For a number of British Twitter users, the weather forecast on Thursday was cloudy with a chance of political cyber terrorism after the @BBCWeather Twitter account was hacked by a group called the Syrian Electronic Army.
Having gained control of the @BBCWeather feed – one of three BBC accounts the Syrian Electronic Army claimed it hacked – the group tweeted that it had also taken @BBCArabicOnline and the local station @bbcradioulster. On the @BBCWeather feed, the SEA replaced traditional weather news and updates with messages like “Hazardous fog warning for North Syria: Erdogan orders terrorists to launch chemical weapons at civilian areas,” and the more satirical, “Earthquake warning for Qatar: Hamad Bin Khailifah about to exit vehicle.”
All of the fake tweets posted while the accounts were under SEA control have since been removed, a BBC spokesman said in a statement confirming the hacks. “The BBC Twitter accounts which were hacked earlier today are now back under our control and all inappropriate tweets have been deleted,” the spokesman explained, continuing “We apologize to our audiences that this unaccepable material appeared under the BBC’s name.”
The SEA took control of the accounts for approximately three hours, judging by the gap remaining on each account post-cleaning. The BBC apparently lost control of the feeds around noon local time on Thursday before regaining control around 3 p.m.
Oddly enough, it’s possible that the Twitter hacks may be related to an earlier attempt that same day to breach online security at the BBC. The Guardian reported that employees at the BBC had been the subject of a number of phishing emails that day that implicated both the Guardian and Human Rights Watch in a strange sting to gain access to company email addresses and accounts.
The Guardian report also stated that BBC staff received a warning post-Twitter hack asking everyone not to open any email with the subject line “URGENT” and the body text “Please read the following article to its importance.” Said phishing emails included what were supposed to be links to articles at both the Guardian and Human Rights Watch portals, but redirected visitors to what claimed to be an additional BBC email portal that required addresses and passwords to gain access.
It’s somewhat surprising – and a little depressing, as well – that, in this day and age, such obvious phishing attempts can still be so successful. The only unanswered question is where the Syrian Electronic Army will strike next – and whether they’ll use these old school methods again when they do.
