DoSWatch

DoSWatch = Aggregated stories about the use of denial of service attacks and hacking as a form of censorship.

If you hear about such an event, or if you've been censored in this way, please email or use @DoSWatch on Twitter.

This is not a news site. Our goal is to collect and quickly summarize, not research and fact-check. Many details of these reports rely on translated pages, speculation, and/or anecdote, so should be treated as such. Link quality will vary.

*click for email

Sunday, August 8, 2010

Dosh (Chechnya) hacked - December 2009


DATE:
2009-12

AFFECTED COUNTRIES:
Chechnya/Russia

AFFECTED SITES:
doshdu.ru

EFFECT OF ATTACKS:
n/a

SOURCE COUNTRY:
n/a

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Chechnyan independent news site Dosh, which covers human rights issues, was hacked. Attacks take places on the site regularly. This attack was "not on schedule," after a media report that the site received a Reporters Without Borders award.

URLS:
1. http://www.newsland.ru/News/Detail/id/441275/


Ha Si Phu Library (Vietnam) hacked - February 2010


DATE:
2010-02

AFFECTED COUNTRIES:
Vietnam

AFFECTED SITES:
hasiphu.com

EFFECT OF ATTACKS:
Offline

SOURCE COUNTRY:
n/a

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Ha Si Phu Library hacked and taken down.

URLS:
1. http://danluanvn.blogspot.com/2010/02/thu-vien-ha-si-phu-cung-bi-tin-tac-tan.html


Chinese Security Agency website hacked - June 2005


DATE:
2005-06

AFFECTED COUNTRIES:
China

AFFECTED SITES:
www.mps.gov.cn

EFFECT OF ATTACKS:
Defaced

SOURCE COUNTRY:
China

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack, defacement

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Hackers attacked the Chinese Security Agency's website. Defacement criticized the agency's work, including that it can't protect itself.

URLS:
1. http://www.lenta.ru/news/2005/06/20/hackers/


Samara Region (Russia) news site hacked - December 2009


DATE:
2009-12

AFFECTED COUNTRIES:
Russia

AFFECTED SITES:
bogatoe.info

EFFECT OF ATTACKS:
Defaced. Malware.

SOURCE COUNTRY:
n/a

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack, defacement

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Samara Region news site hacked and defaced, seemingly with malware.

URLS:
1. http://www.bogatoe.info/news/119-vzlom


A New Israel Fund site DDoSed - August 2010


DATE:
2010-08

AFFECTED COUNTRIES:
Israel

AFFECTED SITES:
lonistom.co.il

EFFECT OF ATTACKS:
Taken offline

SOURCE COUNTRY:
Australia

ALLEGED ATTACKERS:
far-right activists

TYPE OF ATTACK:
DDoS

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
In an "ongoing war against Israeli peace activists and human rights NGOs" the New Israel Fund's site Lo Nistom ("We won't shut up") was DDoSed.

URLS:
1. http://www.richardsilverstein.com/tikun_olam/2010/08/06/israeli-rightist-cyber-vandals-take-down-new-israel-fund-site-in-dos-attack/
2. http://www.haaretz.co.il/captain/spages/1183204.html


Richard Silverstein's blog DDoSed - May 2010


DATE:
2010-05

AFFECTED COUNTRIES:
USA, Israel

AFFECTED SITES:
richardsilverstein.com

EFFECT OF ATTACKS:
Offline

SOURCE COUNTRY:
Russia, Lebanon, USA

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
DDoS

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Liberal Jewish blogger's site Tikun Olam DDoSed. Author speculates it may have been because his "blog was mentioned in a Yediot article [the previous day] and credited with breaking the gag order against reporting the arrests of Ameer Makhoul and Said Omer. Yediot has many extreme right wing readers (you can likely read lots of hate in the Talkback for that article directed against [Silverstein]". (1)

URLS:
1. http://www.richardsilverstein.com/tikun_olam/2010/05/10/denial-of-service-attack/


Th3J35t3r's Islamic extremist DoS attacks during July 2010


DATE:
2010-07

AFFECTED COUNTRIES:
Multiple, mostly Middle East and USA

AFFECTED SITES:
annabaa.org, almoslim.net, alghurabaa.org, way2allah.com, alfaloja.net, fatwa1.com, islamicemirate.com, tawheedmedia.com, muslimdefenseforce.islamicink.com, rjfront.info, falojaa.net, islamicawakening.com, alemarah-iea.com/english, sawtaljihad.org, h-alali.net, islamicboard.com, einladungzumparadies.de

EFFECT OF ATTACKS:
Depending on attack, down for 30 minutes or Apache server defaulted (displays "Hey, it worked!" Apache install page [not the website's contents])

SOURCE COUNTRY:
n/a

ALLEGED ATTACKERS:
The Jester (th3j35t3r), a former soldier waging a campaign against militant Islamic websites. His goal is to make communication channels used for jihadi ops unreliable, not necessarily to take them out altogether.

TYPE OF ATTACK:
DoS, hack

ATTACK SPECIFICS:
XerXeS DoS as well as a "new technique" that defaults the server to display the "Hey, it worked!" Apache install page.

EVENT DESCRIPTION:
"www.annabaa.org TANGO DOWN 30 mins. For the online radicalization of young muslims in US and Europe." (1)
"www.almoslim.net TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (2)
"www.alghurabaa.org TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (3)
"www.way2allah.com TANGO DOWN 30 mins. For online incitement to cause young muslims to carry out acts of violent jihad." (4)
"www.alfaloja.net TANGO DOWN 30 mins. For the online radicalization of young muslims in US and Europe." (5)
"www.fatwa1.com TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (6)
"www.islamicemirate.com TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (7)
"www.tawheedmedia.com TANGO DOWN 30 mins. For online incitement to cause young muslims to carry out acts of violent jihad." (8)
"www.muslimdefenseforce.islamicink.com TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (9)
"www.muslimdefenseforce.islamicink.com TANGO DOWN 30 mins. For online incitement to cause young muslims to carry out acts of violent jihad." (10)
"www.rjfront.info TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (11)
"www.falojaa.net TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (12)
"www.islamicawakening.com TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (13)
"www.falojaa.net TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (14)
"www.alemarah-iea.com/english -DOWN 30 MINS -lesser known backup of Taliban Main (now defunct) Site. Getting Personal? Admin = Adil Watanmal" (15)
"www.sawtaljihad.org - TANGO DOWN indefinitley. For online incitement to cause young muslims to carry out acts of violent jihad." (16)
"www.h-alali.net TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (17)
"www.islamicboard.com TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (18)
"www.einladungzumparadies.de TANGO DOWN 30 mins. For online incitement to cause young muslims to carry out acts of violent jihad." (19)

URLS:
1. http://twitter.com/th3j35t3r/status/18936284340
2. http://twitter.com/th3j35t3r/status/18933773664
3. http://twitter.com/th3j35t3r/status/18781973237
4. http://twitter.com/th3j35t3r/status/18713452239
5. http://twitter.com/th3j35t3r/status/18710829991
6. http://twitter.com/th3j35t3r/status/18708341592
7. http://twitter.com/th3j35t3r/status/18547410960
8. http://twitter.com/th3j35t3r/status/18540189894
9. http://twitter.com/th3j35t3r/status/18524610749
10. http://twitter.com/th3j35t3r/status/18523737043
11. http://twitter.com/th3j35t3r/status/18472850724
12. http://twitter.com/th3j35t3r/status/18461459866
13. http://twitter.com/th3j35t3r/status/18458727660
14. http://twitter.com/th3j35t3r/status/18357305944
15. http://twitter.com/th3j35t3r/status/18296704508
16. http://twitter.com/th3j35t3r/status/18150401065
17. http://twitter.com/th3j35t3r/status/18055309513
18. http://twitter.com/th3j35t3r/status/17673225657
19. http://twitter.com/th3j35t3r/status/17611176590


Chinese Human Rights Defenders hacked - July 2010


DATE:
2010-07

AFFECTED COUNTRIES:
China

AFFECTED SITES:
crd-net.org

EFFECT OF ATTACKS:
Offline for days

SOURCE COUNTRY:
China

ALLEGED ATTACKERS:
Chinese government

TYPE OF ATTACK:
DDoS

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Latest DDoS attack against the Chinese Human Rights Defenders' website.

URLS:
1. http://chrdnet.org/2010/07/27/china-human-rights-briefing-weekly-july-20-26-2010/


ChristopherPitts.net (USA) hacked - August 2009


DATE:
2009-08

AFFECTED COUNTRIES:
USA

AFFECTED SITES:
christopherpitts.net

EFFECT OF ATTACKS:
Hacked, content deleted

SOURCE COUNTRY:
China

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Blogger reported being hacked after writing "several seemingly benign posts on Shanghai." "Someone managed to enter my site and delete all of these posts." (1)

URLS:
1. http://wordpress.org/support/topic/hacked-censored-in-china


Youm el-Sabea (Egypt) hacked - August 2010


DATE:
2010-08

AFFECTED COUNTRIES:
Egypt

AFFECTED SITES:
youm7.com

EFFECT OF ATTACKS:
Hacked, defaced

SOURCE COUNTRY:
Egypt

ALLEGED ATTACKERS:
Tarek Ahmed

TYPE OF ATTACK:
Hack, defacement

ATTACK SPECIFICS:
"According to software engineer Abdel Rahman Ghareeb, who has closely studied hacking techniques, the security system used to safeguard Youm el-Sabea's website is an easy hack." (1)

EVENT DESCRIPTION:
Attack on a popular Egyptian independent newspaper Youm el-Sabea attributed to "transgressions against the Muslim Prophet Muhammad and his family, companions, and wives [which were] posted on Youm el-Sabea's website." (1)

"The message went on to note that the attack was primarily a response to a book by author Anis el-Degheidi--entitled, Muhakamet el-Nabi Muhammad, or “Trials of the Prophet Muhammad”--the contents of which allegedly defame the Prophet." (1)

The hacker, Tarek Ahmed, was caught shortly thereafter. (2)

URLS:
1. http://www.almasryalyoum.com/en/news/hackers-target-news-website-gamal-mubarak-facebook-page
2. http://www.almasryalyoum.com/en/news/police-arrest-youm-al-sabea-website-hacker