Link-spamming spreads to NHS, police

Home Office harbouring hentai - how humiliating!

Hot on the heels of spam-linked local government and pwned parish Council sites, El Reg has discovered that central government is not immune to infiltration by spammers.

To schools we must now add NHS, Police and Fire Brigade. If Altavista is to be believed, not only have the Home Office crime reduction pages been encouraging a dubious interest in hentai, but the Met also has been making its own contribution to racial harmony with links to "asian video porn" and "interracial movies".

As the list grows, we are left to wonder at the consistency of a government that has criminalised possession of some categories of material, particularly porn or "terror"-related, while having such a poor track record when within its own domains. Karma – not to mention "duty of care" - leaves us wondering whether the Home Office should not now be hauled up in front of its own shiny new laws.

If readers would like to assist with the important task of cleaning up Government websites, it is not hard to do. Pick your favourite search engine and load a search that is something like "site:dom.uk +porn", where "dom" equals the appropriate official designation. So far we have looked at "gov.uk", "sch.uk", "nhs.uk" and yes, "police.uk".

Not all search engines give the same result: in some cases, Altavista returns a more comprehensive search than Google. While "porn" is the obvious term of choice when it comes to hunting down spam, it can pay to be creative: "tramadol" and "vicodin" will also score.

Let us know what you find, but be careful and be responsible. Don’t click through to links, unless you wish to risk infecting your computer with illegal material or a nasty piece of malware. If you encounter what looks like real links to child porn, inform the relevant site admin and/or the Internet Watch Foundation. Don’t go looking at it.

While our first survey revealed that most of this material is no more than link spamming – spam designed to sit on pre-existing poorly moderated boards and boost site ratings – in a few instances, sites have been more deeply hacked. Hidden directories have been created on the site server and unauthorised software installed. These are far more serious, possibly allowing hackers to access other confidential information on that site.

When it comes to compromised sites, step forward, under the "sch.uk" banner, Cardiff, Brent, cantonian.cardiff and sidious.kingsbury.brent. That may not sound like many, but a search on "porn Guestbook site:sch.uk" adds another 30 or so.

Welcome also Thorpe Greenways and Bishopton/ Redmarshall Infant Schools. We’re not sure what’s going down on the Lamberhurst School Notice Board, but it certainly does not look appropriate for kids. The fact that the site is "under construction" suggests strongly that the server may have been hacked.

Congratulations - kinda - to Yorkshire and Humberside Fire Brigade, who also make the list. That site joins around 15 NHS sites, ranging from individual practices, such as Strawberry Gardens up in Morecambe, through to the entire Cornwall Region, which currently holds a spam overhead of some 2,300 pages. Lothian Referrals and Wired for Health were also, at one point, victims of this practice – but now look to be clear.

However, what the last link reveals is that the NHS seems to be more at risk than other government departments. The Gold Standards Framework is a national programme: that has been infiltrated. Wired for Health looks like the precursor site to Healthy Schools, which was also the locus for infection of Worcestershire County Council's site.

Likewise, according to Altavista, the NHS FOI site (do not download the .csvs). However, pride of place in the embarrassment stakes must go to the Met and the Home Office, both briefly spammed.

Denying that the material in question had ever been hosted on their site, a Home Office spokeswoman blamed OSCommerce software used to host a publicity catalogue. She said: "This feature was withdrawn... because it was discovered that it could be exploited by third parties to circumvent spam filters."

The Department for Health reassured us that it takes internet security seriously, and that its own website had not been compromised.

A spokeswoman said: "The problem identified seems to be with poorly managed or unmoderated open discussion forums and message boards. The main DH website does not have this functionality and comes up clean on search engines.

"The nhsidentity website contains guidelines for nhs.uk sites, which advise that websites should follow COI/Cabinet Office guidelines - these include security and operations guidelines on running message boards."

We waited in vain for the Met to respond, but at time of writing have heard nothing from them.

Update: All three sites featured in our last report on this subject promptly took their site down. Over in Worcestershire El Reg was pleased to be invited to join an early morning phone-in on the topic, where we heard one local councillor claim that material hosted on the worcestershire.gov.uk site wasn’t, er, actually on the Worcestershire site. Still, the best form of defence is attack, as another local councillor demonstrates very well. ®