Angry Birds Site Toppled After Surveillance Report

9 Notorious Hackers Of 2013

An attacker hacked "The Official Home of Angry Birds" website Tuesday. Gone was the official Angry Birds graphic, replaced with a "Spying Birds" logo. Above it, one of Finnish gamemaker Rovio's trademark red birds sported a National Security Agency (NSA) crest, while a "bad piggy" rolled away.

But Rovio's angrybirds.com website apparently remained hacked -- or at least defaced -- only for a few minutes before the company took the website offline. About 90 minutes later, reported Finnish news outlet Helsingin Sanomat, the game developer had the site restored, with the rogue artwork expunged.

Who hacked Angry Birds? According to the Syrian Electronic Army (SEA), the site was hacked by a "friend" of the group. "The attack was by 'Anti-NSA' Hacker, He sent an email to our official email with the link of the hacked website," read a tweet from an official SEA account.

But was Rovio's website hacked -- for example to redirect site visitors to drive-by-attack websites -- or simply defaced? A Rovio spokesman didn't immediately respond to an emailed request for comment on that question. "At this stage it's not clear if Rovio's web servers were compromised or if the hacker managed to hijack the firm's DNS records and send visiting computers to a third-party site carrying the image instead," said security researcher Graham Cluley in a blog post.

Regardless, the attack appears to have been inspired by a report published this week -- based on information leaked by former NSA contractor Edward Snowden -- which suggests that since 2007, US and British spy agencies have been regularly intercepting mobile app data.

Intercepted information includes Google Maps data, IM buddy lists, phone logs, and geographic data embedded in social media updates, according to the report, which was jointly published Monday by The Guardian, The New York Times, and ProPublica. The report also described how, since 2012, British intelligence analysts have been able to intercept Angry Birds players' profiles, as well as advertising data, which might include information about everything from their location and marital status to political affiliations and income.

[Big tech firms may now share more info about government demands for user data. See Government Loosens Data Disclosure Gag.]

In the wake of that report, Rovio has strongly denied facilitating surveillance of its customers in any way. "Our fans' trust is the most important thing for us and we take privacy extremely seriously. We do not collaborate, collude, or share data with spy agencies anywhere in the world," said Mikael Hed, CEO of Rovio Entertainment, in a statement released Wednesday.

Rather, he pointed to advertising networks as the most likely culprit behind intelligence agencies grabbing mobile users' personal details. "As the alleged surveillance might be happening through third-party advertising networks, the most important conversation to be had is how to ensure user privacy is protected while preventing the negative impact on the whole advertising industry and the countless mobile apps that rely on ad networks," Hed said. "To protect our end users, we will -- like all other companies using third-party advertising networks -- have to reevaluate working with these networks, if they are being used for spying purposes."

From a big-picture standpoint, however, might many mobile app developers also be culpable because they handle or transmit data in insecure -- and thus easily interceptible -- ways? "There certainly is a problem with some smartphone apps transferring sensitive information -- such as GPS location, address books, and phone numbers -- in an insecure way," said Cluley. "Clearly more app developers need to work harder to ensure that any information which ekes out of their apps is properly encrypted and sent over a secure SSL connection."

One 2012 study, for example, found that nearly half of all mobile apps collect more data than they require, while one-third ask for many more permissions than they require. In many cases, this data grab has to do with feeding mobile advertising networks, while the excess permissions trace to lazy developers not taking the time to give their app only the permissions it requires.

Last year, of course, Snowden's leaks began highlighting the NSA's massive digital dragnet, which appears to be driven by a "capture first, worry about whether or not it's relevant later" ethos. Based on what's now known about how the NSA's surveillance programs operate, it's likely already capturing and storing massive amounts of personal information that gets transmitted insecurely by mobile apps.

So while smartphones bring convenience, thanks to insecure apps, they're also bleeding personal information and feeding a massive surveillance infrastructure. "A poorly configured smartphone may be the best espionage tool ever created," Edward Parsons, a cybersecurity senior manager at KPMG, said via email.

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter.

The NSA leak showed that one rogue insider can do massive damage. Use these three steps to keep your information safe from internal threats. Also in the Stop Data Leaks issue of Dark Reading: Technology is critical, but corporate culture also plays a central role in stopping a big breach. (Free registration required.)