Categories: SecurityWorkspace

Lessons From The Washington Post’s Syrian Strike

The Washington Post reported Thursday, 15 August that it had been the victim of an attack by a group known as the Syrian Electronic Army (SEA). The intrusion involved both a phishing attack against a staff writer’s Twitter account as well as some Washington Post page redirections by way of an exploit of the Outbrain advertising and content discovery platform.

So what exactly is the SEA, and perhaps more importantly, what can and should publishers and enterprises do to protect themselves from being victims?

Syrians with a history

The SEA, which is aligned with Syrian President Bashar al-Assad, has a long history using various attack methods, said Jason Lancaster, senior intelligence analyst at Hewlett-Packard’s Security Research division.

“The group’s motivation, spreading pro-Assad messages, has not changed, but we have seen the volume of activity escalating over the past few months as well as the evolution of its tactics,” Lancaster, who has been tracking the SEA’s activities for years, told eWEEK.

In Lancaster’s view, attacking websites through third parties, as they have done in this attack with Outbrain, is part of this escalation of events.

“This is not a typical tactic used by the SEA but is something we have known the group is capable of for a while,” Lancaster said.

A powerful distribution tool

The third-party attack — in which a widget from Outbrain, which was resident on The Washington Post Website, led to an unintended page redirection — is eerily reminiscent of an attack that WhiteHat security researchers described at the Black Hat conference at the end of July. In the WhiteHat research, JavaScript was inserted into ads and used to build a botnet. In The Post attack, an ad network (Outbrain) was also the conduit for attacking a site.

“This is an example of the power of the ad network when it comes to malware distribution,” Matt Johansen, manager for the Threat Research Center at WhiteHat Security, told eWEEK. “Instead of buying an ad and then later tainting it, the attackers here went after the ad network portal itself via social engineering emails.”

In the SEA case, once the attackers were in the ad network’s admin panel, they had one of the world’s most efficient and powerful distribution tools at their fingertips and they used it, Johansen said.

“Although we don’t have firsthand knowledge of the malware, it doesn’t seem to be using JavaScript like the botnet from our recent research,” Johansen said. “It would appear to be a more traditional drive-by malware download via the malicious ad loading in the browser.”

How the Washington Post responded

While the fact that The Washington Post was hacked is not a good thing, some positive lessons can be learned from the event.

The Washington Post had a strong security response plan and ultimately did a good job managing the issue, Kyle Adams, chief software architect for Junos WebApp Secure at Juniper Networks, told eWEEK.

“They reacted very quickly to mitigate the problem by identifying the issue, quickly mitigating future damage by blocking the threat and then were transparent about the incident,” Adams said. “So, from my perspective, they did everything exactly as they should have.”

“For the SEA’s primary targets, which include mainstream media and any group perceived as supporting Western values, organisations should be particularly vigilant in monitoring for phishing attacks and SQL injection, as these are primary vectors for attack for the SEA,” Lancaster said.

At-risk groups should enforce strong password policies, maintain unique passwords for each social media site and closely monitor corporate Websites for any out-of-process changes, Lancaster said. The use of two-factor authentication for social media sites is also a good best practice to further help reduce the risk of exploitation, he added.

“Attackers leveraging ad networks to distribute malware is not new, and care must be taken to ensure that the content pushed through from these third parties is not malicious,” Lancaster said. “Today, global media organisations and individuals with access to those organisations’ social media accounts should be considered high-risk targets and should operate with a high level of caution.”

The success with which the SEA has been able to attack media sites to date is a leading indicator for Lancaster that the attacks will continue into the future.

Stand by for more

“When a group is highly successful using techniques that are relatively easy to execute with little to no threat of retaliation from the victims, we do not expect the attacks to stop,” Lancaster said. “In fact, the frequency and value of targets may increase.”

Shutting down the SEA is not an easy task either, given the global nature of the Internet. Lancaster noted that a number of SEA domains, including syrian-es.com, syrian-es.org and syrian-es.net, have been shuttered. Fifteen of the SEA’s Twitter accounts have been suspended, and a sixteenth is likely to be shut down as well.

The highly visible attacks by the SEA began during the Arab Spring with increasing geo-political tensions in Syria, Lancaster said. “These tensions have not eased, and as this is a primary motivator of the group, we do not anticipate its attacks stopping until the unrest in Syria comes to an end,” he said.

Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

What do you know about Internet security? Find out with our quiz!

Originally published on eWeek.

Sean Michael Kerner

Sean Michael Kerner is a senior editor at eWeek and contributor to TechWeek

Recent Posts

Ericsson To Cut 1,200 Jobs in Sweden Amid ‘Challenging’ Market

Swedish telecoms giant Ericsson blamed “challenging mobile networks market” and “further volume contraction” for job…

4 hours ago

FTX’s Sam Bankman-Fried Sentenced To 25 Years In Prison For $8bn Fraud

Dramatic downfall. Sam Bankman-Fried sentenced to 25 years in prison for masterminding $8bn fraud that…

5 hours ago

Elon Musk Orders FSD Demo For Every Tesla US Sale

Fallout avoidance? Tesla buyers in the US must be shown how to use the FSD…

6 hours ago

Amazon Pumps Another $2.75 Billion Into Anthropic

Amazon completes its $4bn investment into AI firm Anthropic, after providing an additional $2.75bn in…

8 hours ago

The Sustainability of AI

While AI promises unparalleled efficiency, productivity, and innovation, questions regarding its environmental impact loom large.…

10 hours ago

Trump’s Truth Social Makes Successful Market Debut

Shares in Donald Trump’s social media company rose about 16 percent after first day of…

11 hours ago