Govt websites still getting hijacked by online casinos

Government websites continue to be hijacked to promote online casinos, with the latest being reportedly the national language agency, Dewan Bahasa dan Pustaka (DBP).

The incidents raise fresh concerns over cybersecurity as Malaysia increasingly shifts government services to digital platforms, amid years of reports of data leaks and other online security breaches.

Over the past three years, reports have emerged of search engines such as Google finding links to illegal gambling sites hidden within government-controlled web domains.

Freelance investigative journalist Nigel Aw is the latest to flag such a case, alleging that DBP’s website contained hidden links to online casinos when he visited it on Oct 13.

In an article on his website, Aw said DBP’s online platforms appeared to have been compromised in three ways to conceal links to gambling sites.

First, hidden hyperlinks to gambling websites had been inserted into the underlying code of the website dbp.gov.my.

Second, observium.dbp.gov.my had been replaced with a gambling page. Third, searches for epp.dbp.gov.my on Google directed users to a gambling website, though regular users are still served the normal website.

“It would appear that whoever was responsible intended to leverage the ‘gov.my’ domain suffix to boost the ranking of gambling sites on Google Search,” he explained.

‘Free-ride on reputation’

In simple terms, Google sees government websites as an authoritative source of information and makes them more prominent in its search results.

The perpetrators of the cyberattack appear to be attempting to free-ride on this reputation to promote their own services.

As of the time of writing, the first and second issues appear to have been fixed, but the third has not been fully addressed.

DBP is not the only apparent victim. Malaysiakini’s checks found that a state government website has also been compromised in a similar manner.

Malaysiakini is not identifying the state government website pending comment.

A previous investigation by The Fourth and Indonesian newsroom Tirto.ID also identified more than 150 government websites in Malaysia and Indonesia that had been used to display gambling advertisements.

In June, the two newsrooms revealed that the operation was most likely run by scam centres in Southeast Asia’s “Golden Triangle” - a mountainous region spanning across the borders of Myanmar, Thailand, and Laos.

Their analysis of the source code on compromised websites suggested that the code had been developed by operators based in China.

Among the clues were Chinese characters embedded in the code, references to Chinese web browsers, and the use of the Chinese yuan as the default currency for transactions.

Happening since 2023

According to a local cybersecurity company, Syntx Sdn Bhd, gambling sites have been hiding in Malaysian government and university websites since at least Aug 2023.

That month, local technology news site Pokde.Net reported that the government’s official halal website, halal.gov.my, had been replaced by a gambling website.

In a blog post in June, Syntx described the operation as a search engine optimisation (SEO) “poisoning” campaign that exploited government and university hosts.

“We have confirmed 83 compromised government and university hosts across 43 organisations, 34 government agencies and seven universities, from our own evidence, and 17 were still live at our last check.

“This is not the full picture. New ones keep surfacing as we scan,” it said.

Syntx named the campaign “Tundra”.

Malaysiakini has contacted DBP, MCMC, Communications Ministry, Digital Ministry, and the National Cybersecurity Agency (Nacsa) for their comments and clarification on measures being taken to strengthen the security of government websites.

In response, Nacsa chief executive Megat Zuhairy Megat Tajuddin (above) affirmed his agency's awareness of such threats, saying that it coordinates with relevant bodies to verify incidents as well as support necessary responses and mitigation measures.

"Most SEO poisoning incidents can be mitigated promptly, with affected websites restored and recovered within a relatively short timeframe, subject to the extent of the compromise and the necessary remediation measures.

"Where criminal activities are identified, matters may be referred to the appropriate law enforcement authorities under their respective jurisdictions," he told Malaysiakini.

SNAPSHOT | 'PN will be part of N Sembilan govt'; 5 immigration officers arrested in hacking case

Three agencies investigating Perkeso website hacking claim - Fahmi

MCMC: Beware of scammers 'hacking' your mind

Annuar: Ministry to introduce anti-hacking app