The founder of Facebook has been hacked. Mark Zuckerberg, the creator of one of the world's most popular social media platforms recently had his Pinterest and Twitter profiles defaced by a hacker or group of hackers calling itself, OurMine.
It appears that Zuckerberg, along with 117 million other unfortunate people, had his credentials stolen in the 2012 Linkedin breach. Those credentials were reported to be sold on the darkweb last month for less than £2,000, or just a handful of bitcoin.
That said, the theft of a password for one social media account shouldn't necessarily mean the breach of two separate ones. According to OurMine, the Facebook founder betrayed one of the first rules of personal cyber-security: using different passwords for different accounts.
This one, according to some sources, was a simple ‘dadada'.
"This is a stark reminder that senior people, who might naturally have more security protocols in place than regular employees, are just as much at risk of being hacked as everyone else," Brian Chappell, technical services director at BeyondTrust told SCMagazineUK.com, "There's a host of simple products and systems to help create and store secure passwords so there's really no excuse for people to still be using the same password for multiple accounts."
"Of course, it's never a good thing to see anyone hacked but with this happening to Zuckerberg himself, maybe it will make people realise that no one is invincible. The recent stories about LinkedIn and MySpace data being sold on the dark web show that password data is a hot commodity so it's not something that hackers are going to stop hacking for anytime soon."
OurMine's Twitter account has since been suspended but, according to The Guardian, the miscreant(s) not only detailed how they found the password, but added that the founder's Facebook account had also been accessed. Facebook has since denied this, going on to say that no one accessed Facebook accounts or servers.
Twitter, however, has two factor authentication, requiring a credential other than passwords to access an account. Twitter, would not answer how the OurMine got through that second factor but released a statement to SC via email, saying, "A number of other online services have seen millions of passwords stolen in the past several weeks. We recommend people use a unique, strong password for Twitter.”
Justin Harvey, CSO at Fidelis remains suspicious. He told SC "I am very surprised, as well as guardedly sceptical, that a social media titan's account was hacked simply by using the same password he had on another site. It's actually very similar to the Katy Perry Twitter breach last week. The big question is why wasn't Zuckerberg using the two-factor capability built into his own product? And if he was, does this mean the two-factor implementation was hacked or is not secure? "
Believed to originate within Saudi Arabia, OurMine has cuts its teeth on small ventures, often taking down semi-popular figures on the internet and niche chatrooms.
The group has a considerable social media following, regularly updating its purported 40,000 Twitter followers on it's often dubious achievements. While the account has since been blocked, the group remains active on Facebook.
According to one source, the group started as an offshoot of Anonymous. When the group split, it started to attack Wikileaks and the popular gaming community of Minecraft.
The bloggers at Essence of Zen, have created a video, viewable below on their interactions with the group.
The wider significance of this? “If Mr Social Media's accounts can be compromised, with all of the knowledge and resources he and his team have available, we should all be taking notice.” Richard Parris, CEO at Intercede told SC.
“It's been demonstrated time after time that the simple username and password combination is a fundamentally flawed approach to internet security, but that is typically all we are offered to protect our identity and our data.”
Facebook did not respond for comment.
