Hacked cyber-defense site may be source for recent text threats

The mystery of where Islamist hackers got phone numbers and email addresses to send threatening text and email messages grew Sunday, when it emerged that a database belonging to the IsraelDefense magazine and web site had been hacked over the weekend.

“It’s not clear if that database was the source of the phone numbers used in the SMS ‘attack,’ but there were no reports of other large database hacks over the weekend,” said Dr. Tal Pavel of security group Middle Eastern Net, and a lecturer at Netanya Academic College, “so it’s very possible that is the one they used.”

Ironically, that database may belong to IsraelDefense, an organization that just recently sponsored a major cyber-security event, touting Israel’s prowess in developing technology to defend against precisely the hack attacks aimed at databases containing personal information – like email addresses and phone numbers. Its site was hacked Saturday, and said it was investigating the hack attack.

The messages, sent in Hebrew and English from phone numbers in Israel and the Palestinian Authority, threatened “revenge, the account between us is not closed,” “a warning to the Zionists, the al-Qassam rockets are waiting for you,” and (in English) “Al-Qassam has chosen you to be the next Shalite (sic),” a reference to kidnapped IDF soldier Gilad Shalit.

Besides the text messages, an email from IsraelDefense received by many of the site’s subscribers threatened Israelis with “hell” if Gaza should be attacked. The messages contained pictures of former Hamas leader Sheikh Ahmed Yassin, with a message reading “This is a reminder to you that we will not forget the blood of our Sheikh. We vow again to take revenge, and this time to cut off the heads of your commanders.”

There were no reliable estimates on how many Israelis received the text and mail messages, said Pavel, but the number was likely in the tens of thousands.

Saturday was a day fraught with tension in Palestinian areas. The day marked the tenth anniversary of the death of Yassin, who encouraged suicide bombings against Israel. He was killed in an Israeli Air Force raid on March 22, 2004. Earlier Saturday, IDF forces operating in Jenin killed Abu al-Hija, a Hamas operative who officials said was organizing a major terror attack against Israelis.

Pavel said that it was possible that the text message and email operations were being run by different groups, with one commemorating Yassin’s death, and the other threatening revenge for the Jenin operation. “It could very well be an ‘unhappy coincidence,’ with Hamas or Islamic Jihad preparing in advance to send out the messages on the anniversary of Yassin’s death, with additional threats sent out over the Jenin operation.”

“We’ll probably never know if IsraelDefense’s database was the one they pulled the phone numbers from, but it’s certainly possible,” said Pavel. “Subscribers to the site, as well as those attending the Cybertech event they held, would most likely have given their phone numbers as part of the application process. If the hackers were able to get to the email addresses, they were probably able to get to the phone numbers as well. If IsraelDefense’s database of attendees to the Cybertech event was the source for this hack, I would say that was rather ironic.”