Visitors to the official Angry Birds website, run by Finnish developers Rovio, saw an unexpected message overnight.
Rovio confirmed to the Finnish press that its website had been meddled with to display a message saying “Spying Birds” with one of their iconic Angry Birds bearing an NSA logo on its forehead.
However, at this stage it’s not clear if Rovio’s web servers were compromised or if the hacker managed to hijack the firm’s DNS records and send visiting computers to a third party site carrying the image instead.
Whatever the details of how the hack was perpetrated, it appears to have only been present for a few minutes and the company made its website unavailable for 90 minutes while it confirmed that its systems were now secured.
According to a tweet by the Syrian Electronic Army, the attack was conducted by a hacker calling themselves “Anti-NSA hacker”.
What is clear, however, is that hackers were almost certainly motivated by news reports this week that the NSA and the UK’s GCHQ were exploiting Angry Birds and other smartphone apps to help them collect user data.
The revelations, detailed in documents leaked by NSA whistleblower Edward Snowden, explain that popular apps which are monetised through advertising networks stream personal information to target in-app ads more reliably, but can also leak personal information that can be snapped up by intelligence agencies.
Rovio has issued a statement to the press, denying it voluntarily shares any user information with surveillance agencies, and saying it will re-evaluate how it works with third party advertising networks.
As I’ve mentioned before, there certainly is a problem with some smartphone apps transferring sensitive information (such as GPS location, address books and phone numbers) in an insecure way.
Clearly more app developers need to work harder to ensure that any information which ekes out of their apps is properly encrypted and sent over a secure SSL connection.
Whilst I do not approve of the NSA spying, it is not the fault of the developers, it would be like anyone using Angry birds to siphon data from DNS poisning on access points and breaking and modifying dns servers of big ISP's. They should not be caught in the cross fire of this, it should all be aimed at the source via legitimate means.