Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/5/2010
10:22 AM
Gadi Evron
Gadi Evron
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Turkish Hackers Defacing Israeli Facebook Accounts

Following the Gaza flotilla incident, Turkish hackers have been defacing Facebook accounts of Israelis and uploading anti-Israeli material to them.

Following the Gaza flotilla incident, Turkish hackers have been defacing Facebook accounts of Israelis and uploading anti-Israeli material to them.This is the first incident (I know of) where activism on Facebook has taken the next step to hacktivism, breaking the law by hacking accounts to spread propaganda.

I doubt the apparently Turkish hackers broke into these accounts for the specific purpose of anti-Israeli defacement. The more likely scenario is they stole the account credentials by either phishing attack on Facebook (and, indeed, there was an Hebrew phishing attack on Facebook just last month) or by gathering the credentials of Israelis logging into Facebook by use of Trojan horses, such as those used for stealing bank login credentials.

Thus they are likely to already have had the user data ready for use in criminal activity, and then simply used it in this latest act of hacktivism.

Much like in the Estonian incident, in which the Russian-speaking population got engaged in attacking Estonia, those who know more on attacking computers, and those who already had resources to attack with (such as botnets) due to their existent illegal activities (such as spam), then joined the "party" and attacked, only using these more sophisticated tools rather than what the rest of the population was doing.

As researched in my soon-to-be-published paper with Dr. Robert Cialdini and Dr. Rosanna Guadagno about how the online Russian population was manipulated to attack Estonia -- whether on purpose or as an ad-hoc response to events -- the hackers in this case followed the social proof of so many people being active online, and spreading as a meme (social contagion) as a cue, and as new social norms emerged jumped on the bandwagon and launched their more sophisticated attacks.

This attack is special because it is the first active attack of Facebook accounts for the purpose of propaganda (that I know of), but it is in no way technologically innovative or shocking in concept.

Whenever there are political, ethnic, or religious tensions, the online aftermath follows in short order.

Then if the other side in this conflict has not yet attacked (whichever it may be), it gets upset by the attacks and responds in kind.

Truths to be remembered:

1. The sites attacked (or, in this case, Facebook accounts) on both sides are in the vast majority of cases not affiliated with the country in question and are, in fact, likely to be Jim's Shoes or Mumma's Orphanage.

2. This is because these are targets of opportunity found in bulk via Google search for sites in that country or by certain keywords.

3. The country in question is in the vast majority of cases not related in any fashion whatsoever to these actions taken by citizens.

4. Reciprocal attacks always happen until attacks on both sides subside a few day to weeks later.

Facebook is where many of us spend less-than-quality time with our friends these days, so that activism, as well as criminal activity in hacktivism, are likely to continue.

Follow Gadi Evron on Twitter: http://twitter.com/gadievron.

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading. Gadi is CEO and founder of Cymmetria, a cyber deception startup and chairman of the Israeli CERT. Previously, he was vice president of cybersecurity strategy for Kaspersky Lab and led PwC's Cyber Security Center of Excellence, located in Israel. He is widely recognized for ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.