Skype blog hacked | Hacker News Reader

Skype blog hacked

blogs.skype.com

86 pointstazer58 comments

This blog is not hosted by the Skype but on WordPress VIP. This means that, most likely, the blog was not broken into using a software exploit of any sort since the security on VIP blogs is professional. Knowing that this is the Syrian Army, this attack was most likely done using phished credentials.

If they had any sort of system access they would have defaced the entire subdomain or the main site. So most likely, this is nothing to worry about. Your account data most likely still in safe hands.

You're right. It was probably a brute force since they don't have maximum login attempts. http://blogs.skype.com/wp-admin

Such a simple feature to implement...

It does appear to be a brute force or phishing attack. These sort of drive-bys can typically be permanently stopped with 2FA or a password-less MFA solution like LaunchKey (Disclaimer: co-founder). LaunchKey has a free WordPress Plugin available, among others: http://wordpress.org/plugins/launchkey/

It is 2014, you better prepare a good PR response for when you get breached OR start implementing stronger authentication ASAP.

It is only a simple feature if you don't care about DOS against the user account and do not have an adversary with a large botnet.

Limiting login attempts is not as effective as you might think. How should it work? If you want to ban IP addresses that get X attempts wrong in Y minutes, then you're failing to realize that hackers like this normally have access to hundreds or thousands of IP addresses. If you want to lock the whole account for a while, then you've just introduced a way for anyone to lock the account of someone else they don't like.

Also considering that their Twitter and Facebook accounts were also compromised, your assumption that it was the blog itself that was compromised is a big one. I don't have any first hand knowledge on that though personally, I'm just saying.

No need to ban an IP address. After x attempts just add y seconds before allowing another login attempt. If you like, lock account with SMS or email to owner after z attempts. Do this per login, regardless of device type/location. The time taken to test out just 5 passwords should make a brute force impractical.

This plugin does exactly that and is very effective. Everyone using WP should be using it. http://wordpress.org/plugins/limit-login-attempts/

I run this on my personal site to prevent drive-bys but it won't stop a determined hacker with many IPs.

Here's a proper solution to secure your account: http://wordpress.org/plugins/google-authenticator/

That sounds not fun for the account owner. I could prevent you from logging into your account.

WordPress.com has pretty sophisticated brute force detection mechanisms and protections in place. I am not sure why you would say otherwise.

Yeah getting access to their WordPress blog doesn't really prove anything.

Doesn't look like they are trying to prove insecurity of the service but protest the spying that Skype and now Microsoft are involved in.

Doesn't WordPress offer any two-step auth option? Feels like a rather large limitation.

WordPress.com offers two-step authentication for all of our users. You can use any application which supports Time-Based One-Time Passwords (TOTP) such as Google Authenticator, Authy, etc. and you can also receive a one time password via SMS.

Here is the screenshot of the blog hacked. http://imgur.com/RGeTFWV

So it looks like Skype doesn't host on its own server. It looks like this is wordpress.com but with custom domain?

curl http://blogs.skype.com -v

< X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.

EDIT Okay it is

New to wpscan. When it says plugins found are these the vulnerable plugins wordpress.com running?

https://gist.github.com/yeukhon/8211580

And I found the username 7 pretty interesting.... wonder if I am actually doing the ethical thing here :(

You will find those usernames whenever you scan wordpress.com with wpscan.

Wow you are right about that.

just did it on another blog.wordpress.com. How come? On Skype's blog I can access /author/7 or /author/ian but I can't do it on another blog, I get "Oops".

I think they are trying ?author=1, ?author=2, etc

Snapshot archive (if they fix the page): http://mraka.eu/snapshot/v/blogs.skype.com

Direct link to the snapshot of the hacked site: http://mraka.eu/snapshot/img/2014/01/01/e0d8888c73483275afea...

Snapshot archive of twitter account: http://mraka.eu/snapshot/v/twitter.com

Direct link to the first tweet snapshot: http://mraka.eu/snapshot/img/2014/01/01/1d6269aa8371ce676587...

Direct link to the first retweet snapshot: http://mraka.eu/snapshot/img/2014/01/01/a0f4c0947281bb0fb19d...

The Twitter account has also been compromised at the same time: https://news.ycombinator.com/item?id=6996899

http://twitter.com/Skype/status/418495453471068161

Sounds legit. :-)

Screenshot: http://imgur.com/Fr8um8B

There is also a second post from the same - apparently compromised - author: http://blogs.skype.com/2014/01/01/dont-use-microsoft-emails-...

>> Hacked by Syrian Electronic Army.. Stop spying!

Seems a strange message to send to a country that spies on it's own citizens (and where apparently the citizens are unable to prevent their own government from doing it to them).

Indeed and they buy german spying technology products. However I think the logical fallacy you've stepped in is that the Syrian Electronic Army (SEA) doesn't want to get spied on themselves by Skype and Microsoft, maybe. haha :)

But I fully support the message here, I think that spying inside of consumer products is a sign of the abuse of power and monopoly.

More than likely a guessed admin password.

Here's a screenshot of the blog, in case it get's fixed:

http://puu.sh/65TRe.png

Its Twitter account was also hacked and a message posted, but it appears to have been deleted.

Screenshot here: https://twitter.com/MikeElgan/status/418482819611230208

Looks to be one of those auto posters (i.e. content posted on the blog is automatically pushed out to twitter, facebook, others)

I thought so as well, until https://twitter.com/Skype/statuses/4184954534710681

Ahh, I see. Interesting!

Gotta wonder what's running through non-techie Skypers when they see the tweets (https://twitter.com/Skype/status/418495453471068161) and all :D

I'm not sure why the accent on "Stop using MS, it's spying on you!" is on MS. AFAIK every company is using your data and giving/selling it to the government.

How is MS more evil than anyone else?

Microsoft has been moving Skype from its original peer-to-peer architecture to a more centralized system for some time. After the Snowden shitstorm, critics have been implying that the move was NSA-related.

I might be wrong, but wasn't skype's p2p system used mostly for udp hole punching? (i.e., the supernodes were used to initiate the connection and then the clients communicated directly with each other.) With the centralized system, do the call contents go through microsoft's servers now? (this should be pretty easy to prove, doesn't it? Just check the addresses where your UDP packets are being sent to and received from.) It just seems to me that if anyone wanted to spy on you, forcing someone else to migrate to an entirely new system would be massive overkill: Applebaum's talk shows there are _plenty_ of better tools available to get to your packets.

EDIT: This really seems like an interesting question: _are_ there any advantages an attacker would have with skype's centralized system that they wouldn't with their previous p2p system? From what we've seen so far, I think the differences (from an attacker's perspective) are trivial.

If someone drowns 4 kittens and you only drown 1 kitten, you're still pretty evil. I don't see how "everyone else is doing it" is possibly a valid argument. Obviously 'evil' in this case is based on your definition though, it's not exactly a universal concept.

What if a cop held a gun to your head and told you to drown those kittens?

Microsoft is responsible for spying on 90% of all users of an Desktop (or laptop) operating system.

Simply put, because of their market share, their evil has a bigger impact than other companies evil.

footnote: One is always completely free to decided if evil with more market share than other evils are more evil.

They also hacked their Facebook page.

I don't consider getting access to a website via the most insecure blogging platform on the internet "hacking".

[citation needed]

WordPress isn't that insecure. A lot of third-party (i.e. written by inexperienced developers) plugins for it are, though.

Not sure why you say that. WordPress.com offers 2-Factor Auth:

http://en.support.wordpress.com/security/two-step-authentica...

There are also tons of available security plugins & pretty extensive documentation on hardening a self-hosted install:

http://wordpress.org/plugins/tags/security http://codex.wordpress.org/Hardening_WordPress

Still, a lot of what's on that page and a lot of the common features of plugins like Wordfence (which I use) should be part of the core, I think.

Though also in my opinion even having a web-based file editor is pretty terrible...

Hardening Wordpress. That made me speechless…………

But hey, what do I know? ¯\_(ツ)_/¯ Only the tip of the iceberg. Some men believe.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress

How much of what's on that list actually applies to a recent version of Wordpress?

>> to a recent version of Wordpress

Saying recent here isn't logical, because after patching the incident, it's not an incident anymore. But I guess you mean how secure you are with a recent version of Wordpress. I think this is though question, because Wordpress relies to a high degree on external components and plugins. There is probably no single pure Wordpress Blog, because the original Wordpress archive already relies heavily on external dependencies. That's where many of the issues were found as correctly pointed out by wyck. However this reliance on external code, without a Wordpress team or at least a software that is evaluating the code-quality or any other metric, you can't be secure. Yeah we can argue with: "But Wordpress is n-times more popular than X." However it still makes WP very vulnerable to attacks. I've cleaned and recovered some hacked commercial wp blogs and shops myself (not installed by me, but the previous dev). So whatever you believe in WP may be, just get over it. There are so many other opensource alternatives that wait for you to be tried out.

Show me an alternative that I can sell to a non-technically minded client with a small business who just wants to blog and put up a youtube feed and do e-commerce and maybe SEO. And oh, they can't ever even know what a terminal is, much less git.

Why should the client know git or anything else if you are the one who has to setup the blog for him/her? Or are you working with clients only who know html, css, ftp etc so they can do the work themself just being lazy and paying you instead?

I think they don't want to be intimidated by complexity and don't want to have to pay someone more to deal with it for them in the future. Typically they want to be able to administrate the site themselves, and they can do that through web forms easily enough.

What you describe can easily be solved with Google Fusion Tables and a tiny script in your favorite server-side language.

You're right - I think the problem is mostly one of marketing the alternatives.

Try http://getkirby.com or http://concrete5.org or http://silverstripe.org there are many many other CMS or Blogging platforms too. For just Blogging as the main thing, you're perfectly set with https://ghost.org/

Without exaggerating, I've downloaded almost any CMS on Github and Bitbucket and Sourceforge and I'm almost done with testing all of them. I think about 15 remain. With all honesty, I cannot say that I'm impressed with any CMS so far. There is just one thing that stood out, with it's concept, but it's still only Alpha grade quality, that's: http://parsimony.mobi/

I've you're curious what I ended up with, just ping me and I'll share my results, after I've really compared all CMS with each other. Currently I would say that there are about ~10 good quality CMS, with hundreds of miserably coded ones. That is a good benchmark, for how good developers are in the real world, I mean there is only so much space at the top of the iceberg. Not everybody can excel with every project they start (well, except people like Fabrice Bellard)

I've not compared Typo3, Alfresco and other Enterprise CMS, because even when they come with all features loaded, they suck at code complexity and user friendliness

You can't tell me that Wordpress is the only blogging platform that fits to all of your requirements, because there are thousands of CMS out there and you'll spend weeks testing all of them.

I'm not actually a Wordpress fanboy by any means (though it does pay the bills) - for my own personal use i'm setting my site up in Slim Framework. Professionally, though, i've found that if someone wants to blog or do "e-commerce", talking them out of Wordpress (and into something they're still willing to pay for) is a difficult thing to do.

Not much because those are plugins and not WordPress, there are over 27k of them on .org and probably another 5-10k hosted on other sites.

Having 2-Factor auth is meaningless if you can bypass the auth itself.

I doubt the purported "insecurity" of Wordpress has anything to do with this. Given that they simultaneously defaced a multitude of social media outlets for Skype, it seems fairly likely that they phished or compromised someone who managed social media accounts.

Reply on news.ycombinator.com