Kenyan officials say government sites hit by Indonesian hacker

Security experts in Kenya alerted the Computer Incident Response Team (CIRT) to the attacks after the hacker, known as "Direxer," compromised the sites on Jan. 17.

The attacks exploited a cross-site scripting vulnerability, according to Tyrus Kamau, head of security and risk at Cellulant. That vulnerability can be exploited because of "poor programming practices" and regular penetration testing by the attacker, he said.

The websites were hosted on one server and the sites had operating-system vulnerabilities, running outdated OSes, misconfigured servers and simple-to-break passwords. Analysts at ICT mailing lists suggested that some of the compromised websites were still using default passwords.

"The funny issue is the sites were running OSes that have regular updates from the developers, but if you check on these sites, the old framework is the same on all of them," said John Gichuki, an independent information security consultant.