Syrian Electronic Army hacks Washington Post Web site

You need insight into how these kind of sites are run to understand how attacks typically work on them.

Backend: lots of technology feeding them content and sending their content out other places. App servers, content sinks, message buses, databases, FTP'd stories, etc etc. Nobody ever attacks these because you have to have some kind of basic reconnaissance on what they do and how they do it. And they're not very secure because of the low visibility. But if you do know how most news sites get their content, there's some fun holes to play with.

Frontend: SQL injection, misconfigured services, bad firewalls, shared or easily-guessed accounts. You don't need anything fancy most of the time. There is no Security Czar making sure everything is secure on the frontend. There's supposed to be, but their lack of authority or motivation prevents them from really trying to secure everything in a big-picture way.

Development: The site is constantly being developed, and not always by the same staff. Sometimes a new guy who writes really shitty code will push something to production which is clearly hazardous to security. It gets through code review and policies and procedures because everyone's busy trying to get real work done. Often these holes go unnoticed for years.

Third-party content: There is nothing ensuring content you're getting from a 3rd party is what you expect it to be. If it's not being served by your servers, it's subject to attack. Often sites get taken down not because of attack, but because an ad network is timing out, causing the page to stop being loaded, effectively DoSing the page. SLAs mitigate this to a small extent by encouraging the 3rd party not to lose money to their customers by being hacked.

Phishing: This will work 90% of the time. Professional pen-testers have agreements not to phish or social engineer their targets more than a certain amount, because it almost always works; there's not much need to test it. But keep in mind that if this were Syrians, their lack of mastery of English could present a problem. Maybe it'd only work 60% of the time in this case.

"I just feel like these sites should be getting scanned daily": Nope. The vast majority of sites don't get constantly hammered by attackers looking for a way in, because 99% of the attacks seen on large-traffic sites are trivial automated things like botnets, which try one or two common holes across millions of sites. Even the most basic security measures prevent these.

Real, targeted attacks are rare, and often get lost in the noise of constant botnet barrage. There just aren't a whole lot of SEA's out there trying to take over every single website. Usually when they do try, they succeed, in some fashion or another; if they were to do this to every popular website on the internet, it would take them months or years to get around to it all. And they probably have day jobs.

The very last attack that works is a 0-day. It's called a 0-day because (typically) it is patched a day or two after it's announced, and they are rare. If you have one, you don't use it just to attack one news site.

So who did it? NSA with Chinese proxies?

Your expectations are based on a completely different scenario. A honeypot is designed to attract attackers, and is designed with bad security in mind. No corporate network runs SSH in the open. There's no need.

What a corporate network needs is to provide remote access to specific services based on who is authorized. A VPN is the way to accomplish this. It would be stupid to allow SSH access to everyone (including hackers) when only a handful of authorized administrators would even have SSH accounts, much less do anything on the box. You keep it behind the VPN and only allow specific users access. It reduces the attack surface, creates audit trails, simplifies revoking network access, etc. This is security 101.

The comments at the bottom of the page are pretty funny.

This happened at the FT a few weeks ago with "Syrian Electronic Army" posts and that was a successful phishing attack so "their lack of mastery of English" clearly isn't an issue.

Otherwise an excellent analysis of the likely vectors by the way.