Cyber Incident Victim: CBS Interactive
Date:
Jul 2014
Location:
Russia
Summary
A Russian hacker group known as W0rm breached servers belonging to CBS Interactive, compromising a database containing usernames, email addresses, and encrypted passwords for over one million users. The attackers exploited a vulnerability in the Symfony PHP framework implementation on CNET's website, gaining unauthorized access to several servers before the issue was identified and resolved. While W0rm initially advertised selling the stolen data for one bitcoin, they clarified the offer was solely to draw attention to security flaws rather than for financial gain, aligning with their stated goal of improving internet safety through high-profile breaches. A security expert noted the group responsibly withheld technical exploit details, minimizing immediate risks to affected users.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On July 14, 2014, CBS Interactive confirmed that CNET servers were compromised by the Russian hacker collective W0rm over the preceding weekend. The attackers claimed to have exfiltrated a database containing usernames, email addresses, and encrypted passwords, asserting it encompassed over one million user accounts. A CBS Interactive spokeswoman acknowledged unauthorized access to "a few servers," stating the breach was identified and resolved days before the public disclosure, with ongoing monitoring for potential impacts. W0rm initially announced plans to sell the database for one bitcoin (approximately $622) via Twitter on July 14 but later clarified through a representative that the sale offer was solely intended to attract attention, with no actual intent to decrypt passwords or complete transactions. The group cited CNET's prominence—ranking as the ninth-most visited U.S. web property in May 2014 with 27.1 million unique visitors—as motivation for targeting the site.
Technical analysis by W0rm attributed the breach to a security vulnerability in CNET.com’s implementation of the Symfony PHP framework, a widely used web development tool. The group framed its actions as altruistic, claiming to target high-profile entities like CNET, Adobe Systems, Bank of America, and the BBC to expose security weaknesses and improve internet safety. W0rm specifically praised CNET’s security team while emphasizing their exploit’s demonstration of unavoidable flaws. Web security expert Robert Hansen noted the group’s restraint in withholding full technical details of the exploit, suggesting the public disclosure limited immediate risks to users. CBS Interactive did not independently verify the scale of affected users cited by W0rm, later clarifying that the one-million-account figure originated solely from the attackers. No evidence emerged of password decryption or misuse of stolen data following the containment of the breach.