The NHS is at the centre of another controversy as their website has been redirecting thousands of people to pages that contained malware or advertising.
The problem was first experienced during the weekend where users inevitably took to social media sites to express their anger and views about the situation.
A user, who goes by the name Muzzers on Reddit, stated that he came across the problem when searching for flu shot information.
Muzzers stated, “So while attempting to access flu shot information I stumbled upon a page which redirected me to an advertisement. Digging a bit deeper I found hundreds more pages which redirect to either an advertisement or malware infested page.”
In total, it is believed that the problem affected over 800 pages but the site administrators have been keen to stress that the problem wasn’t caused by hackers but by a typo by a developer.
A spokeswoman for the Health and Social Care Information Centre (HSCIC) which runs the NHS website told the Guardian, “Last year, a developer accidentally put “translate.googleaspis.com” rather than “translate.googleapis.com” as the source for the JavaScript file. Last night someone in the Czech Republic took ownership of the incorrectly spelt domain it was referring to; the correctly spelled one is actually owned by Google. Although the typo existed in NHS Choices code, until the point the domain name was purchased, this was not causing any issues.”
The vast majority if not all of the affected links have now been corrected but it remains unclear just what impact this has had as there is the potential threat that personal data has been compromised.
Internet security expert Graham Cluey finds the explanation baffling and if it is true, then anybody who inadvertently downloaded the malware could be at risk.
Cluey stated, “I’m surprised by that explanation… what often happens is that a hacker will find a weak point and inject a piece of code to exploit it and set up a domain name. Otherwise whoever registered the domain name in the Czech Republic must have scanned the code, which few do, or registered numerous websites in the hope of getting lucky.”
A spokeswoman for the HSCIC claimed that they will ensure that no reoccurrence of this will ever happen again.
She stated, “NHS Choices is treating this issue with urgency and once resolved we plan to undertake a thorough and detailed analysis to ensure that a full code review is undertaken and steps put in place to ensure no reoccurrence.”
It today’s world, it is now imperative that all data is protected by a robust backup solution to ensure that it can be recovered. Users need to also ensure that they protect their machines by ensuring that they have the latest security updates installed and working properly.
