The wheels come off Formula 1's notification service as fans plied with attacker's messages
(2021/07/05)
- Reference: 1625515266
- News link: https://www.theregister.co.uk/2021/07/05/f1_notification_attack/
- Source link:
The world of Formula 1 racing was livened up over the weekend as the sport's official app sent out some unexpected notifications on the eve of the Austrian Grand Prix.
The first simply said "foo" and was followed by another saying "Hmmmm, I should check my security.. :)"
Users of both Android and iOS versions of the app received the notifications instead of the usual pings proclaiming the greatness of the sport in which a result is sometimes decided by a mechanic dropping a clanger in the pitstop department.
[1]
Credit: 'mr0c'
The Register contacted F1 to find out what had befallen the push notification service used by its app, but the tarmac-and-tyre fans have yet to respond. Sporting publication ESPN [2]reported a statement attributed to F1, which said: "Our investigation confirms that this targeted attack was limited to the Push Notifications Service.
"We will continue to investigate, review and improve safety measures but, at this time, have no reason to believe that any customer data has been accessed during this incident."
[3]Post-lunch snooze plans dashed as the UK tests its Emergency Alerts... again
[4]Rude awakening for O2 customers after network runs surprise test of emergency mobile alert system
[5]Hawaii governor: I wanted to tell everyone nuke alert was fake – I just forgot my password
[6]Whoa, someone actually texted you in 2020? Oh, nvm, it's just Boris Johnson, telling you to stay the f**k at home
App notifications have proved a problem for some of the higher – and lower – profile services of late, although mainly through self-inflicted borkage. A developer for insurer Cuvva [7]inadvertently sent a "cautionary tale" notification out to the company's customers while video slinger HBO Max infamously sent out an " [8]Integration Test Email " notification last month.
In this case, however, F1 (or the service it uses for its app) appears to have been the victim of miscreants prodding the outfit's defences (which could be anything from a vulnerable service to a thoughtlessly secured PC.)
[9]
Having made developer favourite "foo" appear, the subsequent message can only be described as a missed opportunity. A promise to make the rest of the season free to air would have caused a proper kerfuffle. Or perhaps the announcement that Nigel Mansell or Nelson Piquet were once again on pole.
[10]
Foo, indeed. ®
Get our [11]Tech Resources
[1] https://regmedia.co.uk/2021/07/05/f1.jpg
[2] https://www.espn.co.uk/f1/story/_/id/31759854/f1-confirms-targeted-attack-led-app-hack
[3] https://www.theregister.com/2021/06/22/uk_emergency_alerts_test/
[4] https://www.theregister.com/2021/05/11/o2_emergency_alert/
[5] https://www.theregister.com/2018/01/24/hawaii_governor_forgot_twitter_password_nuclear_attack/
[6] https://www.theregister.com/2020/03/24/uk_coronavirus_advice_texts/
[7] https://www.theregister.com/2021/06/09/who_me/
[8] https://twitter.com/ch4mbr4s/status/1405710016020193280
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YOOBAFzHEOu-ErunMzxkIgAAAEs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YOOBAFzHEOu-ErunMzxkIgAAAEs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
The first simply said "foo" and was followed by another saying "Hmmmm, I should check my security.. :)"
Users of both Android and iOS versions of the app received the notifications instead of the usual pings proclaiming the greatness of the sport in which a result is sometimes decided by a mechanic dropping a clanger in the pitstop department.
[1]
Credit: 'mr0c'
The Register contacted F1 to find out what had befallen the push notification service used by its app, but the tarmac-and-tyre fans have yet to respond. Sporting publication ESPN [2]reported a statement attributed to F1, which said: "Our investigation confirms that this targeted attack was limited to the Push Notifications Service.
"We will continue to investigate, review and improve safety measures but, at this time, have no reason to believe that any customer data has been accessed during this incident."
[3]Post-lunch snooze plans dashed as the UK tests its Emergency Alerts... again
[4]Rude awakening for O2 customers after network runs surprise test of emergency mobile alert system
[5]Hawaii governor: I wanted to tell everyone nuke alert was fake – I just forgot my password
[6]Whoa, someone actually texted you in 2020? Oh, nvm, it's just Boris Johnson, telling you to stay the f**k at home
App notifications have proved a problem for some of the higher – and lower – profile services of late, although mainly through self-inflicted borkage. A developer for insurer Cuvva [7]inadvertently sent a "cautionary tale" notification out to the company's customers while video slinger HBO Max infamously sent out an " [8]Integration Test Email " notification last month.
In this case, however, F1 (or the service it uses for its app) appears to have been the victim of miscreants prodding the outfit's defences (which could be anything from a vulnerable service to a thoughtlessly secured PC.)
[9]
Having made developer favourite "foo" appear, the subsequent message can only be described as a missed opportunity. A promise to make the rest of the season free to air would have caused a proper kerfuffle. Or perhaps the announcement that Nigel Mansell or Nelson Piquet were once again on pole.
[10]
Foo, indeed. ®
Get our [11]Tech Resources
[1] https://regmedia.co.uk/2021/07/05/f1.jpg
[2] https://www.espn.co.uk/f1/story/_/id/31759854/f1-confirms-targeted-attack-led-app-hack
[3] https://www.theregister.com/2021/06/22/uk_emergency_alerts_test/
[4] https://www.theregister.com/2021/05/11/o2_emergency_alert/
[5] https://www.theregister.com/2018/01/24/hawaii_governor_forgot_twitter_password_nuclear_attack/
[6] https://www.theregister.com/2020/03/24/uk_coronavirus_advice_texts/
[7] https://www.theregister.com/2021/06/09/who_me/
[8] https://twitter.com/ch4mbr4s/status/1405710016020193280
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YOOBAFzHEOu-ErunMzxkIgAAAEs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YOOBAFzHEOu-ErunMzxkIgAAAEs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
Given the opportunity, what would you have said?
Red Ted
If you were the originator of the “foo” comment, what would you have put out instead?
I quite like the idea of contrasting the old and the new… “John Surtees was better than Lewis Hamilton because he did it on two wheels as well as four” or “Given a modern car, Fangio would win”.
Suggestions on a postcard to the usual address.
I got this on two devices, both with push notifications off. Expected the first "foo" to be followed by "bar" and then "baz".