for continuing to attack them, claiming Israel is on their land?

      Basically, both Jews and Muslims claim the "holy land" as their own. So, who do we support, then, or do we just let them blow themselves to bits?

      Seems to me that, if the issue IS a religious one, if the issue IS whose holy land it is, we should go with the historically accurate one... and I would argue that, to be historically accurate, we would have to say it belongs to the Jews. They took the land quite a long time ago from races that no longer exist, really.

    9. Re:Hackers vs The General Assembly by CannonballHead · · Score: 1

      Only extremist groups? Hm. Was Germany an extermist group? I know, they weren't Islamic. But that wasn't really just an extremist group... admittedly, an "extremist group" ended up in control of the country, but there didn't appear to be a huge outcry by the general populace, either. Maybe there was and I'm not aware of it, of course.

      According to Wikipedia, immediately after Israel was independent, the following nations declared war on Israel: Egypt, Lebanon, Syria, Transjordan, and Iraq. After Israel won, ceasefires were signed.

      Regarding the Suez canal and the Sinai Peninsula... Israel didn't allow UN people to be on their side. Egypt did. But, not very soon after, wikipedia says.. "On May 19, 1967, Egypt expelled UNEF observers,[17] and deployed 100,000 soldiers in the Sinai Peninsula.[18] It then closed the straits of Tiran to Israeli shipping,[19][20] catapulting the region back to the pre-1956 status quo. On May 30, 1967, Jordan entered into the mutual defense pact between Egypt and Syria. President Nasser declared: "Our basic objective is the destruction of Israel. The Arab people want to fight."[21]"

      So, basically, Egypt kicks the UN observers out, deploys soldiers, cancels Israeli shipping, basically starting a war. Jordan and Syria and Egypt combine with this. Nasser says that his nation wants the destruction of Israel. President Nasser, not the president of Jamas or some extremist group.. the president of the nation of Egypt. Israel responded with a preemptive strike, the Six Days' War, and totally beat the Egyptian air force; then they attacked Jordanian, Syrian... AND Iraqi air forces. So, Iraq again. Air force... not extremist groups. This is the air force.

      Furthermore, regarding Iraq: "In June, 1981, Israel successfully attacked and destroyed newly built Iraqi nuclear facilities in Operation Opera.
      During the Gulf War, Iraq fired 39 missiles into Israel, in the hopes of uniting the Arab world against the coalition which sought to liberate Kuwait. At the behest of the United States, Israel did not respond to this attack in order to prevent a greater outbreak of war.[27]"

      Now, technically, it seems mostly terrorist groups. The question is ... how condoning and sympathetic the nations of Syria, Lebanon, Iran, etc, are of groups like Al Quaeda and Hezbollah. Just as people tend to argue that if an American company is openly doing some form of "evil" somewhere in the world and the American government does nothing about it... well, imagine if America had a large terrorist group dedicated to destroying Mexico, and the government didn't seem to care.

    10. Re:Hackers vs The General Assembly by shaitand · · Score: 1

      'If I remember correctly, they were given the land of Israel by, in fact, the United Nations in 1948... or, well, they approved at least. I guess Britain technically "owned" it.'

      If you ask the British or I'm sure the Jews. If you ask anyone else in the middle east I think you would hear a different story.

      'Indeed.. rise and fall of nations apparently is entirely ... well, mostly based on force. Romans, Greeks, Babylonians, Persians, Medes, Turks, English, American...'

      No question about it and that only makes sense. After all, a 'nation' is a body that imposes its will upon the peoples of as large an area as possible by threatening to harm them in some way if they don't obey it.

      'Basically, both Jews and Muslims claim the "holy land" as their own. So, who do we support, then, or do we just let them blow themselves to bits?'

      Sounds like a fairly reasonable choice to me. If a bunch of idiots want to classify themselves based upon some ridiculous mythology they have chosen to believe and further want to attack others who believe in different invisible men then I say let them have at it. I for one am rather annoyed that one of these invisible man worshiping idiots rigged an election and proceeded to embroil my nation into this nonsense.

      'Seems to me that, if the issue IS a religious one, if the issue IS whose holy land it is, we should go with the historically accurate one... and I would argue that, to be historically accurate, we would have to say it belongs to the Jews.'

      Seems to me that we have clearly established the issue is NOT a religious one and has nothing to do with holy lands. We have established rather soundly that the issue is one of nations and that nations are an issue of force. I say we fail to recognize any government in the middle east until it stabilizes (no matter how many thousands of years that might be), trade with anyone who has money and sell weapons to anyone who has money. As for the invisible men granting holy lands, lets just leave them to the nuts shall we?

    11. Re:Hackers vs The General Assembly by Anonymous Coward · · Score: 0

      At the end of the day I do not think 1 type of people is entitled to the 'holy land' Everyone is including Muslims,Christians, Jews and every other on this big blue ball.

    12. Re:Hackers vs The General Assembly by MrNaz · · Score: 0, Troll

      Holy crap, I was making a joke, not inviting a whole bunch of pro-Israeli zealots to come out of the woodwork and attempt to bludgeon me with their version of history. Get of /. and go find some neocon political website to post on ffs.

      --
      I hate printers.
    13. Re:Hackers vs The General Assembly by Anonymous Coward · · Score: 0

      "According to Wikipedia, immediately after Israel was independent"

      As in "Israel was already there by 1930, it's only it was a region under country X"? Or, maybe, once English *took apart* some land, told it was the new country of Israel and forced away people already stablished there?

      I don't know where are you from or where do you live now, but I'd like to see your reaction if this evening somebody comes and tells you the land you sit over is no more "country X" but "country Y", so your house is immediatly expropiated from you in the name of "the new govern of Y", and you must move away.

    14. Re:Hackers vs The General Assembly by MrNaz · · Score: 1

      They took the land quite a long time ago from races that no longer exist, really.

      Presuming you're not pro-Israel by default (in which case I'll never convince you), I'd just like to point out that it just is not true that the land now called "Israel" was most certainly NOT purely vacant prior to 1948, as you seem to believe. The land was populated, but since 1948 there have been incremental displacements of the local population, inch by inch, year by year. Just look at the current building of the wall. It goes deep onto the other side of the border, illegally annexing the land for all intents and purposes. This has been going on for a half century, they push the border a bit, put a few settlements there and then say "oh well, we're here now, can't go back in time so let's just live with how it is now".

      As I said though, if you're just pro-Israeli, there's nothing I'll be able to say to convince you of the injustice of the situation. You'll just keep pointing to the suicide bombers and rocket firing terrorists and saying how evil they are, ignoring the fact that they are only doing what every other nation would do under those circumstances. So if you're pro-Israeli, lets just agree that we're not going to see eye to eye, and leave it at that.

      -Naz

      --
      I hate printers.
  2. What? by Junior+J.+Junior+III · · Score: 3, Funny

    The UN was ineffective due to half-assedly fucking up a security detail? That's un-possible!

    --
    You see? You see? Your stupid minds! Stupid! Stupid!
    1. Re:What? by MrNaz · · Score: 2, Funny

      Haha UN-possible. *giggles uncontrollably* OK I'm done.

      --
      I hate printers.
    2. Re:What? by Anonymous Coward · · Score: 1, Insightful
      From the article:

      If only prepared SQL statements were used properly, this embarrassing incident would have been easily prevented.
      And yes, prepared statements are available even in the very obsolete ASP "Classic" + ADODB Microsoft setup they're using. (screenshot)

      The UN was ineffective because it relied on Microsoft. Microsoft, btw, is a US company.
    3. Re:What? by Atlantis-Rising · · Score: 3, Insightful

      The exact quote you presented supports the opposite view- it was a failure of administration, not a failure of technology.

      --
      "It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
    4. Re:What? by Kroc · · Score: 0

      This is the EU, no silly Americanism's here.
      It's "De-possible!" :P

  3. What a lie by Anonymous Coward · · Score: 0

    Apparently the UN website is down due to "scheduled maintenance"... A flagrant lie from the most important worldwide organization, a bit shocking really, but surprising?

    1. Re:What a lie by sholden · · Score: 2, Insightful

      Or the standard page when the web monkey flips the "maintenance mode" switch...

      Plus I'm sure they scheduled the downtime (for right now) after they noticed the crack.

  4. Nonono! by Funkcikle · · Score: 2, Funny

    It wasn't hacked! Their website clearly states it is down for scheduled maintenance. Honestly, some people need to stop spreading these fake stories!

    1. Re:Nonono! by Edzor · · Score: 2, Informative

      you do realise that the UN website is up? The submitter has just used their default "yeah the website is borked" page http://www.un.org/sg/?

    2. Re:Nonono! by Anonymous Coward · · Score: 0

      ....... And there were weapons of mass destruction.

    3. Re:Nonono! by rvw · · Score: 2, Informative

      This one is up: www.un.org!

    4. Re:Nonono! by FutureDomain · · Score: 1

      The UN website is up, but the page with the Secretary-General's speeches is currently down.
      The URL for the actual speech site (bypassing the maintenance page) is http://www.un.org/apps/news/infocusRel.asp?infocus ID=130&Body=xxxxxx&Body1=.

      --
      Hydraulic pizza oven!! Guided missile! Herring sandwich! Styrofoam! Jayne Mansfield! Aluminum siding! Borax!
  5. Surprising? by richdun · · Score: 1

    both quite surprising to find in such a high profile site

    Are we really that surprised? I thought it was pretty standard that most of the "high profile sites" out there are the ones least likely to understand the importance of keeping their software up to date. It seems like the larger the company/organization/multi-national quasi-governmental agency, the more likely they are to simply buy in to whatever is being promoted by (insert your favorite vendor here), and won't upgrade unless something breaks or they can afford to buy whatever (insert your favorite vendor here) is selling in the quantities and packages they are selling it.

    1. Re:Surprising? by LurkerXXX · · Score: 3, Insightful

      Did you not read the article at all? This had nothing to do with patching the system. It had to do with them hiring someone who never bothered to learn about SQL and security. It had nothing to do with the tools/system used. It had to do with incompetence of the person hired to set it up.

    2. Re:Surprising? by foobsr · · Score: 1

      I thought it was pretty standard that most of the "high profile sites" out there are the ones least likely to understand the importance of keeping their software up to date.

      Probably also — my bias — because all the persons in charge are so qualified (along the lines: younger than ever, experience > age, always only A++ level grades, superb team-players with ultimate social and leadership capabilities) that they more care about quantum career leaps.

      CC.

      --
      TaijiQuan (Huang, 5 loosenings)
    3. Re:Surprising? by John+Jorsett · · Score: 1, Redundant

      What, cronyism, featherbedding, and incompetence at the UN? That's unpossible!

    4. Re:Surprising? by drspliff · · Score: 4, Informative

      This is pretty much standard for a lot of government organisations, or atleast I've seen it many times myself.

      I don't know how to explain it, but a lot of the people I've seen create websites for government or local authority branches are business types lacking on the technical side. Basically the person who the project manager likes most, regardless of reviewing their technical ability on previous sites other than quickly browsing through one or two and going "ohh, thats nice isnt it!".

      On one occasion I've seen a company win the contract simply because the paper they sent to the project manager sparkled slightly in the light and was followed up by a long phone call. Their websites were utter trash, but they were very good at making money.

      I suspect the same happened here :)

    5. Re:Surprising? by LurkerXXX · · Score: 2, Insightful

      I've seen exactly the same in many many companies where I've been called in to clean up the mess. Hiring of incompetent staff is by no means limited to government.

    6. Re:Surprising? by Virgil+Tibbs · · Score: 1

      Did you not read the article at all? You must be new here! ;)
      --
      www.tdobson.net #### Dare to Dream #### blog.tdobson.net
    7. Re:Surprising? by JW.Axelsen.Sr. · · Score: 1

      I don't know how to explain it
      government-type jobs usually go to the lowest bidder, (usually) no matter how much they suck at whatever tasks they're supposed to perform
    8. Re:Surprising? by Anonymous Coward · · Score: 0

      It had nothing to do with the tools/system used.

      Dude, you're on slashdot, don't be reasonable when it's Microsoft technology involved. Obviously it's Microsoft's fault; and they should have updated a working system to run Linux regardless.

    9. Re:Surprising? by drspliff · · Score: 1

      Personally I'd say it's more about perception of value, I've seen several contracts approved by management because they check all the boxes and are closer to what the expected budget is, instead of being technically competant and providing what they actually need. Sadly most of the companies that won these contracts were Microsoft shops.

    10. Re:Surprising? by hachete · · Score: 1

      They learnt their lesson well from the US

      --
      Patriotism is a virtue of the vicious
    11. Re:Surprising? by Anonymous Coward · · Score: 0

      Like pointer arithmetic / manual memory management: Good developers are safe. Fact is: if you allow it, developers will make mistakes: Buffer overflow. Boom! Java doesn't allow pointer arithmetic / manual memory management. Java is safe.

      SQL injection is similar: Once you allow embedding user input in SQL statements, some developers will make mistakes. SQL injection. Boom! How to solve it? Don't allow embedding user input. Enforce the use of parameters. Then you are safe. The Java database H2 database engine supports a feature to enforce using parameters.

    12. Re:Surprising? by FireFlie · · Score: 1

      "SQL injection is similar: Once you allow embedding user input in SQL statements, some developers will make mistakes. SQL injection. Boom! How to solve it? Don't allow embedding user input."
      I really hate web programming so I am not very knowledgeable in this particular area, but it was my understanding that most programming languages have libraries which allow a programmer to sanitize user input that will be used in an SQL statement, such as php's mysql_real_escape_string. I'm not saying that this is all that needs to be done, but it seems that a problem like this could be eliminated with a few extra lines. Am I just way off base here?
    13. Re:Surprising? by Anonymous Coward · · Score: 0

      And you are aware I'm sure that mysql_real_escape_string is the *3rd* try at a php library that would actually be safe? Php is a horrible example of a language who's writers could get things written safely themselves.

      Am I just way off base here?

      Yes. Just as are many that depend on unsafe libraries, or others who try to reinvent the wheel again and write their own sanitizing code (which they often also screw up).

      Use stored procedures.

    14. Re:Surprising? by Anonymous Coward · · Score: 0

      Oh no! A non-php site was attacked through SQL injection! The horror!!!

      Awwwwwwwww.....Sigh. Hear that? It's the collective disappointment of thousands of Slashdot/perl sycophants and php haters missing the chance to irrationally dump on php! Such a pitiful sound. That's what you get for RTFS/A guys... next time just jump right in and start crapping on php, skip the summary and article. You know it will be so much more fun.

    15. Re:Surprising? by TheRaven64 · · Score: 1
      Using something like mysql_real_escape_string is a very bad idea (not least because it means you're using MySQL, but that's another story). If you use it properly, it can work, but like reading input directly into a buffer on the stack, it is incredibly easy to use incorrectly.

      Most database APIs have some analogue of printf specifically designed for producing escaped SQL strings. These allow SQL statements to be constructed in a completely safe way. Always use these instead of manually constructing SQL statements, and you will find it very hard to write an SQL injection vulnerability (it's possible, but it takes real anti-skill).

      --
      I am TheRaven on Soylent News
    16. Re:Surprising? by Anonymous Coward · · Score: 0

      Parameter binding is always safer in that the user-supplied data is not a part of the SQL string, but passed separately, and cannot affect the generated SQL.

      Posting anonymously because I moderated elsewhere in this discussion.

    17. Re:Surprising? by Viceroy+Potatohead · · Score: 1

      Could your please forward your comment to http:/// www.un.org?user=user&pass=pass&query=INSERT%20INTO %20MainTable%VALUES%20('[your comment]').

      Thank you. This could be most helpful.

    18. Re:Surprising? by ShakaUVM · · Score: 1

      I don't know how to explain it, but a lot of the people I've seen create websites for government or local authority branches are business types lacking on the technical side. Basically the person who the project manager likes most, regardless of reviewing their technical ability on previous sites other than quickly browsing through one or two and going "ohh, thats nice isnt it!".

      So you're saying that government is all politics, then?

    19. Re:Surprising? by TheLink · · Score: 1

      Yes you're way off base. You should be using mysql_real_escape_string_this_time_no_kidding. And on the next upgrade go to mysql_genuine_advantage_TM_string.

      Or use a programming language that's a lot better designed. Sheesh.

      Think about it: first came mysql_escape_string, then they screwed that up, next came: mysql_real_escape_string.

      Whereas in properly designed languages:
      1) They don't screw up so often.
      2) And usually when they do, they fix the bits they screw up, and you don't have to change a single line of your code - because the _interface_ is fine (designed OK), just the implementation could have been buggy.

      With PHP you get stupid stuff like addslashes, stripslashes and magic quotes.

      I do have to write PHP regularly, but I do it because some idiot wrote the stuff in PHP a while ago. Take it from me PHP makes it hard to do the right thing and easy to do the wrong thing (PHP is very like MySQL in some ways).

      Lastly, it's probable that others have noticed the bug in the UN site before, but just never bothered to exploit it or were waiting for the "right time", OR even exploited it without anybody noticing. Such bugs are plentiful given the amount of cluelessness and crap out there.

      --
    20. Re:Surprising? by Qrlx · · Score: 1

      It had to do with incompetence of the person hired to set it up.
      Unless that person falsified their resume, I would place the blame on the incompetence of the person who extended the job offer.

      If you hire someone with no arms to flip burgers, don't blame them when your hamburger stand is a failure. Unless s/he wore prosthetic arms to the interview or something. And even then, you still made a bad hire.

  6. Is it really a big surprise? by background+image · · Score: 5, Insightful

    This article briefly analyzes the exploited vulnerability and the technology used on the server, both quite surprising to find in such a high profile site.

    Maybe it's not such a surprise, considering that

    • they've used MS Word to make their 'down for maintenance' page
    • the code (not including the image) for that one sentence page is > 11k...
    1. Re:Is it really a big surprise? by Anonymous Coward · · Score: 0

      Because it shows that their webadmin is a complete and utter spastic.

    2. Re:Is it really a big surprise? by Nimey · · Score: 1

      If they're clueless enough to use Word to write Web pages, that's evidence that they may be clueless enough to not properly secure their web server.

      --
      Hail Eris, full of mischief...

      E pluribus sanguinem
    3. Re:Is it really a big surprise? by newell98 · · Score: 1

      Not the point. The parent poster was implying that if their web-master is using MS Word to generate an error page with >11k of code then chances are the rest of their technical staff aren't too bright either.

    4. Re:Is it really a big surprise? by background+image · · Score: 1

      Don't be dense. If they're incompetent enough to be building parts of their website with a tool like MS Word, it doesn't seem tremendously far-fetched to me to think that their abilities in other areas--security for example--may be less than stellar.

    5. Re:Is it really a big surprise? by SplatMan_DK · · Score: 3, Insightful

      weicco, I think his point is that an IT organization that uses 11 Kb of rubbish-style HTML code generated in MS Word to write "Down for scheduled maintenance" on a web page is likely to treat their server security issues with the same "professionalism". :-)

      - Jesper

      --
      My security clearance is so high I have to kill myself if I remember I have it...
    6. Re:Is it really a big surprise? by rob1980 · · Score: 1

      Or maybe that page was a quickie that an intern put up until the real developer gets in on Monday.

      (Of course, given that this happened in the first place, that isn't entirely likely. heh)

    7. Re:Is it really a big surprise? by gad_zuki! · · Score: 1

      Exactly. The UN is acting like many boneheaded companies that have some administrative assistant doing "the webpage" instead of hiring a professional. I'm sure the server was setup by someone's kid too. The real shame here is that there are lots of talented tech workers looking for work. Lowballing only hurts the cheapskates in the end.

  7. A website is hacked. So? by Anonymous Coward · · Score: 0

    Why is this shocking or surprising? I've seen countless terrible implementations where some leet web hacker has made terrible security and general data integrity problems because they have no idea how a database should be set up or secured. They apparently don't teach databases well enough in school, and the folks who teach themselves rarely seem to bother trying to learn it right.

  8. High profile guarantees nothing by Anonymous Coward · · Score: 0

    Sometimes they have very stupid policies and habits which lead to errors.

  9. U.N.Constitutional by AnyThingButWindows · · Score: 0

    How hard is it, I mean really, to spell U.N.Constitutional? Why is it that people think that the U.N. is some kind of authority over American citizens?

    --
    When government fears the people, there is liberty. When the people fear the government, there is tyranny. - Jefferson
    1. Re:U.N.Constitutional by Anonymous Coward · · Score: 0, Offtopic

      I think it's kind of funny how the U.S. is brown-nosing the U.N., now that things aren't going too well in Iraq. "Ohhhhhh.. we broke it, can you fix it, please!"

  10. Waste of an exploit by JosefAssad · · Score: 5, Funny
    What a waste of an exploit.

    I personally would have sneaked in and invented a new UN agency with its own inscrutable and almost-pronounceable acronym, and then sat back and watched.

    Just imagine if, halfway down this page, you get an entry like this:

    UNCRP: Works in field missions to improve standards in accordance with self-determined metrics. Composed of members elected to permanent positions based on a variety of factors subservient to aforementioned goals, assuming goals have been determined prior to agency initiation. Primary work areas include inter-agency provision of UNCRP-related efforts, with the ultimate objective of improving standards, mainly in the field.

    One quick email to follow up:

    To: secgen@un.org
    From: Agency Coordination and Initiation Subcommittee to the Secretariat
    Subject: Need traction on UNCRP agency kickstart

    Dear sir:

    With respect to the newly established UNCRP agency, we respectfully request formal approval of resources. We expect to be operational within 5 years and will submit the initial statement of work within 3 years from approval.

    Thank you for providing the momentum to this newly founded agency; we have dedicated much effort to the realization of the UNCRP, as it is conducive to the eradication of, several things in the UN charter.


    Regards,


    Rolf Wittigersen

    And that should be it. Make yourself some popcorn, and watch the headless wonder of a new UN agency being created. At least with the UNCRP, it would be purposeless by design rather than through the diligent work of its employees.

    1. Re:Waste of an exploit by Anonymous Coward · · Score: 0

      I think you would be a good 'Yes man' http://en.wikipedia.org/wiki/The_Yes_Men

    2. Re:Waste of an exploit by eggoeater · · Score: 2, Funny

      ...missions to improve standards in accordance with self-determined metrics...
      ....based on a variety of factors subservient to aforementioned goals...
      ...work areas include inter-agency provision...
      ...with the ultimate objective of improving standards...
      Hey!
      I recognize that writing....
      You're the CTO/CIO for my company, aren't you??

    3. Re:Waste of an exploit by Jugalator · · Score: 1

      Agreed. Seriously, what's wrong with hackers not even able to type properly? If you saw the thumbnail-sized photo of the defaced site in the article link, you'd know what I'm talking of. It looks like absolute crap. My mom is a better web designer. A 10 year old has better grammar. I don't get it. After going through the work of planning and attacking a site, why are they making sure it looks like an obvious attack? Isn't the point then lost?

      --
      Beware: In C++, your friends can see your privates!
    4. Re:Waste of an exploit by TheLink · · Score: 1

      You're assuming this exploit was the first. How'd you know that it hasn't already been exploited before in secret?

      MS SQL server in some configs can allow people to do all sorts of stuff.

      --
  11. SQL Injection and Blind SQL Injection Info by mrkitty · · Score: 2, Insightful
    --
    Believe me, if I started murdering people, there would be none of you left.
  12. And Jews violated more laws under the Nazis, too by Anonymous Coward · · Score: 0, Insightful

    Since when was a UN resolution worth more than the paper it was written on?

    And let me guess. You supported a coalition of over 30 countries banding together and overthrowing a corrupt despot who not just violated but utterly ignored almost 20 UN resolutions over a period of a decade or so.

    Riiiight. Suuure you did.

    So, the UN is only important to you when it comes to supporting the genocide of Israel?

    Ignorant jackass.

  13. The hole is still open, though... by caferace · · Score: 3, Interesting
    1. Re:The hole is still open, though... by Jugalator · · Score: 2, Informative

      Interesting... And if you're a confused moderator, note that the ending apostrophe is to be part of the URL, but wasn't here due to Slashdot's auto-link generation.

      You'll get

      ADODB.Recordset.1 error '80004005'

      SQLState: 37000
      Native Error Code: 8180
      SQLState: 37000
      Native Error Code: 105
      [MERANT][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the character string ''.
      [MERANT][ODBC SQL Server Driver][SQL Server]Statement(s) could not be prepared. /apps/news/infocus/sgspeeches/statments_full.asp, line 26

      --
      Beware: In C++, your friends can see your privates!
  14. Unsurprising by freyyr890 · · Score: 1

    This is not unlike an issue I discovered a little while back. An online application suite for schools designed for easy manipulation of databases containing student records was subject to SQL injection using the web interface. The web interface was designed for parents to get an up to date progress report for their child, or for students to select courses without resorting to paperwork.

    Well, passing along the escape character (') to the login page returned the following message:
    java.sql.SQLException: ORA-01756: quoted string not properly terminated

    I played with this a little while, and eventually was able to mine my friend's student number. Figuring I should probably notify someone, I talked to my high school's technical department.

    They put me on the line to the staff at the provincial team. I tell them about the problem and suggest that they contact the company that built the software to begin with.

    They close the web interface, and contact the developer. Now, four months later, the issue STILL isn't patched on the thousands of other installs across North America. I tried directly contacting the developer, AAL Solutions. No reply. I finally dug up an email for the Independent School implementation of eSIS. It seems that the developer is still working on it. Slowly.

    1. Re:Unsurprising by El_Oscuro · · Score: 1

      To escape quotes in Oracle, use two quotes (''), so if you used an expression:

      replace(p_input_parm,'''','''''')

      This would replace all single quotes with escaped quotes. With the quotes escaped in Oracle, SQL Injection attacks go nowhere. You should also escape the HTML characters < and > to prevent someone from injecting Javascript into your site. There is a function in Oracles OWA_UTIL package for this.

      --
      "Be grateful for what you have. You may never know when you may lose it."
    2. Re:Unsurprising by ArsenneLupin · · Score: 1

      With the quotes escaped in Oracle, SQL Injection attacks go nowhere. Not exactly true. Quote-less sql injection is possible, as whitnessed by the numerous successful SQL rape attacks against Coldfusion sites. You just need to pick a URL that has a number inside it, rather than a string. If your parameter is a number, no need to close any quote.

      And, in order to sneak in your own string, use the char(72)%2Bchar(101)%2Bchar(108)%2Bchar(108) %2Bchar(111)%2Bchar(32)%2Bchar(119)%2Bchar(111)%2B char(114)%2Bchar(108)%2Bchar(100)%2Bchar(33) trick.

      Hmm, looks like the only real protection against SQL rape is a real fat ass, that'll keep those floppy-dicked hackers out better than anything else :)

  15. Site is by Dunbal · · Score: 1

    Unavailable due to scheduled maintenance. Heheheh. Also, why is lying always the first reaction? Scheduled my ass. I'm getting fed up of this. Lies everywhere.

    --
    Seven puppies were harmed during the making of this post.
    1. Re:Site is by FireFlie · · Score: 1

      Of course it is also a possibility that this is a generic "this page is down" placeholder, and someone just hit a button to remove the offending page as quickly as possible while they contacted someone that could actually do something about it.

  16. Re:And Jews violated more laws under the Nazis, to by MrNaz · · Score: 1

    Err... chill dude...

    --
    I hate printers.
  17. Re:And Jews violated more laws under the Nazis, to by Dunbal · · Score: 2, Insightful

    Since when was a UN resolution worth more than the paper it was written on?

          Since no one (cough America) listens to the UN anymore. This is hardly the UN's fault. Just like the league of nations, it has no power to enforce its mandates. Blame the countries that refused to empower the UN.

    --
    Seven puppies were harmed during the making of this post.
  18. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  19. Some jive honkeys. by Sitnalta · · Score: 1

    At first reading, I thought that the UN was defaced by some white people, and the author was just being racist.

    Then I imagined that the UN as a society of pimps. This is where I live now. In my mind.

  20. Our agreements? The struggling Parliament of Man by Etherwalk · · Score: 5, Insightful

    As a nation, the US has made numerous commitments to the UN, and that includes agreements to follow things like the Universal Declaration of Human Rights. When we *agree* to follow International Law, we ought to, don't you think? Especially when we're heavily involved in creating that law in the first place?

    The fact is that the UN, while it does have a lot of problems, is also far more effective and dare-I-say-it even important than most people in the US ever give it credit for. It's far from a perfect system, but it's still the best we have. We're one of the rich kids on the playground, and one of the strong kids on the playground, and we don't always enjoy what the student government wants to do--so we turn away from it sometimes. But that doesn't mean that it isn't important, or helpful, or that it doesn't, sometimes, do what's right. And that doesn't mean we shouldn't work with it, sometimes, and give it more credit for what it does and tries to do.

    Instead, we tend to discount it. Because sometimes we don't like what it says about us or others in the playground, and because it's politically convenient (and salable) for our leaders to emphasize our strength and autonomy, all of our accomplishments and our not-inconsiderable military and economic muscle, and all of our pride. Some degree of Nationalism isn't a terrible thing, and we do have a lot to be proud of--but we also still have a lot to do, and to accomplish, as a nation and as members of larger world, and pretending the other children on the playground are irrelevant doesn't help us to do those things.

    Also, don't you want the Universal Declaration of Human Rights to apply to US Citizens in a US Court or on the streets? The Bill of Rights is getting stretched more thinly every day, and the anti-terrorist effort (though directed in part by well-meaning people) is cutting swaths in our Constitution.

    --Me

    The subtlest change in New York is something that people don't speak much about but that is in everyone's mind. The city, for the first time in its history, is destructible. A single flight of planes no bigger than a wedge of geese can quickly end this island fantasy, burn the towers, crumble the bridges, turn the underground passages into lethal chambers, cremate the millions. The intimation of mortality is part of New York now: in the sound of jets overhead, in the black headlines of the latest edition.

    All dwellers in cities must live with the stubborn fact of annihilation; in New York the fact is somewhat more concentrated because of the concentration of the city itself, and because, of all targets, New York has a certain clear priority. In the mind of whatever perverted dreamer who might loose the lightning, New York must hold a steady, irresistible charm.

    It used to be that the Statue of Liberty was the signpost that proclaimed New York and translated it for all the world. Today Liberty shares the role with Death. Along the East River, from the razed slaughterhouses of Turtle Bay, as though in a race with the spectral flight of planes, men are carving out the permanent headquarters of the United Nations -- the greatest housing project of them all. In its stride, New York takes on one more interior city, to shelter, this time, all governments, and to clear the slum called war. ...

    This race -- this race between the destroying planes and the struggling Parliament of Man -- it sticks in all our heads. The city at last perfectly illustrates both the universal dilemma and the general solution, this riddle in steel and stone is at once the perfect target and the perfect demonstration of nonviolence, of racial brotherhood, this lofty target scraping the skies and meeting the destroying planes halfway, home of all people and all nations, capital of everything, housing the deliberations by which the planes are to be stayed and their errand forestalled.

    -- E.B. White, from "Here Is New York," 1948

  21. Re:pacifists are such losers by Anonymous Coward · · Score: 1, Funny
  22. Re:pacifists are such losers by Anonymous Coward · · Score: 1

    pacifist are such losers. I hate pacifists, too cowardly to take a stand

    Looking through your posting history and finding such gems as, "I say beat the shit out of the jerks, maybe they'll think twice before doing it again," I guess I'd be safe to classify you as a trollish, impotent, angry young man.

    But you're right, let's get rid of the "opposition to war or violence as a means for resolving disputes" (American Heritage) that pacifism entails, close down our embassies, withdraw our diplomats, and resolve our differences - without exception - with a good old-fashioned wrestle. My wife volunteers; does yours?

    that being said, the united nations is a bunch of cowering inept fools.

    Lest you be accused of being "too cowardly to take a stand", should you not be planning a military coup of the UN or something, rather than posting on Slashdot? Only the "soft headed moron" would use words when he has his almighty fists. Onward into battle, tfiddler, for the freedom of our glorious nation rests on your shoulders!
  23. Surprising? Not at all.. by madsheep · · Score: 1

    So it coincidence the site is down for scheduled maintenance right now? I suppose this maintenance was scheduled immediately following their defacement?

    SQL injection in a high-profile site is not surprising or uncommon. When you work with back end databases, your protection from such an attack is only all the programmers that make up the DB interfaces on your website. This happens often due to laziness, lack of knowledge, or simple mistakes. It's pretty frequent when you have people collaborate on a project as well. One person might be the best security programmer in the world and do 95% of the website. That "other" guy that did 5% of it could eb the reason you just got hacked. Web attacks are becoming more and more common and will continue to rise with Web 2.0 features. Surprising? Not at all... we see this stuff all the time and on more popular sites than un.org (is that really saying much?).

  24. still vulnerable by Anonymous Coward · · Score: 0
    FTFA:

    As you can easily verify by opening this URL, the site is vulnerable to an attack called SQL Injection. This is a very well known kind of vulnerability, fairly easy to avoid and very surprising to find in such a high profile web site.
    The statements_full.asp page is STILL injectable and STILL available. I wonder what other pages are also injectable on that domain. I also wonder how fast it will take for someone to makes a javascript form that posts your very own words to the UN site via SQL-injected URLs. -- Anonymous
  25. but is it susceptible to... by Anonymous Coward · · Score: 0

    the good ol' hot beef injection?

    1. Re:but is it susceptible to... by Anonymous Coward · · Score: 0

      Nah, they weren't rooted, its just a website defacement. :(

  26. United Nations can't catch a break? by Anonymous Coward · · Score: 0

    It's bad enough they are known as an ineffective organization. The idea of world government is a great idea but no one is ready for it. I guess it'll take an Extinction Level Event Asteroid Injection to get the nations to get them to cooperate.

    1. Re:United Nations can't catch a break? by Grant_Watson · · Score: 1

      The idea of world government is a great idea but no one is ready for it.

      I don't know why so many people seem to think that putting all your eggs in one basket is at all wise.

    2. Re:United Nations can't catch a break? by TheLink · · Score: 1

      Yeah, I personally believe that having multiple nontotally cooperative countries (BUT that are unlikely to go to war with each other) is good. Let the countries negotiate with each other.

      Then if some country gets really crappy, people move elsewhere.

      After all if you look at the proliferation of crappy country governments, why should most people want to risk a crappy world government? Like how are you going to choose the world government? The same way the crappy country govs were chosen?

      Like how stupid is that? What problem are you trying to solve? And is the "solution" better than the problem?

      --
    3. Re:United Nations can't catch a break? by Anonymous Coward · · Score: 0

      Well.... putting 'all of your eggs in one basket'/forming a single world government be it a democracy or dictatorship - whichever entity accomplishes that would be feeling like, "... :(, there's nothing left to take over. This sucks."
      What are they going to do, enslave us all? So we don't get to pick our own form of slavery anymore, so what.

  27. Security is hard by Anonymous Coward · · Score: 1, Interesting

    In the world of developing high volume web sites in a secure fashion, it is very easy to say "proactive," but very hard to do.

    I have worked with many web developers who thought they knew a lot about making web sites secure, and who didn't even know what a SQL Injection vulnerability was. Why didn't they know? Because they had never run across it before. It had not been taught in their school, nor in any of the "how to use Microsoft Visual Studio" training they had.

    The "well nobody told me" problem is hard to surmount, and it can have dire consequences. A friend of mine worked at a place where the senior architect explicitly forbade parameterizing SQL queries because he thought it was needless code complexity and a waste of time! I have also seen developers struggle with the .NET event-driven model for web page development, writing very insecure code because they really didn't have their heads around the timing of code execution or the mechanisms behind view state.

    One thing that got me a while back was an exploit reported by Microsoft involving a means by which extra information about the web site could be teased out of the http header under some circumstances. Our client followed Microsoft's instructions for tweaking IIS to prevent the attack, and several of our pages started trying to redirect to invalid URLs. Problems like that bug me because of how difficult it is to be aware of them in advance. One has to invest a lot of time in keeping up with the latest news on a wide variety of web-related technologies (just to learn about the problems), and even more time in re-writing your code based on the new knowledge. What was secure yesterday isn't secure today, and designing sites that will remain secure tomorrow requires a very great deal of money, time, and effort to be spent in activities that don't always seem to have a measurable benefit at the time.

    So...I can sympathize.

    1. Re:Security is hard by Anonymous Coward · · Score: 0

      I agree that in some cases binding query APIs to SQL queries do tend to increase code complexity and are a waste of time.

      There is no reason this need be a requirement to construct secure queries in an interpreted web environment.

      What we need are **simple** systems that understand some basic context and do the right thing without being explicitly asked to. Its not hard or rocket science.

      select * from accounts where login='$form.login'

      (Web application): Gee maybe I should check/escape the login form field before executing the query.

    2. Re:Security is hard by pAnkRat · · Score: 1

      Sorry, but people who charge money for website development (aka. professionals)
      and who claim they don't know what SQL-Injection or Cross Site Scripting is about,
      should get theit development license revoked or something.

      "I don't know" is a very lame excuse, espacialy if they call themselves a pro.

      I know that complete security is near impossible, but basics are still basics.
      This is like a doctor claiming he had until now never heard about steril(?) scalpels and hygiene basics.
      You don't excpet to die from wound fever, after three stichtes anymore do you.
      (200 years ago it might have been the case, but not here and now anymore)

      --
      we need an "-1 Plain wrong" moderation option!
  28. USA and Israel by kwoff · · Score: 0, Troll

    That's precious that they're asking USA and Israel "dont kill children and other people". Does it not count if you blow yourself up while doing it? Or do you just have to be muslim to be excluded?

    1. Re:USA and Israel by kwoff · · Score: 1

      My article was modded as a Troll. Again. It's been years since I was able to moderate. Oh, well.

      But FWIW, I think it's legitimate to point out that it's not only the USA and Israel doing the killing. The hack's statement was hypocritical. You never see hacks urging extremists to stop the terror.

  29. Re:And Jews violated more laws under the Nazis, to by c6gunner · · Score: 2, Interesting

    Any organization which elects Libya to chair it's "Human Rights Council" automatically loses any right to be taken seriously.

    Seriously, is it possible any more to even pretend that the UN is anything but a forum for tinpot dictators and other nameless losers to bitch, complain, and blame the west for all of Earth's problems?

    Come to think of it ..... it kinda reminds me of Slashdot, actually ;)

  30. Hardly a surprise by Opportunist · · Score: 5, Interesting

    You'll notice that webpages of governments, political parties and other highly bureaucratic systems are usually quite vulnerable. This is due to a few factors.

    First of all, whatever they do, use or change needs about a truckload of paperwork and red tape to get done. They're not only vulnerable to 0day exploits, they're usually vulnerable to exploits that have been around for a year or two, simply because they cannot respond quickly to security threats and vulnerabilities.

    Then there's that compatibility issue. Especially when dealing with multiple partners, you have to find some kind of way that makes it easy for every partner to incorporate their content into your system. You must not prefer any, you must not use a system that would block certain partners and participants out due to incompatibility. Now, compatibility usually boils down to the lowest common denominator. And that's usually not the most secure one.

    And finally the good ol' fact that the people who work there are usually not the creme of the crop, the best of the best and the spearhead of excellence, or they'd be in free enterprise making more money.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:Hardly a surprise by rtaylor · · Score: 2, Insightful

      And finally the good ol' fact that the people who work there are usually not the creme of the crop, the best of the best and the spearhead of excellence, or they'd be in free enterprise making more money. You often get what you pay for. The population demands low paid government workers then wonders why they get low quality government work completed.
      --
      Rod Taylor
  31. The easiest non-intrusive way by michaelhood · · Score: 2, Interesting

    to check for SQL injection like this on a website is to do something like this:

    http://www.un.org/apps/news/infocus/sgspeeches/sta tments_full.asp?statID=105%20OR%201=1

    If they're not using parameter binding and/or properly sanitizing user input, this should return a different record (article in this case) than the original URL. - http://www.un.org/apps/news/infocus/sgspeeches/sta tments_full.asp?statID=105

  32. Still vulnerable by Ysangkok · · Score: 2, Informative

    Still vulnerable: SQL error

  33. Re:pacifists are such losers by Anonymous Coward · · Score: 0

    Wish I had mod points :(

    +5 Funny

  34. Amateurs In the UK they physically take the Server by Anonymous Coward · · Score: 0

    The article starts off:-

    "A major security alert has been sparked after the theft of a computer database containing thousands of top secret telephone records from police investigations into terrorism and organised crime."

    So you think someone hacked the computer and nicked the database.

    further down the article:-

    "The raid at the high-security head office of Forensic Telecommunication Services Ltd (FTS) at Sevenoaks, Kent, raised fears that vital evidence from undercover investigations may have been lost or have fallen into the wrong hands."

    "The stolen computer server - a metal box the size of a large DVD player - contained details of who made calls on mobiles, their exact location and precisely when the calls were made."

    FTS said in a statement to The Mail on Sunday last night: "We can confirm that the company was recently the victim of a break-in at one of our premises in Kent.

    "As a result, some IT equipment, including a server, were stolen".

    "The server, which is security protected, contained administrative data and details of some case files in relation to FTS's forensic work."

    http://www.dailymail.co.uk/pages/live/articles/new s/news.html?in_article_id=474788&in_page_id=1770

  35. Re:Our agreements? The struggling Parliament of Ma by MvD_Moscow · · Score: 3, Insightful

    You really need to lay off the theory and try living in the real world.

    Now let's pretend for a minute that 'positive liberty' is all BS. Let's pretend that the libertarian ideology on liberty is the most moral one. Let's say UN implements your Libertarian Declaration of Human Rights.

    Now how will that be a step in the right direction for the freedom and safety of mankind (pretty big words for statement devoid of any arguments)? Do realize that no one will even care about this document, let alone even paying lip service to it's requirements. The vast majority of the earth couldn't give a flying fuck about your rants on positive and negative liberty. Fuck, most of them are so poor that they can't really have a debate on this issue.

    Try explaining the dangers of positive liberty to an illiterate African kid. Try telling him that the government should not be building school or hospitals because that means richer people will have to pay more taxes and it increases government involvement in the individual's life. Most people don't care about your Ivory tower rants. People want education and healthcare. People don't want to see their kids dying from something stupid like malaria. People want at least baseline prosperity.

    Don't get me wrong, I am not really arguing against libertarian ideology. I am just pointing out that libertarian views on positive liberty issues is a extreme view than is not shared by the majority of the population of our planet. And it doesn't matter whether they are right or wrong.

    Okay, forget positive liberty issues. Let's look at social liberalism, you would think there would be more consensus on this one, right? So how are you planning to force all nations on the planet to ratify a document that would essentially legalize the vast majority of illegal drugs (if not all, I guess it depends how hardcore you are about such things, I don't know, I don't really see the point in recreational use of heroin)? Hell, we have troubles legally enforcing the current declaration because many muslim nations like making exceptions (I am beating your wife is right, no? What kind of barbarian would want to ban something like that?), I am not even talking about practical implementation of the current declaration.

    The UN isn't about world peace and prosperity and promoting rights. It's about comprising and trying to find a mutually acceptable solution while at the same time trying to advance freedom/prosperity.

    I don't even know why I wrote this. You're just a naive little American, with no understanding of the world around him. Your one size fits all attitude is just laughable. It's because of people like you that I don't like libertarians. Libertarians are kind of like communists in a way, flip side of the same coin.

  36. Who's next? by Anonymous Coward · · Score: 0

    Ten to one, we hear next week that some large repository of Student papers is vulnerable too.

  37. Don't worry by owidder · · Score: 2, Funny

    The UNO knows what to do. See my small cartoon: http://geekandpoke.typepad.com/geekandpoke/2007/08 /strong-uno.html Bye, Oliver

  38. Re:Waste of commas by StrahdVZ · · Score: 1

    Beside the overly zealous use of commas, that would, with all due respect, convince the Secretary General, if he is the recipient, that the email was, in fact, sent by William Shatner, its a great idea!

  39. Re:Our agreements? The struggling Parliament of Ma by MrSteveSD · · Score: 2, Insightful

    It's far from a perfect system, but it's still the best we have.

    The UN is really a complete affront to democracy. It's effectively a five country dictatorship. You have 5 countries which can veto the will of all the world's countries and they can never be removed from their position on the Security Council. They can also veto the appointment of a UN Secretary General, even if the rest of the world wants that person for the role. It's amazing really that the media do not direct their attention at the UN's completely undemocratic structure rather than just its operational failures (which often stem from that structure).

    I mean, what's more outrageous. That some UN officials have been corrupt in the past or that the organisation is itself a dictatorship?
  40. Re:Our agreements? The struggling Parliament of Ma by Anonymous Coward · · Score: 0

    I'm not a libertarian and I'm not the GP but, I seriously think we should legalize most illegal drugs.

    Why? Because the vast majority of the domestic harms ascribed to illegal drug use actually result from the illegality of drug use. But worse than that, the illegality creates far greater harms in the rest of the world. For example, sick people throughout the world are dying in terrible pain because the most effective, natural analgesic, morphine, is effectively prohibited by anti-drug treaties. (Yes, the richest six countries have adequate supplies; everyone else is fucked. It is ridiculous that we're spending billions to eradicate the poppy growing in Afghanistan when there's such a desperate shortage of morphine. And yes, other countries aren't required to accept the anti-drug treaties, but their trade depends on it.) Or look at the cocaine-related violence in South America. Again, entirely a result of the illegality of drugs and our demand for them. We have ineffective laws intended to protect a few foolish westerners from self-inflicted harm inflicting far greater harm on the rest of the world. I don't see any positive argument for these laws.

    I do see the point of recreational heroin use although I've never tried it. But I don't see the point of fucking-over undeveloped countries.

  41. Re:Our agreements? The struggling Parliament of Ma by HappyUserPerson · · Score: 0, Informative

    Also, don't you want the Universal Declaration of Human Rights to apply to US Citizens in a US Court or on the streets?

    No way! Our Constitution and Bill of Rights are designed to protect us and our rights! Somehow, I don't think the safety, security, and interests of Americans is high on the priority list of the UN. I would prefer that our courts stick with the Constitution and Bill of Rights that make America's interests top priority.

  42. Re:Our agreements? The struggling Parliament of Ma by Citizen+of+Earth · · Score: 2, Informative

    is also far more effective and dare-I-say-it even important than most people in the US ever give it credit for

    What are the things that you are claiming that the UN is effective at? As far as I can tell, there are only two things: (1) giving hand-outs to the desperately poor, and (2) keeping tinpot dictators in power. One could argue that these together are self-perpetuating.

  43. Re:And Jews violated more laws under the Nazis, to by MrNaz · · Score: 1

    blame the west for all of Earth's problems

    Yea, because the third world is responsible for global warming, sweatshopped labour, "pre-emptive" wars and capitalistic plutocracy. Get over yourself, if you think the west's natural position is at the top of the human pecking order. If you had any perspective at all you'd know that history has shown again and again that any empire or civilization that seeks to place itself above others will eventually be pulled out of privilege, or die due to the inherent instabilities that arise when a whole order is based upon competitive self-serving narcissism.

    --
    I hate printers.
  44. Stupidity is NOT just in Gov't by Tablizer · · Score: 1

    I've worked in both commercial and government organizations, and stupidity happens in both. If a commercial site messes up, it is just easier for them to hide it because the consequences are usually more localized and they can just pay off parties affected.

    Almost all companies and organizations are cheap and want the most while paying the least. Governments are often not given much money for items outside of their core function, and websites often fall into that classification. Commercial entities do spend more on esthetics though. I've seen contractors make a commercial site super pretty and the head hancho's really liked it, but it ran like malassis on modems at a time when high-speed was not common (inside they had high-speed). They also used a lot of JavaScript to make it fancy, but it crashed on versions of browsers that they didn't test. They chose fancy over robust. Perhaps commercial and gov't make different flavors of mistakes and shortsighted decisions, but they both make mistakes.

  45. The heart of the matter... by myowntrueself · · Score: 1, Funny

    'Basically, both Jews and Muslims claim the "holy land" as their own. So, who do we support, then, or do we just let them blow themselves to bits?'

    At the heart of the problem is that Muslims and Christians both desperately want to be Jews. They, too, want the 'special deal' with 'god' that the Jews got.

    But the Jews don't want someone not born a Jew (or who went thru a *very* special process of conversion) to share in Jewness. The Jews want neither Muslims nor Christians to be Jews.

    This 'Holy land' is holy to Christians, Muslims *and* Jews for this very reason; that the Christians and Muslims want to be Jews.

    And thats at the heart of most of the problems of the middle east and has leaked out into many other parts of the world.

    --
    In the free world the media isn't government run; the government is media run.
    1. Re:The heart of the matter... by MrNaz · · Score: 1

      Come again? Dude, you sound like someone who's never met a Christian, a Jew OR a Muslim.

      --
      I hate printers.
    2. Re:The heart of the matter... by marafa · · Score: 0

      ROFLMAO!
      someone PUHLEASE mod this guy HILARIOUS!

      --
      _ In Egypt Networks: Network Solutions with a Twist
  46. Re:Our agreements? The struggling Parliament of Ma by AnyThingButWindows · · Score: 0, Flamebait

    As a nation, the US has made numerous commitments to the UN, and that includes agreements to follow things like the Universal Declaration of Human Rights. When we *agree* to follow International Law, we ought to, don't you think?

    ABSOLUTELY FUCKING NOT. I will NEVER allow someone outside my country tell me what I can, and cannot do unless they want to face my 2nd amendment rights in their face with my hand on the trigger. Thats why we have the 5th Amendment: "No person shall be denied life, liberty, or property without due process of law". We created the Constitution for a PURPOSE. If you don't know the constitution, then you need to learn it, and learn it NOW. The REASON that this country is so royally fucked is because world government favoring little imperialists have either forgotten, or either never LEARNED the constitution, what it means, how many people died for it, and what it means to be a patriot. A patriot's duty is to protect his country FROM his government. Ever watched the Patriot? Braveheart?

    The Bill of Rights is getting stretched more thinly every day, and the anti-terrorist effort (though directed in part by well-meaning people) is cutting swaths in our Constitution.

    Thats because little wimps sit on their butts and ALLOW it to happen. What ever happened to Thomas Jefferson, Martin Luther King, and Rosa Parks? Rosa Parks was a true hero because she KNEW that DEFIANCE was the ONLY option to push the sorry ass government we have in place into some common damn sense.

    If you want to play the 'terrorist' card, I don't believe a damn word of it. Your damned president CREATED your 'terrorist' threat. He is not my president, I din't vote for him, and the election was rigged in the hands of Diebold machines, not the people. It is not who votes that counts... But who counts the votes.

    If you are stupid enough to believe that 'jet fuel' bit, that supposedly brought down two of the largest towers in the world, then you need to go back to collage, and learn a few things about physics. And please explain to me the collapse of WTC7! Surely you aren't dumb enough to believe fire brought down an entire building when the building hardly had any fire in it at all.

    The terrorist bit is simple bullshit. The only terrorists in this country are the ones sitting on their damn thrown in Washington DC, and NY at the CFR building. Government is not God. I listen to Alex Jones's show, I know what goes on in this world. I don't sit on my ass all day and watch Faux News, MSN-BC, and A-BC. Those media corps are controlled by 6 people. And you sit there, and honestly think that they are not government controlled? Look up Reichstag, and what Hitler did in WWII to play his own people into the demon of fear, and how he used it to enslave people into voting for him, THEN you look back to today, and look at what that sorry son of a bitch we have for president has done. You CAN NOT tell me they are different because you would be DEAD WRONG.

    "Those who sacrifice liberty for security DESERVE NEITHER, and will LOOSE BOTH." - Benjamin Franklin

    So you GO, and VOTE for the ONE YOU SERVE. You ARE going to get what you DESERVE.

    http://www.google.com/search?hl=en&sa=X&oi=spell&r esnum=0&ct=result&cd=1&q=Reichstag&spell=1

    I for one will be voting for Ron Paul.

    --
    When government fears the people, there is liberty. When the people fear the government, there is tyranny. - Jefferson
  47. Working for True Believers by Anonymous Coward · · Score: 0

    ...often sucks dead reptiles because they resent having to pay for the work they get. After all, the Cause motivates them, so everyone else should be just as motivated and satisfied by supporting the Cause! "The check will be mailed next week. Honest."

  48. Re:Our agreements? The struggling Parliament of Ma by rossz · · Score: 2, Informative

    The fact is that the UN, while it does have a lot of problems, is also far more effective

    I doubt that very much. The UN couldn't pour sand of a boot even with instructions written on the heel.

    How long has the genocide in Darfur been going on? Last I heard, the UN issued a proclamation that said basically, "stop or we'll say top again". How about those times the UN security forces allowed militants and war lords to drive right past them and kill the civilians they were supposed to be protecting? How about all those rape and child sex slave cases being hushed up by the UN?

    The only time UN security forces are able to do a damn thing that is useful is when the United States or one of our trusted friends (UK, Canada, Australia, etc) is in charge of it.

    The UN may be been created with noble intent, but it now only serves to keep tin-pot dictators in power. Look who's on the commission for human rights. The worse evil dictator bastards on the planet.

    Look who the UN just put in charge of the commission on sustainability. The representative from Zimbabwe. Zimbabwe! OMFG! They have about 3000% inflation in that country! Once an exporter of food, now suffering mass famine. All because of the policies of the evil dictator Mugabe. But hey, Mugabe's policies just got the rubber stamp from the UN, so it must be desirable.

    Any argument that the UN is useful and/or necessary is both morally and intellectually bankrupt given its past history and current (in)actions.

    --
    -- Will program for bandwidth
  49. Author doesn't know much either... by jgoemat · · Score: 1

    While most of us may agree with the message, many will object to the spelling, and specifically to the dont used instead of don't. There's a technical reason for the missing apostrophe, though, because messing with this very character (') is part of the technique apparently used by the attackers.

    There is no stumbling block here. All the hacker had to do would be to escape their own apostrophe. That's the very vulnerability that makes this work.

    '; update speeches set text = 'Don''t try to hack this site, I beat you to it.' where id = 1;'
  50. Re:And Jews violated more laws under the Nazis, to by Planesdragon · · Score: 3, Insightful

    Seriously, is it possible any more to even pretend that the UN is anything but a forum for tinpot dictators and other nameless losers to bitch, complain, and blame the west for all of Earth's problems? That's, ah, er, the point of the United Nations. Avoid World War III by making a place where every nation can come and bitch to the rest of the world.

    All the rest of it is just gravy.
  51. Re:pacifists are such losers by tfiedler · · Score: 1

    at least i have the courage to post as someone and not as an anonymous coward. oh, i volunteered btw, right out of hs, i'm also far from a young man and i've probably seen and experience more of this world than you. in any case, your name calling is no different than mine, however i happen to be right.

    --
    Democrats and Republicans are like AIDS and Cancer, I want neither!
  52. SQL Injection by rdoger6424 · · Score: 1

    Representatives from the United States of; DROP TABLE; frown on such SQL Injections

    --
    "Hello 911? I just tried to toast some bread, and the toaster grew an arm and stabbed me in the face!"
  53. Re:And Jews violated more laws under the Nazis, to by hunterx11 · · Score: 1

    Libya chaired the Commission on Human Rights, not the Human Rights Council. The Human Rights Council is in fact the successor to the now-defunct Commission on Human Rights; it was created to address the failures of the UNCHR, and Libya's tenure as chair was part of the impetus for the creation of the new body. Although the UNHRC has not fared much better, it is nonetheless wise not to ignore actual facts in favor of needless polemics.

    --
    English is easier said than done.
  54. Re:Our agreements? The struggling Parliament of Ma by Anonymous Coward · · Score: 0

    So it is OK to use Nazi methods against us that do not live in the "land of the free"?

    You are invited to come and have a look at real freedom in Scandinavia.

  55. I would like... by Twisted64 · · Score: 1

    I would like to mod SplatMan +1, Kind.

    --
    Consciousness is a myth. Trust me.
  56. Re:Our agreements? The struggling Parliament of Ma by Anonymous Coward · · Score: 0

    There is something that comes up everytime the UN is discussed. The "they" thing. The UN does not have much free will. Most of its Member States, the UN first and foremost, like it that way. The "UN" is usually the expression of the least common denominator of its Member States' will.

    If the "UN" does not do something right, especially if you are american, shouldn't you hold your own government accountable?

  57. Meanwhile, at a research institution by Anonymous Coward · · Score: 0

    I work at a major research institution, and I've been told flat-out by my supervisor that "we're not a target" for hackers. It's a shame, considering the millions which would be wasted if someone decides to mess up our data.

  58. Re:Our agreements? The struggling Parliament of Ma by PinkyDead · · Score: 1

    The value of the Constitution and the Bill of Rights outside the borders of the United States is substantially less than that of toilet paper.

    And when you are outside the borders of the United States, you can be damn sure that your government supported by your courts, constitution and bill of rights will consider you substantially less valuable than its international trade agreements.

    --
    Genesis 1:32 And God typed :wq!
  59. Re:Our agreements? The struggling Parliament of Ma by Anonymous Coward · · Score: 0

    I agree with you that we should legalize most drugs and simply decriminalize the rest.

    The way drugs are handled in the world should defiantly be reformed. This could have a lot of benefits. For instance, Afghanistan might be strengthened if its government was allowed to have monopoly on poppy exports. These exports could then be processed by richer nations. The Taliban would lose an important source of finance.

    I am not too sure about the recreational use of heroin. At least in a completely legal context (heroin would be treated like say alcohol). I favor a more harm reduction approach where the government maintains safe-injecting rooms where users can have access to clean needles and a clean dose. Of course, getting access to these facilities would involve more than just wanting to get some heroin for free.

    While putting heroin addicts into jail is a pretty stupid idea, I am not too sure that legalizing heroin is the right solution. In terms of its physical effect it has potential for doing a lot harm.

  60. Re:And Jews violated more laws under the Nazis, to by Neoprofin · · Score: 1

    Any nation that seeks to put itself above others will eventually not be. What a fabulous non-statement. Every monarchy will eventually end! Every nation with an A in the title will end! All of those statements are just as true as yours, it doesn't take much. Up to this point we haven't seen anything that qualifies as forever but there have been plenty who made pretty good runs, and they were not the meek and complacent.

  61. Ralf-isms by IwantToKeepAnon · · Score: 1

    Good one, one of my favs is "Hello Super Nintendo Chalmers".

    LOL!

    --
    "Happy families are all alike; every unhappy family is unhappy in its own way." -- Anna Karenina by Leo Tolstoy
  62. Pacifists, eh? by zippthorne · · Score: 1

    'Cause nothing says, "Pacifist" like vandalizing somebody else's stuff...

    --
    Can you be Even More Awesome?!
    1. Re:Pacifists, eh? by inKubus · · Score: 1

      It's definitely in contrast to protesting the UN by throwing a rock through their front door... So yes, they were "peaceful" in their protest. Of course, it might be illegal, but no one was really "hurt" in the process.

      --
      Cool! Amazing Toys.
    2. Re:Pacifists, eh? by zippthorne · · Score: 1

      No one except the network admins who have to make sure everything is fixed. Unless they use open source software, then we know their time is worthless.

      --
      Can you be Even More Awesome?!
  63. Re:And Jews violated more laws under the Nazis, to by c6gunner · · Score: 1

    That's, ah, er, the point of the United Nations. Avoid World War III by making a place where every nation can come and bitch to the rest of the world.
    Which is a nice idea, as long as you only allow rational and influential nations a seat at the table.

    What the UN has actually turned into is the equivalent of raiding your town jail and local loony-bin to find members for your town council. While the concept of "equal representation" might seem noble, in these cases it fails horribly.

    We (the "western" nations) have already recognized the fact that negotiating with terrorists, tyrants, and fascists is not only useless but counter-productive. Our foreign policies generally reflect that. Yet at the same time we allow such individuals to take part in UN discussions, and vote on matters with a voice equal to those of liberal democracies. I shouldn't need to point out the foolishness of such a hypocritical policy. The UN should have been scrapped years ago.
  64. Re:Our agreements? The struggling Parliament of Ma by sco08y · · Score: 1

    The fact is that the UN, while it does have a lot of problems, is also far more effective and dare-I-say-it even important than most people in the US ever give it credit for. It's far from a perfect system, but it's still the best we have.

    The UN tends to keep the various powers, especially European and Russian, but also China and Japan, tied up in red tape so they are less inclined to engage in world wars. It also sets up a standard system whereby brutal third world dictators can demand and receive handouts while they butcher their people. This isn't far from its original intent: to get various nations to sit down and talk rather than invading each other, but it's nothing like the vision the one world government people have for it.

    The usual critique of democracy is that it's far from perfect, but that it's the best we have. The UN is also the best we have, but it is absolutely awful. There is *nothing* in the UN's charter or design that would ever make them lift a finger to stop a genocide.

    Also, don't you want the Universal Declaration of Human Rights to apply to US Citizens in a US Court or on the streets?

    Not particularly. Have you actually read the thing? Well, I haven't, because it's ridiculously long, but I skimmed it pretty well. It's missing some key stuff, like an equivalent to the US Constitution's tenth ammendment. The framers realized one key point: many people will only tend to agree on a few fundamentals. So your key documents should be short and sweet (and, consequently, timeless!) and the more local bodies will go into more detail.

    but we also still have a lot to do, and to accomplish, as a nation and as members of larger world

    Nations don't have agendas, and, being sovereign, they are not members of anything larger. Your intentions may be laudable, but they require that the modern nation-state change into something fundamentally different from what it is. The liberal democratic nation state has served us poorly to decently for the last few hundred years and has been an order of magnitude better than anything that came before it. And most of the experiments of the last century have been tragedies orders of magnitude larger than anything humanity could conceive of.

  65. Re:Surprising? Not at all.. by danpsmith · · Score: 1

    That "other" guy that did 5% of it could eb the reason you just got hacked. Web attacks are becoming more and more common and will continue to rise with Web 2.0 features. Surprising? Not at all... we see this stuff all the time and on more popular sites than un.org (is that really saying much?).

    It seems like most of the people talking about AJAX and Web2.0 don't even really know what it is. Ajax isn't any bigger of a security threat than is allowing the users of your website to use get or post on a URL, which nearly every site of any complexity already does.

    --
    Judges and senates have been bought for gold; Esteem and love were never to be sold.
  66. Re:Our agreements? The struggling Parliament of Ma by Anonymous Coward · · Score: 0

    He was right. You truly are an imperialist.