Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

The Price of Fame? Celebrities Face Unique Hacking Threats

Hackers are hitting the sports industry hard on social media and luring quarantined consumers with offers of free streaming services, a new report shows.

While sports arenas and movie theaters have gone dark for now during the pandemic, the celebrity athletes and film stars who are so well-known because of their craft remain in the crosshairs of hackers on social media.

A new report of threat data collected over 12 months by ZeroFOX across an ecosystem of media and entertainment customers including sports teams, talent agencies, celebrities, and streaming services – reveals the kinds of unique vulnerabilities entertainment companies deal with at the hands of criminals. And the main space they are being hit is on social media, accounting for 89% of threat activity, the report reveals.

Athletic teams and sports organizations are the top targets for attack, according to ZeroFOX – specifically, celebrity sports stars. While sports only represent a small portion of entertainment, sports talent is often high-profile, with sports-related threat activity making up 63.3% of all incidents. Credential compromise, in particular, has become a pervasive problem for athletes and athletic organizations.

"One of the biggest examples of this we have seen in the last year was the NFL compromise," says Ashlee Benge, senior threat researcher at ZeroFOX. "There has been a rash of lower-echelon hacking teams that target high-profile accounts. With these kinds of attacks, it is often less of a typical compromise and more of a drive-by graffiti of these accounts."

In the event Benge refers to from January, at least 15 NFL team Twitter accounts and the league's own official account, @NFL, were hacked. In many cases, the accounts were altered by removing the profile picture, Twitter header, and Twitter name. Some also had a tweet claiming to come from a group called OurMine.

"Hi, we're back (OurMine). We are here to Show (sic) that everything is hackable," the tweet read.

Benge says the best way to secure high-profile accounts (or any secure account) – and one that she advises given the opportunity for hackers to access celebrity accounts is huge now – is with multifactor authentication.

"It's a much larger attack surface in years prior where print media was the primary source of promotion," Benge says. "But it's a double-edged sword. If you choose not to use [social media], you really reduce brand awareness in a lot of ways."

According to the report, other top attack tactics targeting media and entertainment include impersonations (7.3%), compromised credentials and personally identifiable information (PII) (1.4%), cyberattack chatter (5.2%), and pirated content/counterfeit goods (6%).

The top concern for those seeking to combat criminal activity is on protecting high-profile individuals – and that is where 73% of defense efforts are focused, researchers say.

The New ‘Hook’: Free Streaming Services  
The newest type of attack relating to entertainment and media amid the pandemic is around streaming services, Benge says. ZeroFOX is observing a surge of scams on social media related to streaming services as more people are using them due to stay-at-home orders around the globe.

These scams target streaming service users and trick them into disclosing their account information in exchange for the false promise of a free streaming-service membership, Benge says. Many of these scams are circulated on social platforms to increase visibility and the likelihood of victims falling for the "offer." 

Benge points to a recent scam circulating across WhatsApp claims to offer free streaming-service membership to every user who enrolls in the program. The WhatsApp message appears to be from a particular streaming service and preys off users' vulnerability during the pandemic by offering free access as an act of goodwill. The message contains a link that directs visitors to a site intended to appear similar to a legitimate streaming site. The page displays a message that reads, "Due to the COVID-19 pandemic, we are giving away totally free access to our platform for the period of isolation, until the virus is contained."

Cyberattack Chatter Offers a Window into Planning
ZeroFOX researchers observed that attackers frequently use surface, Deep, and Dark Web chatrooms and forums to plan attacks, choose targets, and sell hacking services.

"Cybercriminals flock to both the surface and Dark Web, messaging groups, and even social media to market their portfolios of tools, including attack infrastructure and malware, and to dump data, sell stolen information, and network with other criminals," according to the study's authors.

Researchers recommend security managers in entertainment find ways to monitor the so-called chatter for useful intelligence to thwart attacks on talent, fans, and brand before they occur.

"Content monitoring can be highly valuable to media and entertainment organizations," the report states. "When personal information is leaked or physical threats are posted, early warning and immediate action is necessary to protect that individual and their online community. By monitoring content related to talent and immediately addressing threatening or offensive content, organizations mitigate this risk, especially when explicit and threatening content is detected."

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/1/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Attacker Dwell Time: Ransomware's Most Important Metric
Ricardo Villadiego, Founder and CEO of Lumu,  9/30/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-01
The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the c...
PUBLISHED: 2020-10-01
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
PUBLISHED: 2020-10-01
Unisys Stealth(core) before 4.0.132 stores Passwords in a Recoverable Format.
PUBLISHED: 2020-10-01
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
PUBLISHED: 2020-10-01
Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization.