Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Wednesday, 1 February, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Taboola and Reuters malvertising was enabled by multiple credential use

by The Gurus
June 24, 2014
in Editor's News
Share on FacebookShare on Twitter

Reuters suffered a “malvertising” incident over the weekend when attackers affiliated to the Syrian Electronic Army accessed the news service via a third party.
 
In an email to IT Security Guru, security analysts from Bromium revealed that hackers spear-phished their way into the advertising network Taboola initially, which as a trusted service allowed them to deface Reuters’ website and access Taboola services.
 
An updated statement revealed that this was enabled by targeting a user who had privileged access to the back-end system, and used the same credentials for this, their email and PayPal accounts.
 
An update to the original statement by Taboola CTO, Lior Golan, said that the attacker was able to abuse access to widget editing capabilities within its back-office dashboard “Backstage”, and that the user used the same password for both their email account and Backstage.
 
“This user fell victim to a targeted phishing attack, and provided their email password to the attacker. While we used two factor authentication for our email, we didn’t use such method for Backstage, and so the attacker was able to get in,” Golan said.
 
“The attacker then used Backstage widget editor (a tool that is exposed only to specific internal Taboola users) to edit the header of the Reuters widget. Taboola widget headers are comprised of an HTML snippet, and the attacker used this capability to add an HTML meta refresh tag that redirected users from Reuters to their own site whenever the Taboola widget was loaded there.”
 
He said that within the first hour after the attack, it was able to block access to the attacker on this account, pro-actively reset the password to all other Taboola Backstage accounts, and fix the specific widget that was compromised.
 
“In addition, the attacker used the fact another Taboola user used a similar password to their email and to the Paypal account and was able to get into a Paypal account used by Taboola to pay small bills. That Paypal account password was reset as well,” he said.
Taboola said that the Syrian Electronic Army hacked into Taboola’s widget on Reuters.com, and that the intruder was redirecting users that accessed article pages on reuters.com to a different landing page.
 
“The breach was detected at approximately 7:25am, and fully removed at 8am. There is no further suspicious activity across our network since, and the total duration of the event was 60 minutes. While we use 2-step authentication, our initial investigation shows the attack was enabled through a phishing mechanism. We immediately changed all access passwords, and will continue to investigate this over the next 24 hours.”
 
According to Bromium, this showed how an attacker could use this method of hitting “soft targets” like advertising networks to infect well-trafficked sites and their trusted users. According to Rahul Kashyap, head of security research at Bromium, this is an important issue that affects pretty much every internet user.
 
He described it as a “killing many birds with one stone” effort, as once you infiltrate popular websites then many users are likely to fall victims to any attacks from there. Already in the past few months: Yahoo, YouTube, Facebook, Disney, The Guardian are some of the victims of malicious ads campaign (popularly known as malvertisment). These provide the perfect ‘high v
alue’ targets to the attacker”, he said.
 
In his analysis, Frederic Jacobs said: “By compromising Taboola, the value of the compromise is significantly higher than just compromising Reuters. Taboola has 350 million unique users and has partnerships with world’s biggest news sites including Yahoo!, the BBC, FoxNews, the New York Times… Any of Taboola’s clients can be compromised anytime now.”
 
Kashyap said: “Online advertising is a multi-billion industry, much more needs to be done to provide a secure experience to unsuspecting users. It is paramount that high profile websites limit the attack surface and properly vet each 3rd party provider. Ultimately it’s their brand that at stake.”

FacebookTweetLinkedIn
Tags: AuthenticationMalvertisingpassword
ShareTweetShare
Previous Post

Enterprise search not seeing investment due to file privacy concerns

Next Post

Michael Schumacher "dies" used as Facebook scam

Recent News

JD Sports admits data breach

JD Sports admits data breach

January 31, 2023
Acronis seals cyber protection partnership with Fulham FC

Acronis seals cyber protection partnership with Fulham FC

January 30, 2023
Data Privacy Day: Securing your data with a password manager

Data Privacy Day: Securing your data with a password manager

January 27, 2023
#MIWIC2022: Carole Embling, Metro Bank

#MIWIC2022: Carole Embling, Metro Bank

January 26, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information