Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

The Price of Fame? Celebrities Face Unique Hacking Threats

Hackers are hitting the sports industry hard on social media and luring quarantined consumers with offers of free streaming services, a new report shows.

(Image: Bits and Splits via Adobe Stock)
(Image: Bits and Splits via Adobe Stock)

While sports arenas and movie theaters have gone dark for now during the pandemic, the celebrity athletes and film stars who are so well-known because of their craft remain in the crosshairs of hackers on social media.

A new report of threat data collected over 12 months by ZeroFOX across an ecosystem of media and entertainment customers including sports teams, talent agencies, celebrities, and streaming services – reveals the kinds of unique vulnerabilities entertainment companies deal with at the hands of criminals. And the main space they are being hit is on social media, accounting for 89% of threat activity, the report reveals.

Athletic teams and sports organizations are the top targets for attack, according to ZeroFOX – specifically, celebrity sports stars. While sports only represent a small portion of entertainment, sports talent is often high-profile, with sports-related threat activity making up 63.3% of all incidents. Credential compromise, in particular, has become a pervasive problem for athletes and athletic organizations.

"One of the biggest examples of this we have seen in the last year was the NFL compromise," says Ashlee Benge, senior threat researcher at ZeroFOX. "There has been a rash of lower-echelon hacking teams that target high-profile accounts. With these kinds of attacks, it is often less of a typical compromise and more of a drive-by graffiti of these accounts."

In the event Benge refers to from January, at least 15 NFL team Twitter accounts and the league's own official account, @NFL, were hacked. In many cases, the accounts were altered by removing the profile picture, Twitter header, and Twitter name. Some also had a tweet claiming to come from a group called OurMine.

"Hi, we're back (OurMine). We are here to Show (sic) that everything is hackable," the tweet read.

Benge says the best way to secure high-profile accounts (or any secure account) – and one that she advises given the opportunity for hackers to access celebrity accounts is huge now – is with multifactor authentication.

"It's a much larger attack surface in years prior where print media was the primary source of promotion," Benge says. "But it's a double-edged sword. If you choose not to use [social media], you really reduce brand awareness in a lot of ways."

According to the report, other top attack tactics targeting media and entertainment include impersonations (7.3%), compromised credentials and personally identifiable information (PII) (1.4%), cyberattack chatter (5.2%), and pirated content/counterfeit goods (6%).

The top concern for those seeking to combat criminal activity is on protecting high-profile individuals – and that is where 73% of defense efforts are focused, researchers say.

The New ‘Hook’: Free Streaming Services  
The newest type of attack relating to entertainment and media amid the pandemic is around streaming services, Benge says. ZeroFOX is observing a surge of scams on social media related to streaming services as more people are using them due to stay-at-home orders around the globe.

These scams target streaming service users and trick them into disclosing their account information in exchange for the false promise of a free streaming-service membership, Benge says. Many of these scams are circulated on social platforms to increase visibility and the likelihood of victims falling for the "offer." 

Benge points to a recent scam circulating across WhatsApp claims to offer free streaming-service membership to every user who enrolls in the program. The WhatsApp message appears to be from a particular streaming service and preys off users' vulnerability during the pandemic by offering free access as an act of goodwill. The message contains a link that directs visitors to a site intended to appear similar to a legitimate streaming site. The page displays a message that reads, "Due to the COVID-19 pandemic, we are giving away totally free access to our platform for the period of isolation, until the virus is contained."

Cyberattack Chatter Offers a Window into Planning
ZeroFOX researchers observed that attackers frequently use surface, Deep, and Dark Web chatrooms and forums to plan attacks, choose targets, and sell hacking services.

"Cybercriminals flock to both the surface and Dark Web, messaging groups, and even social media to market their portfolios of tools, including attack infrastructure and malware, and to dump data, sell stolen information, and network with other criminals," according to the study's authors.

Researchers recommend security managers in entertainment find ways to monitor the so-called chatter for useful intelligence to thwart attacks on talent, fans, and brand before they occur.

"Content monitoring can be highly valuable to media and entertainment organizations," the report states. "When personal information is leaked or physical threats are posted, early warning and immediate action is necessary to protect that individual and their online community. By monitoring content related to talent and immediately addressing threatening or offensive content, organizations mitigate this risk, especially when explicit and threatening content is detected."

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3493
PUBLISHED: 2021-04-17
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivile...
CVE-2021-3492
PUBLISHED: 2021-04-17
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (ker...
CVE-2020-2509
PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later Q...
CVE-2020-36195
PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
CVE-2021-29445
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...