Apple, Facebook Twitter Attacks: 6 Key Facts

FBI investigates how hackers compromised an iOS developer website to exploit Java plug-in vulnerabilities and breach major social networking and technology companies.

In the past five days, first Facebook and then
Apple
disclosed that attackers exploited zero-day vulnerabilities in Java browser plug-ins used by their employees, although apparently failed to steal any customer or user data from either company. Twitter, which earlier this month warned that
about 250,000 users accounts were compromised
by attackers, didnt say at the time how the companys systems had been hacked, but did strongly urge users to disable Java.
The attacks were apparently first discovered last month, and while the companies either waited to detail them publicly, or only released partial information, some
security experts had seen signs
that something was amiss with Java. Apple was blocking Java a couple of weeks ago, and the U.S. Department of Homeland Security was advising against [using] Java in the browser, Sean Sullivan, security advisor at F-Secure, told
Dark Reading
. I had a very strong feeling that something was going on.
Heres whats now known about the attacks:
1. Compromised iPhone Developer Site Served Malware
All three companies were apparently compromised after their mobile developers visited a popular website devoted to iOS development called iPhoneDevSDK.
The sites administrator confirmed late Tuesday that the site had apparently been hacked, and while no data appeared to have been stolen, all users passwords have been reset as a precautionary measure. Today, we were alerted that our site was part of an elaborate and sophisticated attack whose victims included large Internet companies, according to a
forum post
made by the sites administrator,
Ian Sefferman
.
[ Attend
Interop Las Vegas
, May 6-10, and get the most thorough training on Apple Deployment at the NEW Mac & iOS IT Conference. Use Priority Code DIPR02 by March 2 to save up to $500. ]
As the most widely read dedicated iOS developer forum, were targeted for attacks frequently, he said. Security is a top priority for us, which is one reason why we switched to Vanilla Forums to host our site last year. Vanilla manages security like pros, and I should be clear that -- as best we can tell right now -- this attack has nothing to do with their software.
Rather, attackers apparently obtained or guessed one of the passwords tied to an administrator account at the site. It appears a single administrator account was compromised, he said. The hackers used this account to modify our theme and inject JavaScript into our site. That JavaScript appears to have used a sophisticated, previously unknown exploit to hack into certain users computers.
Seff said its not yet clear when the drive-by-infection campaign started, but it appears to have been ended -- by the attacker -- on January 30, 2013. Were continuing to work with Facebook, Vanilla, other targeted companies and law enforcement to find out who is behind this sophisticated attack, he said. Were very sorry for the inconvenience -- well work tirelessly to ensure your datas security now and in the future.
2. Malware Infected Mac OS X Systems
Apple Tuesday
released an update
that inoculates Java 6 (for any OS X systems that are running it) against the exploit employed by the attackers who compromised Apple itself, as well as Facebook and Twitter.
Apple has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plug-in for browsers, according to a statement released Tuesday by Apple,
reported
The Loop
.
The malware was employed in an attack against Apple and other companies, and was spread through a website for software developers, said Apple. We identified a small number of systems within Apple that were infected and isolated them from our network. There is no evidence that any data left Apple. We are working closely with law enforcement to find the source of the malware.
But according to Reuters, which first reported the news of the Apple breach, its still
not clear how much data may have been stolen
from Apple, or if all infected systems at the company have yet been identified.
3. Attackers Employed Watering Hole Technique
Apple, Facebook and Twitter were apparently all exploited via a
watering-hole attack
, which refers to attackers using a known -- and not otherwise malicious -- website to serve malware in advance of their targets visiting the website. The technique has been used numerous times, for example in the so-called
Aurora attacks
that compromised Google.
In this case, attackers targeted mobile developers and succeeded in exploiting them, according to a
blog post from Facebooks security team
, despite their employees systems being fully up to date and running antivirus software with the latest signature updates. As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement and began a significant investigation that continues to this day, said Facebook.
We have found no evidence that Facebook user data was compromised, according to Facebook. But it didnt say what types of data attackers might have obtained.
4. Facebook Spotted Attack After Suspicious Network Behavior
While antivirus software didnt spot or block the attacks, other security defenses in place helped at least some of the businesses spot the exploit. Notably, Facebook said its security team spotted signs of an infection, which it then chased down. In this particular instance, we flagged a suspicious domain in our corporate DNS logs and tracked it back to an employee laptop, according to Facebook. Upon conducting a forensic examination of that laptop, we identified a malicious file, and then searched company-wide and flagged several other compromised employee laptops.
After analyzing the compromised website where the attack originated, we found it was using a zero-day (previously unseen) exploit to bypass the Java sandbox (built-in protections) to install the malware, said Facebook. We immediately reported the exploit to Oracle, and they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability.
Similarly, Twitters information security personnel had detected unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data, according to a blog post at the time from Bob Lord, Twitters director of information security, who said that
attackers accessed data
that included usernames, email addresses, session tokens and encrypted/salted versions of passwords.
5. Hacked Companies Circled The Wagons
Apple, Facebook and Twitter being attacked wasnt unusual, but according to Facebook, having such an attack succeed was rare. Facebook, like every significant Internet service, is frequently targeted by those who want to disrupt or access our data and infrastructure, it said. As such, we invest heavily in preventing, detecting and responding to threats that target our infrastructure, and we never stop working to protect the people who use our service. The vast majority of the time, we are successful in preventing harm before it happens, and our security team works to quickly and effectively investigate and stop abuse.
In the case of this successful exploit, Facebook said it immediately shared threat intelligence with other affected businesses, though didnt name them. Facebook was not alone in this attack, it said. It is clear that others were attacked and infiltrated recently as well. As one of the first companies to discover this malware, we immediately took steps to start sharing details about the infiltration with the other companies and entities that were affected. We plan to continue collaborating on this incident through an informal working group and other means.
Facebook, working with a third party, also
sinkholed the command-and-control server
employed by attackers, reported Ars Technica.
6. Warning: More Mobile Developers Likely Exploited
Who else might have been compromised as part of this attack campaign? F-Secures Sullivan said in a blog post that because the attackers who compromised Facebook and Twitter did so via sites that target developers of mobile apps, all mobile app developers -- whether using Mac OS X or Windows -- should
assume theyve been targeted
.
Twitter and Facebook obviously have dedicated security teams on the lookout for trouble. (Theyre big targets.) Unfortunately, other smaller Silicon Valley startups (with big user bases) dont have the same resources, said Sullivan. There are hundreds of thousands if not millions of mobile apps in the world. How many of the apps developers do you think have visited a mobile developer website recently?
What were attackers looking for? Thats not yet clear, but if the hackers behind the exploits are criminals, then theyre likely pursuing any avenue that could lead to remuneration. Unfortunately for mobile code developers, that might include efforts to sneak backdoors into their mobile apps. Accordingly, any developer who has Java enabled in his browser, has visited mobile developer websites in the last couple of months and finds evidence his computer is compromised, probably should use his source code versioning system to check recent commits, said Sullivan. And if you dont use a source code version system (such as SVN or Git), have fun re-reading your entire code base.

Last News
▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security	▸ Homeland Security Background Checks Breach Raises Concerns. ◂ Discovered: 23/12/2024 Category: security	▸ Fully committed to the future world of technology. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Apple, Facebook Twitter Attacks: 6 Key Facts