From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Hacking

Brianna Monsanto

itbrew.com

It’s all fun and games until your Muppets fandom website is targeted by repeated cyberattacks (wocka wocka!).

Joe Hennes, the Muppet fanatic who owns and edits ToughPigs, a fan blog devoted to Jim Henson’s beloved puppets, has spent years grappling with determined hackers. He first knew something was wrong when the website wouldn’t load properly: Instead of words and images devoted to Kermit the Frog and friends, he was staring at a single line of text…in Russian.

“It was like, obviously Bad News Bears,” Hennes said.

Hennes, who was unable to pinpoint when the hacking attempts first started, said the hacking problem was fueled by the website’s antiquated nature (ToughPigs was created in 2001). The hardest part about the whole ordeal was that, although Hennes had learned a thing or two about HTML and the difference between secure and insecure plugins over the years, he said none of the volunteers and co-owners who help run ToughPigs were true “tech people.”

“None of us know anything about how to actually run or design a website,” Hennes said. “We can write blog posts, we can create images and podcasts, but as far as the guts of the website? Completely in the dark.”

Things got worse for ToughPigs. The website would go down, according to Hennes, only to be replaced with pages entirely unrelated to Muppets and ToughPigs content.

“This time, it’s not just a line of text,” Hennes said. “It’s a foreign gambling site, or for a while, it was a website that sold knitting supplies.”

Tim Nash, a WordPress security consultant and managing director at cybersecurity firm Tempered, doesn’t have any relation to ToughPigs, but suspects a couple of things could have caused this nightmare for Hennes. ToughPigs visitors encountering a faux website, he said, could have been the result of a traffic scam, where unscrupulous techniques are used to drive more visitors to an (often unsuspecting) client’s website.

“So, they take over your Muppet site and go, ‘Okay, well, the knitting website needs some traffic today because they’ve paid us $10 for 1,000 visitors. Redirect people from the Muppets site directly to the traffic site,’” Nash said. The wonky ToughPigs homepage could have also been a side effect of an SEO scam or a DDoS attack against another website, he added.

Hennes also began to notice weird activities going on with ToughPigs behind the scenes.

“We were seeing security plugins being disabled and new plugins that were maybe a little more nefarious being installed,” Hennes said. “We were seeing new admin users on WordPress being added that were not members of our team, and we were seeing the worst slowdowns of our website.”

Why would anyone hack a Muppets website? 

After working with three techs and taking ToughPigs offline for two weeks, Hennes discovered the culprit behind the reoccurring mischief was stray code on the site’s backend.

“It allowed bots to start coming in,” Hennes said, adding that the bots were able to parse information from the website to extract admin usernames and commit other nefarious acts such as removing two-factor authentication.

“Part of me is like, ‘Well, I guess it’s not personal. That’s nice,’” Hennes said. He joked that he wished a malicious actor targeted ToughPigs because they saw some value in it, instead of it being an impersonal automated attack. The Muppet connoisseur said he believes all of ToughPigs’ attacks were performed by bots, but wouldn’t be surprised to hear a human was in the mix initially.

Such automated attacks are the norm for WordPress websites, according to Nash.

“That’s the really horrible thing,” Nash said. “When you have someone sitting there going, ‘My livelihood’s being destroyed,’ and you have to tell them that the person who’s doing it doesn’t even know who you are.”

In true Muppets fashion, Hennes said there are lessons to be learned from his lengthy tango with his site’s issues. He suggested small businesses and website owners spend time educating themselves on how to navigate the server and backend of their sites.

Meanwhile, Nash has some simple advice: WordPress owners should strive to keep their sites as updated as possible, “That means keeping your WordPress site up to date, that means keeping the plugins up to date, and it means keeping the theme up to date.”

Close up of Kermit the Frog on a computer screen with an overlayed lock icon.

How a Muppets fan website thwarted hacking attempts

Joe Hennes, owner and editor-in-chief of Muppets fan website ToughPigs, says stray code on the backend of his website led to repeated cyberattack attempts over the years.

Billy Hurley

On Oct. 22, Alex Albert, a lead at AI company Anthropic, 

The seemingly ordinary receipt for three pepperoni pizzas looked more impressive when Albert revealed who called in the pies: Anthropic’s AI assistant Claude.

Earlence Fernandes, a computer-science and engineering assistant professor at UC San Diego, reacted to the tweet like he usually does when he sees a flashy new technology demo: He had some questions for the chef.

“What if the website has something malicious embedded in it that takes control of Claude and changes your pizza order from 5 to 15?” Fernandes said to IT Brew.

Fernandes has always had a “rational paranoia” when it comes to examining new technologies, from self-driving cars to smart homes to new AI.

Fernandes’s CV boasts 30 conference papers highlighting a range of security and privacy issues. The professor and his teams over the last decade or so have found weaknesses in emerging tech like:

Large language models that leak chat details after processing 

Wireless gear shifters that can be manipulated 

Stop signs that can be read by neural-network-based classifiers as 

Before the security researcher made a habit of poking around roadways and door locks, however, there was Clippy.

As a teenager, Fernandes read up on Microsoft’s binary interface, the Component Object Model, to find a way to get every millennial’s favorite animated paper clip to appear in a Java program.

“I didn’t get into security in the beginning. It mostly was getting computers to do things in different ways, and just trying to understand how these computers work, and finding workarounds for roadblocks,” Fernandes said.

Fernandes grew up in India, where his computer access was limited largely to the high school’s lab of Windows 98 machines, he said.

After choosing the high-school computer engineering track over biology, his journey began at a fast clip(py). He received an undergraduate computer-engineering degree in India’s University of Pune, a PhD at the University of Michigan, and was also a scientific programmer at Vrije Universiteit in the Netherlands. Fernandes ultimately landed at UC San Diego, messing with plenty of technology along the way.

“I don’t like people telling me the way things work. I like figuring it out myself,” he said.

While security research hasn’t turned the professor off of technology, he said, it has led to “tempered excitement.” He’ll only use physical keys, for example, given his experience breaking into too many internet-connected door locks. He’s fine, though, with a video-camera doorbell.

“The safety calculus there is that the doorbell is not going to allow an attacker to get into the house, but an internet connected door lock is just asking for trouble,” he said.

The same goes with electronic gear shifters; he’ll use them, he says, but his cycling research has led him to preferring wires between the shifters and bike’s derailleurs.

Fernandes encourages his students to extend an engineering mindset of “How does this thing work?” to a security perspective that questions the assumptions of a technology, even if that tech is an automated pizza order, a stop sign, or an animated paper clip.

He often paraphrases a definition of computer security that he attributes to software engineer and hacker George Hotz.

“Computer security is the art and science of seeing the world for what it is, not for what others tell you it is,” Fernandes said.


How Earlence Fernandes finds the holes in today’s emerging tech

GenAI, internet-connected door locks, and even regular ol’ stop signs.

, released on May 14, found some items that should probably stay out of the new-hire welcome package: easy-to-guess, temporary passwords.

After scanning over 651 million malware-compromised credentials over the last year, a team at the password security company found 120,000 that contained terms common to new-hire credentials—logins like “user,” temp,” “welcome,” and “change.”

Compromising common starter passwords allows attackers to potentially get around safeguards like multi-factor authentication (MFA) and to potentially get first access into employee-issued services.

“Before you can set MFA, you need to log in the first time with a password to then configure MFA. So [new-hire accounts] are quite a juicy target for any threat actors, especially if they’re pre-provisioned before the user starts,” Darren James, Specops senior product manager, told IT Brew.

 detailed how a criminal group initiated its onboarding process—not via a company-issued, first-day password, however; the group compromised a new hire’s personal email account, according to the Dragos post.

Among the heap of found-to-be-compromised passwords, the Specops report revealed eight of the most common base terms (often given slight variation) for day-one accounts:

“This is an issue, as attackers can use brute force or cracking tools to guess end users’ weak and common passwords. They can also become compromised via password reuse, when end users reuse work passwords on less secure personal devices, websites, and applications,” the Specops report read, also mentioning that its research suggests end users sometimes simply keep their first-day password or make only a slight alteration.

 the company found that of the 1,997 web-application attacks that occurred between November 1, 2022, and October 31, 2023, 77% involved the hacker gaining access via stolen credentials, and 21% used brute force to discover “usually easily guessable passwords.”

While some IT departments onboarding new employees share plaintext passwords via text or email, James had fairly straightforward advice: Don’t send the password. (Specops has a First Day Password feature that keeps a cached credential on a new device and immediately prompts a user to set a complex password via an enrollment link. )

Andras Cser, vice president, principal analyst at market research company Forrester, recommends an option like an 

, which sends a push notification through a secure connection; the presented code is based on a shared key between the app and code server.

“Leaving a password right with the manager is never a good idea,” Cser told IT Brew.

And if you have to send a password, make it tough—like, really tough, according to James.

“You want to be putting horrible, nasty-type passwords that they are absolutely going to want to change. And they’ll never just change the last character,” James said.

Specops study finds new-hire passwords commonly compromised

A study found plenty of “starter” passwords in a pile of compromised credentials.

There was money to be made last month, if you knew how to hack a car and get it to play 

Researchers from around the world met in Tokyo from January 24–26 to find ways to compromise Tesla modems, EV chargers, and the Alpine Halo9 iLX-F509 touchscreen, which the 

” event works: Teams have months to prepare for the chosen targeted vehicle and its components. In this case, Pwn2Own selected a Tesla Model 3/Y and Tesla Model S/X, and many of its features, like tuners, modems, Bluetooth, and infotainment systems. Other selected targets included EV charger and operating systems.

Each team eventually gets three 10-minute attempts to demonstrate a successful pwn, what the rules define as a demonstration of “arbitrary code execution” on the device. Ya know, like 

“They were all sitting around, trying to play Doom on this thing. It was so funny,” Dustin C. Childs, head of threat awareness at Trend Micro Zero Day Initiative, told IT Brew. Trend Micro, largely responsible for the payouts, also partnered with Tesla for the event.

A hacked Halo9 iLX-F509 screen being used to play the video game Doom.

This year’s demo showcase featured over 45 entries, 49 unique zero-day bugs, plenty of crowd noise, and even a buzzer beater.

In a room of about 150 people, according to Childs, one entrant established a connection with the EV charger with about ten seconds left.

In the end, hackers drove home—netting bug bounty prizes that totaled 

Childs spoke to IT Brew from Japan about the event’s most exciting moments, and how to make sure vendors get fixes before time runs out.

The responses below were edited for length and clarity.

On day one, the Synacktiv team, a team from France, hacked a Tesla modem. We actually had to set up an RF enclosure, which is like a Faraday cage, because they essentially exploited the [baseband] cellphone network to talk to the Tesla modem. The Tesla’s gonna ping out every now and then, looking for that baseband signal, so it can get updates, give GPS, and do all these other things. They were able to intercept that signal in response to it and compromise the modem. And then the next day, they showed how they could use that exploit to move into the infotainment system.

The infotainment system is, of course, sandboxed, but they were able to escape that sandbox. They didn’t take it any further through this context. But potentially, they could have gone into ECUs (electronic control units) or into other systems that were potentially controlling other parts of the vehicle, even potentially, up to the autopilot. That’s really, really, really hard to do, of course. They didn’t do that, but the potential was there to do that.

What happens next with something like that—to communicate with Tesla to start making a fix?

The awesome thing about working with Tesla is Tesla was here. So, [the team] demonstrated it, we took them into a private room, and they explained it to us. We brought Tesla in and they explained it to them. Tesla’s already working on it…they’ll have a fix out, probably within three or four weeks.

Is the feeling complicated: the excitement combined with the reality that these cars can be hacked?

Yeah, there is that feeling that today’s cars can be hacked, and that is worrying. But from our perspective, we’d rather be on the side of finding the bugs and working with the vendors to get them fixed, rather than just knowing, “Yeah, today’s cars can be hacked” and not even know how bad.

The Synacktiv team hacking a Tesla modem. 

Last-second Tesla hacks at ‘Pwn2Own Automotive’

ZDI’s Dustin C. Childs describes the complicated excitement of hacking today’s cars.

High-speed scenes from a car-hacking competition

Eoin Higgins

The private information of Louisiana drivers was exposed in a massive breach, officials announced on June 15, as part of the global ransomware 

 that exploited a MOVEit software vulnerability and affected agencies across the federal government. CI0p, the Russian-linked 

 syndicate, is allegedly behind the attack, 

 on May 31, though the vulnerability was identified as early as 2021.

The state’s Office of Motor Vehicles said in a 

 on the theft that it was still unclear if threat actors “have sold, used, shared, or released the OMV data obtained from the MOVEit attack”—but the scope of the hack is stunning.

All Louisiana drivers’ names, addresses, Social Security numbers, birthdays, height and eye color, license numbers, and vehicle registration information were likely exposed.

Louisiana Governor’s Office of Homeland Security and Emergency Preparedness (GOHSEP) director Casey Tingle told reporters in a 

 on June 16 that more than 6 million records were exposed, but due to duplicative records from licenses and vehicle registrations, Tingle couldn’t say how many people were impacted.

“The scale of the data in the OMV data is so large as to involve most Louisianans, so that’s the scope of what we’re dealing with,” Tingle said.

Tingle added that GOHSEP isn’t sure if the breach involved licenses and information from people who no longer live in Louisiana, but urged anyone who could be affected to 

 to reverberate across public and private institutions. The hack 

 like the Department of Energy, and potentially involves the data of millions of people.

An illustration of a gloved hand coming out of a laptop screen holding a key

Louisiana OMV data breach exposed nearly all residents’ personal information

The data breach was part of global MOVEit ransomware attack.

Manufacturers are at a high risk of attack from threat actors, a 

 found, as IT leaders are often underprepared and working with outdated infrastructure. That’s changing, though, as cybersecurity becomes more of a priority for teams across the industry.

“Across the sector, the concerns about cybersecurity were growing, leading organizations to invest more in defending themselves from threats,” Shishir Singh, EVP and CTO of BlackBerry’s cybersecurity business unit, told IT Brew in a recent interview on the survey.

 BlackBerry asked around 1,500 senior IT leaders in the manufacturing sector about their cybersecurity preparedness and fears. Respondents were from the US, UK, Germany, Japan, Australia, and Canada, representing companies varying in size from 100 to 17,500 employees with an annual revenue of nearly $277 million.

Singh, who joined BlackBerry in January 2022, told IT Brew that the findings revealed an industry with some work to do.

“Almost three-quarters of the organizations have either been targeted by a cyberattack or found themselves to be vulnerable to cybersecurity threats,” Singh said. “This includes incidents arising from employees.”

The threats include ransomware, which has continued to be a major concern for companies and organizations around the world in almost every sector and industry—and increasingly offered as something of a software-as-a-service, Singh told IT Brew.

 Older, larger companies with outdated equipment in use on many older factory floors are at a higher risk of attack in part because they are more attractive targets to nation-state actors and affiliates who have interests in disruption tactics.

Smaller, newer companies, on the other hand, have the advantage of speed and an easier transition period for their relatively smaller infrastructure needs. Not only are they more ready to make the switch, smaller companies are less susceptible to being targeted by nation-state actors, in Singh’s opinion.

“They are a little bit more on the modern assets and modern tools and things like that, they’re a little bit more aware,” Singh said. “They’re not dealing with a lot of the legacy infrastructure support—that’s my personal read on it based on some of the survey data.”

Nation-state threats to manufacturing have IT leads worried about aging tech infrastructure: BlackBerry survey

“Almost three-quarters of the organizations have either been targeted by a cyberattack or found themselves to be vulnerable to cybersecurity threats,” BlackBerry’s Shishir Singh tells IT Brew.

Tom McKay

Here’s something hackers don’t get every day: an open invite to crack a military satellite.

On June 5, the Aerospace Corporation, Space Systems Command, and the Air Force 

, a roughly 11-pound CubeSat, into low Earth orbit on board a SpaceX rocket. Moonlighter’s mission, 

, is simple: taking offensive and defensive cyber exercises for space systems into the actual environment those systems will be based in. At DEF CON 2023 in August, five teams of hackers will compete for a grand total of $100,000 in prize money to breach Moonlighter’s defenses.

, if only because they haven’t historically been targets for hackers. That changed in 2022, when hackers working for the Russian military targeted Viasat’s KA-SAT network amid its invasion of Ukraine. While the attack was aimed at ground assets rather than the satellites themselves, the incident served 

While Moonlighter is an actual satellite, the hackers will actually be targeting a simulated flight computer hosted in an onboard sandbox alongside the real one. That’s because screwing with any of the satellite’s actual control systems could lead to catastrophe for Moonlighter.

“If you’re doing a hacking competition, or any sort of cyber activity or exercise with a live vehicle, it’s difficult because you’re potentially putting that vehicle’s mission at risk,” Aaron Myrick, the project leader at Aerospace Corporation, told the Register. “And that’s not a good option when you’ve spent a lot of engineering hours and a lot of money to get this launched. So we said if we want to do this right, we have to build this from the ground up.”

The competition in August builds on the Air Force and Space Force’s annual Hack-a-Sat content, which previously involved purely simulated satellites.

 the project is intended to broaden the space industry’s awareness and acceptance of the need for offensive cybersecurity research. One challenge is that satellites often spend large amounts of time isolated from their operators and relying on automated systems.

Istari’s lead cybersecurity software engineer, James Pavur, who participated in qualifying rounds for the competition, told the Register the exercise involved “wicked-hard astrodynamics problems related to overall mechanics and positioning.” Pavur added that the risk of losing contact with a satellite also presents unique opportunities, as operators often build in redundant communications pathways that can “become attack surfaces that an attacker might target.”

While the DEF CON contestants will have mostly free rein to attack Moonlighter’s sandbox payload, there are hard limits: They won’t be able to affect its orbital trajectory.

“We are designing the flight software for the cyber payload to basically be able to operate the vehicle fully,” Myrick told Cyberscoop. “So it will be able to change how the vehicle is pointed.”