The US destroyer, USS Kidd streamed hours of game play in a ‘funny’ incident that has serious cyber-security ramifications.
The official Facebook page of the warship, the USS Kidd, has gone rogue: Someone has taken over the page in order to…stream ‘Age of Empires’ play.
‘Age of Empires’ is a real-time online multiplayer strategy game in which the objective is to advance one’s civilisation. Players “build, settle, trade & fight” their way from the Stone Age into the future, reaching certain milestones (inventing the wheel, ending feudalism) along the way.
Addictive Game
In the USS Kidd incident, practical jokers have ‘anthropomorphised’ the warship, so that it appears to be having a great time playing the addictive game:
The pranksters have also changed the page type listing in the “About” information to “Gaming Video Creator.”
The incident was 1st reported by military news specialist Task & Purpose, which revealed that the USS Kidd‘s page was officially taken over at 10:26 p.m. last Sun. The hijacked page of the warship, which finished up its latest active deployment in late Sept., then posted a joyful “Hahahahaha” & commenced 4 hours of live Age of Empires action.
Cyber Awareness Month
One person commented on the post, “Just in time for Cyber Awareness month.”
Another five livestreams of the game followed before the posts stopped the next day, on Oct. 4. The posts garnered 10s of 1,000s of views & 100s of amused comments, including thoughts on the ship’s gaming prowess (i.e., “this guy is awesome but can’t get out of the Stone Age”).
And indeed, it never did progress – not great for a ship whose motto is “On to Victory.”
Unknown Entity
For its part, the Navy admitted the attack: “The official Facebook page for USS Kidd (DDG 100) was hacked,” Cmdr. Nicole Schwegman, a Navy spokesperson, confirmed to Task & Purpose on Tuesday. “USS Kidd‘s Facebook page had an unauthorized access from an unknown entity.”
In an update on Thurs., she explained, “access has been secured by Facebook, & once their procedures are complete we’ll regain access to the page.” However, the page is still not recovered as of press time.
Cybersecurity Concerns
Obvious humour value aside, there are serious security concerns underlying the incident, researchers pointed out. Essentially, the US Navy lost control of the page & could do nothing but watch literally as unauthorised people posted unauthorised content.
“It’s easy to look at a compromised Facebook page & think that it’s no big deal,” outlined Jake Williams, co-founder & CTO at Breach Quest.
Confusion & Morale Problems
“But many military units use Facebook pages as an official communication channel, particularly for family-readiness groups. A threat actor compromising an official Facebook page could create confusion & morale problems.”
As for speculating about the cause of the hack, re-used credentials might be a good bet, he added.
“Unfortunately, many official pages are managed using a shared login, & as a result, multifactor authentication (MFA) is not enabled,” he stated.
“Where possible, organisations should not use shared logins for official pages. Instead, they should delegate control of the pages to individual accounts & ensure they have MFA enabled.”
Copper Stealer
Social-media account takeover (ATO) is a popular activity for cyber-attackers, who are putting more & more resources into the activity.
For instance, a malware called Copper Stealer was recently discovered targeting Facebook & Instagram accounts, along with Apple, Amazon, Bing, Google, PayPal, Tumblr & Twitter credentials.
Crooks can monetise the data by selling credential collections that can be used for brute-force attacks against other, higher-value accounts; they can cause reputational damage through impersonation & rogue posts; or they can use the account to mount malware or phishing attacks on the followers or friends of the original account owner.
