Attacks/Breaches
11/15/2012
01:05 PM
50%
50%

Anonymous Launches OpIsrael DDoS Attacks After Internet Threat

Hacktivist collective said the attacks are in response to the Israeli government threatening to sever all Internet connections to and from Gaza strip.

Attackers have also been using LOIC, which is a PC-based tool for launching a DDoS attack against a website of the user's choosing, if used in manual mode. When used in "hive mind" mode, meanwhile, the tool's target can be controlled by attack organizers. Although an early version of LOIC, used in attacks against PayPal, broadcast the IP address of the person using it to the site being attacked -- unless they were using a VPN -- developers have since updated the tool to better hide users' tracks. A more recently released version of LOIC also now runs on mobile phones.

Kenig said it was impossible to tell from where the OpIsrael Anonymous DDoS attacks are being launched. "We don't know, but we know that according to what was published, it's mainly Anonymous members that are supporting the Palestinians in Gaza Strip. They are the ones who have been launching this campaign, and they're looking for supporters," he said. "We saw in the [IRC] channels loads of correspondence in Arabic, so we can guess where it comes from."

Previous DDoS Anonymous attacks, including against PayPal and record industry trade groups, succeeded in knocking those sites offline not via LOIC attacks, but rather through the participation of botnet controllers, who brought the necessary packet-spewing firepower to bear. So far, however, Kenig said there's no sign that botnets have been used in these OpIsrael attacks. "At this point, it looks like there is no botnet involved, but mainly supporters using LOIC, mobile LOIC, and the usual stuff for Anonymous," he said.

As of press time, the government websites under attack remained reachable, although the IDF website appeared to be loading slowly. Meanwhile, the website of an Israeli surveillance camera manufacturer had been defaced with an image of smoke rising from the Gaza Strip, together with a "Stop bombing Gaza!!" warning, saying that "millions of Israelis & Palestinians are lying awake, exposed & terrified." The website has been previously defaced with Anonymous messages.

The Anonymous OpIsrael campaign began after Israel and Gaza militants exchanged fire in what's been described as the most intense violence to have occurred in the Gaza Strip since 2009. The conflict escalated after Israel warned that that after days of rocket attacks emanating from the Gaza Strip, it would increase the frequency of its targeted assassinations of top Hamas officials.

Israel Wednesday launched "Operation Pillar of Defense," which opened with an airstrike against a car carrying Ahmed al-Jaabari, who headed the Izz el Deen al Qassam, which is the military wing of Hamas. The airstrike killed him, together with at least one other occupant. The Israeli Defense Force has begun releasing black-and-white footage of its airstrikes.

Recent breaches have tarnished digital certificates, the Web security technology. The new, all-digital Digital Certificates issue of Dark Reading gives five reasons to keep it going. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8893
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-8894
Published: 2015-01-28
Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter.

CVE-2014-8895
Published: 2015-01-28
IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL.

CVE-2014-8917
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media A...

CVE-2014-8920
Published: 2015-01-28
Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.