Feeds

Bad Vibes, man: Babble app chaps unwrapped in phish trap hack flap

Viber website pwned, privates leaked all over the 'net by Syrian hackers

Beginner's guide to SSL certificates

Hacker gang the Syrian Electronic Army broke into the systems of Viber, the popular mobile chat service, and dumped its user account records online.

The miscreants, loyal to Syria's president Bashar al-Assad, say they were able to infiltrate Viber’s support website, which allowed them to extract punters' private data. The site was defaced on Tuesday with a message featuring the Syrian Electronic Army logo and unsubstantiated accusations against the gossip app's makers:

Dear All Viber Users, The Israeli-based "Viber" is spying and tracking you We weren't able to hack all Viber systems, but most of it is designed for spying and tracking.

The Viber support web server is now unavailable. Before the plug was pulled, the hacktivists' graffiti linked to a "screen-capture of what appears to be an internal database ... showing users’ phone numbers, device UDID, country, IP address, operating system and version, first registration to Viber, and what version of Viber they are using", notes security industry veteran Graham Cluley.

The phone numbers of the individuals exposed in the defacement began with the international dialling code of 963, the code for Syria. The page also revealed Viber administrators' contact details, such as their names, phone numbers and email addresses.

In a statement, Viber admitted its computer defences were breached after a support staffer was tricked by a phishing email. It said the hack looked worse than it was, but nonetheless resolved to beef up the security of its systems anyway:

The Viber Support site was defaced after a Viber employee unfortunately fell victim to an email phishing attack. The phishing attack allowed access to two minor systems: a customer support panel and a support administration system. Information from one of these systems was posted on the defaced page.

It is very important to emphasize that no sensitive user data was exposed and that Viber’s databases were not “hacked”. Sensitive, private user information is kept in a secure system that cannot be accessed through this type of attack and is not part of our support system.

We take this incident very seriously and we are working right now to return the support site to full service for our users. Additionally, we want to assure all of our users that we are reviewing all of our policies to make sure that no such incident is repeated in the future.

Viber also insists the spying accusations are cobblers; the company is based in Cyprus but has an office of developers in Israel, a fact that has sparked baseless conspiracy theories about the biz.

In addition to providing a text messaging service, the 200 million users of the Viber app can exchange images, video and audio messages over the internet.

The Viber hack comes days after the same crew of hackers claimed to have extracted sensitive information about millions of Tango users, another mobile messaging app. The Tango hack was reportedly pulled off using a vulnerable WordPress installation, a different hacking strategy.

The Syrian Electronic Army is best known for its cyber-assaults on the social media feeds of media outlets, such as the Associated Press, The Telegraph, and the BBC. Several of these hacks were carried out using multi-stage phishing attacks.

Internet messenger applications such as Skype, Viber and WhatsApp have increasingly come under attack in many repressive regimes where the government has full access to all comms routed through mobile operators but cannot censor OTT systems. Both Skype and WhatsApp have been banned in Syria since March 2012. According to Reuters, Saudi Arabia plans to block WhatsApp within "weeks" if it doesn't allow the state to monitor communications. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.