In Another Recent Display of Cyber Politics, SEA Hackers Take on The Washington Post and Others
New York, NY (PRWEB) August 19, 2013 -- Last week's reported site redirection hack attack on The Washington Post and others wasn’t the first time the Syrian Electronic Army (the SEA) tangled with major news outlets, back in April they hijacked Associated Press (AP) Twitter accounts, and for a few brief moments, sparked a panic which prompted a scary $136 billion stock market death spin based on faked AP Tweets that the White House had been bombed and President Obama had been injured. “The ripple effects of any type of successful cyber attack on a prominent and trusted organization can be mind boggling, but the social engineering possibilities of a successful redirection attack can lead organizations of any size to very dark places if the attackers have a more sinister objective in mind,” says Joe Caruso, CEO/CTO of Global Digital Forensics, a premiere cyber security solutions provider with years of experience in the trenches of the real-world cyber battlefield.
Right this way folks.
“By our very nature as human beings, we inherently trust our own experiences. There is no thought given to a light turning on when you flip the switch, just like there is no thought given when you turn the key in your car and the engine starts. Sheer repetition of those experiences condition us to expect those responses. The only time we really have to get our consciousness involved is if the expected response doesn’t materialize. The uh-oh moment comes when the light doesn’t come on, or the engine doesn’t start, only then do we go into problem solving mode. That’s what makes redirection attacks like the one on The Washington Post so potentially dangerous. People thought they were going to a trusted source they rely on all the time, but in reality, visiting certain stories sent them somewhere else, in this case a website created by the Syrian Electronic Army to make a political statement. Fortunately, the SEA’s endgame was a political statement and it was pretty easy for users to realize they had been blown way off course. But now imagine if it wasn’t just an informational site, and the attackers' objective was something far more nefarious. What if it was a bank or credit union site that hackers had gained access to and were able to redirect visitors? The attackers could make a duplicate looking site which would not set off any of those internal alarm bells, I mean how often does a typical user study the URL in the address line to make sure they are where they think they are, they used that same bookmark to get to the site they always did, and their expectation seemingly materialized. So no uh-oh moment, and no thinking about it. But now, when they are typing in their login information, they are essentially handing over control of their real account right to the bad guys. Put up a quick splash screen after they log in that the site is temporarily down, please try again later, and presto, a frustrated but still unsuspicious user goes on their merry way, not even knowing they just gave away the keys to their treasure vault. How many valid accounts credentials do you think they could pilfer if they did it for just an hour on one of the huge financial sites that get tons of traffic every day? Or how devastating could it be to a small business if their customers are getting sent to a hacker created shopping cart page to enter all their valid credit card information? It’s frightening to think about, not to mention a legal nightmare just waiting to happen.”
Cyber security basics cannot be overlooked.
“Building a realistic looking dummy website is not rocket science. We’ve done it to clients many times as part of our comprehensive penetration testing, specifically the social engineering component we’ve designed to mimic real-world phishing and spear phishing campaigns, as they are still the most relied on methods for attackers to get that first foot in the door. And we’ve never failed to get at least that one bite we need to gain access to the network, and virtually anything and everyone else connected to it. That’s why the basics are so important, system vulnerabilities, user awareness, training, cyber security policies and procedures, they all have to be regularly tested and maintained, because what worked two years ago, may not cut the mustard anymore. Our professional cyber threat assessments, designed to take into account the newest devices and industry trends, coupled with our penetration testing, where we take on the role of real world hackers to infiltrate, incapacitate or control networks and/or systems, have been meticulously developed to pinpoint weaknesses against today’s threats, with an industry eye on what’s coming down the pike. Not only will we identify threats and weaknesses, but we’ll help clients mitigate them with industry best-practices, we’ll help them develop and implement emergency cyber incident response plans and escalation matrixes, and we have veteran emergency incident responders strategically located across the country and the globe that are available 24/7 every day of the year to offer unrivaled response times in the event an attack or intrusion does manage to occur, because we know just how critical time is when it comes to identifying and stopping any successful data breach or intrusion. Client trust, business integrity, even regulatory compliance can all be affected if the attack is not quickly controlled. So it should be easy to see, regular cyber threat assessments, penetration testing, and a cyber emergency response plan are cyber security basics that simply cannot be overlooked.”
From proactive cyber security solutions, to reactive emergency response, Global Digital Forensics helps clients cover all the bases with customized solutions that fit a client’s particular needs, so don’t wait to significantly decrease the chances of a successful cyber attack, there are no more excuses, professional help is just one call away.
*Global Digital Forensics is a recognized industry leader in the fields of computer forensics, electronic discovery (eDiscovery), cyber security and emergency incident response, with years of experience assisting clients in the government, banking, healthcare, education and corporate arenas. For a free consultation with a Global Digital Forensics specialist, call 1-800-868-8189 about tailoring a plan which will meet your unique needs. Emergency responders are also standing by 24/7 to handle intrusion and data breach emergencies whenever and wherever they arise. Time is critical if a cyber-incident has occurred, so don’t hesitate to get help. For more information, visit http://www.evestigate.com.
Aris Demos, Global Digital Forensics, http://www.evestigate.com, +1 (800) 868-8189, [email protected]
Share this article