<http://schema.org/articleBody>
"Earlier this week, the Facebook and Twitter accounts of social media content manager SocialFlow \u2014 along with those from other companies such as The New York Post \u2014 were subject to a major phishing attack by hacker group Syrian Electronic Army. As a part of an effort to spread awareness, SocialFlow outlined what happened and how it fell short of keeping the platform fully protected.\nSocialFlow, whose customers include Pepsi and publishers such as The Economist, noted in a blog post that although user accounts are safe and no data has been compromised, its Twitter handle, Facebook page and website were the targets of a major phishing attack. Several false posts were made from its social pages.\nSEE ALSO: Is Your Mobile Device Safe From Hackers?\n\n\"A number of employees received a phishing email, and that put us on alert,\" SocialFlow CEO Jim Anderson wrote in the post. \"'Beware of the phishing email' word went around the office, and our security was put on alert. Unfortunately, an employee working outside the office clicked on the link and entered an email address and password. That person had publishing access to our Twitter account, Facebook account, and website.\"\nAn email from what seemed like a known sender was sent to employees with the title \"Article\" and a link that appeared to go to a popular news site. \n\"It was clever because the subdirectory even went to /2013/08/13/tech/social/index.html,\" Anderson continued. \"That directory structure looks very clearly like an article that we would share among our staff. Of course the known sender didn\u2019t really send the email \u2014 the reply address was forged, which is a pretty easy trick.\"\n\nInstead of directing readers to the site, an email authentication dialog box appeared. \n\"It was very cleverly constructed to look like the login screen of our email provider, and it\u2019s easy to see how an employee who was slightly distracted could have concluded that email needed to be re-authenticated,\" Anderson said.\nSince the staffer had access to the company's Twitter and Facebook accounts, the phishers received the access that allowed them to post stories and change passwords. \nIn response, Anderson said SocialFlow \"implemented our security protocols\" to help regain control of its social pages. \"Since our blog posting engine and associated RSS feeds, are tied to our website, we temporarily took it down to make sure that route didn't allow the attack to spread further,\" he added.\nSocialFlow called clients to inform them about the breach and explain why they couldn't publish content via the platform during that time. However, it fell short of encouraging staffers to use two-step authentication to double-lock their accounts and ward off hackers.\n\"Here is where I must confess to being a bit red-faced,\" Anderson said. \"Despite our efforts to get all of our employees to use two-factor authentication for our corporate email system, we had some employees for whom that had not yet been turned on. When intruders are probing for vulnerabilities, it only takes one breached account to create a compromise \u2026 And needless to say, we now have 100% employee compliance on this.\"\nAlthough the attack lasted only about 15 to 20 minutes, it took a bit longer to restore its social pages and get back up and running.\n\"The whole experience, start to finish, was perhaps 2 to 3 hours,\" Anderson said. \"The cleanup, restart of the website and communications both inside the company and with our customers continued for several hours after that. And of course we\u2019ll do post-mortems on the whole experience for some time to come.\"\nSocialFlow decided to detail the chain of events to help inform other publishers about account protection moving forward.\n\"Social media tools and processes are going to need to mature and 'harden' as social media activity becomes a more central part of what publishers and brands do on a daily basis,\" Anderson said. \"We hope that by sharing this information we\u2019re making a contribution in that regard.\"\nMashable composite: iStockphoto, aetb and SocialFlow"^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2013/08/14/socialflow-hacked/>