Thaha Municipality’s Khanepani Hacked - Now Leaking More Than Just Water!

Introduction On February 12, 2025, the Thaha Municipality of Makwanpur district, Nepal, fell victim to a cyberattack. A newly injected HTML file, named “c0p.html,” was discovered on the subdomain registered under Thaha Municipality: https://khanepani.thahamun.gov.np/c0p.html. This unauthorized modification suggests a successful defacement of the website, compromising its integrity. Thaha Municipality, a local administrative body in Makwanpur, now joins the growing list of governmental websites in Nepal targeted by cybercriminals.

Fig 1: Defacement of the site

About the Attackers The attackers appear to be an Indonesian hacker operating under the alias “./SaklarRusak.” and belonged to the the hacker group named “TSecNetwork”. The group reportedly found to includes members from Indonesia, China and Russia as well. As part of the defacement, the hackers left a message in Indonesian: “Jangan suka nunda, nanti keburu tidur,” which translates to “Don’t like to procrastinate, you’ll rush to sleep.”

Fig 2: Listed on defacement forum

Additionally, the attackers provided links to their online presence, including their Zone-H archive and TikTok handle, “.saklarrusak.”

Fig 3: Attacker Social Presence

Zone-H is a well-known repository that archives defaced websites and publishes news related to IT security, digital warfare, and cyber threats. By leaving these identifiers, the attackers may be seeking recognition within the hacking community or attempting to recruit new members.

Fig 4: html code used to deface the site

Looking at the defacement, it is found that the attacker has used the image of “Sudat Kantin”. So, it can be assumed that the indonesian attacker might also have been linked to “Sudat Kantin”

Fig 5: Image of Sudat Kantin used by attacker

Sudut Kantin is an Indonesian community media platform known for its unconventional and amateurish approach to content creation. The name translates to “Canteen Corner” in English, and the platform shares essays, opinions, literature, and reviews on various topics. They often engage in socio-political discourse, discussing issues like democracy and governance in Indonesia. Their presence extends to social media platforms like Instagram, where they connect with a broader audience.

Potential Cause of Defacement

Fig 6: Alerts on Khanepani’s portal

1. Missing Content Security Policy (CSP)

• Cause: A Content Security Policy (CSP) helps prevent cross-site scripting (XSS) attacks by restricting the sources from which content can be loaded. Without it, malicious scripts could be injected into the portal, leading to defacement or other malicious actions.
• Impact: An attacker could inject their own scripts, leading to data theft, modification of the website’s appearance, or redirection of users to malicious sites.

2. Lack of Anti-Clickjacking Header (X-Frame-Options)

• Cause: The absence of this header allows the website to be embedded in an iframe on malicious sites.
• Impact: This could lead to clickjacking attacks, where attackers trick users into clicking on hidden elements on the page that perform unintended actions, like defacing the site or stealing user credentials.

3. Cookies Without HttpOnly Flag

• Cause: Cookies without the HttpOnly flag are accessible via JavaScript, which can lead to cookie theft in the event of an XSS attack.

Fig 7: Missing flag

• Impact: If the attacker can inject JavaScript into the site, they could steal session cookies, impersonate users, and carry out unauthorized actions (such as defacing the site or accessing sensitive data).

4. Missing HTTP Strict Transport Security (HSTS)

• Cause: HSTS ensures that all connections to the site are over HTTPS, preventing Man-in-the-Middle (MitM) attacks, where traffic could be intercepted or modified.
• Impact: Without HSTS, attackers could potentially downgrade a user’s connection to HTTP, allowing them to modify requests and responses, including the website’s content, leading to defacement.

5. Missing X-Content-Type-Options Header

• Cause: The absence of this header allows browsers to interpret content as a different MIME type than intended.
• Impact: This can be exploited by attackers to force the browser to execute a malicious script, which could lead to defacement or the delivery of malicious content to users.

6. Use of Vulnerable JavaScript Libraries

• Cause: Using outdated or vulnerable JavaScript libraries (such as jQuery, AngularJS, etc.) can expose the website to known vulnerabilities.
• Impact: An attacker could exploit known vulnerabilities in these libraries to inject malicious scripts, gain access to sensitive data, or perform other malicious actions, including defacing the portal.

Fig 8: Potential Vulnerable jQuery Library

7. Unvalidated Redirects and Forwards (Big Redirect Detected)

• Cause: If the website allows user input (e.g., URLs) to be processed and redirects are not properly validated, attackers can exploit this to redirect users to malicious websites.
• Impact: An attacker could cause users to be redirected to phishing sites, where credentials or sensitive information could be harvested. They could also trick users into clicking links that lead to defaced versions of the site.

8. Additional Causes:

• Weak Authentication & Authorization: If there are weak or poorly implemented authentication and authorization controls, an attacker could gain unauthorized access to sensitive parts of the portal and modify or deface content.
• Outdated Software: If the portal is running outdated CMS platforms, server software, or plugins, these could have known security flaws that attackers could exploit.
• Lack of Proper Input Validation and Sanitization: Without proper input validation, attackers could inject malicious code into forms, URLs, or other inputs, leading to XSS, SQL injection, or other vulnerabilities.

Recommendations to Secure the Portal:

1. Implement Strong CSP: Restrict sources of scripts, images, styles, etc., to trusted domains only.
2. Set Anti-Clickjacking Header: Use X-Frame-Options to disallow embedding the site in iframes.
3. Set HttpOnly Flag for Cookies: This prevents JavaScript from accessing sensitive cookies, helping mitigate XSS risks.
4. Enable HTTP Strict Transport Security (HSTS): Ensure that the site is only accessed via HTTPS to prevent MITM attacks.
5. Use X-Content-Type-Options: Ensure that the browser interprets content types strictly.
6. Update Vulnerable JS Libraries: Regularly update any third-party libraries to fix known vulnerabilities.
7. Validate All Redirects and Forwards: Ensure that any redirects validate user input and do not allow open redirection.
8. Regularly Update and Patch the Website and Server: Always apply security patches to the web server and CMS platforms to protect against known vulnerabilities.

Rising Cyber Threats Against Government Websites Website defacement is a clear breach of integrity, undermining the credibility and security of official platforms. In recent times, several governmental websites in Nepal have been targeted and defaced by hackers, raising concerns over the state of cybersecurity measures within public institutions. Such attacks not only disrupt online services but also expose vulnerabilities that could lead to more severe breaches, such as data leaks and system compromises.

Authorities and cybersecurity experts must take swift action to investigate this breach and implement stronger security measures to safeguard Nepal’s digital infrastructure. Regular security audits, timely patching of vulnerabilities, and enhanced monitoring can help mitigate the risks associated with cyber threats.

Conclusion The cyberattack on Thaha Municipality serves as yet another reminder of the growing cybersecurity challenges faced by government institutions. However, given Nepal’s history of ignoring cybersecurity concerns, it’s unlikely that any serious measures will be taken. Hackers seem to care more about testing government websites than the government does about securing them. At this point, Nepal’s digital defenses might just be relying on luck — and even that is running out!