Forest Global Training Partners

Cyber Risks · Krebs on Security

Complexity as the Enemy of Security

Summary: Hackers allied with the Syrian Electronic Army compromised the rsaconference.com site by spoofing messages from Codero executives to employees of the Austin hosting firm, prompting someone with DNS record access to enter credentials at a phishing link. The attackers used that access to alter the third-party Lucky Orange analytics script the conference site loaded, replacing the homepage with a message to Ira Winkler hours after his conference video called the SEA 'the cockroaches of the Internet.'

What's compelling: RSA's Amit Yoran called complexity the enemy of security, noting that on a content-rich site 'it only takes one simple slip' - and the SEA used the same CEO-spoofing phishing play against Outbrain to deface Time, CNN and The Washington Post sites, meaning your security posture extends to every third-party script and vendor with access to your pages.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related