14 DAY TRIAL // The company behind Plone, which is often referred to as the most secure content management system (CMS) on the market, says the recent claims of a potential hack of FBI’s computers are very likely to be fake.
Hacker CyberZeist, acting on behalf of Anonymous, revealed that in late December he managed to break into the CMS software used by the FBI and steal more than 150 logins, along with hashed passwords, and emails.
CyberZeist said he used a zero-day flaw in Plone, which was also being used by the FBI, to access the sensitive details, pointing out that no details regarding the vulnerability can be shared for the time being because it’s still being sold on the black market.
In a lengthy post today, however, Plone says a hack of FBI’s system is very unlikely, pointing out that the company is not aware of any zero-day flaw in its software.
“Security fix announcements are normally issued with two weeks' notice. If the Plone security team were to receive reports of a zero day exploit or vulnerability in the wild, it would release a security fix immediately,” Plone says.
“Just a hoax”
Describing the claim as a hoax, Plone goes on to debunk the hack, emphasizing that some of the details shared by CyberZeist are not accurate, as is the case of the server software, which was detected as FreeBSD ver 6.2-RELEASE.
“It is extremely unlikely that the FBI would run such an old version of FreeBSD. Moreover, FreeBSD 6.2 provides Python 2.4, with the option of using Python 2.5. Plone does not run on such old versions of Python,” Plone said.
So then, what’s the purpose of claiming that you hacked the FBI when you didn’t, you could ask? Well, according to Plone, which describes its software as “an extraordinarily secure content management system,” the hacker is most likely trying to sell a fake exploit and needs media exposure to increase the price.
“The bigger scam here is the repeated references to the exploit being for sale, and messages to other Plone users. The so-called ‘exploit’ is for sale on TOR for 8 BTC ($9000 US), but it is not possible to get refunds on such transactions. We don’t believe the FBI is his target; it is more likely that he is using this high profile site as a way of advertising fake exploits for sale,” Plone said.
For the moment, however, it’s hard to tell whoever is right in this FBI hack saga, but CyberZeist has promised to share more information about the breach after the zero-day is no longer for sale on Tor. So let’s just wait a few more days and we’ll see.