Russian White-Hat Hackers Revenge-Prank VKontakte with Spam Worm
Last updated September 23, 2021
- A team of hackers played a prank against the VKontakte IT team after the latter failed to acknowledge a bug report.
- The prank was based on a custom worm that spread links on multiple pages on the platform.
- By the time the joke was realized, there were thousands of reports of fake articles that hid the worm.
A full year after the Russian social media platform VKontakte failed to reward a security researcher for a vulnerability tip, or to even fix the particular security flaw, the hacker decided to play a prank on them. White hat hackers are intelligent and ethical, they do know how to have fun, so the researcher gathered a team from the Baghosi community, created a worm to take advantage of the specific vulnerability that was reported a year ago, and started spamming.
Во вконтакте массовый взлом? pic.twitter.com/62iu2PBrIl
— köt (@alxsaltzman) February 14, 2019
Лучшее про взлом ВКонтакте pic.twitter.com/0InivvLsp9
— Misha Lozhkov (@AwesooomeMike) February 14, 2019
The worm was carefully planted inside an article’s source code, waiting for a visitor to open the page after getting lured by the title. Once someone did, the worm would pull the VK groups and pages the visitor was administering and automatically post a link to the post there. This resulted in the worm post going viral in a couple of minutes, counting thousands of re-posts before anyone could realize what was going on. The fake article had quite a few comments underneath, which the worm pulled from user reviews of the VKontakte app on the AppStore and the Google Play Store. To avoid a complete debacle, the post remained up for only half an hour before the hackers deactivated the worm. Nevertheless, the prank was successful and the message was loudly heard.
source: vk.com
(translated from Russian)
The white hat hackers group were quick to take responsibility on the VKontakte platform, resulting in their brief ban that was lifted when the admins realized that it was all part of a joke. That said, no user data or any other information was compromised or stolen. VKontakte decided not to issue an official report on the issue, but the fact that the vulnerability report was ignored although they run a relevant security vulnerability reporting program remains concerning for a social media platform that is home to 100 million users.
Are you a member of the VKontakte social media community? Share your comments and experience in the comments below. Also, don’t hesitate to check out our socials on Facebook and Twitter, where you can stay up to date with all that is going on in the tech world.
Related
Most Popular
Most Popular