Hello, World!
As a result of the conflict between Hamas and Israel, a cyber war has begun in the Middle
East.
Over the past week, hacktivist groups around the world have taken sides, and launched a
whole array of operations.
To start with, the Pro Palestine group ‘AnonGhost’ hacked an App that many Israelis use to provide
real time alerts for Hamas rocket fire into civilian areas.
AnonGhost discovered an API vulnerability in the App, which they exploited to send false
rocket alerts, with customised messages . Some of which actually warned of incoming nuclear
bombs.
The group published proof of concept python code, making it easy for their legion of followers
to join in and send false alerts to the app’s 100 thousand plus users.
Following the mayhem, the app was taken off the Play Store.
The Russian hacktivist collective KillNet, which spawned following Russia’s invasion
of Ukraine - blamed the Government of Israel for the recent bloodshed, pointing out that
in 2022 Israel betrayed Russia by supporting Ukraine - which seems to be the main reason
for them pledging their support to the Palestinians, and unleashing DDoS attacks against various
Israeli government websites.
The hacktivist group Anonymous Sudan - took a similar stance, attacking the website of
the Jerusalem Post, claiming that they had deleted all their articles.
Though this just seems to have just been a DDoS attack as 24 hours later it was all back
up.
However, in a potentially much more dangerous operation operation Anonymous Sudan teamed
up with a group called SiegedSec to launch attacks on Israeli industrial control systems…
these things are typically used in manufacturing plants, power stations and water treatment
facilities - so messing with them is a lot more dangerous than just DDoSing some government
website.
In particular Anonymous Sudan claims to have targeted GPS systems.
Building Automation and Control Networks - which governs things like air conditioning, lighting,
and access to electronic door locks.
And they targeted ‘Modbus Industrial Control Systems’, which are often used to monitor
sensors in factories and control equipment - however it’s unclear to what extent these
attacks were successful - if at all, and what kind of facilities were even targeted.
In other news, a newly spawned group - ‘Cyber Avengers’ claims to have hacked Israel’s
second largest power station, ‘DORAD’, they released a bunch of internal documents,
including schematics - but there’s no indication that they have the ability to mess with the
power station’s operation.
However the group also claims to have hacked Israel’s national water company, and released
a video proving that they have access to the CCTV systems of Israel’s water infrastructure,
with the title, ‘An eye for an eye’ - a reference to Israel’s siege on Gaza which
has included the shutting off their water supply.
The video ends with the words “the worst is yet to come”.
Now, in normal times a hack of CCTV systems isn’t a big deal, but in the context of
a war - CCTV access would obviously be incredibly useful to an adversary if they were planning
on attacking the facility.
Whilst most of the hacktivist groups involved in the conflict have taken the Palestinian
side, some have sided with the Israelis.
The Indian cyber force is one of those, these guys recently made headlines for DDoSing Canadian
military websites following the fallout between Canada and India over the alleged assassination
of a political dissident on Canadian soil.
But the Indian cyber force has since pivoted to supporting Israel and claims to have DDoS’d
the official Hamas website, as well as several other Palestinian government services.
A different hacktivist group, going by ‘ThreatSec’ attacked a Palestinian ISP, claiming to have
shut down “literally every server owned by Alfanet” - one of the biggest ISPs in
the Gaza strip.
This was quite a surprise because the group has previously allied themselves with hacktivists
known to be anti Israel and pro Palestine.
And so ‘ThreatSec’ received quite a from their followers, forcing them to clarify their
position, saying they actually dislike both parties in the war, so as a result they’re
now targeting both Gaza and Israel.
Just a few days before the conflict in the Middle East kicked off - the Red Cros published
“8 rules for civilian hackers during war” - this was a kind of open letter to hacktivists
worldwide, an attempt to bridge the divide between hacktivists on all sides and set down
some basic ground rules that hopefully everyone could agree on - and spoiler alert - this
didn’t get a good reaction.
But before we get to that, the 8 rules were pretty much as you’d expect, in a nutshell
they prohibit directly targeting civilian or humanitarian systems, or conducting attacks
which might have an impact on those systems.
But the red cross quickly found out that hacktivists don’t like being told what to do.
With a representative of KillNet saying "Why should I listen to the Red Cross?”.
Anonymous Sudan said the new rules were "not viable and that breaking them for the group's
cause is unavoidable”.
And a pro-Ukrainian group Hydro’s response was to hack the Red Cross itself, defacing
the website of the Russian branch, claiming that the Red Cross doesn’t follow their
own rules.
This seems to be in reference to the Red Cross’s apparent involvement in the controversial
transfer of Ukrainian children to Belarus.
However the only hacktivist group I could find which publicly welcomed the rules was
the IT Army of Ukraine.
So that’s what’s been going on in the hacktivist world so far, if you want to stay
up to date with future developments make sure to hit that bell icon, and I’ll see you
in the next video, have a good one.