Dr. Roy Spencer's climate website has been hacked

RoySpencerHeaderCapture

I have confirmed that www.drroyspencer.com has been hacked and rendered inoperable.

Dr. Spencer confirms this in an email exchange with me this AM and writes:

“Apparently some Indonesian female hacker.”

Whether this is a direct attack on his views about climate, an indirect attack via a hired gun, or just some kid looking to hold up a trophy for others to see is unclear at this point.

It does point to the risks though of running an independent server. My best advice to anyone in the climate issue is to run on wordpress.com rather than an independent server as they keep everything running smoothly and up to date against the latest security threats.

Get notified when a new post is published.
Subscribe today!
0 0 votes
Article Rating
82 Comments
Inline Feedbacks
View all comments
Lady Life Grows
February 28, 2013 8:04 pm

Irony–this is the first time I have looked at his website. Very fine site.

Andy Krause
February 28, 2013 8:23 pm

“I can tell you the cloud is a far better place to be.”
Please handover your business intelligence and critical knowledge assets to a third party. Better yet if the party is immune to your laws.

Andrew
February 28, 2013 8:37 pm

Self hosting is very technical and not for everyone who would like to have a voice on the net. While I agree with your sentiment, I can not imagine the current level of creativity would exist without third party hosting… However, it is a dangerous thing to post socially “unacceptable” material when using third party hosting… The “denier” word is quite scary and is rather indicative of mass witch hunt riots — several points in history come to mind – with the fairly recent movie Agora foremost in my memory… events then set back scientific knowledge 1500 years or more… the hope with the “Climate Change” nonsense is that either most of society doesn’t care enough to seek a witch hunt or that there are enough actual scientists to overcome the political elite and the powerful special interest groups feeding at the public trough generated using the fear factor.

Sad-But-True-Its-You
February 28, 2013 9:19 pm

Oh Dear.
In order to gain publicity regarding the ‘Sequester’ President Obama has ordered a kill-order of all Federal Detention Center Inmates, those ON death row and all those NOT on death row.
Additionally President Obama is … ‘Angered’ .. by ‘voices’ contrary to HIS vision of ‘Sequester’.
Therefore, President Obama by Secret Executive Order has ordered the hacking of ‘Contrary Voices’ both within the US Government and exterior to it. Mr. Obama’s thinking is that HE owns all the human and non-human lives on planet Earth. As such, HE and Only HE has rights to kill anything. He gives words to his faithful that He Will be judicious and loving toward those who bestow absolute obedience to HIM and HIM alone by physical actions.
The Parade of Favorites we have seen in the media for the last few days gives evidence of the obvious.
🙁
Not a good day for ‘America’ tomorrow.
A mad man is at the RED button and We are the Target.

February 28, 2013 11:18 pm

it’s the Koreans!

March 1, 2013 4:52 am

ecoGuy says:
February 28, 2013 at 11:39 am
Agree with the comment on WordPress security and common platforms. Its literally a numbers game for the hackers, no point trying to hack 1 off sites when there are millions of WordPress sites to crawl through.

This can be a difficult problem. On the one hand, utilizing popular software like WordPress has the advantage of a lot of support and a lot of people developing (or attempting to develop) very sound, stable and secure software. On the other hand, because it is so widely known and used, more people know about the intimate details of the software and can sometime determine vulnerabilities and exploit them. This is precisely why Microsoft has had to battle security problems for so many years, as opposed to say Mac OS/X, which up until the past decade was not nearly as popular (that has change quite a bit now however).

_Jim says:
February 28, 2013 at 4:03 pm
squid2112 says February 28, 2013 at 11:00 am
One might be inclined to think that exposing a ‘physical’ LAN port directly to the internet on an MS-OS-box is an insane thing to do; there are task-specific firewall ‘boxes’, of course, capable of operating at LAN line rates that trap and censor malformed traffic or any other outright hacking attempts, screening out low-level protocol hack ‘attempts’ before supplying arriving packets to the MS-OS-box … of curse, any legitimate-appearing, properly-formatted packets may be destined to ‘disrupt’ an otherwise operating ‘task’ on said MS-OS-box are another story …

_Jim,
I was in no way suggesting anything of the sort. Anyone who opens a LAN connection to the public is opening their door to the entire world. That would be completely insane. We have been utilizing routers, firewalls, load-balancers and a plethora of supporting software for years. A properly architected infrastructure utilizes a combination of all of these technologies in a tiered architectural fashion. Typically, a more secure site will only allow a connection through port 80 (http) and/or 443 (https, SSL). From there, the software (sometimes additional hardware appliances, but ultimately software does the job) will monitor and/or filter traffic packets to ensure security against typical SQL injections, Cross-Site-Scripting (XSS) and other similar types of exploits. One of the most difficult exploits to guard against (and I have several experiences with this) are DDoS attacks. These can be very difficult to thwart. I once had a DDoS attack on my server cluster take down an entire Peak-10 service provider (one of their largest facilities too). Utilizing CDN’s (content delivery networks) like Akamai can help with this significantly, but I have also found that blocking IP address blocks from known aggressors (ie: China) usually takes care of most of it. If you can protect yourself enough to make it just a bit more difficult, you can usually protect yourself pretty well as the aggressors tend to move on to other sites that are easier. This largely depends upon the value of the information or systems that reside on the “other side of the wall”. The more valuable, the more willing the aggressor is to spend time and resource attempting the exploit. The fundamentals of site protection are not very complicated nor difficult to implement (common sense), mostly. There can be a distinct advantage to operating on proprietary software however, as the intimate details of the software are not known to the general public like they are with WordPress. I have been designing and developing proprietary application frameworks for Internet applications for a very long time now (including for the DOD). I currently work on such an application that handles extremely large volume international logistics data, and is exposed to the general internet. We deal with these kinds of security issues daily.

Alvin
March 1, 2013 4:53 pm

Odd. Hackers usually do things to “tag” a site with their personal calling card. Skillet is a christian metal band. I haven’t heard of many christian hackers.