Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/5/2010
10:22 AM
Gadi Evron
Gadi Evron
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Turkish Hackers Defacing Israeli Facebook Accounts

Following the Gaza flotilla incident, Turkish hackers have been defacing Facebook accounts of Israelis and uploading anti-Israeli material to them.

Following the Gaza flotilla incident, Turkish hackers have been defacing Facebook accounts of Israelis and uploading anti-Israeli material to them.This is the first incident (I know of) where activism on Facebook has taken the next step to hacktivism, breaking the law by hacking accounts to spread propaganda.

I doubt the apparently Turkish hackers broke into these accounts for the specific purpose of anti-Israeli defacement. The more likely scenario is they stole the account credentials by either phishing attack on Facebook (and, indeed, there was an Hebrew phishing attack on Facebook just last month) or by gathering the credentials of Israelis logging into Facebook by use of Trojan horses, such as those used for stealing bank login credentials.

Thus they are likely to already have had the user data ready for use in criminal activity, and then simply used it in this latest act of hacktivism.

Much like in the Estonian incident, in which the Russian-speaking population got engaged in attacking Estonia, those who know more on attacking computers, and those who already had resources to attack with (such as botnets) due to their existent illegal activities (such as spam), then joined the "party" and attacked, only using these more sophisticated tools rather than what the rest of the population was doing.

As researched in my soon-to-be-published paper with Dr. Robert Cialdini and Dr. Rosanna Guadagno about how the online Russian population was manipulated to attack Estonia -- whether on purpose or as an ad-hoc response to events -- the hackers in this case followed the social proof of so many people being active online, and spreading as a meme (social contagion) as a cue, and as new social norms emerged jumped on the bandwagon and launched their more sophisticated attacks.

This attack is special because it is the first active attack of Facebook accounts for the purpose of propaganda (that I know of), but it is in no way technologically innovative or shocking in concept.

Whenever there are political, ethnic, or religious tensions, the online aftermath follows in short order.

Then if the other side in this conflict has not yet attacked (whichever it may be), it gets upset by the attacks and responds in kind.

Truths to be remembered:

1. The sites attacked (or, in this case, Facebook accounts) on both sides are in the vast majority of cases not affiliated with the country in question and are, in fact, likely to be Jim's Shoes or Mumma's Orphanage.

2. This is because these are targets of opportunity found in bulk via Google search for sites in that country or by certain keywords.

3. The country in question is in the vast majority of cases not related in any fashion whatsoever to these actions taken by citizens.

4. Reciprocal attacks always happen until attacks on both sides subside a few day to weeks later.

Facebook is where many of us spend less-than-quality time with our friends these days, so that activism, as well as criminal activity in hacktivism, are likely to continue.

Follow Gadi Evron on Twitter: http://twitter.com/gadievron.

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading. Gadi is CEO and founder of Cymmetria, a cyber deception startup and chairman of the Israeli CERT. Previously, he was vice president of cybersecurity strategy for Kaspersky Lab and led PwC's Cyber Security Center of Excellence, located in Israel. He is widely recognized for ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
5 Ways to Up Your Threat Management Game
Wayne Reynolds, Advisory CISO, Kudelski Security,  2/26/2020
Google Adds More Security Features Via Chronicle Division
Robert Lemos, Contributing Writer,  2/25/2020
Cybersecurity Industry: It's Time to Stop the Victim Blame Game
Jessica Smith, Senior Vice President, The Crypsis Group,  2/25/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9463
PUBLISHED: 2020-02-28
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internal.php?object=centreon_configuration_remote request.
CVE-2020-5247
PUBLISHED: 2020-02-28
In Puma (RubyGem) before 4.3.2 and 3.12.2, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This...
CVE-2020-9447
PUBLISHED: 2020-02-28
The file-upload feature in GwtUpload 1.0.3 allows XSS via a crafted filename.
CVE-2019-10064
PUBLISHED: 2020-02-28
hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.
CVE-2019-8741
PUBLISHED: 2020-02-28
A denial of service issue was addressed with improved input validation.