Syrian Electronic Army claims credit for CBS Twitter accounts hack

Yesterday, several of CBS’s Twitter accounts were hacked, including its main account, and its accounts for 60 Minutes, 48 Hours, and CBS Denver. The hackers got into the account and tweeted a series of things relating to President Obama and the United States being in cahoots with Al-Qaeda. The tweets also had links that led users to malware-infested sites. While CBS was able to regain access to its accounts, it was unable to figure out who was behind the attacks, until now.

Syrian Electronics Army behind CBS Twitter account hacks

The Syrian Electronic Army, the same group that hacked 3 of the BBC’s Twitter accounts, claimed credit for hacking into CBS’s accounts. In a statement through its official website, the Syrian Electronic Army also claimed credit for hacking into an account belonging to a radio station in San Diego. The group published a screenshot of one of the accounts that it had hacked. The groups stated that they used the hacked accounts and “published through it the truth”.

Syrian Electronics Army behind CBS Twitter account hacks 1

CBS and BBC weren’t the only victims of the Syrian Electronic Army. The group also hacked NPR’s Twitter accounts, the website and Twitter belonging to the Human Rights Watch, and a blog used by Reuters. On its website’s bio, the group states that they are trying to fight against the campaigns “led by the Arab media and Western on our Republic by broadcasting fabricated news about what is happening in Syria”.

Twitter has proceeded to block all Twitter accounts associated with the Syrian Electronic Army, however the group continues to make new ones. There have been several account hacks in the past. Recently Colin Powell’s Facebook had been hacked by the same hacker who obtained personal emails from members of the Bush family. It may be wise for these social networks to implement a two-factor authentication feature to better defend themselves from these type of situations in the future.

[via All Things D]


Syrian Electronic Army claims credit for CBS Twitter accounts hack is written by Brian Sin & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Hackers take control of several CBS News Twitter accounts

It looks like CBS is the latest victim in a series of Social Network account hacks that seem to be prevalent this year. Today, CBS stated that several of its Twitter accounts, including 60 Minutes, 48 Hours, CBSDenver, and its official Twitter account were all compromised earlier today. The hackers used the accounts and tweeted things like, “General Dempsey calls for #Obama’s arrest under new anti-terror laws #48hours”.

Hackers take control of several CBS News Twitter accounts

The hackers also provided links in the tweets that led to malware infected sites. A couple of the tweets took jabs at President Obama, while others suggested that the United States was in cahoots with Al-Qaeda. CBS quickly regained access to the accounts thanks to help of Twitter. It was quick to delete the tweets, and apologized to its followers for the immature activity that took place.

Hackers take control of several CBS News Twitter accounts 1

CBS is just one of many victims this year that have been targeted by hackers. Earlier in March, hackers got a hold of Colin Powell’s Facebook page, and posted several, vulgar comments geared towards himself and the Bush family. The hacker was the same hacker who got a hold of personal emails from the entirety of the Bush family. Later on in the month, 3 of BBC’s Twitter accounts were hacked by a group who called themselves the Syrian Electronic Army.

Then there were also those funny account hacks, like back in February when Burger King’s account was taken over and transformed into a McDonalds’s account, with its profile bio saying, “Burger King USA Official Twitter account. Just got sold to McDonalds because the whopper flopped =[.” Considering all of the recent events of Twitter accounts being hacked, maybe it’ll be wise for Twitter to implement a two-factor authentication system.

[via All Things D]


Hackers take control of several CBS News Twitter accounts is written by Brian Sin & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Reddit suffers down-time due to DDoS attack

Reddit was targeted by a distributed denial of service attack (DDoS) attack earlier yesterday morning, resulting in some unpleasant downtime for Redditors all around. Why it became the target of an attack is still a mystery, but a Reddit representative told the Huffington Post that “All we know is it is blatantly malicious.” Some speculate that the DDoS attack was related to Reddit’s manhunt for the Boston Marathon terrorists.

Reddit gets hit by a DDoS attack

Redditors had spent days trying to uncover just who was responsible for the tragic events at the Boston Marathon. Redditors began crowd sourcing photos from the Boston Marathon and were looking for individuals who looked suspicious. There were many people on the list, many of which were deemed innocent later on. In one unfortunate incident, the New York Post used one of the photos on Reddit of “two suspicious men” as their Thursday cover, two men who were later identified as a high school soccer player/track runner and his coach.

The manhunt for the Boston Marathon Manhunt generated a lot of traffic for Reddit, but was not enough to overload its servers. The hacker could have decided that while Redditors were working diligently on the Boston Marathon manhunt, it would be the best time to throw everyone off with his/her DDoS attack. Reddit was successful in mitigating the attack, however no one has yet stepped forward in claiming credit for it.

Reddit’s DDoS attack was just one of many that happened this year, and one of many that are yet to come. Bandwidth usage by DDoS attacks have skyrocketed by over 700% according to Prolexic Technologies. It discovered that 77% of DDoS attacks were aimed towards bandwidth capacity and routing infrastructure, while 23% of the attacks disrupted critical apps and processes running on a server. WordPress sites have also been under attack by hackers who want to gain access to the servers running the site and use them to create a huge botnet.

[via Huffington Post]


Reddit suffers down-time due to DDoS attack is written by Brian Sin & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

DDoS Bandwidth usage skyrockets in Q1 2013

The average bandwidth used by DDoS (distributed denial-of-service) attacks had dramatically increased in Q1 2013. A report from Prolexic Technologies, a DDoS protection and mitigation service provider, discovered that the average bandwidth usage by DDoS attacks, which used to be at 6 Gbps, has increased 8 times to 48 Gbps. It has also discovered that 10% of all DDoS attacks it had mitigated reached speeds of 60 Gbps.

DDoS bandwidth usage skyrockets in Q1 2013

Breaking down the numbers, Prolexic discovered that 41% of all the Q1 2013 DDoS attacks came from China, followed by 22% from the United States, 11% from Germany, 6% from Iran, and 5% from India. While these attacks were located in these countries, that doesn’t necessarily mean that these countries were directly involved in the attacks. Information Week states that hackers could have installed DDoS toolkits onto servers located in these countries and used command-and-control servers to remotely use these toolkits to launch their attacks.

Prolexic found that 77% of the DDoS attacks it mitigated were aimed towards bandwidth capacity and routing infrastructure, while the other 23% were aimed towards disrupting critical apps and processes running on a server. Between Q4 2012 and Q1 2013, the total number of DDoS attacks increased by 2%, while the duration of these attacks increased by 7% (from 32.2 hours to 34.5 hours).

These attacks are increasing in bandwidth usage most likely because these “malicious actors have become more adept at harnessing the power of large DDoS botnets,” says Prolexic. One such botnet is speculated to be currently in development. Recently, attackers have attacked hundreds of WordPress sites, and analysts speculate that these hackers are going to be using the servers running these sites to launch a “massive botnet”.

[via Information Week]


DDoS Bandwidth usage skyrockets in Q1 2013 is written by Brian Sin & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Lookout demonstrates how easy it is to hack a phone

Lookout CEO John Hering showed everyone just how easy it is for a phone to be hacked. At All Thing’s D’s conference, D: Dive Into Mobile, Hering worked together with All Things D’s Liz Gannes to demonstrate a few examples of common hacks that can affect phones. Hering says that there is a “fundamental shift in the attacks on mobile devices in a post-PC era,” and that its very easy to spoof emails.

Lookout demonstrates how easy it is to hack a phone

The example that Hering demonstrated involved sending a phishing email. He used two phones, one that acted as the hacker, and the other the victim. The phishing email was sent from what appeared to be All Things D’s boss, Walt Mossberg, to the victim’s phone’s inbox. The email looked real, and also had an attachment to a free game app. The email showed just how easy it is to get a recipient to download and install an attachment.

After the victim installed the attachment, which was really a malware-infested app, the hacker phone was able to gain access to the other phone’s sensitive information. Hering demonstrated this by showing that he could see all of the other phone’s SMS text messages. But seeing SMS text messages is just one example of what these hackers can do. They can also acceses private information, reset your passwords, and lock you out of your phone and your accounts.

Hering says that many people, even smart people, can succumb to these hacks. He provides several (common sense) tips that people can use to protect themselves, their mobile devices, and their private information. He says that you should always be cautious about the links people ask you to download/install. He says only download apps from legitimate sources, like Google Play, and he says that you should always check the permissions the app is requesting to access before installing it. He also recommends that you should install security apps, like Lookout, NQ Mobile, Avast, Kaspersky, or other similar services to further protect yourself.

[via All Things D]


Lookout demonstrates how easy it is to hack a phone is written by Brian Sin & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

WordPress sites targeted by mass brute-force botnet attacks

Many wordpress sites are under attack by a botnet using brute-force methods to obtain their passwords. The attacks seem limited to only users who kept the default “Admin” username for their websites, however, these attacks are only the beginning. Analysts and companies fear that the attackers are attempting to build a massive botnet that is much more powerful than any botnet seen before.

Wordpress sites under attack by brute-force botnet

Currently, there are over 90,000 IP addresses being used to launch these brute-force attacks. These IP addresses are using thousands of passwords to hack into the WordPress sites. Right now, the botnet is limited to just using home PCs, however, the attackers could soon use the powerful servers that run these WordPress sites to launch a much stronger botnet. Matthew Prince, CEO of CloudFlare, wrote,

“These larger machines can cause much more damage in DDoS attacks because the servers have large network connections and are capable of generating significant amounts of traffic.”

Prince references to the “itsoknoproblembro”, or “brobot”, botnet that launched DDoS attacks against many major US Banks, including Bank of America, U.S. Bank, Wells Fargo,and more. Ars Technica reports that there is already some evidence that a massive botnet is being developed. ResellerClub, a web host, stated that they are undergoing an “ongoing and highly distributed global attack.” HostGator is a major target, with its WordPress machines being targeted by over 90,000 IP addresses.

So what can you do right now? Right now, if you have Admin as your default username, you should go ahead and change your password. You can also sign up for CloudFlare, which is rolling out a fix to prevent your site from becoming a victim to this botnet attack. CloudFlare will be using its data retrieved from these attacks and giving them to its partners so that they can come up with a solution to stop this botnet in its tracks. Also, in the future, if you plan on using the WordPress platform for your site, be sure to change the default “Admin” username to something unique.

[via CloudFlare]


WordPress sites targeted by mass brute-force botnet attacks is written by Brian Sin & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

FAA Dismisses Claims An Android App’s Ability To Takeover A Plane

FAA Dismisses Claims An Android Apps Ability To Takeover A Plane

We reported on a story where a hacker claimed to have created an Android application that would be able to completely take over an aircraft. Hugo Teso, who is a security consultant and ex-commercial pilot, says his application would be able to make an aircraft “dance to his tune,” but the FAA has dismissed Teso’s claims today.

The FAA responded to Teso’s claims by saying the systems that are certified to be used on the flight decks are immune to the exploits that exist in a PC-based ACARS training software, which is what Teso tested his Android application on and not against systems inside of an actual aircraft. The FAA released a statement saying, The FAA has determined that the hacking technique described during a recent computer security conference does not pose a flight safety concern because it does not work on certified flight hardware.” (more…)

By Ubergizmo. Related articles: Hacker Claims To Have Developed Android App That Can Hack Into Aircrafts, Mississippi Man Caught Double-Texting With 3-Year-Old, Drugs In His Vehicle,

    

Smartphone Used To Hijack Plane

Smartphone Used To Hijack PlaneI suppose the headline says it all, and it is now down to the little details which should interest many an airline passenger. At least this lends some weight to the argument that one should ensure all electronic items, including smartphones, be turned off throughout the flight, as it just isn’t cool to be on a hijacked flight. Animalnewyork.com has “proof” that smartphones and airplanes are not a desirable mix when you have someone with the technical know how as well as nefarious attitude, where during a security conference in Amsterdam, hacker and researcher Hugo Teso showed off to the world how it is possible to actually hijack a plane’s controls from the ground with an Android-powered smartphone.

This makes things all the more creepier, as it shows that the hacker himself or herself does not even need to be physically present on the plane to do so. How did Teso perform this seemingly impossible task? Well, he exploited the Aircraft Communications Addressing and Report System (ACARS), which so happens to control the plane’s flight management systems, and lacks a whole lot in terms of security.

Teso said, “You can use this system to modify approximately everything related to the navigation of the plane. That includes a lot of nasty things. ACARS has no security at all. The airplane has no means to know if the messages it receives are valid or not, so they accept them and you can use them to upload data to the airplane that triggers these vulnerabilities. And then it’s game over.”

By Ubergizmo. Related articles: HTC First Launches Facebook Home Today On AT&T For $99, T-Mobile iPhone 5 Now Available For $99,

    

Hacker Claims To Have Developed Android App That Can Hack Into Aircrafts

Hacker Claims To Have Developed Android App That Can Hack Into AircraftsOur smartphone apps these days can perform a fair number of tasks, ranging from simple reminders, to more complex such as tracking our location, places we’ve run, how far we’ve run and etc. However an app that could in theory hack aircraft? That just sounds dangerous, but unfortunately it is all too real. Hugo Teso, a security consultant who happens to be a trained commercial pilot, claims to have developed an Android app that can make an aircraft “dance to his tune” by hacking its flight management systems. The hack was shown off at the Hack In The Box conference where the app, dubbed PlaneSploit, was able to seek out targets by infiltrating radio broadcasts between the aircraft and air traffic control, and then hijacking it by sending malicious messages to take over the plane. As it stands, the app is more of a proof-of-concept software and presumably will not be making its way into app stores anytime soon, so hopefully those in charge of security will be looking into this ASAP!

By Ubergizmo. Related articles: Mississippi Man Caught Double-Texting With 3-Year-Old, Drugs In His Vehicle, BMW Has Quartet Of App Integrations For iPhone,

    

Hacker claims he can remotely hijack airplanes using an Android app

Hacker claims he can remotely hijack airplanes using an Android app

Hugo Teso, a security consultant who also happens to be a trained commercial pilot, says he’s developed an Android app that can make an airliner “dance to his tune” by attacking its flight management systems. The hack was demoed at this year’s Hack In The Box conference in Amsterdam, where Teso showed how the app — called PlaneSploit — can seek out targets from the ground by infiltrating radio broadcasts between aircraft and air traffic control, and then use a second communication system to send malicious messages to that could “take full control of the plane” or indirectly affect the pilot’s behavior. PlaneSploit is proof-of-concept software, designed to work in a closed virtual environment, so it’s not like we’re going to see it pop up on Google Play any time soon, but just the fact it exists will hopefully help to keep the puppet masters out of real-world planes. And no, there’s no Windows Phone version.

Filed under: , ,

Comments

Via: Net Security, Computerworld

Source: Aircraft Hacking: Practical Aero Series (PDF)