[lux]

The hacking collective took over the Lenovo site for several hours on Wednesday, redirecting users to a slideshow of bored teenagers



Lenovo, the PC maker at the centre of the Superfish controversy, suffered its own security breach on Wednesday when its main website was defaced, redirecting users to a slideshow of pictures of bored-looking teens (apparently the hackers themselves) set to the song Breaking Free from High School Musical.

Clicking on the slideshow sends users to the Twitter account of hacking collective the Lizard Squad, while viewing the source of the page reveals a note reading “the new and improved rebranded Lenovo website featuring Ryan King and Rory Andrew Godfrey” – two people previously named by security reporter Brian Krebs as being members of the group.

Lizard Squad tweeted hours before the attack to expect “more mischief”.

The hack was apparently carried out through a “DNS hijack”, an increasingly common method whereby domain name system server, which translates a human-readable web address such as google.cominto a machine-readable IP address such as “8.8.8.8”, redirects visitors to another website – in this case, one controlled by Lizard Squad.

The hijack closely resembles another Lizard Squad attack, on Google’s Vietnamese website, which was carried out this week, according to Andrew Hay, director of security research at OpenDNS. Both sites used the same domain name registrar, Webnic.cc.

“Two defacements in a single week is normally nothing, but two extremely high-profile defacements from the same registrar in the same week is a definite trend,” Hay said. “We may see more redirections of domains that were registered with Webnic.cc in the coming days.”

Following the hack, Lizard Squad has been posting screenshots of emails allegedly sent to Lenovo.com addresses, including one discussing Superfish. A DNS hijack can potentially gain access to emails sent during the period the site is taken over, by redirecting the email in the same way as the website. But this would not grant access to the full database of emails.

In a statement, Lenovo said: “Unfortunately, Lenovo has been the victim of a cyber attack. One effect of this attack was to redirect traffic from the Lenovo website. We are also actively investigating other aspects. We are responding and have already restored certain functionality to our public facing website.

“We are actively reviewing our network security and will take appropriate steps to bolster our site and to protect the integrity of our users’ information and experience.

“We are also working proactively with 3rd parties to address this attack and we will provide additional information as it becomes available.”


Lenovo’s reputation in the information security community was already rock-bottom after it emerged that the company sold laptops infected with pre- installed malware named Superfish, which broke users’ encrypted connections in order deliver the firm’s own adverts into search pages.

The company initially denied the reports, saying that it was “satisfied” that user security was never at risk. A day later it recanted and apologised for its error.

Peter Hortensius, Lenovo’s chief technology officer, told the New York Times that “we did not do a thorough enough job understanding how Superfish would find and provide their info. That’s on us. That’s a mistake that we made.”

He added: “This week we begin the plan to make sure this never happens again. We’ll release that plan by the end of the week.”

[source]

[Eclipse]

I remember a time when quotes from external sites pissed you off.

OT: Lizard Squad is gay. Lenevo's been under some heavy fire recently. First the super fish shit and now this...

[lux]

I remember a time when quotes from external sites pissed you off.

OT: Lizard Squad is gay. Lenevo's been under some heavy fire recently. First the super fish shit and now this...

I hate how IMO Lenovo makes the best laptops, ever.

And they do, but at least this shit is interesting, relevant to the forum, and has a source link.

[Losi]

Lmao. That's great. Skids actually doing their own work. Shoutouts to Lenovo for trash security.

[Reiko]

That's me in that picture, lol

---

Lmao. That's great. Skids actually doing their own work. Shoutouts to Lenovo for trash security.

"Their own work"? Not quite. They used Scott's exploit and my rootkit.

[Losi]

That's me in that picture, lol

---

"Their own work"? Not quite. They used Scott's exploit and my rootkit.

Nvm. Skids just being skids.

[lux]

That's me in that picture, lol

---

"Their own work"? Not quite. They used Scott's exploit and my rootkit.

qt3.14

[Master]

It seems that their website wasn't defaced at all then, traffic was simple redirected to a fake site with pretty much nothing Lenovo could possible have done to prevent it. Basically "Lenovo website hacked and defaced" is simply untrue.

Edit: You could say they deserved it after the superfish affair.

[lux]

It seems that their website wasn't defaced at all then, traffic was simple redirected to a fake site with pretty much nothing Lenovo could possible have done to prevent it. Basically "Lenovo website hacked and defaced" is simply untrue.

Reasonable points, although the 'face' of the site was changed. Still counts for me.

[dr0ptbl]

That's me in that picture, lol

---

"Their own work"? Not quite. They used Scott's exploit and my rootkit.

nice! although you probs didnt want your face on a top site.
sucks using others work. what did the exploit target?