What the hack: 7 things to know for May 21

1. Hack a shack: Israeli websites appear to be under assault of a coordinated hack attack, seemingly timed for Quds Day, which seems to be turning into something of a tradition.

• The hack appears to consist of websites being taken over by some unknown group with a threatening message. Videos and screenshots shared on social media show the phrase “Be ready for a big surprise” in Hebrew and English. The video appears to show explosions in Tel Aviv and a battered and bloodied Prime Minister Benjamin Netanyahu swimming away from a burning city.
• It’s unclear exactly how many sites have been hacked, with media outlets reporting between hundreds and thousands. It’s also unclear how many of the sites being attacked are actually significant or in widespread use.
• According to Channel 12 news, among the sites taken over are Bang & Olufsen electronics, the personal website of a photographer and the Yad L’Achim anti-assimilation organization.
• “Don’t click any links,” the top story on Channel 12 news’s website advises, before having readers click on a link to see what sites are affected.
• Hagit Ofer, the head of women’s rights organization Naamat, which is also hacked, tells Army Radio with a sense of humor, “Once the Iranians understood that the future female IDF soldiers would be integrated into elite units, they seemingly felt pressure and attacked Naamat before they meet the best of our girls in another setting. This won’t stop us.”

2. Hackers without borders: It’s not clear who in fact is behind the attack, though the Iranians, who have been the main driver behind Quds Day, appear to be a prime suspect.

• Haaretz reports that uPress, a firm that stores servers for some of Israel’s largest websites, blamed the hack on a security hole from those using the WordPress content management system exploited by a group called Hackers of Savior. “On the uPress Facebook page, it says the hackers are Iranian, though at this point there is no proof of that,” the paper reports.
• “No country or group has taken responsibility for the attacks, but there are estimations that these are Hamas or Iranian actors,” reports Channel 12 news.
• Israel Hayom blames it on “Iranian hackers” in its headline, going off the uPress statement.
• Walla’s headline appears to discount Iranian involvement, blaming it on “Arab” hackers. The “Arab” may be just sloppiness by the news site, though, since Turkey, which is not Arab, is mentioned in its story as one possible suspect.
• Lotem Finkelstein of Check Point tells Walla that the hacked sites all appear to use the same cloud-based service for security, and says “we see organization from hackers in the Muslim world (seemingly Turkey, North Africa and Gaza) to attack Israeli sites.”
• “Even though we are talking about a large number of sites, this is really small scale. My advice: Make sure the sites are secured with active and updated security packages and on the sites that ask users for access to the camera — avoid that.”

3. Purrsian hacking: The hack attack, which Israel’s Cyber Directorate had warned about in advance, comes against the background of what appears to be an growing official hacking war between Israel and Iran.

• In Haaretz, Yossi Melman writes that while Israel claimed an Iranian hack of its water system last month barely affected anything, in fact dozens of sites were attacked. Though the damage was indeed minimal, it may point to Iran’s growing capabilities.
• “In the Israeli security establishment and civilian bodies in charge of offensive and defensive cyberwarfare, there is debate as to Iran’s cyber capabilities. Some feel that Iran is not a major player in this arena, certainly when compared to Israel and cyber powerhouses like the United States, China, Russia and other Western countries. Others believe that even if Iran is not among the world cyber leaders, it is definitely enhancing its capabilities and as evidence, they cite the massive attack on computers and installations belonging to Saudi Arabian oil giant Aramco last year,” he writes.
• It’s not just Israel that Iran is going after. Atlantic Council Fellow Holly Dagres writes in the Washington Post that Iranian hackers attempted to get into her computer with a spear-phishing attack posing as an Israeli think tank.
• “In this instance, the hackers were relentless and sophisticated. They first impersonated a senior Israeli researcher with whom I had met and corresponded with in the past. In the fabricated correspondence, they provided a link for me to add my insights on the paper. When I didn’t respond, the hackers sent a second message impersonating the think tank’s external relations liaison (someone I also knew). That message even included a note in Hebrew from the ‘researcher’ asking the contact to follow-up with me. Still not receiving the desired response, they sent an additional message from the ‘researcher,’ this time including a conversation from the president of a prominent Washington think tank offering his critiques of the paper — all to gain my trust.”
• While that attack is linked to CharmingKitten, an Iranian hacking group, other cats are also on the loose, apparently.
• TheHackerNews.com reveals a Bitdefender report that points to a hacking tool linked to Iran’s Remix Kitten being used on Saudi Arabia and Kuwait: “Bitdefender said the intelligence-gathering operations were conducted by Chafer APT (also known as APT39 or Remix Kitten), a threat actor known for its attacks on telecommunication and travel industries in the Middle East to collect personal information that serves the country’s geopolitical interests.”

4. Teachers are the new black hats: Israel is continuing its slog toward normal, opening up beaches and synagogues on Wednesday, but with it are growing fears and indications of a possible second wave, and this time it’s not (only) the ultra-Orthodox being pointed at — it’s the daycare teachers.

• Media outlets report on dozens of kids being sent into quarantine in Tel Aviv, Bnei Brak and Rishon Lezion.
• Channel 12 news reports that Rehovot’s Holland neighborhood is also seeing a mini outbreak: “In recent days two women from the neighborhood on the staff of the Navon school have fallen ill, as well as at least two students in the school, the younger brother of one student and a student at an adjacent school.”
• Channel 13 news reports that a worker at a shelter in the neighborhood has also tested positive, forcing 27 residents and three other workers into quarantine as well.
• In a sign of how much the virus has faded from the public eye, though, it is not mentioned at all in the popular Israel Hayom daily until page 15.
• Haaretz puts it on its front page, but to complain about the government seeking to extend the use of phone tracking for virus cases “despite the shrinking infections.”
• “The danger of misuse of the law and its expansion for other purposes is a concrete one. Not only would citizens be exposed to Shin Bet surveillance, the law would also grant the Health Ministry the right to keep the information that was gathered for a period of 60 days, ‘for the purpose of an internal investigation.’ Under cover of the public fear of the spread of the pandemic and the fear that there will be additional waves, the government wants to enlarge its tool box and expand its freedom of action,” reads the paper’s lead editorial.

5. Thinking fast or slow? A survey published by the Israel Democracy Institute finds that Israelis are less and less trustful of Prime Minister Benjamin Netanyahu’s handling of the crisis, with 44% expressing trust in mid-May, compared with 54%-57% a month earlier.

• The survey finds that Israeli trust of public health professionals remains high, but that of government economics experts are shrinking. At the time time, a plurality of people surveyed (39%) actually think the government is pushing reopening way too fast or a little too fast, while 30% think it’s handling things right and 25% think it’s way too slow or a little too slow.
• Kan, however, reports on an international survey that finds 18% of Israelis thought the government’s steps to constrict the virus were “too strict at times.” That compares to an average of 6% in other countries around the world.
• Speaking to ToI’s Nathan Jeffay, Isaac Ben-Israel, who predicted the virus would play itself out in about 70 days, says Israel’s dwindling numbers show he was correct. “This isn’t because Israel did anything special; the same thing happened in Taiwan where they had no lockdown.”
• However, public health expert Nadav Davidovitch says that while Ben-Israel is a good scientist, he doesn’t know squat about epidemiology or public health.

6. Where are all the tests? While Health Ministry director Moshe Bar Siman-Tov told The New York Times last month that Israel would in early May begin serological sampling of 100,000 people, Yedioth Ahronoth reports that the program is delayed, and even a pilot in Bnei Brak has not gotten off the ground, and it’s unclear when it will.

• “There are still a lot of details to work out. We don’t know when we will really start to do the tests,” it quotes a senior Health Ministry figure saying.
• Haaretz reports that it will actually involve 200,000 tests, and will kick off at the end of the month.
• “While most of the tests will be administered at HMOs throughout the country, about 7,500 of the tests are earmarked for Bnei Brak, the ultra-Orthodox town which was particularly hard hit by the virus. The new blood testing survey there has been dubbed Bnei Brak First and will include blood tests for residents age seven and up in households with confirmed cases, in addition to random testing of a representative sampling of the local population,” the paper reports.
• It notes that the Bnei Brak tests in particular will help the world understand how the virus affects children, given the ultra-Orthodox city’s large number of youngsters.
• “There’s a major question mark in the world on the subject of the infection of children and the spread of the virus by children. The fact that Bnei Brak has a young population with a lot of children provides us a special opportunity to see what the role of children is,” says Prof. Daniel Cohen, who is leading the pilot.
• Army Radio reports that with soccer starting up, there are no plans to test players ahead of time. Health Ministry deputy director Itamar Grotto defends the decision: “The tests are not reliable enough. For every sick person, there are 20 false positives. It will needlessly spin us in circles.”

7. What Abbas means: Two days after Palestinian Authority President Mahmoud Abbas appeared to end all agreements with Israel, nobody is sure yet what the practical ramifications will be, if any.

• Israel Hayom, representing an apparently uncowed Israeli right, trumpets the settler leadership passing a motion backing annexation — and not a Palestinian state — under US President Donald Trump’s deal of the century, though it notes that an internal struggle is building, with several settler leaders signing on to a separate letter that backs the Trump plan.
• In the paper, columnist Boaz Haetzni urges Israel to call Abbas’s bluff and cut off all cooperation.
• “He, his subjects, we, everyone knows that this cooperation, which does help us, is not critical, but for him the mutual help is existential. The Israeli defense apparatus has saved him several times from assassination and coups, not that he’s done us any favors,” he writes.
• Haaretz reports that Palestinians and others trying to get clarifications from Abbas have thus far gotten nowhere, leading to frustration and skepticism.
• One Fatah officials is quoted telling the paper that they don’t know “if all contact and coordination with Israel really stops now and we give back the keys, or if it was a declaration of the official Palestinian position and there hasn’t yet been a decision to bury the agreements.”
• In the New York Times, David Halbfinger writes that if nothing else, Abbas’s statement appeared to be a sign of the desperate straits he finds himself in, and even if cooperation continues, can be taken seriously in that regard.
• “The announcement, amplified by a host of senior Palestinian officials, was in part a desperate move to elicit international backing in Europe and the Arab world, where once-stalwart allies have become less so,” he writes.
• He notes that Palestinians on the ground have not been given any orders to wind down cooperation yet, but according to a Palestinian general “the announcement would almost certainly cause tipsters with knowledge of a planned terrorist attack to refrain from coming forward.”