Attacks/Breaches
11/15/2012
01:05 PM
50%
50%

Anonymous Launches OpIsrael DDoS Attacks After Internet Threat

Hacktivist collective said the attacks are in response to the Israeli government threatening to sever all Internet connections to and from Gaza strip.

Attackers have also been using LOIC, which is a PC-based tool for launching a DDoS attack against a website of the user's choosing, if used in manual mode. When used in "hive mind" mode, meanwhile, the tool's target can be controlled by attack organizers. Although an early version of LOIC, used in attacks against PayPal, broadcast the IP address of the person using it to the site being attacked -- unless they were using a VPN -- developers have since updated the tool to better hide users' tracks. A more recently released version of LOIC also now runs on mobile phones.

Kenig said it was impossible to tell from where the OpIsrael Anonymous DDoS attacks are being launched. "We don't know, but we know that according to what was published, it's mainly Anonymous members that are supporting the Palestinians in Gaza Strip. They are the ones who have been launching this campaign, and they're looking for supporters," he said. "We saw in the [IRC] channels loads of correspondence in Arabic, so we can guess where it comes from."

Previous DDoS Anonymous attacks, including against PayPal and record industry trade groups, succeeded in knocking those sites offline not via LOIC attacks, but rather through the participation of botnet controllers, who brought the necessary packet-spewing firepower to bear. So far, however, Kenig said there's no sign that botnets have been used in these OpIsrael attacks. "At this point, it looks like there is no botnet involved, but mainly supporters using LOIC, mobile LOIC, and the usual stuff for Anonymous," he said.

As of press time, the government websites under attack remained reachable, although the IDF website appeared to be loading slowly. Meanwhile, the website of an Israeli surveillance camera manufacturer had been defaced with an image of smoke rising from the Gaza Strip, together with a "Stop bombing Gaza!!" warning, saying that "millions of Israelis & Palestinians are lying awake, exposed & terrified." The website has been previously defaced with Anonymous messages.

The Anonymous OpIsrael campaign began after Israel and Gaza militants exchanged fire in what's been described as the most intense violence to have occurred in the Gaza Strip since 2009. The conflict escalated after Israel warned that that after days of rocket attacks emanating from the Gaza Strip, it would increase the frequency of its targeted assassinations of top Hamas officials.

Israel Wednesday launched "Operation Pillar of Defense," which opened with an airstrike against a car carrying Ahmed al-Jaabari, who headed the Izz el Deen al Qassam, which is the military wing of Hamas. The airstrike killed him, together with at least one other occupant. The Israeli Defense Force has begun releasing black-and-white footage of its airstrikes.

Recent breaches have tarnished digital certificates, the Web security technology. The new, all-digital Digital Certificates issue of Dark Reading gives five reasons to keep it going. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?