The 5 Most Embarrassing Hacks Ever

What is the worst thing about being hacked?  Is it losing your data? The financial costs?  Having to spend tedious hours getting your system back to where it was?  Or is it the embarrassment?

According to Wikipedia, a hacker is someone who displays “playful cleverness.” Hackers take “the serious humorously and their humor seriously.”  And in the beginning, most hacks were done by hobbyists, intent on having some serious fun at their targets’ expense. Breaking into networks was a way to demonstrate skill, to prove it could be done. And many hackers still have a code that they live by.

However, we are now in the age of cybercrime when crackers and cyber gangs employ every possible hack, malware and scam to make much money as possible. Criminals know that our PCs facilitate in the most intimate activities in our lives. We bank, shop and flirt via our PCs, as if no one can see what we’re doing. Yet, if our system becomes compromised, every byte of our personal data is there for a criminal to use.

Crackers have rarely gotten into the business of exposing private details, unless they were trying to satisfy a personal or political vendetta. But now—as social networks increasingly entwine or real and our digital lives—criminals recognize that our private lives can be used against us. They can play with their victims’ consciences to soak money out of even the most rational computer user. This has given rise to a new generation of extortionware that is designed to threaten both our wallets and our reputations.

From the harmless to the heartless, here are the 5 most embarrassing hacks in history:

1. Bearded
If you ever received the message “You have been bearded”, you know how humiliating it can be to have your PC hit by a Trojan. In the summer of 2000, this nasty Trojan installed a vile, not-safe-for-work desktop wallpaper that once seen can never be deleted from your memory.

2. Sober.
The Sober worm didn’t do much damage to your system, but it did give all of your email contacts something to think about. Disguised as a computer security warning (as many attacks often are), Sober included a SMTP engine that sent out to every email address it could find. If the person who received the email—which often used a provocative subject line like “You have sent me a virus!”—installed the attached executable file, the attack spread and spread and spread. It was quickly disarmed up by most antivirus software, but the embarrassment still lingers.

3. You got phished.
For most of us, getting phished can result in our accounts being hijacked and our contacts being harassed. But if you’re a Facebook board member, a phishing attack can make international news. Facebook investor Jim Breyer’s 2301 Facebook friends found out that even insiders at the world’s largest social network are vulnerable. It isn’t clear whether Breyer’s account was hacked or he fell for a scam himself. What is clear is that when you use a social network, any mistake you make can affect both your friends and your reputation.

4. Hentai virus.
This virus took embarrassment to a whole new level. Users who were infected by it had their web history was published online. The victim was then instructed to pay 1,500 yen to have the history deleted. What was particularly insidious about this attack is that the criminals knew the victim probably had something to hide since the virus was hidden to a Hentai porn video game (IF YOU DON’T KNOW WHAT “HENTAI” IS, PLEASE DO NOT GOOGLE IT WHILE AT WORK). Every virus teaches a lesson, and as PC magazine said, this virus taught us all, “Don’t enter any personal information in the videogame porn that you download from Japanese torrent sites.”

5. ICPP Copyright Foundation
The F-Secure Labs is familiar with Trojans that extort users to get their own documents back. But this newly discovered Trojan played on the nearly universal fear of profound legal trouble. Infected users were told that illegal torrents had been found on their system. The choice: Pay $400 or face jail time and fines. (Of course, the real solution was to delete the Trojan using a tool like our free Online Scanner.) What was most impressive about this attack was the detail and professionalism of the design. The use of legalese and small print tapped into a latent fear of many computer users: Someday you’re going to have to pay for all that music on your iPod.

Guilt and shame are powerful motivators. But when your computer starts acting suspiciously or your software starts making demands, the smartest thing you can do is to scan your system.

Cheers,

Jason

CC image credit:  Perfecto Insecto

More posts from this topic

bash

Shellshock only concerns server admins – WRONG

Yet another high-profile vulnerability in the headlines, Shellshock. This one could be a big issue. The crap could really hit the fan big time if someone creates a worm that infects servers, and that is possible. But the situation seems to be brighter for us ordinary users. The affected component is the Unix/Linux command shell Bash, which is only used by nerdy admins. It is present in Macs as well, but they seem to be unaffected. Linux-based Android does not use Bash and Windows is a totally different world. So we ordinary users can relax and forget about this one. We are not affected. Right? WRONG! Where is your cloud content stored? What kind of software is used to protect your login and password, credit card number, your mail correspondence, your social media updates and all other personal info you store in web-based systems? Exactly. A significant part of that may be on systems that are vulnerable to Shellshock, and that makes you vulnerable. The best protection against vulnerabilities on your own devices is to make sure the automatic update services are enabled and working. That is like outsourcing the worries to professionals, they will create and distribute fixes when vulnerabilities are found. But what about the servers? You have no way to affect how they are managed, and you don’t even know if the services you use are affected. Is there anything you can do? Yes, but only indirectly. This issue is an excellent reminder of some very basic security principles. We have repeated them over and over, but they deserve to be repeated once again now. You can’t control how your web service providers manage their servers, but you can choose which providers you trust. Prefer services that are managed professionally. Remember that you always can, and should, demand more from services you pay for. Never reuse your password on different services. This will not prevent intrusions, but it will limit the damage when someone breaks into the system. You may still be hurt by a Shellshock-based intrusion even if you do this, but the risk should be small and the damage limited. Anyway, you know you have done your part, and its bad luck if an incident hurts you despite that. Safe surfing, Micke   PS. The best way to evaluate a service provider’s security practices is to see how they deal with security incidents. It tells a lot about their attitude, which is crucial in all security work. An incident is bad, but a swift, accurate and open response is very good.   Addition on September 30th. Contrary to what's stated above, Mac computers seem to be affected and Apple has released a patch. It's of course important to keep your device patched, but this does not really affect the main point of this article. Your cloud content is valuable and part of that may be on vulnerable servers.  

Sep 26, 2014
BY 
Unbenannt-2

Why your Apple Watch will probably never be infected by malware

On Tuesday Apple announced its latest iPhone models and a new piece of wearable technology some have been anxiously waiting for -- Apple Watch. TechRadar describes the latest innovation from Cupertino as "An iOS 8-friendly watch that plays nice with your iPhone." And if it works like your iPhone, you can expect that it will free of all mobile malware threats, unless you decide to "jailbreak" it. The latest F-Secure Labs Threat Report clears up one big misconception about iOS malware: It does exist, barely. In the first half of 2014, 295 new families and variants or mobile malware were discovered – 294 on Android and one on iOS.  iPhone users can face phishing scams and Wi-Fi hijacking, which is why we created our Freedome VPN, but the threat of getting a bad app on your iOS device is almost non-existent. "Unlike Android, malware on iOS have so far only been effective against jailbroken devices, making the jailbreak tools created by various hacker outfits (and which usually work by exploiting undocumented bugs in the platform) of interest to security researchers," the report explains. The iOS threat that was found earlier this year, Unflod Baby Panda, was designed to listen to outgoing SSL connections in order to steal the device’s Apple ID and password details. Apple ID and passwords have been in the news recently as they may have played a role in a series of hacks of celebrity iCloud accounts that led to the posting of dozens of private photos. Our Mikko Hypponen explained in our latest Threat Report Webinar that many users have been using these accounts for years, mostly to purchase items in the iTunes store, without realizing how much data they were actually protecting. But Unflod Baby Panda is very unlikely to have played any role in the celebrity hacks, as "jailbreaking" a device is still very rare. Few users know about the hack that gives up the protection of the "closed garden" approach of the iOS app store, which has been incredibly successful in keeping malware off the platform, especially compared to the more open Android landscape. The official Play store has seen some infiltration by bad apps, adware and spamware -- as has the iOS app store to a far lesser degree -- but the majority of Android threats come from third-party marketplaces, which is why F-Secure Labs recommends you avoid them. The vast majority of iPhone owners have never had to worry about malware -- and if the Apple Watch employs the some tight restrictions on apps, the device will likely be free of security concerns. However, having a watch with the power of a smartphone attached to your body nearly twenty-four hours a day promises to introduce privacy questions few have ever considered.    

Sep 9, 2014
BY