Syrian Electronic Army hacks Washington Post Web site

Editorial wants the new cool startup storytelling platform , marketing and advertising are using various ad networks and platforms, countless social networking platforms and apis, 3rd party software to manage live streaming, publishing, or what have you.

And behind that is a usually under resourced development team trying desperately to grow the network while re-working old code projects rushed together because of some breaking news story.

In my experience, working for a news agency is a careful balance between trying to establish solid software engineering practices, rushed prototype code, and sysadmin with large amounts of social thrown in just to keep it interesting.

Frankly it would be nice to not run third-party scripts completely outside of your control, but ad networks would never comply with such a one-sided relationship.

Disclosure: I'm an author on the paper.

EDIT: Here's a great talk by Arjun on AdSafety: https://www.usenix.org/conference/usenix-security-11/adsafet...

[1]: http://www.adsafe.org/

[2]: http://cs.brown.edu/research/plt/dl/adsafety/v1

They use technologies such as Google Caja to control access to the global object.

It's one thing to lock everyone out if you're Booz Allen, but another if you've got journalists on the ground in Cairo competing with Twitter to break news.

The easiest way is to IP limit any services with user privileges.

IP's can be spoofed though, and then you're severely limiting your ability to work flexibly, which doesn't go well for journalists.

Two Factor Auth is another technique that's really coming into it's own now among web systems, but again not super great if someone loses their smartphone or RSA dongle while running from a gunfight and needs to access the system NOW.

I work on the assumption that any password can be compromised at any time, so the system should be able to lock out and roll back a user's edits ASAP, and content-creating users shouldn't be able to get any code executing on the server. Easier said than done with most CMS's though...

As a matter of policy, our team uses LastPass, too, which makes phishing easy to detect; if LastPass doesn't offer to fill your login info, you're not on a legit site. Using LastPass-generated passwords that users can't remember on their own is a marvelous anti-phishing weapon. We also enforce 2FA.

That said, there is no substitute for education.

the undercurrents of misogyny is depressing.

https://twitter.com/Official_SEA16/status/368038668709019648

They effectively didn't hack WaPo at all- they hacked Outbrain, and ad provider network, which embeds ads on the WaPo site. Which is a kind of fascinating way to side-step a lot of work I'm sure WaPo have done up until now.

Backend: lots of technology feeding them content and sending their content out other places. App servers, content sinks, message buses, databases, FTP'd stories, etc etc. Nobody ever attacks these because you have to have some kind of basic reconnaissance on what they do and how they do it. And they're not very secure because of the low visibility. But if you do know how most news sites get their content, there's some fun holes to play with.

Frontend: SQL injection, misconfigured services, bad firewalls, shared or easily-guessed accounts. You don't need anything fancy most of the time. There is no Security Czar making sure everything is secure on the frontend. There's supposed to be, but their lack of authority or motivation prevents them from really trying to secure everything in a big-picture way.

Development: The site is constantly being developed, and not always by the same staff. Sometimes a new guy who writes really shitty code will push something to production which is clearly hazardous to security. It gets through code review and policies and procedures because everyone's busy trying to get real work done. Often these holes go unnoticed for years.

Third-party content: There is nothing ensuring content you're getting from a 3rd party is what you expect it to be. If it's not being served by your servers, it's subject to attack. Often sites get taken down not because of attack, but because an ad network is timing out, causing the page to stop being loaded, effectively DoSing the page. SLAs mitigate this to a small extent by encouraging the 3rd party not to lose money to their customers by being hacked.

Phishing: This will work 90% of the time. Professional pen-testers have agreements not to phish or social engineer their targets more than a certain amount, because it almost always works; there's not much need to test it. But keep in mind that if this were Syrians, their lack of mastery of English could present a problem. Maybe it'd only work 60% of the time in this case.

"I just feel like these sites should be getting scanned daily": Nope. The vast majority of sites don't get constantly hammered by attackers looking for a way in, because 99% of the attacks seen on large-traffic sites are trivial automated things like botnets, which try one or two common holes across millions of sites. Even the most basic security measures prevent these.

Real, targeted attacks are rare, and often get lost in the noise of constant botnet barrage. There just aren't a whole lot of SEA's out there trying to take over every single website. Usually when they do try, they succeed, in some fashion or another; if they were to do this to every popular website on the internet, it would take them months or years to get around to it all. And they probably have day jobs.

The very last attack that works is a 0-day. It's called a 0-day because (typically) it is patched a day or two after it's announced, and they are rare. If you have one, you don't use it just to attack one news site.

Fear mongering at its finest. These people aren't doing anything that isn't already being done by others.

I'm expecting a lot more "cyber warfare" and terrorism-related fear mongering in the following months. We already saw an increase in politicians complaining about Chinese cyber attacks, but the leaks put an end to that. Let's see who they'll focus on next.