Disneyland hack reveals potential risks of social media account takeover

Yesterday, Disneyland Anaheim’s Instagram and Fb accounts had been hacked by a self-proclaimed “super hacker,” utilizing the alias David Do, who proceeded to post racist and homophobic posts throughout the accounts. 

The attack appears to have been determined by a damaging encounter with the manufacturer, with the attacker stating he was “here to deliver revenge on Disney land [sic],” and weary of Disney employees “mocking” him. 

Whilst Disneyland was brief to get back regulate of the account and eliminated the posts, the celebration has been a PR nightmare which is left thousands and thousands of people and households uncovered to hateful and offensive information, significantly on Disneyland Anaheim’s Instagram, which has 8.4 million followers. 

For other corporations, the Disneyland breach highlights that when platforms like Fb and Instagram can support get to a wider viewers, they also open up the door to social media account takeover, which an attacker can use to severely injury your track record.  

While it’s unclear how the hacker received obtain to Disneyland’s social accounts, Aaron Turner, CTO of SaaS Defend at California-based AI cybersecurity provider, Vectra, believes that social media providers are to blame for providing corporations very poor authentication mechanisms. 

“From an identification and accessibility standpoint, it has usually unhappy me that the important social media and online publishing will not let for their largest sponsors to utilize solid authentication and federated identities to protect their makes,” Turner reported. 

A single of the critical issues with social media accounts, and the rationale why accounts are vulnerable to account takeover tries, is they depend on password-based mostly authentication, which is inclined to credential theft. 

According to the Verizon 2022 Facts Breach Investigations Report, last 12 months, 50% of breaches were being caused by stolen qualifications. 

“Because Instagram pressured Disney to use a small-protection authentication mechanism, in essence anything that would not qualify as organization-grade authentication with appropriate logging, checking and anomaly detection, it produced an opportunity for this on-line vandalism to take place,” Turner reported. 

Turner highlights that social media account takeover is a very easy way for a threat actor to result in significant injury to an organization’s reputation. As a final result, companies require to be knowledgeable that applying social media does existing reputational hazards that will need to be managed. 

Why are qualifications so uncomplicated to exploit? 

While it wouldn’t be honest to speculate on how the attacker gained obtain to Disneyland’s accounts, it is correct that credential theft performs a important position in a lot of social media account takeover tries.

In point, investigation shows that out of the 22% of U.S. older people that have been a victim of account takeovers, social media accounts created up 51% of that whole. It also highlights that 60% of account takeover victims made use of the exact password as the compromised account throughout numerous accounts. 

This is a thing that most businesses are well conscious of, too, with 84% of IT leaders expressing passwords are a deceptively weak way to secure info.

The explanation why there is so substantially credential theft is because it’s minimal chance and higher reward. A hacker can acquire a victim’s e mail tackle and begin trying to brute drive a weak password, look for for leaked qualifications on-line, or concentrate on the victim with a phishing campaign to trick them into getting into their login credentials on a spoofed site. 

Given that there are about 15 billion leaked credentials accessible on line, cyber criminals don’t even have to have to have an technical know-how to crack into an account they can steal credentials that somebody else has leaked on the net. 

Mitigating social media account takeover is difficult due to the fact passwords are innately vulnerable to theft by means of phishing ripoffs, social engineering attempts and brute pressure hacks. 

At the very same time, additional security steps presented by social media platforms, like multifactor authentication, are also easily exploitable with threat actors like Lapsus$ and Dark Halo equally using strategies to sidestep the authentication system in the past.  

Craig Lurey, CTO and cofounder of zero-trust stability business, Keeper Protection, recommends that companies deploy a wide variety of controls to increase the safety of their on the net accounts.  

“Password professionals can simply safeguard social media accounts with strong, unique passwords and can also defend the second factor (TOTP code). Social media accounts can also be shared from vault-to-vault securely among a internet marketing or social media group with function-based mostly obtain controls and audit trails,” Lurey explained. 

These steps can help to minimize the probability of a breach, specifically if they are mixed with stability consciousness schooling to help educate workers on how to select sturdy passwords and detect phishing scams. 

Nevertheless, as extensive as social media accounts rely on passwords, there will also be some hazard of credential theft, till passwordless authentication choices, like people promoted by the FIDO Alliance, achieve common adoption.