Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/5/2010
10:22 AM
Gadi Evron
Gadi Evron
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Turkish Hackers Defacing Israeli Facebook Accounts

Following the Gaza flotilla incident, Turkish hackers have been defacing Facebook accounts of Israelis and uploading anti-Israeli material to them.

Following the Gaza flotilla incident, Turkish hackers have been defacing Facebook accounts of Israelis and uploading anti-Israeli material to them.This is the first incident (I know of) where activism on Facebook has taken the next step to hacktivism, breaking the law by hacking accounts to spread propaganda.

I doubt the apparently Turkish hackers broke into these accounts for the specific purpose of anti-Israeli defacement. The more likely scenario is they stole the account credentials by either phishing attack on Facebook (and, indeed, there was an Hebrew phishing attack on Facebook just last month) or by gathering the credentials of Israelis logging into Facebook by use of Trojan horses, such as those used for stealing bank login credentials.

Thus they are likely to already have had the user data ready for use in criminal activity, and then simply used it in this latest act of hacktivism.

Much like in the Estonian incident, in which the Russian-speaking population got engaged in attacking Estonia, those who know more on attacking computers, and those who already had resources to attack with (such as botnets) due to their existent illegal activities (such as spam), then joined the "party" and attacked, only using these more sophisticated tools rather than what the rest of the population was doing.

As researched in my soon-to-be-published paper with Dr. Robert Cialdini and Dr. Rosanna Guadagno about how the online Russian population was manipulated to attack Estonia -- whether on purpose or as an ad-hoc response to events -- the hackers in this case followed the social proof of so many people being active online, and spreading as a meme (social contagion) as a cue, and as new social norms emerged jumped on the bandwagon and launched their more sophisticated attacks.

This attack is special because it is the first active attack of Facebook accounts for the purpose of propaganda (that I know of), but it is in no way technologically innovative or shocking in concept.

Whenever there are political, ethnic, or religious tensions, the online aftermath follows in short order.

Then if the other side in this conflict has not yet attacked (whichever it may be), it gets upset by the attacks and responds in kind.

Truths to be remembered:

1. The sites attacked (or, in this case, Facebook accounts) on both sides are in the vast majority of cases not affiliated with the country in question and are, in fact, likely to be Jim's Shoes or Mumma's Orphanage.

2. This is because these are targets of opportunity found in bulk via Google search for sites in that country or by certain keywords.

3. The country in question is in the vast majority of cases not related in any fashion whatsoever to these actions taken by citizens.

4. Reciprocal attacks always happen until attacks on both sides subside a few day to weeks later.

Facebook is where many of us spend less-than-quality time with our friends these days, so that activism, as well as criminal activity in hacktivism, are likely to continue.

Follow Gadi Evron on Twitter: http://twitter.com/gadievron.

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading. Gadi is CEO and founder of Cymmetria, a cyber deception startup and chairman of the Israeli CERT. Previously, he was vice president of cybersecurity strategy for Kaspersky Lab and led PwC's Cyber Security Center of Excellence, located in Israel. He is widely recognized for ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5226
PUBLISHED: 2020-01-24
Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapp...
CVE-2019-1517
PUBLISHED: 2020-01-24
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE-2019-1518
PUBLISHED: 2020-01-24
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE-2019-1519
PUBLISHED: 2020-01-24
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE-2019-1520
PUBLISHED: 2020-01-24
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.