4 ms·

So what are best guesses here? Weeks of surveillance and social engineering or a 0-day/unpatched software? I just feel like these sites should be getting scann

So what are best guesses here? Weeks of surveillance and social engineering or a 0-day/unpatched software? I just feel like these sites should be getting scanned daily by all kinds of frameworks like metasploit so unpatched known vuln seems unlikely. More likely is exploiting the employees with spear phishing or social engineering, or 0day. And of those three I'd have to lean towards 0day, if it truly was Syrians that did it. And if they got socialflow at almost the same time I'm betting they were using something in common. Though considering the post claims an employee account was hacked through phishing, maybe they had shared accounts for columnists or something.

tcoppi 13y ago
Why are you leaning towards 0days if Syrians did it? What makes Syrians more likely to have and use 0days than to use social engineering?
- INTPenis 13y ago
  Not that I was leaning towards that because they were Syrian, more like I was leaning away from the other options because they were Syrian. Social engineering and phishing is much easier for people with a good knowledge of the culture and language they're attacking.
deleted 13y ago
[deleted]
untog 13y ago
According to this tweet: https://twitter.com/Official_SEA16/status/368038668709019648 https://twitter.com/Official_SEA16/status/368038668709019648 They effectively didn't hack WaPo at all- they hacked Outbrain, and ad provider network, which embeds ads on the WaPo site. Which is a kind of fascinating way to side-step a lot of work I'm sure WaPo have done up until now.
peterwwillis 13y ago
You need insight into how these kind of sites are run to understand how attacks typically work on them. Backend: lots of technology feeding them content and sending their content out other places. App servers, content sinks, message buses, databases, FTP'd stories, etc etc. Nobody ever attacks these because you have to have some kind of basic reconnaissance on what they do and how they do it. And they're not very secure because of the low visibility. But if you do know how most news sites get their content, there's some fun holes to play with. Frontend: SQL injection, misconfigured services, bad firewalls, shared or easily-guessed accounts. You don't need anything fancy most of the time. There is no Security Czar making sure everything is secure on the frontend. There's supposed to be, but their lack of authority or motivation prevents them from really trying to secure everything in a big-picture way. Development: The site is constantly being developed, and not always by the same staff. Sometimes a new guy who writes really shitty code will push something to production which is clearly hazardous to security. It gets through code review and policies and procedures because everyone's busy trying to get real work done. Often these holes go unnoticed for years. Third-party content: There is nothing ensuring content you're getting from a 3rd party is what you expect it to be. If it's not being served by your servers, it's subject to attack. Often sites get taken down not because of attack, but because an ad network is timing out, causing the page to stop being loaded, effectively DoSing the page. SLAs mitigate this to a small extent by encouraging the 3rd party not to lose money to their customers by being hacked. Phishing: This will work 90% of the time. Professional pen-testers have agreements not to phish or social engineer their targets more than a certain amount, because it almost always works; there's not much need to test it. But keep in mind that if this were Syrians, their lack of mastery of English could present a problem. Maybe it'd only work 60% of the time in this case. "I just feel like these sites should be getting scanned daily": Nope. The vast majority of sites don't get constantly hammered by attackers looking for a way in, because 99% of the attacks seen on large-traffic sites are trivial automated things like botnets, which try one or two common holes across millions of sites. Even the most basic security measures prevent these. Real, targeted attacks are rare, and often get lost in the noise of constant botnet barrage. There just aren't a whole lot of SEA's out there trying to take over every single website. Usually when they do try, they succeed, in some fashion or another; if they were to do this to every popular website on the internet, it would take them months or years to get around to it all. And they probably have day jobs. The very last attack that works is a 0-day. It's called a 0-day because (typically) it is patched a day or two after it's announced, and they are rare. If you have one, you don't use it just to attack one news site.

tcoppi 13y ago

Why are you leaning towards 0days if Syrians did it? What makes Syrians more likely to have and use 0days than to use social engineering?

INTPenis 13y ago
Not that I was leaning towards that because they were Syrian, more like I was leaning away from the other options because they were Syrian. Social engineering and phishing is much easier for people with a good knowledge of the culture and language they're attacking.

deleted 13y ago

[deleted]

untog 13y ago

According to this tweet: https://twitter.com/Official_SEA16/status/368038668709019648 https://twitter.com/Official_SEA16/status/368038668709019648 They effectively didn't hack WaPo at all- they hacked Outbrain, and ad provider network, which embeds ads on the WaPo site. Which is a kind of fascinating way to side-step a lot of work I'm sure WaPo have done up until now.

peterwwillis 13y ago

You need insight into how these kind of sites are run to understand how attacks typically work on them. Backend: lots of technology feeding them content and sending their content out other places. App servers, content sinks, message buses, databases, FTP'd stories, etc etc. Nobody ever attacks these because you have to have some kind of basic reconnaissance on what they do and how they do it. And they're not very secure because of the low visibility. But if you do know how most news sites get their content, there's some fun holes to play with. Frontend: SQL injection, misconfigured services, bad firewalls, shared or easily-guessed accounts. You don't need anything fancy most of the time. There is no Security Czar making sure everything is secure on the frontend. There's supposed to be, but their lack of authority or motivation prevents them from really trying to secure everything in a big-picture way. Development: The site is constantly being developed, and not always by the same staff. Sometimes a new guy who writes really shitty code will push something to production which is clearly hazardous to security. It gets through code review and policies and procedures because everyone's busy trying to get real work done. Often these holes go unnoticed for years. Third-party content: There is nothing ensuring content you're getting from a 3rd party is what you expect it to be. If it's not being served by your servers, it's subject to attack. Often sites get taken down not because of attack, but because an ad network is timing out, causing the page to stop being loaded, effectively DoSing the page. SLAs mitigate this to a small extent by encouraging the 3rd party not to lose money to their customers by being hacked. Phishing: This will work 90% of the time. Professional pen-testers have agreements not to phish or social engineer their targets more than a certain amount, because it almost always works; there's not much need to test it. But keep in mind that if this were Syrians, their lack of mastery of English could present a problem. Maybe it'd only work 60% of the time in this case. "I just feel like these sites should be getting scanned daily": Nope. The vast majority of sites don't get constantly hammered by attackers looking for a way in, because 99% of the attacks seen on large-traffic sites are trivial automated things like botnets, which try one or two common holes across millions of sites. Even the most basic security measures prevent these. Real, targeted attacks are rare, and often get lost in the noise of constant botnet barrage. There just aren't a whole lot of SEA's out there trying to take over every single website. Usually when they do try, they succeed, in some fashion or another; if they were to do this to every popular website on the internet, it would take them months or years to get around to it all. And they probably have day jobs. The very last attack that works is a 0-day. It's called a 0-day because (typically) it is patched a day or two after it's announced, and they are rare. If you have one, you don't use it just to attack one news site.