Lack of security personnel, many .gov.vn websites have had inappropriate ads reinstalled

The National Cyber ​​Security Monitoring Center - NCSC under the Department of Information Security (Ministry of Information and Communications) has just continued to update information on the results of reviewing inappropriate advertising content on the website of state agencies with the domain name .gov.vn, in the technical report on the information security situation in October 2023 and statistics on connecting to share data on malware and monitoring.

According to this report, although the Department of Information Security has issued warnings many times, as of the end of October 2023, this agency still recorded 27 units, including 17 provinces and cities and 10 ministries and branches, whose websites were still being exploited to upload large numbers of files with malicious content.

Specifically, in the ministry and sector sector, the number of government agency websites with inappropriate information content inserted was 23 pages. Meanwhile, the number of websites managed by local government agencies that were exploited to insert inappropriate advertising content was 48 pages.

According to NCSC experts, files containing inappropriate advertising content appear in Google search results and redirect users to other websites when users access the link. This will become dangerous and serious if exploited to post and disseminate bad and toxic content, distorting the sovereignty, policies of the Party and policies and laws of the State.

Notably, the situation of many government agency websites being exploited by subjects to install, post, redirect or link to inappropriate advertising content such as card games, gambling, etc. is not new, but has appeared for a long time before.

Since mid-December last year, the Department of Information Security has repeatedly warned and requested ministries, branches, and localities to review inappropriate content on state agency websites (.gov.vn).

In particular, since August 2023, every month in the technical report on the situation of network information security in Vietnam, the Department of Information Security has added a section to update the results of reviewing inappropriate advertising content on the websites of state agencies.

Statistics show that in the three months of August, September and October, the total number of government agency websites recorded by the Information Security Department as being exploited to insert inappropriate advertising content and recommended for review and handling by ministries, branches and localities was 176 pages.

Analyzing the situation of many government agency websites being exploited by subjects to install inappropriate advertising content, experts from the Department of Information Security said that some websites were attacked many times through information security vulnerabilities, and the attackers could re-enter the website and edit the content. In addition, the subjects also took advantage of the website's information posting features such as posting questions and answers, forums, downloading files, etc. to post advertising information.

The representative of the Department of Information Security pointed out that in order to thoroughly fix and handle the situation, in addition to removing files and posts containing malicious content, units also need to investigate the cause or information security vulnerability leading to the above situation and implement a fix; review the source code and application server to remove malicious code that has been planted by the attacker. However, in reality, there are units that have received warnings but do not have enough capacity and resources to handle the situation.

Sharing the same view, expert Vu Ngoc Son, Technical Director of NCS Company, commented: Currently, many agencies and organizations in Vietnam lack specialized personnel in network information security. Due to the lack of personnel working in information security, units face difficulties in responding to and resolving information security incidents.

Considering that the fact that the websites of state agencies with the domain name .gov.vn continuously have inappropriate advertising content installed is a proof that the unit lacks information security personnel, Mr. Vu Ngoc Son analyzed: Also due to the lack of specialized personnel, many units, after being warned, only handled the surface - removing inappropriate information content, but have not found the cause of the website of their unit being installed with malicious content, thereby thoroughly solving the problem at its root.