Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Apple, Facebook Twitter Attacks: 6 Key Facts

FBI investigates how hackers compromised an iOS developer website to exploit Java plug-in vulnerabilities and breach major social networking and technology companies.

In the past five days, first Facebook and then Apple disclosed that attackers exploited zero-day vulnerabilities in Java browser plug-ins used by their employees, although apparently failed to steal any customer or user data from either company. Twitter, which earlier this month warned that about 250,000 users' accounts were compromised by attackers, didn't say at the time how the company's systems had been hacked, but did strongly urge users to disable Java.

The attacks were apparently first discovered last month, and while the companies either waited to detail them publicly, or only released partial information, some security experts had seen signs that something was amiss with Java. "Apple was blocking Java a couple of weeks ago, and the U.S. Department of Homeland Security was advising against [using] Java in the browser," Sean Sullivan, security advisor at F-Secure, told Dark Reading. "I had a very strong feeling that something was going on."

Here's what's now known about the attacks:

1. Compromised iPhone Developer Site Served Malware

All three companies were apparently compromised after their mobile developers visited a popular website devoted to iOS development called iPhoneDevSDK.

The site's administrator confirmed late Tuesday that the site had apparently been hacked, and while no data appeared to have been stolen, all users' passwords have been reset as a precautionary measure. "Today, we were alerted that our site was part of an elaborate and sophisticated attack whose victims included large Internet companies," according to a forum post made by the site's administrator, Ian Sefferman.

[ Attend Interop Las Vegas, May 6-10, and get the most thorough training on Apple Deployment at the NEW Mac & iOS IT Conference. Use Priority Code DIPR02 by March 2 to save up to $500. ]

"As the most widely read dedicated iOS developer forum, we're targeted for attacks frequently," he said. "Security is a top priority for us, which is one reason why we switched to Vanilla Forums to host our site last year. Vanilla manages security like pros, and I should be clear that -- as best we can tell right now -- this attack has nothing to do with their software."

Rather, attackers apparently obtained or guessed one of the passwords tied to an administrator account at the site. "It appears a single administrator account was compromised," he said. "The hackers used this account to modify our theme and inject JavaScript into our site. That JavaScript appears to have used a sophisticated, previously unknown exploit to hack into certain users' computers."

Seff said it's not yet clear when the drive-by-infection campaign started, but it appears to have been ended -- by the attacker -- on January 30, 2013. "We're continuing to work with Facebook, Vanilla, other targeted companies and law enforcement to find out who is behind this sophisticated attack," he said. "We're very sorry for the inconvenience -- we'll work tirelessly to ensure your data's security now and in the future."

2. Malware Infected Mac OS X Systems

Apple Tuesday released an update that inoculates Java 6 (for any OS X systems that are running it) against the exploit employed by the attackers who compromised Apple itself, as well as Facebook and Twitter.

"Apple has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plug-in for browsers," according to a statement released Tuesday by Apple, reported The Loop.

"The malware was employed in an attack against Apple and other companies, and was spread through a website for software developers," said Apple. "We identified a small number of systems within Apple that were infected and isolated them from our network. There is no evidence that any data left Apple. We are working closely with law enforcement to find the source of the malware."

But according to Reuters, which first reported the news of the Apple breach, it's still not clear how much data may have been stolen from Apple, or if all infected systems at the company have yet been identified.

3. Attackers Employed Watering Hole Technique

Apple, Facebook and Twitter were apparently all exploited via a watering-hole attack, which refers to attackers using a known -- and not otherwise malicious -- website to serve malware in advance of their targets visiting the website. The technique has been used numerous times, for example in the so-called Aurora attacks that compromised Google.

In this case, attackers targeted mobile developers and succeeded in exploiting them, according to a blog post from Facebook's security team, despite their employees' systems being fully up to date and running antivirus software with the latest signature updates. "As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement and began a significant investigation that continues to this day," said Facebook.

"We have found no evidence that Facebook user data was compromised," according to Facebook. But it didn't say what types of data attackers might have obtained.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
adeeladil
50%
50%
adeeladil,
User Rank: Apprentice
2/20/2013 | 7:42:02 PM
re: Apple, Facebook Twitter Attacks: 6 Key Facts
here is a very interesting blog that talks about exactly what should be done to detect a breach early and to have a plan in place to react promptly to secure your data and limit the damage from a particular attach http://www.enpointe.com/securi...
adeeladil
50%
50%
adeeladil,
User Rank: Apprentice
2/20/2013 | 7:03:09 PM
re: Apple, Facebook Twitter Attacks: 6 Key Facts
According to FBI Investigation report major social networking sites like Facebook, Twitter and technology companies like Apple were infected. All three companies were apparently compromised after their mobile developers visited a popular website devoted to iOS development called iPhoneDevSDK.
I read an article on cyber securities by En Pointe Technologies that GǣThere are only two types of companies those that have been hacked and those that will be.Gǥ We should put together a strategic security plan that includes an assessment of your current security posture, identify system and policies vulnerabilities and invest in resources and technology to provide a multi layer protection against attacks.
Must find an IT Security Service on http://www.enpointe.com/securi...
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34390
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow on the size parameter of the tz_map_shared_mem function.
CVE-2021-34391
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel�s tz_handle_trusted_app_smc function where a lack of integer overflow checks on the req_off and param_ofs variables leads to memory corruption of critical kernel structures.
CVE-2021-34392
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary checks, which might lead to denial of service.
CVE-2021-34393
PUBLISHED: 2021-06-22
Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. This vulnerability might allow an attacker to exploit the deserializer to impact code execution, causing information disclosure.
CVE-2021-34394
PUBLISHED: 2021-06-22
Trusty contains a vulnerability in all TAs whose deserializer does not reject messages with multiple occurrences of the same parameter. The deserialization of untrusted data might allow an attacker to exploit the deserializer to impact code execution.