AllThingsD reports that at least some of the major cyber attacks reported in the last week, including those that affected employees' computers at Apple and Facebook, may have originated at a site called iPhone Dev SDK. As D (and other sites) note in their stories, you shouldn't visit this site for obvious reasons — at the time of writing, it's down anyway.
But here's what a recent archive of the site looks like opened from within a secure Linux virtual machine:
Not so threatening-looking, right?
The site, which has been active for at least four years as an enthusiast forum, was likely hijacked: either exploited at a basic level to take over certain users' browsers, or hacked in a more human way. (The site is a resource for developers, on which users often ask each other to test early versions of software. It's easy to imagine spreading malicious software this way, or initiating a phishing attack.)
Facebook's own report on the attack last week pointed to a browser-based exploit, however, which implies that the malware was delivered through the site's code, not through software uploaded to its forums. In other words, the site's operators may not have known about it.
An administrator for the site has not responded to a request for comment.
An administrator for iPhoneDevSDK has issued a statement — he didn't learn of the hack until it was reported in the media:
Today, we were alerted that our site was part of an elaborate and sophisticated attack whose victims included large internet companies. We were alerted through the press, via an AllThingsD article, which cited Facebook. Prior to this article, we had no knowledge of this breach and hadn't been contacted by Facebook, any other company, or any law enforcement about the potential breach. You can read more about the attack via Facebook's blog post.
As the most widely read dedicated iOS developer forum, we're targeted for attacks frequently. Security is a top priority for us, which is one reason why we switched to Vanilla Forums to host our site last year. Vanilla manages security like pros, and I should be clear that -- as best we can tell right now -- this attack has nothing to do with their software.
Immediately, we were in contact with Facebook's security team, including Joe Sullivan, Facebook's Chief Security Officer, and his team, to learn what they knew. We also contacted Vanilla, our amazing forum hosts, to ensure the problem was not with their software.
What we've learned is that it appears a single administrator account was compromised. The hackers used this account to modify our theme and inject JavaScript into our site. That JavaScript appears to have used a sophisticated, previously unknown exploit to hack into certain user's computers.
We're still trying to determine the exploit's exact timeline and details, but it appears as though it was ended (by the hacker) on January 30, 2013.
As with Facebook, it's important to stress that we have no reason to believe user data was compromised.
Just to be sure, we've reset all users' passwords. Please use our Forgot Password feature the next time you log in to reset your password.
We're continuing to work with Facebook, Vanilla, other targeted companies, and law enforcement to find out who is behind this sophisticated attack.
We're very sorry for the inconvenience -- we'll work tirelessly to ensure your data's security now and in the future. I want to thank Vanilla Forums for their help in the matter and for keeping the site secure, as well as Facebook for their help quickly after we reached out.