Washington post also posted another good article about the hackers:
"The Post just got hacked by the Syrian Electronic Army. Here’s who they are."
http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/15...
Syrian Electronic Army hacks Washington Post Web site
21–30 of 46 posts
Re: Syrian Electronic Army hacks Washington Post Web site
#22So what are best guesses here? Weeks of surveillance and social engineering or a 0-day/unpatched software? I just feel like these sites should be getting scanned daily by all kinds of frameworks like metasploit so unpatched known vuln seems unlikely. More likely is exploiting the employees with spear phishing or social engineering, or 0day. And of those three I'd have to lean towards 0day, if it truly was Syrians tha…
You need insight into how these kind of sites are run to understand how attacks typically work on them. Backend: lots of technology feeding them content and sending their content out other places. App servers, content sinks, message buses, databases, FTP'd stories, etc etc. Nobody ever attacks these because you have to have some kind of basic reconnaissance on what they do and how they do it. And they're not very sec…
"It's called a 0-day because (typically) it is patched a day or two after it's announced, and they are rare. If you have one, you don't use it just to attack one news site."
It's called a zero day, because there's no patch for it. And if you think most 0days are patched in a day or two after announced, I have a bridge to sell you.
Re: Syrian Electronic Army hacks Washington Post Web site
#23So many media sites have a ton of javascript widgets: ad networks serving third-party ads serving third-party tracking scripts, recommendation tools, analytics, etc. It really increases the attack surface. How do publishers know that the scripts that go on their pages are safe?
That is the risk you take with ads, and to answer your question: they don't know if it's safe.
Frankly it would be nice to not run third-party scripts completely outside of your control, but ad networks would never comply with such a one-sided relationship.
Re: Syrian Electronic Army hacks Washington Post Web site
#24Earlier quoted context omitted.
> A honeypot is designed to attract attackers, and is designed with bad security in mind. I wouldn't say that. You'd be very hard pressed to find a production server without SSH, if not on the default port. I'm doing absolutely nothing to draw attention to myself, so it stands to reason that somebody who is (say, running a large website) would draw a lot more probes and "hacked" logins. > amongst them not running SSH…
Moving SSH to a different port does nothing if your system is being specifically targeted, but it stops 99% of drive-by bots. Not that they do much anyway but it at least stops them from showing up in your logs.
Just out of interest I tried running on 22 and a very high random port, as you said significantly less, though not no attempts. I think it's a false sense of security more than anything.
Re: Syrian Electronic Army hacks Washington Post Web site
#25So many media sites have a ton of javascript widgets: ad networks serving third-party ads serving third-party tracking scripts, recommendation tools, analytics, etc. It really increases the attack surface. How do publishers know that the scripts that go on their pages are safe?
It's a constant battle between so many internal groups about what should be on a news site.
Editorial wants the new cool startup storytelling platform , marketing and advertising are using various ad networks and platforms, countless social networking platforms and apis, 3rd party software to manage live streaming, publishing, or what have you.
And behind that is a usually under resourced development team trying desperately to grow the network while re-working old code projects rushed together because of some breaking news story.
In my experience, working for a news agency is a careful balance between trying to establish solid software engineering practices, rushed prototype code, and sysadmin with large amounts of social thrown in just to keep it interesting.
Re: Syrian Electronic Army hacks Washington Post Web site
#26So if the most common way these hacker "groups" actually "hack" websites are through phishing attacks. How do protect against phishing attacks in a way that will stop them. Obviously educating Martha the secretary to not click links in emails from people she doesn't know isnt working.
How can we make phishing attacks less successful or remove these attack style altogether. 9 times out of 10 when I hear about some major hack its because of phishing.
Re: Syrian Electronic Army hacks Washington Post Web site
#27The "Syrian Electronic Army" is just rented Iranian hackers. They also have a large propaganda chorus you'll see in newspaper article comments just like Gaddafi did to give the illusion of popular support. They also steal citizen journalist videos of atrocities in Syria and then make up fake translations for them to paint the regime in the best light possible. Since most people never fact check anything they see on youtube largely this strategy works. It's too late when the Guardian or Al Jazeera reveal the true translation weeks later damage has already been done.
Shouldn't the Washington Post and other news agencies be running honeypots to catch these guys?
Re: Syrian Electronic Army hacks Washington Post Web site
#28Washington post also posted another good article about the hackers: "The Post just got hacked by the Syrian Electronic Army. Here’s who they are." http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/15...
Recently, security researchers say the group has also started to engage in more sophisticated attacks,
including using Trojans and and targeting Voice over IP (VOIP) services. Those attacks and this week’s Socialflow and Outbrain compromises suggest the SEA may just be getting started.
Fear mongering at its finest. These people aren't doing anything that isn't already being done by others.
I'm expecting a lot more "cyber warfare" and terrorism-related fear mongering in the following months. We already saw an increase in politicians complaining about Chinese cyber attacks, but the leaks put an end to that. Let's see who they'll focus on next.
Re: Syrian Electronic Army hacks Washington Post Web site
#29So many media sites have a ton of javascript widgets: ad networks serving third-party ads serving third-party tracking scripts, recommendation tools, analytics, etc. It really increases the attack surface. How do publishers know that the scripts that go on their pages are safe?
How do publishers know that the scripts that go on their pages are safe?
They use technologies such as Google Caja to control access to the global object.
Re: Syrian Electronic Army hacks Washington Post Web site
#30Earlier quoted context omitted.
You need insight into how these kind of sites are run to understand how attacks typically work on them. Backend: lots of technology feeding them content and sending their content out other places. App servers, content sinks, message buses, databases, FTP'd stories, etc etc. Nobody ever attacks these because you have to have some kind of basic reconnaissance on what they do and how they do it. And they're not very sec…
"It's called a 0-day because (typically) it is patched a day or two after it's announced, and they are rare. If you have one, you don't use it just to attack one news site." It's called a zero day, because there's no patch for it. And if you think most 0days are patched in a day or two after announced, I have a bridge to sell you.
Alright, you got me there. General security holes stay open for months at a time, and remote holes in the production site that are actually vulnerable to a PoC get workarounds installed a day or two after. But still, nobody's going to use an unannounced 0day for a defacement.