Inside Cyber Warfare - Jeffrey Carr [15]
The Gaza Cyber War between Israeli and Arabic Hackers during Operation Cast Lead
Attacking Israeli websites has been a popular way for Palestinians and their supporters to voice their protests and hurt their adversaries. Arab and Muslim hackers mobilized to attack Danish and Dutch websites in 2006 during the Prophet cartoon controversy. A small-scale “cyber war” also erupted between Shiite and Sunni Muslims in the fall of 2008, as predominantly Arab Sunni Muslims and Iranian Shiite Muslims worked to deface or disrupt websites associated with one another’s sects.
The latest example of this occurred when Israel began a military assault on Hamas’s infrastructure in Gaza on December 27, 2008, called Operation Cast Lead. After almost a month into the operation, Palestinian officials declared the death toll had topped 1,000, and media reports carried images of massive property destruction and civilian casualties. This provoked outrage in the Arab and Muslim communities, which manifested itself in a spike of anti-Semitic incidents around the world, calls for violent attacks on Jewish interests worldwide, and cyber attacks on Israeli websites.
The exact number of Israeli or other websites that have been disrupted by hackers is unknown, but the number is well into the thousands. According to one estimate, the number reached 10,000 by the first week of January 2009 alone. Most attacks are simple website defacements, whereby hackers infiltrate the site, leaving behind their own graffiti throughout the site or on the home page. The hackers’ graffiti usually contains messages of protest against the violence in Gaza, as well as information about the hackers, such as their handles and country of origin. The majority of cyber attacks launched in protest of Operation Cast Lead were website defacements. There is no data to indicate more sophisticated or dangerous kinds of cyber attacks, such as those that could cause physical harm or injury to people.
Impact
While media coverage focuses on the most high-profile hacks or defacements, this current cyber campaign is a “war of a thousand cuts,” with the cumulative impact on thousands of small businesses, vanity websites, and individual websites likely outweighing the impact of more publicized, larger exploits.
However, successfully compromising higher-profile websites not only brings more public attention, it also compels businesses all over Israel to preventively tighten security, which costs money. For that reason, the financial impact of infiltrating a few larger corporate websites may be as important as disrupting thousands of smaller sites.
High-profile attacks or defacements between December 27, 2008, and February 15, 2009, include:
Ynetnews.com
The English language portal of one of Israel’s largest newspapers. The Morocco-based “Team Evil” accessed a domain registrar called DomainTheNet in New York and redirected traffic from Ynetnews and other Israeli websites. Traffic was redirected to a site with a protest message in jumbled English. Ynetnews.com emphasized that its site had not actually been “hacked,” but that Team Evil obtained a password allowing them to access a server. The Team then changed the IP addresses for different domain names, sending users attempting to access Ynetnews.com to a domain containing their message.
The website of Discount Bank, one of the three largest banks in Israel, was also registered with DomainTheNet, and Team Evil switched its IP address just as they did with Ynetnews.
Israel’s Cargo Airlines Ltd.
An Israeli airline defaced by hackers.
Kadima.org.il
The website of Israel’s Kadima party was defaced twice during this period.
DZ team, based in Algeria, was responsible for the first defacement, in which they adorned