January 6th, 2009
Thousands of Israeli web sites under attack
In the wake of the escalating conflict between Israel and Hamas, it didn’t take long before pro-Hamas supporters organized themselves and started to defacing thousands of pro-Israeli web sites in order to use them as vehicles for propaganda — Israel is meanwhile hijacking TV signals.
For the time being, pro-Israeli sites remain automatically probed for web application vulnerabilities through search engines reconnaissance of the Israeli web space by JURM-TEAM and TEAM-Evil, two groups working together and using identical templates for the defaced sites.
Compared to previous hacktivism (politically motivated hacking) activities on behalf of this group consisting primarily of mass web site defacements through web applications vulnerabilities exploitation, last week TEAM-Evil managed to hijack the DNS records of several hundred Israeli domains — traffic was redirected to bestsecurity.jp — once compromising the administration panel of the domain registrar DomainTheNet.
- (Go through some of the notable DNS hijackings throughout 2008 - Comcast.net’s DNS hijacking; Photobucket.com’s DNS hijacking; ICANN and IANA’s DNS hijacking)
Members of Team-Evil are no strangers to Israel. The group has been periodically attacking pro-Israeli web sites since 2006. Who are Team-Evil anyway?
Originally started as a Moroccan-based hacking group of Muslim hackers, today thanks to the group’s popularity, they’ve managed to not only recruit more hackers/script kiddies, but also, gain the support of other Muslim hacking groups. The group’s efficient way of exploiting Israeli and pro-Israeli web sites through commodity web site defacement tools scanning and exploiting known web application vulnerabilities reached such a peak, that a 17 years old member of Team-Evil got busted. In the ongoing web site defacement attacks, several other well known Muslim hacking groups appear to be working directly cooperating with Team-Evil, such as:
- JURM-TEAM - members include sql_master, Jurm, Dr.Noursoft, RedDoom, Lpooxd, Cyb3rt and Dr.win
- Islamic Cr3w - members include Twister and AlH7N00TY
- TEAM SPECIAL AGENT - members include PrOf-HaCkEr,Black^Monster, FREEM@N, and R00t-Os
- Team-Evil themselves - members include Jurm, Cyber-terrorist, J3ibi9a, Scritpx, Fatna Bant Hmida
It’s important to point out that the massive web site defacements taking place are not rocket science, they are the low-hanging fruit made possible for them to abuse due to insecurely configured web servers. Interestingly, according to one of the messages left on the defaced sites, a separate campaign is launched by the Hamas supporters in response to June, 2008’s defacement done by Israeli hackers of the arabs48.com portal.
- (Go through related hacktivism attacks - Hundreds of Dutch web sites hacked by Islamic hackers; Pro-Serbian hacktivists attacking Albanian web sites; 300 Lithuanian sites hacked by Russian hackers)
Having monitored the demise of international cyber jihadist hacking teams (Osama Bin Laden’s Hacking Crew, Ansar AL-Jihad Hackers Team, HaCKErS aLAnSaR) attacking primarily Western sites, in comparison Israel, Palestine and their supporters are not going to give up that easily the propaganda capabilities that they’ve building since 2001 by means of web site defacements.
Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response. He's been an active security blogger since 2007, and maintains a popular security blog. See his full profile and disclosure of his industry affiliations.
Subscribe to Zero Day via Email alerts or RSS.
