dot id vs dot gov dot my

You could say 3 - 0. But then again, no one is certain that the perpetrators were Indonesian hackers. Maybe there were done by Indonesian hackers, but until an investigation is carried out and evidence are collected, we can never be sure. Talking about Indonesian hackers, there's a funny story I want to tell. The first was prior to HITBSecConf2004. One of the events that we had was the Capture the Flag competition, basically a hacking competition. About a month or so before the event, I got word that a hacker in Indonesia was calling for sponsorships because "they want to bring the best of best Indonesian hackers to compete in the event". I could not, however, confirm this stories since I was bloody busy. However, there was a registration by a team from Indonesia - but they never showed up for the event.

Talking again about the Indonesian hackers, and the fact that they've defaced USM and MCMC, of course there's the word cyberwarfare coming up. But then again, I don't really bother. In fact, I know a couple of Indonesian hackers, and they are damn good - and we'll be hanging out at Bellua Cyber Security 2005. The HITB crew and I will be organizing the CtF for them.

Again, talking about the defacements - where is NISER and MyCERT in all this? Aren't they the one that is supposed to take care of national ICT security, or am I wrong? Why aren't they educating the public sector that security is not all about having firewalls and patched servers? Are they investingating the defacements now? Or are they still figuring out the ones before this?

I mean, just look at the JKR website. It's been hacked and rehacked so many times within a day. Amat mensiasukan.

To the administrators/managers of the websites that have been defaced - DO NOT ask yourself why this happened even though you've spent so much on firewalls, IDS, competent admins, etc. Instead, ask yourself, what haven't you done to secure your IT infrastructure. You are dead wrong if your answer is "I've done enough, waaaattt."

The answer is simple: security is about process, not about products.

Listening to : Adam Freeland - Burn the Clock