By Jennifer LeClaire / CIO Today. Updated July 14, 2014.
It’s hardly the notorious hacker group Anonymous, but the results are similar. Technology review site CNET was attacked by Russian hackers over the weekend.
A Twitter user or users who goes by the name “w0rm” with the handle @rev-priv8 put up an image of an apparent remote access to a CNET.com server. According to Forbes, the screenshot depicted a shell proving hackers had compromised the site.
So far, CNET is not offering insight into what may have motivated the hacker or hackers or whether or not any of its data was compromised. In a published statement, Jen Boscacci, senior manager of corporate communications at CNET, said: “Here’s the situation, a few servers were accessed. We identified the issue and resolved it yesterday. We will continue to monitor.”
A String of Media Attacks
Janne Ahlberg, a product security professional at Microsoft who speaks freely on Twitter about security issues, offered an update to the Forbes story on Twitter early Monday. He said the “perpetrator appears to be offering database for 1 Bitcoin.”
This would seem logical, given suspected ties between w0rm and the Dec. 2013 BBC hack. Reports of Russian hackers who stealthily took over a BBC computer server before Christmas circulated far and wide last year. Those hackers were known by the monikers "HASH" and "Rev0lver" and attempted to sell access to the BBC server on Dec. 25, according to Reuters.
There was a rush of hackers attacking media sites in 2013. Last December, hackers hit The Washington Post for at least the third time in the past three years. The Post was more forthcoming than the BBC, disclosing that the extent of the data loss was not clear, but employees were instructed to change their user names and passwords -- even though they were stored in encrypted form -- based on the assumption that they may have been compromised.
Last August, the Syrian Electronic Army hit The New York Times, Twitter and its image server Twimg, among other sites, with a DNS attack. And in early 2013, the SEA targeted The Financial Times, The Guardian and The Associated Press, as well as The Washington Post.
Drilling Into the Attack
We caught up with TK Keanini, CTO of Lancope, to get his take on the Russian hack attack. He told us it’s important that we quickly get to the method and technique used in this compromise because given the commonality of the infrastructure with other major Web sites, others may be at risk by the same exploit.
“These days, it is just as important to have the advanced telemetry in place for incident response as it is to have the protective proactive measures,” Keanini said. “These content management systems are large and extremely complex and it is a game of who has more time to find vulnerabilities -- these attackers make it a full time job and thus almost always succeed first.
Keanini then asked a couple of important questions: With the CNET hack, what if this individual were not so noisy? How would this exploit have been detected?
“Scary thinking I know,” he said, “but CNET is lucky this attacker was a showoff because most highly skilled in this craft would rather not brag and sell the compromised site to the highest bidder.”