Boing Boing says hacker got around 2FA in breaching its content management system

The popular blog used the breach as a teachable moment to spread better security practices.

Boing Boing, a popular blog and news aggregator with deep roots on the internet, said Monday that an unknown attacker had used a hacked account of one of its team members to spread malicious code.

The hacker was able to get around two-factor authentication — an extra security measure — to log into the Boing Boing content management system (CMS) software. From there, the attacker installed a widget that redirected Boing Boing visitors to a malicious web page, the publication said in a statement under the tagline, “We Wuz Hacked.”

Founded three decades ago as a zine, Boing Boing is an irreverent and wide-ranging news site that embraced blogging long before it became popular. Contributors to the self-styled “Directory of Wonderful Things” have long promoted sound security practices. In May 2019, for example, co-editor Cory Doctorow blogged about a Google study touting the benefits of 2FA.

Boing Boing said the breach occurred around midday Friday and that, once the issue was verified, the website’s security team removed the malicious code from its servers and changed passwords and access tokens.

The incident has prompted Boing Boing to set up a separate network log “so we are able to take action and determine the scope of a breach more thoroughly in the future,” the website’s leadership said. They advised recent visitors of the Boing Boing site to check their antivirus software for anything suspicious on their machines.

“From a systems security perspective, this is an excellent cautionary tale of the importance of individual user security,” Boing Boing’s statement reads.

“Even two-factor authentication and password hygiene can be compromised on the user’s end,” the statement continues, “and just because a particular issue … had been detected via third parties in the past, it always pays to consider all possible first-party infection vectors.”

Boing Boing has built up a devoted following over the years. In a 2008 story about the site, The New York Times noted that Boing Boing readers “can appear particularly intense” in their devotion to various subjects.

“Theirs is the intensity that comes from discovering that, indeed, there are other people who like to create detailed drawings on an Etch-a-Sketch or collect 100-year-old fantasies of what the future might look like or rage at the encroachment of technology companies and the government on personal privacy,” The Times wrote.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure