Malaysia airlines hacked page
Naked Security Naked Security

Lizard Squad moves on from Xbox and PlayStation, hacks Malaysia Airlines

The Malaysia Airlines website was defaced by hackers claiming to represent Lizard Squad and the 'Cyber Caliphate'.

The Malaysia Airlines website has been defaced by hackers claiming to represent Lizard Squad and the ‘Cyber Caliphate’.

The website‘s front page was replaced by the Lizard Squad’s monocled lizard sporting a top hat and tuxedo along with a message, presumably is in reference to the disappearance of the airline’s flight MH370 last year:

Malaysia airlines hacked page

404 - Plane Not Found

Some media outlets have reported that the lizard image was in some cases substituted for a Malaysia Airlines plane in flight, and included the message “ISIS will prevail”.

A group calling itself “CyberCaliphate” recently took control of US Central Command social media accounts on Twitter and YouTube, although it’s not clear if that was connected to Lizard Squad.

Lizard Squad has previously been responsible for DDoS attacks against the Sony PlayStation and Microsoft Xbox networks over the Christmas period, as well as the development of its own DDoS-for-hire service.

Malaysia airlines took to Facebook to confirm the attack, but reassured users that their data is safe:

MA Facebook post

Malaysia Airlines confirms that its Domain Name System (DNS) has been compromised where users are re-directed to a hacker website when URL is keyed in.

At this stage, Malaysia Airlines’ web servers are intact.

The airline has resolved the issue with its service provider and the system is expected to be fully recovered within 22 hours.

The matter has also been immediately reported to CyberSecurity Malaysia and the Ministry of Transport.

Malaysia Airlines assures customers and clients that its website was not hacked and this temporary glitch does not affect their bookings and that user data remains secured.

But Lizard Squad strongly hinted that might not be the case:

Lizard Squad tweet

Going to dump some loot found on servers soon

In fact, when Malaysia Airlines tweeted a message that user data is safe, Lizard Squad called the company “clueless”:

Malaysia Airlines tweet

@MAS [MEDIA STATEMENT]: User data is secured. 26th January 2015.

@LizardMafia @MAS Are you really that clueless? Wait until we package this nice present for you.

A later tweet then referenced a now-removed image that displayed what appeared to be a screenshot of an inbox displaying passenger itineraries.

We don’t know yet what has been taken (if anything), but if you have used Malaysia Airlines it’s worth being on your guard against potential phishing emails, and keeping an eye on your bank statements.

Leave a Reply

Your email address will not be published. Required fields are marked *