Washington Post Site Hacked After Successful Phishing Campaign

ronjor · Aug 15, 2013

The Washington Post acknowledged today that a sophisticated phishing attack against its newsroom reporters led to the hacking of its Web site, which was seeded with code that redirected readers to the Web site of the Syrian Electronic Army hacker group. According to information obtained by KrebsOnSecurity, the hack began with a phishing campaign launched over the weekend that ultimately hooked one of the paper’s lead sports writers.
Click to expand...

http://krebsonsecurity.com/2013/08/washington-post-site-hacked-after-successful-phishing-campaign/

CloneRanger · Aug 15, 2013

Fine with me

Rmus · Aug 16, 2013

Here's how the Syrian Electronic Army's hack worked
http://www.washingtonpost.com/blogs...-how-the-syrian-electronic-armys-hack-worked/

The Syrian Electronic Army's attack against The Washington Post succeeded because of a vulnerability in Outbrain, a third-party content recommendation service. Outbrain works by embedding a widget on websites filled with sponsored links, and it seems as though once the SEA had hacked Outbrain, that gave them access to redirect readers on certain pages to SEA-controlled sites.

The Post's engineers have confirmed that Outbrain was the source of the vulnerability. Outbrain has also confirmed that its systems have been attacked, presumably a reference to the SEA.
Click to expand...

Syrian Electronic Army Hacks the Outbrain service; Washington Post, CNN suffers
http://thehackernews.com/2013/08/Outbrain-hacked-Syrian-Electronic-Army.html

Syrian Electronic Army today announced that they hacked into the admin panel of Outbrain, a content recommendation service, used my millons of websites including The Washington Post, CNN, TIMES and also by us at 'The Hacker News'.

Update: Outbrain's official statement:

On the evening of August 14th, a phishing email was sent to all employees at Outbrain purporting to be from Outbrain's CEO. It led to a page asking Outbrain employees to input their credentials to see the information. Once an employee had revealed their information, the hackers were able to infiltrate our email systems and identify other credentials for accessing some of our internal systems.
Click to expand...

Very interesting!

----
rich

Log in or Sign up

Washington Post Site Hacked After Successful Phishing Campaign

ronjor Global Moderator

CloneRanger Registered Member

Rmus Exploit Analyst

Log in or Sign up

Washington Post Site Hacked After Successful Phishing Campaign

ronjor Global Moderator

CloneRanger Registered Member

Rmus Exploit Analyst

Useful Searches