Syrian Electronic Army attacks Washington Post, CNN and Time via plug-in

Updated happygeek 1 361 Views

Within days of the New York Times website suffering an outage which was widely reported as being down to another cyber attack, although the NYT itself insists it was actually an internal issue following system maintenance, media sites belonging to CNN, Time and the Washington Post have been attacked by the Syrian Electronic Army (SRA) in support of President Bashar al-Assad. All three sites concerned apparently used a single link recommendation service called Outbrain, and it seems that a social engineering attack there led to the successful breach. 0612f5b78049dbb2f29c20a86e26b88f

Outbrain that "we have fully secured the network and resumed service. If you have additional questions about the incident, please do not hesitate to contact us" and stated that it would be "compiling a fuller brief on the episode to share with anyone who would like more information. If you want to receive the brief, please email publishersupport@outbrain.com".

The Washington Post has apparently also come under attack using targeted social engineering and advanced phishing tactics earlier in the week, before the Outbrain plug-in breach, and the SEA had some success in compromising account password security. Managing Editor Emilio Garcia-Ruiz "the attack resulted in one staff writer’s personal Twitter account being used to send out a Syrian Electronic Army message." The SEA have had quite some success in compromising the social media accounts of the media, with the New York Post also seeing Facebook and Twitter accounts posting similar messages.

Darien Kindlund, Threat Intelligence Manager at security vendor FireEye notes that the Syrian Electronic Army is "a prolific hacker group loyal to Syrian President Bashar al-Assad. Its campaign began in mid-2011, and includes DDoS attacks, phishing, pro-Assad defacements and spamming against governments, online services, and media that are perceived hostile to the Syrian government".

Barry Shteiman, Senior Security Strategist at another security outfit, Imperva, points out that “it makes a lot of sense for a hacktivist group that wishes to display their message and show that they exist to go after high end media. They have been actively hacking Twitter accounts of news sites and have recently escalated to hacking into the websites themselves to create awareness".

Dani AI

Generated

Good summary from and a reasonable caution from about attribution — the technical lesson worth pulling out is how a single trusted third‑party can amplify an attacker’s reach. News coverage at the time describes the attack as a supplier compromise that used social engineering to gain access, which is precisely the supply‑chain risk defenders should plan for. CSO Online, Aug 15 2013.

Practical, non‑glamorous controls that reduce this class of risk: maintain an inventory / SBOM of every front‑end widget and vendor; perform continuous component scanning (SCA) and periodic attestation of vendor security posture; require short‑lived credentials and OAuth tokens for integrations; and contractually require timely incident notification and an off‑ramp (ability to turn a service off). OWASP’s guidance on component analysis and SBOMs is a good place to start. OWASP: Component Analysis.

Put isolation and policy controls between your pages and third‑party code. Prefer sandboxed iframes or a server‑side proxy for untrusted widgets rather than embedding third‑party JS straight into your origin. Use Content Security Policy to restrict script/frame sources and enable reporting, and apply Subresource Integrity for stable, versioned CDN assets (note: SRI breaks if the provider changes files frequently). Example patterns:

# example CSP header (tune to your needs)
Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.example; frame-src 'self' https://widgets.trusted.example; object-src 'none'; report-uri /csp-report
<!-- SRI on a versioned script -->
<script src="https://cdn.example/lib-1.2.3.js"
        integrity="sha384-BASE64HASH"
        crossorigin="anonymous"></script>

See MDN for practical notes on CSP, SRI and iframe sandboxing. MDN: Content Security Policy — MDN: Subresource Integrity — MDN: iframe sandbox.

Operationally, require phishing‑resistant 2FA for vendor portals and admin accounts (hardware tokens where possible), add synthetic checks that validate third‑party widgets for unexpected redirects, and keep a short incident playbook: disable the widget, collect logs, rotate affected credentials, and notify stakeholders. Historical coverage of this incident underscores how effective simple social engineering can be — plan accordingly. CSO Online, Aug 15 2013.

Member Avatar for Member #949455
Member #949455

Within days of the New York Times website suffering an outage which was widely reported as being down to another cyber attack, although the NYT itself insists it was actually an internal issue following system maintenance, media sites belonging to CNN, Time and the Washington Post have been attacked by the Syrian Electronic Army (SRA) in support of President Bashar al-Assad. All three sites concerned apparently used a single link recommendation service called Outbrain, and it seems that a social engineering attack there led to the successful breach.

I read about that. The only I can say is that it's hard to separate a hacker or a country using cyber warfare or a terrorist who is using hacker method to attack the US. I'm leaning towards a hacker not a country nor a terrorist.

Time will tell. I think John Kerry said something about a war on TV today not sure.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview