Indonesia, the archipelago country of Southeast Asia, is considered the fastest-growing IT market in Asia Pacific.
As a home of several unicorns and a decacorn, Indonesia is advancing increasingly fast in terms of tech adoption among its citizens. Even when the country is divided to tens of thousands of islands, enthusiasm is high.
But despite its fast adoption, the country lacks the ability to properly secure its IT infrastructure.
Worldwide, as government websites have been targeted by hackers, this time, Indonesia's National Cyber and Crypto Agency (BSSN) website has also become a victim of deface hacking.
The BSSN website that has the address pusmanas.bssn.go.id, was hacked, in a campaign that was reported as an act of revenge.
It is reported that a hacker from Brazil is the culprit.
Hacking the BSSN website, the Brazilian hacker managed to deface the website, changing its appearance with an entirely new page.
On the page, "Hacked by theMxonday was clearly shown.
The hacker admitted on the defaced page that he was the one behind the hack, and that he hacked the BSSN website because previously, an Indonesian hacker had hacked a Brazilian-state website.
"NSA da indonesia pwenetada KKKKKKKKKKKK sonx was here 3:) this deface is a response to lamers from indonesia who hack brazilian site"
The Brazilian hacker also posted to suggest how easy it was for him to hack the website.
Shortly after the incident, Anton Setiawan, a spokesperson for BSSN, confirmed the hack.
He said that the BSSN website was hacked, but no data is stolen.
The site itself, which is located in a subdomain of the main BSSN website, acts as the National Malware Center, where the agency puts its repository of malware data for the public to see.
There has been no attempt of significant breach other than defacing the website, Anton said.
To resolve the issue, the computer emergency response team at BSSN temporarily put the site offline.
During the brief moment, both the website and its IP address cannot be accessed. Shortly afterwards, after the matter is resolved, BSSN's CSIRT returned the site online.
As a crucial government agency, the BSSN must have a mitigation plan to anticipate this kind of attacks.
While the hack only changed the appearance of the site, an act of defacing a website suggests that the culprit must have managed to breach the system in the first place.
What this means, the hackers were inside, or maybe worse, managed to plant a backdoor into the system.
It is necessary for websites that have experienced even a slight deface, to carry out digital forensics and an overall information security audit. This in order to know how the hacker managed to breach the security, the exact time it happened, and what changed since the hacker breached it.
Previously, Indonesians have seen too many websites and online services getting hacked. But this specific case is the most ironic of them all.
BSSN is Indonesia’s primary cyber intelligence, cyber threat intelligence, cyber defense and cybersecurity agency. The fact that a website under its jurisdiction is easily hacked questions the the level of Indonesia’s national cyber security, and how well the government is doing to protect its properties when it comes to the internet.
BSSN's website should have the safest cybersecurity of all websites and web services in Indonesia, but yet it failed.
