Feeds

Bad Vibes, man: Babble app chaps unwrapped in phish trap hack flap

Viber website pwned, privates leaked all over the 'net by Syrian hackers

Securing Web Applications Made Simple and Scalable

Hacker gang the Syrian Electronic Army broke into the systems of Viber, the popular mobile chat service, and dumped its user account records online.

The miscreants, loyal to Syria's president Bashar al-Assad, say they were able to infiltrate Viber’s support website, which allowed them to extract punters' private data. The site was defaced on Tuesday with a message featuring the Syrian Electronic Army logo and unsubstantiated accusations against the gossip app's makers:

Dear All Viber Users, The Israeli-based "Viber" is spying and tracking you We weren't able to hack all Viber systems, but most of it is designed for spying and tracking.

The Viber support web server is now unavailable. Before the plug was pulled, the hacktivists' graffiti linked to a "screen-capture of what appears to be an internal database ... showing users’ phone numbers, device UDID, country, IP address, operating system and version, first registration to Viber, and what version of Viber they are using", notes security industry veteran Graham Cluley.

The phone numbers of the individuals exposed in the defacement began with the international dialling code of 963, the code for Syria. The page also revealed Viber administrators' contact details, such as their names, phone numbers and email addresses.

In a statement, Viber admitted its computer defences were breached after a support staffer was tricked by a phishing email. It said the hack looked worse than it was, but nonetheless resolved to beef up the security of its systems anyway:

The Viber Support site was defaced after a Viber employee unfortunately fell victim to an email phishing attack. The phishing attack allowed access to two minor systems: a customer support panel and a support administration system. Information from one of these systems was posted on the defaced page.

It is very important to emphasize that no sensitive user data was exposed and that Viber’s databases were not “hacked”. Sensitive, private user information is kept in a secure system that cannot be accessed through this type of attack and is not part of our support system.

We take this incident very seriously and we are working right now to return the support site to full service for our users. Additionally, we want to assure all of our users that we are reviewing all of our policies to make sure that no such incident is repeated in the future.

Viber also insists the spying accusations are cobblers; the company is based in Cyprus but has an office of developers in Israel, a fact that has sparked baseless conspiracy theories about the biz.

In addition to providing a text messaging service, the 200 million users of the Viber app can exchange images, video and audio messages over the internet.

The Viber hack comes days after the same crew of hackers claimed to have extracted sensitive information about millions of Tango users, another mobile messaging app. The Tango hack was reportedly pulled off using a vulnerable WordPress installation, a different hacking strategy.

The Syrian Electronic Army is best known for its cyber-assaults on the social media feeds of media outlets, such as the Associated Press, The Telegraph, and the BBC. Several of these hacks were carried out using multi-stage phishing attacks.

Internet messenger applications such as Skype, Viber and WhatsApp have increasingly come under attack in many repressive regimes where the government has full access to all comms routed through mobile operators but cannot censor OTT systems. Both Skype and WhatsApp have been banned in Syria since March 2012. According to Reuters, Saudi Arabia plans to block WhatsApp within "weeks" if it doesn't allow the state to monitor communications. ®

Mobile application security vulnerability report

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.