The home page for one of the nation’s most respected computer security training institutes was defaced Friday morning and the site remains offline. A group identifying itself as “Fluffi Bunni” managed to break into the Web site for the Networking and Security Institute, which is known as SANS. The institute’s director of research, Alan Paller, said the site would remain offline until forensic work was finished and “until we figured out how it happened.”
THE COMPUTER INTRUDERS replaced the normal SANS.org home page with a taunting message that remained on the SANS site for about 27 minutes, Paller said.
He said the defacement was embarrassing for the organization, but added that SANS is a top target for computer intruders.
“If you sit in the middle of the road long enough, a truck will hit you,” he said. “We are a target.”
SANS offers certification classes and other seminars for computer security professionals. It also publishes a number of popular security mailing lists.
The SANS site includes an e-commerce component, as network security professional can register and pay for conferences at SANS.org. But Paller said no personal data was compromised, as registration information isn’t stored on the computer that was broken into.
“Still, this is not what you want to have happen,” he said.
A group calling itself “Fluffi Bunni” has struck at popular computer security organizations before. In May, Exodus Communications’ security.exodus.net site was defaced and a similar message left behind.
Paller couldn’t say when the SANS.org site would be back up, because he vowed the organization would plug whatever hole the intruders used to break in first — a standard he said many victimized sites don’t stick to.
“We are losing business every minute, but you’ve got to do it right,” he said.
The break-in occurred the same morning that the annual DEF CON computer hacker convention began in Las Vegas. Paller said there is no apparent connection between the conference and the defacement.