The hacking collective took over the Lenovo site for several hours on Wednesday, redirecting users to a slideshow of bored teenagers

This article is more than 5 years old

This article is more than 5 years old

Lenovo, the PC maker at the centre of the Superfish controversy, suffered its own security breach on Wednesday when its main website was defaced, redirecting users to a slideshow of pictures of bored-looking teens (apparently the hackers themselves) set to the song Breaking Free from High School Musical.

Clicking on the slideshow sends users to the Twitter account of hacking collective the Lizard Squad, while viewing the source of the page reveals a note reading “the new and improved rebranded Lenovo website featuring Ryan King and Rory Andrew Godfrey” – two people previously named by security reporter Brian Krebs as being members of the group.

How can I find and remove Superfish and similar malware? Read more

Lizard Squad tweeted hours before the attack to expect “more mischief”.

Lizard Squad (@LizardCircle) Expect more lizard mischief soon.

The hack was apparently carried out through a “DNS hijack”, an increasingly common method whereby domain name system server, which translates a human-readable web address such as google.cominto a machine-readable IP address such as “8.8.8.8”, redirects visitors to another website – in this case, one controlled by Lizard Squad.

The hijack closely resembles another Lizard Squad attack, on Google’s Vietnamese website, which was carried out this week, according to Andrew Hay, director of security research at OpenDNS. Both sites used the same domain name registrar, Webnic.cc.

“Two defacements in a single week is normally nothing, but two extremely high-profile defacements from the same registrar in the same week is a definite trend,” Hay said. “We may see more redirections of domains that were registered with Webnic.cc in the coming days.”

Following the hack, Lizard Squad has been posting screenshots of emails allegedly sent to Lenovo.com addresses, including one discussing Superfish. A DNS hijack can potentially gain access to emails sent during the period the site is taken over, by redirecting the email in the same way as the website. But this would not grant access to the full database of emails.



In a statement, Lenovo said: “Unfortunately, Lenovo has been the victim of a cyber attack. One effect of this attack was to redirect traffic from the Lenovo website. We are also actively investigating other aspects. We are responding and have already restored certain functionality to our public facing website.

“We are actively reviewing our network security and will take appropriate steps to bolster our site and to protect the integrity of our users’ information and experience.

“We are also working proactively with 3rd parties to address this attack and we will provide additional information as it becomes available.”

What will happen to the Lizard Squad hackers? Read more

Lenovo’s reputation in the information security community was already rock-bottom after it emerged that the company sold laptops infected with pre- installed malware named Superfish, which broke users’ encrypted connections in order deliver the firm’s own adverts into search pages.

The company initially denied the reports, saying that it was “satisfied” that user security was never at risk. A day later it recanted and apologised for its error.

Peter Hortensius, Lenovo’s chief technology officer, told the New York Times that “we did not do a thorough enough job understanding how Superfish would find and provide their info. That’s on us. That’s a mistake that we made.”

He added: “This week we begin the plan to make sure this never happens again. We’ll release that plan by the end of the week.”