The Onion explains how it got hacked by the Syrian Electronic Army

the onion hackedRemember how we all thought it was weird that the rebel organization Syrian Electronic Army targeted satirical news outlet The Onion after successfully hacking actual, usually reliable news sources on Twitter? No matter how odd the choice was, here’s the truth according to The Onion: The hack attack penetrated the publication with at least three methods of phishing attacks, also known as sending links that gain control of one’s email account under the guise of receiving really important information – a trick a lot of people still fall for.

In a write-up detailing how the hacking happened, The Onion explained that the Syrian Electronic Army first sent out emails to a few Onion employees containing links disguised as a Washington Post story about their organization. Of course, any self-respecting journalist would jump at a chance to check out a tip … only it wasn’t a tip, but rather a malicious link that lead to another malicious link until it finally landed on a page that asked for login details. The last link bore the word Google in its extra-lengthy URL – which would probably raise flags for Internet savvy users – making it easy for anyone to quickly make the assumption of its legitimacy and right for asking one’s password to Google Apps before redirecting to Gmail.

sea-phishing

All it took was for one Onion employee to fall for this trickery. Once the hackers got into the account, they used it to send out more of the same email to other Onion employees, who by nature wouldn’t question the act since it came from a source they trusted.

A lot of staff members clicked the link and stopped as soon as they were asked to enter log in details, but just like the first phase of the phishing attack, all it took was two more employees to fall for the trap, and one of them happened to have social media account access.

The Onion became aware of this breach quickly and sent out alerts to everyone to change their email passwords. The Syrian Electronic Army, however, became unstoppable at that point – they successfully avoided being thwarted right away by modifying their original phishing email to look like a password-reset link and sending it out to a few more people, excluding staff members who worked in the IT department. This third and final phase of the phishing attack affected two more accounts, and one of those accounts happened to be the back-up email for regaining Twitter access, just in case hackers took control of it.

Instead of feeling duped and defeated, The Onion took this opportunity to publish an article relating to the incident. They also forced a company-wide password reset for every Google Apps account owned by staffers to ensure that potential security breaches caused by the Syrian Electronic Army are nipped at the bud. “In total, the attacker compromised at least five accounts. The attacker logged in to compromised accounts from 46.17.103.125 which is also where the SEA hosts a website,” revealed The Onion in a blog post.

“Don’t let this happen to you,” The Onion warned in big, bold print. They ended their report by providing tips on how to prevent this sort of attack from happening. While most of them pertain to people who work for a company or organization, some of them are pretty obvious: Analyze the links you receive and be extra wary of ones that ask for login details, and anyone can be a victim of a phisher – your boyfriend, your best friend, your boss, even your mom (especially your mom). Make sure to tell them to be extra careful as well.

We recently were able to talk with the Syrian Electronic Army about its rash of Twitter hacks and the motives behind them

News

Japanese billionaire splashes the cash to break retweet record

Japanese billionaire entrepreneur Yusaku Maezawa has proved again he has a knack for self-publicity after launching a cash-prize contest to break the retweet record. Maezawa is the same man who is hoping to go to the moon with SpaceX.
Mobile

Having trouble logging in? Here’s how to reset your Apple ID password

To use any of Apple's services, you need to have an Apple ID and know your password. Thankfully, there are ways to deal with forgotten passwords and regain access to your account. Here's how to reset your Apple ID password.
Mobile

Join the Apple club with our complete guide to switching from Android to iOS

If Android simply isn’t cutting it for you anymore, then you might be considering Apple’s warm embrace. Here’s how to make the switch from Android to iOS without losing your contacts, sleep, or hair!
Computing

Lost your router? Here's how to find its IP address to help track it down

Changing the login information for your router isn't always easy, that's why so many have that little card on the back. But in order to use it, you need to know where to go. Here's how to find the IP address of your router.
Computing

Is your PC slow? Here's how to restore Windows 10 to factory settings

Computers rarely work as well after they accumulate files and misconfigure settings. Thankfully, with this guide, you'll be able to restore your PC to its original state by learning how to factory reset Windows.
Computing

Make a GIF of your favorite YouTube video with these great tools

Making a GIF from a YouTube video is easier today than ever, but choosing the right tool for the job isn't always so simple. In this guide, we'll teach you how to make a GIF from a YouTube video with our two favorite online tools.
Photography

Photoshop fail gives Aussie leader two left feet in official portrait

The Aussie prime minister doesn't have two left feet, despite an official photograph of the leader and his family suggesting otherwise. It was, of course, a Photoshop fail, and the embarrassing snafu was soon trending on Twitter.
Social Media

Instagram now lets you post to multiple accounts in one tap

Instagram for iPhone now lets you post to multiple accounts at the same time. It's not the regram feature that many users have been asking for, but it could prove useful for some users who manage more than one profile.
Social Media

No yolk! A photo of an egg has become the most-liked post on Instagram

Until this weekend, the most-liked post on Instagram was of Kylie Jenner's baby daughter, which has around 18 million likes. It's now been knocked off the top spot not by a stunning sunset or even a cute cat, but by an egg.
Social Media

Invite your friends — Facebook Events can now be shared to Stories

Facebook is testing a way to make plans with friends to attend an event -- through Stories. By sharing an event in Facebook Stories, users can message other friends interested in the event to make plans to attend together.
Social Media

A quick swipe will soon let you keep bingeing YouTube on mobile devices

The YouTube mobile app has a new, faster way to browse: Swiping. Once the update rolls out, users can swipe to go to the next (or previous) video in the recommended list, even while viewing in full screen.
Web

Switch up your Reddit routine with these interesting, inspiring, and zany subs

So you've just joined the wonderful world of Reddit and want to explore it. With so many subreddits, however, navigating the "front page of the internet" can be daunting. Here are some of the best subreddits to get you started.
Photography

Starting your very own vlog? Here are the best cameras to buy

Any camera that shoots video can be used to vlog, but a few models stand out from the crowd thanks to superior image quality, ergonomics, and usability. When it comes to putting your life on YouTube, here are the best cameras for the job.