Feeds

Bad Vibes, man: Babble app chaps unwrapped in phish trap hack flap

Viber website pwned, privates leaked all over the 'net by Syrian hackers

The Power of One eBook: Top reasons to choose HP BladeSystem

Hacker gang the Syrian Electronic Army broke into the systems of Viber, the popular mobile chat service, and dumped its user account records online.

The miscreants, loyal to Syria's president Bashar al-Assad, say they were able to infiltrate Viber’s support website, which allowed them to extract punters' private data. The site was defaced on Tuesday with a message featuring the Syrian Electronic Army logo and unsubstantiated accusations against the gossip app's makers:

Dear All Viber Users, The Israeli-based "Viber" is spying and tracking you We weren't able to hack all Viber systems, but most of it is designed for spying and tracking.

The Viber support web server is now unavailable. Before the plug was pulled, the hacktivists' graffiti linked to a "screen-capture of what appears to be an internal database ... showing users’ phone numbers, device UDID, country, IP address, operating system and version, first registration to Viber, and what version of Viber they are using", notes security industry veteran Graham Cluley.

The phone numbers of the individuals exposed in the defacement began with the international dialling code of 963, the code for Syria. The page also revealed Viber administrators' contact details, such as their names, phone numbers and email addresses.

In a statement, Viber admitted its computer defences were breached after a support staffer was tricked by a phishing email. It said the hack looked worse than it was, but nonetheless resolved to beef up the security of its systems anyway:

The Viber Support site was defaced after a Viber employee unfortunately fell victim to an email phishing attack. The phishing attack allowed access to two minor systems: a customer support panel and a support administration system. Information from one of these systems was posted on the defaced page.

It is very important to emphasize that no sensitive user data was exposed and that Viber’s databases were not “hacked”. Sensitive, private user information is kept in a secure system that cannot be accessed through this type of attack and is not part of our support system.

We take this incident very seriously and we are working right now to return the support site to full service for our users. Additionally, we want to assure all of our users that we are reviewing all of our policies to make sure that no such incident is repeated in the future.

Viber also insists the spying accusations are cobblers; the company is based in Cyprus but has an office of developers in Israel, a fact that has sparked baseless conspiracy theories about the biz.

In addition to providing a text messaging service, the 200 million users of the Viber app can exchange images, video and audio messages over the internet.

The Viber hack comes days after the same crew of hackers claimed to have extracted sensitive information about millions of Tango users, another mobile messaging app. The Tango hack was reportedly pulled off using a vulnerable WordPress installation, a different hacking strategy.

The Syrian Electronic Army is best known for its cyber-assaults on the social media feeds of media outlets, such as the Associated Press, The Telegraph, and the BBC. Several of these hacks were carried out using multi-stage phishing attacks.

Internet messenger applications such as Skype, Viber and WhatsApp have increasingly come under attack in many repressive regimes where the government has full access to all comms routed through mobile operators but cannot censor OTT systems. Both Skype and WhatsApp have been banned in Syria since March 2012. According to Reuters, Saudi Arabia plans to block WhatsApp within "weeks" if it doesn't allow the state to monitor communications. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.