Hack attack: No borders for Arab computer vandals

Neither cold of winter nor heat of summer can stop dedicated hackers from their rounds, defacing and destroying websites. But who are these people: Are they pimply-faced kids looking for fun? Are they government-sponsored cadres waging a cyber-war against their country’s enemies? Are they sincere activists using the web to spread political ideas? Sometimes, the message is the medium, especially when it comes to Israel.

Whatever their intention, most of today’s hackers have an agenda to share with their captive audiences — Internet users who visit a site expecting one type of experience but get a very different one. And just as Internet users have gotten used to the idea of rich websites with video, audio, photos and more, hackers, whether they work for fun or politics, have also begun using sophisticated video- and special effect-laden content to get their message out.

Israeli sites are high on the agenda of the masses of hackers. Surprisingly, many are still vulnerable to some very basic hacker scripts that have been around for years, a fact that allows a hacker who calls himself Sejeal to hijack over 1,000 sites in one day (!), replacing them with “a memorial to Gaza martyrs.” Even though Sejeal’s message seems aimed at Israelis, nearly all the sites he hacked on January 1 (as recorded by the Zone-h hacker archive site) were in Europe, mostly Italy.

Each hacker has his or her own message, with some crafting very clear and specific messages to the audiences for the sites they hack and others distributing general messages, not necessarily political in nature. And some leave nothing on a hacked site except for their signature.

Lots of the hackers who target Israeli websites are Arab, Turkish, and Iranian; Zone-h (which records many, but by no means all, of the world’s hacked sites daily) lists hundreds of individuals and groups with names derived from Arabic, Turkish, and Persian (“Abdul Hamidan,” “Pashe Kosh,” etc.). Some hacker groups, like the Gaza Hacker Team, specifically target Israeli sites but others simply search randomly for vulnerabilities. Usually, the more specific the targeting, the more vitriolic the message.

Sejeal’s anti-Israel message is relatively calm compared to some of the other messages placed by hackers on Israeli sites – like the ones posted by the “3Qrab Almoseam” team – which threatens (in Hebrew, English, and Arabic) that Israelis will “be taken as beasts to the slaughter,” with a video of Kassam rockets striking Israeli homes in Sderot. Martial music in Arabic plays in the background with lyrics declaring undying loyalty to the jihad, or holy war.

Most anti-Israel hackers prefer to mix their diatribes against Israel with images of the suffering of Gazans. The Gaza Hacker Team, which targets Israeli sites exclusively, features a video of an Arab rapper singing about the suffering of Gazans with background video of IDF bombings of sites in Gaza. Also targeting Israel alone, and mixing violent messages with video and photos of Gazans running from Israeli attacks, is CapoO_TunisiAnoO, a team that may or may not operate out of Tunisia (often the country affiliation given by hackers is inaccurate, part of their attempt to cover their tracks).

3Qrab Almoseam, Gaza Hacker Team, and CapoO_TunisiAnoO are the most political of the anti-Israel hackers, but there are many others. The difference is that they either don’t target Israel exclusively, or their messages aren’t specifically anti-Israel. For example, HTC 28 DZ hacks a lot of Israeli sites, but many of its recent messages encourage viewers to “respect the Prophet Mohammed,” the same message that shows up on the non-Israeli sites it hacks. Among Arab hackers, the theme of spreading Islamic messages seems to be the most popular one, with sites displaying Arabic passages from the Koran (usually with English translation), accompanied by Muslim religious chants and music.

During Operation Pillar of Defense, international hacker group Anonymous made headlines by threatening to “take down” Israel’s IT systems. Those attacks, however, were directed against heavily defended servers, and nearly all of them failed. Other hackers have successfully infiltrated databases and stolen credit card and other personal information on Israelis, although those attacks, too, are very limited in scope and success. The Arab hackers defacing pages are, on the other hand, usually very successful — because they generally attack websites of businesses and organizations that are not essential to the defense of the country or the functioning of the economy, and are not as well defended.

Israel is not the only Middle East country under hack attack; there are plenty of hackers targeting Egypt, Syria, Saudi Arabia, Iran, and other countries in the region. Many of the messages on the hacks on Egyptian and Syrian sites are political, condemning the regimes in those countries for abuses against their citizens. In Syria, Zone-h recorded dozens of hacks daily, most of them condemning Bashar Assad for his attacks against civilians in the civil war between his army and rebel forces. But those attacks leveled off in late November, when Syria announced it was “closing” the Internet in the country. The few hackers who have managed to upend sites since then have promised revenge on Assad for cutting off one of their main forms of protest.

Ironically, there are also many sites with the .ps suffix – the domain name for Palestine – that get hacked as well, with the same messages that show up on hacked Israeli sites. Viewers of those sites can see the same crying Gaza children and Kassam rocket launches, the same Israeli soldiers shooting at West Bank crowds, and the same Israeli civilians running for cover in Sderot that Israeli viewers of hacked sites see. What’s the point? Either it’s a subtle dig at the regime of Mahmoud Abbas for being too chummy with Israel, or the hackers just post whatever they have when they find a vulnerable site, without determining if the message is appropriate for the audience.

Iranian sites get hacked as much as Israeli sites do, probably because Iran, like Israel, is one of the more technologically advanced countries in the region. But the hackers are not necessarily Israeli — at least the Israeli hacker teams don’t seem to submit their work to Zone-h. Many of the hacks on Iranian sites say things like “we love Iran,” or “Iran forever.” One hacker, FTA_boy, who specializes in Iranian sites, writes in his hack message: “We Love Iran. Whoever the admin may be of this site, please get better security before someone serious gets into it.”

Also notable is how many Iranian sites (sites with the .ir suffix) are hosted on servers in the US, according to the Zone-h archive of hacked sites. A good plurality, if not majority, of Iranian sites are listed as being hosted in the US, which raises the question of how the US has not tried to ban this practice, considering the nearly total ban the US has on American companies doing business with Iran.

The lack of discrimination by hackers regarding which sites they attack has some interesting consequences — like the Palestinian site that praises radical Islam and Osama Bin Laden that got hacked by a group displaying a message promoting those same things. One Israeli site that got attacked in recent days, CDB – the Center for Deaf-Blind Persons – was the victim of Gaza Hacker Team, which placed its video/rapper package on the site. It was the first time the site had been hacked, said Debbie Toubi, a director of the site, and she believes that “these hackings were deliberately timed to prevent the usual end of the year donations.”

Unfortunately, if the hack did deliberately or inadvertently prevent the organization from getting money, it hurt not just deaf and blind Israelis, whom the Gaza Hacker Team presumably doesn’t care about, but also Arabs suffering from those conditions, because, Toubi said, “we operate a program for (Arab) young adults in the Abu Tor neighborhood of Jerusalem.”

Politics is one thing, but if hackers were really interested in doing “for the people,” they should think twice before launching an attack; you never know who you’re going to be hurting, said Toubi. “It pains me to think,” she added, “that while we were out there working for the good of all, they were hacking our website.”