Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

The Price of Fame? Celebrities Face Unique Hacking Threats

Hackers are hitting the sports industry hard on social media and luring quarantined consumers with offers of free streaming services, a new report shows.

While sports arenas and movie theaters have gone dark for now during the pandemic, the celebrity athletes and film stars who are so well-known because of their craft remain in the crosshairs of hackers on social media.

A new report of threat data collected over 12 months by ZeroFOX across an ecosystem of media and entertainment customers including sports teams, talent agencies, celebrities, and streaming services – reveals the kinds of unique vulnerabilities entertainment companies deal with at the hands of criminals. And the main space they are being hit is on social media, accounting for 89% of threat activity, the report reveals.

Athletic teams and sports organizations are the top targets for attack, according to ZeroFOX – specifically, celebrity sports stars. While sports only represent a small portion of entertainment, sports talent is often high-profile, with sports-related threat activity making up 63.3% of all incidents. Credential compromise, in particular, has become a pervasive problem for athletes and athletic organizations.

"One of the biggest examples of this we have seen in the last year was the NFL compromise," says Ashlee Benge, senior threat researcher at ZeroFOX. "There has been a rash of lower-echelon hacking teams that target high-profile accounts. With these kinds of attacks, it is often less of a typical compromise and more of a drive-by graffiti of these accounts."

In the event Benge refers to from January, at least 15 NFL team Twitter accounts and the league's own official account, @NFL, were hacked. In many cases, the accounts were altered by removing the profile picture, Twitter header, and Twitter name. Some also had a tweet claiming to come from a group called OurMine.

"Hi, we're back (OurMine). We are here to Show (sic) that everything is hackable," the tweet read.

Benge says the best way to secure high-profile accounts (or any secure account) – and one that she advises given the opportunity for hackers to access celebrity accounts is huge now – is with multifactor authentication.

"It's a much larger attack surface in years prior where print media was the primary source of promotion," Benge says. "But it's a double-edged sword. If you choose not to use [social media], you really reduce brand awareness in a lot of ways."

According to the report, other top attack tactics targeting media and entertainment include impersonations (7.3%), compromised credentials and personally identifiable information (PII) (1.4%), cyberattack chatter (5.2%), and pirated content/counterfeit goods (6%).

The top concern for those seeking to combat criminal activity is on protecting high-profile individuals – and that is where 73% of defense efforts are focused, researchers say.

The New ‘Hook’: Free Streaming Services  
The newest type of attack relating to entertainment and media amid the pandemic is around streaming services, Benge says. ZeroFOX is observing a surge of scams on social media related to streaming services as more people are using them due to stay-at-home orders around the globe.

These scams target streaming service users and trick them into disclosing their account information in exchange for the false promise of a free streaming-service membership, Benge says. Many of these scams are circulated on social platforms to increase visibility and the likelihood of victims falling for the "offer." 

Benge points to a recent scam circulating across WhatsApp claims to offer free streaming-service membership to every user who enrolls in the program. The WhatsApp message appears to be from a particular streaming service and preys off users' vulnerability during the pandemic by offering free access as an act of goodwill. The message contains a link that directs visitors to a site intended to appear similar to a legitimate streaming site. The page displays a message that reads, "Due to the COVID-19 pandemic, we are giving away totally free access to our platform for the period of isolation, until the virus is contained."

Cyberattack Chatter Offers a Window into Planning
ZeroFOX researchers observed that attackers frequently use surface, Deep, and Dark Web chatrooms and forums to plan attacks, choose targets, and sell hacking services.

"Cybercriminals flock to both the surface and Dark Web, messaging groups, and even social media to market their portfolios of tools, including attack infrastructure and malware, and to dump data, sell stolen information, and network with other criminals," according to the study's authors.

Researchers recommend security managers in entertainment find ways to monitor the so-called chatter for useful intelligence to thwart attacks on talent, fans, and brand before they occur.

"Content monitoring can be highly valuable to media and entertainment organizations," the report states. "When personal information is leaked or physical threats are posted, early warning and immediate action is necessary to protect that individual and their online community. By monitoring content related to talent and immediately addressing threatening or offensive content, organizations mitigate this risk, especially when explicit and threatening content is detected."

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-06-04
In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19861, CVE-2018-19862, and CVE-2019-17601. NOTE: this product is discontinued.
PUBLISHED: 2020-06-04
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service (loss of the ability to establish new connections), as demonstrated by SlowITe.
PUBLISHED: 2020-06-04
Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.
PUBLISHED: 2020-06-04
Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request ...
PUBLISHED: 2020-06-04
Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console� that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the applicat...