Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/5/2010
10:22 AM
Gadi Evron
Gadi Evron
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Turkish Hackers Defacing Israeli Facebook Accounts

Following the Gaza flotilla incident, Turkish hackers have been defacing Facebook accounts of Israelis and uploading anti-Israeli material to them.

Following the Gaza flotilla incident, Turkish hackers have been defacing Facebook accounts of Israelis and uploading anti-Israeli material to them.This is the first incident (I know of) where activism on Facebook has taken the next step to hacktivism, breaking the law by hacking accounts to spread propaganda.

I doubt the apparently Turkish hackers broke into these accounts for the specific purpose of anti-Israeli defacement. The more likely scenario is they stole the account credentials by either phishing attack on Facebook (and, indeed, there was an Hebrew phishing attack on Facebook just last month) or by gathering the credentials of Israelis logging into Facebook by use of Trojan horses, such as those used for stealing bank login credentials.

Thus they are likely to already have had the user data ready for use in criminal activity, and then simply used it in this latest act of hacktivism.

Much like in the Estonian incident, in which the Russian-speaking population got engaged in attacking Estonia, those who know more on attacking computers, and those who already had resources to attack with (such as botnets) due to their existent illegal activities (such as spam), then joined the "party" and attacked, only using these more sophisticated tools rather than what the rest of the population was doing.

As researched in my soon-to-be-published paper with Dr. Robert Cialdini and Dr. Rosanna Guadagno about how the online Russian population was manipulated to attack Estonia -- whether on purpose or as an ad-hoc response to events -- the hackers in this case followed the social proof of so many people being active online, and spreading as a meme (social contagion) as a cue, and as new social norms emerged jumped on the bandwagon and launched their more sophisticated attacks.

This attack is special because it is the first active attack of Facebook accounts for the purpose of propaganda (that I know of), but it is in no way technologically innovative or shocking in concept.

Whenever there are political, ethnic, or religious tensions, the online aftermath follows in short order.

Then if the other side in this conflict has not yet attacked (whichever it may be), it gets upset by the attacks and responds in kind.

Truths to be remembered:

1. The sites attacked (or, in this case, Facebook accounts) on both sides are in the vast majority of cases not affiliated with the country in question and are, in fact, likely to be Jim's Shoes or Mumma's Orphanage.

2. This is because these are targets of opportunity found in bulk via Google search for sites in that country or by certain keywords.

3. The country in question is in the vast majority of cases not related in any fashion whatsoever to these actions taken by citizens.

4. Reciprocal attacks always happen until attacks on both sides subside a few day to weeks later.

Facebook is where many of us spend less-than-quality time with our friends these days, so that activism, as well as criminal activity in hacktivism, are likely to continue.

Follow Gadi Evron on Twitter: http://twitter.com/gadievron.

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading. Gadi is CEO and founder of Cymmetria, a cyber deception startup and chairman of the Israeli CERT. Previously, he was vice president of cybersecurity strategy for Kaspersky Lab and led PwC's Cyber Security Center of Excellence, located in Israel. He is widely recognized for ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11949
PUBLISHED: 2020-05-28
testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.
CVE-2020-11950
PUBLISHED: 2020-05-28
VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with resultant execution of OS commands). For example, this affects IT9388-HT devices.
CVE-2020-13645
PUBLISHED: 2020-05-28
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verificat...
CVE-2020-13643
PUBLISHED: 2020-05-28
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be e...
CVE-2020-13644
PUBLISHED: 2020-05-28
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accord...