Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Syrian Electronic Army hacks Washington Post Web site

washingtonpost.com

Post reply on HN
Print view View original

41–46 of 46 posts

Re: Syrian Electronic Army hacks Washington Post Web site

#41

Post by wil421 »

tlarkworthy wrote: post #31
wil421 wrote: post #26

So if the most common way these hacker "groups" actually "hack" websites are through phishing attacks. How do protect against phishing attacks in a way that will stop them. Obviously educating Martha the secretary to not click links in emails from people she doesn't know isnt working. How can we make phishing attacks less successful or remove these attack style altogether. 9 times out of 10 when I hear about some maj…

In your contrived story: why did you choose a woman? and why did you pick on a secretary? the undercurrents of misogyny is depressing.

I only picked the first name that came to mind that sounded older. I didnt choose a womens name on purpose. Albert in accounting, etc... would have done just fine.

Re: Syrian Electronic Army hacks Washington Post Web site

#42

Post by showerst »

seliopou wrote: post #35
dkoch wrote: post #11

So many media sites have a ton of javascript widgets: ad networks serving third-party ads serving third-party tracking scripts, recommendation tools, analytics, etc. It really increases the attack surface. How do publishers know that the scripts that go on their pages are safe?

Publishers should use AdSafe[1], which is a system for sandboxing widgets. AdSafe provides widget authors an API for access object properties and the DOM, as well as a static check to ensure that widgets are using this API properly. Given that the static check passes, and the library implementing the API is correct, then your widget is properly sandboxed and attacks like that can't happen. Check out the AdSafety pape…

Are there projects like this that let me embed a third-party URL instead of direct code?

So if a publisher provides me with a link to widget.js, I could just run some sort of Adsafe.executeInWrapper(http://example.com/widget.js)

Most providers in my experience don't want you to embed their actual JS code, because then they lose the ability to do updates and fix bugs without contacting every single customer to upgrade.

Re: Syrian Electronic Army hacks Washington Post Web site

#43

Post by seliopou »

bentlegen wrote: post #38
seliopou wrote: post #35

Earlier quoted context omitted.

Publishers should use AdSafe[1], which is a system for sandboxing widgets. AdSafe provides widget authors an API for access object properties and the DOM, as well as a static check to ensure that widgets are using this API properly. Given that the static check passes, and the library implementing the API is correct, then your widget is properly sandboxed and attacks like that can't happen. Check out the AdSafety pape…

AFAIK, there was nothing vulnerable in the widget itself: the hackers accessed Outbrain's admin panel, and changed the content of their recommended links to point to their website instead. The hackers posted screenshots of accessing the admin panel: http://mashable.com/2013/08/15/outbrain-hacked/

What was reported[1] was that certain stories were redirecting users to the SEA's site. This implies that they weren't just rewriting recommended links, but were changing the code of the widgets, which resulted in that behavior.

[1]: http://www.politico.com/blogs/media/2013/08/washington-post-...

Re: Syrian Electronic Army hacks Washington Post Web site

#44

Post by cheald »

wil421 wrote: post #26

So if the most common way these hacker "groups" actually "hack" websites are through phishing attacks. How do protect against phishing attacks in a way that will stop them. Obviously educating Martha the secretary to not click links in emails from people she doesn't know isnt working. How can we make phishing attacks less successful or remove these attack style altogether. 9 times out of 10 when I hear about some maj…

We've been on the receiving end of these attacks lately. Strict SPF policies, DKIM, and a restrictive DMARC policy can help ward them off.

As a matter of policy, our team uses LastPass, too, which makes phishing easy to detect; if LastPass doesn't offer to fill your login info, you're not on a legit site. Using LastPass-generated passwords that users can't remember on their own is a marvelous anti-phishing weapon. We also enforce 2FA.

That said, there is no substitute for education.

Re: Syrian Electronic Army hacks Washington Post Web site

#45

Post by bentlegen »

seliopou wrote: post #43
bentlegen wrote: post #38

Earlier quoted context omitted.

AFAIK, there was nothing vulnerable in the widget itself: the hackers accessed Outbrain's admin panel, and changed the content of their recommended links to point to their website instead. The hackers posted screenshots of accessing the admin panel: http://mashable.com/2013/08/15/outbrain-hacked/

What was reported[1] was that certain stories were redirecting users to the SEA's site. This implies that they weren't just rewriting recommended links, but were changing the code of the widgets, which resulted in that behavior. [1]: http://www.politico.com/blogs/media/2013/08/washington-post-...

Ah, you're right. This screenshot actually shows the HTML they injected: http://rack.0.mshcdn.com/media/ZgkyMDEzLzA4LzE1L2E1L3RpbWVzY...

Re: Syrian Electronic Army hacks Washington Post Web site

#46

Post by INTPenis »

tcoppi wrote: post #6
INTPenis wrote: post #5

So what are best guesses here? Weeks of surveillance and social engineering or a 0-day/unpatched software? I just feel like these sites should be getting scanned daily by all kinds of frameworks like metasploit so unpatched known vuln seems unlikely. More likely is exploiting the employees with spear phishing or social engineering, or 0day. And of those three I'd have to lean towards 0day, if it truly was Syrians tha…

Why are you leaning towards 0days if Syrians did it? What makes Syrians more likely to have and use 0days than to use social engineering?

Not that I was leaning towards that because they were Syrian, more like I was leaning away from the other options because they were Syrian. Social engineering and phishing is much easier for people with a good knowledge of the culture and language they're attacking.
Post reply on HN