No Joke: Syrians Hack The Onion

On Monday, The Onion, a news parody site, became the latest publication to have its Twitter account hacked by the Syrian Electronic Army.

The group, which supports Syria’s embattled president, Bashar Al-Assad, posted several anti-Israel messages to The Onion’s nearly 5 million Twitter followers. Another message read, “UN retracts report of Syrian chemical weapon use: Lab tests confirm it is Jihadi body odor.”

A member of the Syrian Electronic Army who goes by the hacker handle “Th3 Pr0” told The New York Times that the group aimed at The Onion because of a recent Onion parody post, purportedly written by Syrian President Bashar Al-Assad, titled: “Hi, In The Past 2 Years, You Have Allowed Me To Kill 70,000 People.”

“The Onion is a satire news organization and quite often is more trusted to reflect the news than the corporate media is known to,” Th3 Pr0 wrote in an e-mail. “Recently they have published an article that savages Syria and its current circumstances. This hurt the feelings of many Syrians who relied on it to tell the truth in a funny way. We hoped that our effort to correct their news would draw attention to the fact that it was likely that an outside decision was involved in changing The Onion’s tune.”

“We hope people take it in good humor and understand our people’s suffering,” he added. “The Onion can do a much better job reporting the truth through its satire. Unfortunately even they seem to be biased.”

The Syrian Electronic Army started targeting Syrian opposition groups during the beginning of the Syrian uprisings in 2011 and have since turned their attention to media outlets, hacking their Twitter accounts in retaliation for what they call the media’s one-sided coverage of the Syrian civil war. In recent weeks, Human Rights Watch, NPR, CBS, the Associated Press, E! Online and the Guardian were all hacked by the group.

The group uses multiple tactics in its attacks, but according to security researchers who have investigated the break-ins, the hackers send employees at each organization an e-mail with a link that redirects them to a fake Gmail or Microsoft Outlook log-in page, where they are asked to enter in their username and password. The hackers then use those passwords, to break into e-mail in-boxes, where they can search for the password to a Twitter account or reset the site’s Twitter password themselves.

In the case of the Associated Press, the hackers sent a link disguised as a Washington Post article. S.E.A. hackers claim that more than 50 A.P. employees fell for the hoax, including several of the A.P.’s social media editors.

To prove that the S.E.A. was behind the recent Associated Press Twitter hack, Th3 Pr0 sent a screenshot he took while he was resetting the AP’s Twitter password. Security researchers confirmed that the group was responsible.

The S.E.A.’s A.P. attack, in which it used the A.P. account to post a fake message about explosions at the White House, sent the stock market nose-diving before the hoax was discovered.

The group is now emboldened by that success. “We have a strategy and we are working on it very successfully,” Th3 Pr0 wrote via e-mail. “It’s just the beginning.”

Meanwhile, The Onion deleted the fake posts to its Twitter account and posted a new satirical article on the experience titled: “Onion Twitter Password Changed To OnionMan77: ‘That Ought To Do It,’ Company Sources Confirm.”