DoSWatch: August 2010

Sunday, August 8, 2010

Dosh (Chechnya) hacked - December 2009

DATE:
2009-12

AFFECTED COUNTRIES:
Chechnya/Russia

AFFECTED SITES:
doshdu.ru

EFFECT OF ATTACKS:
n/a

SOURCE COUNTRY:
n/a

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Chechnyan independent news site Dosh, which covers human rights issues, was hacked. Attacks take places on the site regularly. This attack was "not on schedule," after a media report that the site received a Reporters Without Borders award.

URLS:
1. http://www.newsland.ru/News/Detail/id/441275/

Ha Si Phu Library (Vietnam) hacked - February 2010

DATE:
2010-02

AFFECTED COUNTRIES:
Vietnam

AFFECTED SITES:
hasiphu.com

EFFECT OF ATTACKS:
Offline

SOURCE COUNTRY:
n/a

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Ha Si Phu Library hacked and taken down.

URLS:
1. http://danluanvn.blogspot.com/2010/02/thu-vien-ha-si-phu-cung-bi-tin-tac-tan.html

Chinese Security Agency website hacked - June 2005

DATE:
2005-06

AFFECTED COUNTRIES:
China

AFFECTED SITES:
www.mps.gov.cn

EFFECT OF ATTACKS:
Defaced

SOURCE COUNTRY:
China

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack, defacement

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Hackers attacked the Chinese Security Agency's website. Defacement criticized the agency's work, including that it can't protect itself.

URLS:
1. http://www.lenta.ru/news/2005/06/20/hackers/

Samara Region (Russia) news site hacked - December 2009

DATE:
2009-12

AFFECTED COUNTRIES:
Russia

AFFECTED SITES:
bogatoe.info

EFFECT OF ATTACKS:
Defaced. Malware.

SOURCE COUNTRY:
n/a

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack, defacement

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Samara Region news site hacked and defaced, seemingly with malware.

URLS:
1. http://www.bogatoe.info/news/119-vzlom

A New Israel Fund site DDoSed - August 2010

DATE:
2010-08

AFFECTED COUNTRIES:
Israel

AFFECTED SITES:
lonistom.co.il

EFFECT OF ATTACKS:
Taken offline

SOURCE COUNTRY:
Australia

ALLEGED ATTACKERS:
far-right activists

TYPE OF ATTACK:
DDoS

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
In an "ongoing war against Israeli peace activists and human rights NGOs" the New Israel Fund's site Lo Nistom ("We won't shut up") was DDoSed.

URLS:
1. http://www.richardsilverstein.com/tikun_olam/2010/08/06/israeli-rightist-cyber-vandals-take-down-new-israel-fund-site-in-dos-attack/
2. http://www.haaretz.co.il/captain/spages/1183204.html

Richard Silverstein's blog DDoSed - May 2010

DATE:
2010-05

AFFECTED COUNTRIES:
USA, Israel

AFFECTED SITES:
richardsilverstein.com

EFFECT OF ATTACKS:
Offline

SOURCE COUNTRY:
Russia, Lebanon, USA

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
DDoS

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Liberal Jewish blogger's site Tikun Olam DDoSed. Author speculates it may have been because his "blog was mentioned in a Yediot article [the previous day] and credited with breaking the gag order against reporting the arrests of Ameer Makhoul and Said Omer. Yediot has many extreme right wing readers (you can likely read lots of hate in the Talkback for that article directed against [Silverstein]". (1)

URLS:
1. http://www.richardsilverstein.com/tikun_olam/2010/05/10/denial-of-service-attack/

Th3J35t3r's Islamic extremist DoS attacks during July 2010

DATE:
2010-07

AFFECTED COUNTRIES:
Multiple, mostly Middle East and USA

AFFECTED SITES:
annabaa.org, almoslim.net, alghurabaa.org, way2allah.com, alfaloja.net, fatwa1.com, islamicemirate.com, tawheedmedia.com, muslimdefenseforce.islamicink.com, rjfront.info, falojaa.net, islamicawakening.com, alemarah-iea.com/english, sawtaljihad.org, h-alali.net, islamicboard.com, einladungzumparadies.de

EFFECT OF ATTACKS:
Depending on attack, down for 30 minutes or Apache server defaulted (displays "Hey, it worked!" Apache install page [not the website's contents])

SOURCE COUNTRY:
n/a

ALLEGED ATTACKERS:
The Jester (th3j35t3r), a former soldier waging a campaign against militant Islamic websites. His goal is to make communication channels used for jihadi ops unreliable, not necessarily to take them out altogether.

TYPE OF ATTACK:
DoS, hack

ATTACK SPECIFICS:
XerXeS DoS as well as a "new technique" that defaults the server to display the "Hey, it worked!" Apache install page.

EVENT DESCRIPTION:
"www.annabaa.org TANGO DOWN 30 mins. For the online radicalization of young muslims in US and Europe." (1)
"www.almoslim.net TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (2)
"www.alghurabaa.org TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (3)
"www.way2allah.com TANGO DOWN 30 mins. For online incitement to cause young muslims to carry out acts of violent jihad." (4)
"www.alfaloja.net TANGO DOWN 30 mins. For the online radicalization of young muslims in US and Europe." (5)
"www.fatwa1.com TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (6)
"www.islamicemirate.com TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (7)
"www.tawheedmedia.com TANGO DOWN 30 mins. For online incitement to cause young muslims to carry out acts of violent jihad." (8)
"www.muslimdefenseforce.islamicink.com TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (9)
"www.muslimdefenseforce.islamicink.com TANGO DOWN 30 mins. For online incitement to cause young muslims to carry out acts of violent jihad." (10)
"www.rjfront.info TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (11)
"www.falojaa.net TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (12)
"www.islamicawakening.com TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (13)
"www.falojaa.net TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (14)
"www.alemarah-iea.com/english -DOWN 30 MINS -lesser known backup of Taliban Main (now defunct) Site. Getting Personal? Admin = Adil Watanmal" (15)
"www.sawtaljihad.org - TANGO DOWN indefinitley. For online incitement to cause young muslims to carry out acts of violent jihad." (16)
"www.h-alali.net TANGO DOWN 30 mins. For facilitating jihadi recruitment of young muslims & spreading propaganda." (17)
"www.islamicboard.com TANGO DOWN 30 mins. For the continued distribution of jihadist instructional materials & propaganda." (18)
"www.einladungzumparadies.de TANGO DOWN 30 mins. For online incitement to cause young muslims to carry out acts of violent jihad." (19)

Chinese Human Rights Defenders hacked - July 2010

DATE:
2010-07

AFFECTED COUNTRIES:
China

AFFECTED SITES:
crd-net.org

EFFECT OF ATTACKS:
Offline for days

SOURCE COUNTRY:
China

ALLEGED ATTACKERS:
Chinese government

TYPE OF ATTACK:
DDoS

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Latest DDoS attack against the Chinese Human Rights Defenders' website.

URLS:
1. http://chrdnet.org/2010/07/27/china-human-rights-briefing-weekly-july-20-26-2010/

ChristopherPitts.net (USA) hacked - August 2009

DATE:
2009-08

AFFECTED COUNTRIES:
USA

AFFECTED SITES:
christopherpitts.net

EFFECT OF ATTACKS:
Hacked, content deleted

SOURCE COUNTRY:
China

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Blogger reported being hacked after writing "several seemingly benign posts on Shanghai." "Someone managed to enter my site and delete all of these posts." (1)

URLS:
1. http://wordpress.org/support/topic/hacked-censored-in-china

Youm el-Sabea (Egypt) hacked - August 2010

DATE:
2010-08

AFFECTED COUNTRIES:
Egypt

AFFECTED SITES:
youm7.com

EFFECT OF ATTACKS:
Hacked, defaced

SOURCE COUNTRY:
Egypt

ALLEGED ATTACKERS:
Tarek Ahmed

TYPE OF ATTACK:
Hack, defacement

ATTACK SPECIFICS:
"According to software engineer Abdel Rahman Ghareeb, who has closely studied hacking techniques, the security system used to safeguard Youm el-Sabea's website is an easy hack." (1)

EVENT DESCRIPTION:
Attack on a popular Egyptian independent newspaper Youm el-Sabea attributed to "transgressions against the Muslim Prophet Muhammad and his family, companions, and wives [which were] posted on Youm el-Sabea's website." (1)

"The message went on to note that the attack was primarily a response to a book by author Anis el-Degheidi--entitled, Muhakamet el-Nabi Muhammad, or “Trials of the Prophet Muhammad”--the contents of which allegedly defame the Prophet." (1)

The hacker, Tarek Ahmed, was caught shortly thereafter. (2)

URLS:
1. http://www.almasryalyoum.com/en/news/hackers-target-news-website-gamal-mubarak-facebook-page
2. http://www.almasryalyoum.com/en/news/police-arrest-youm-al-sabea-website-hacker

"Yes to Gamal Mubarak" FaceBook page hacked - August 2010

DATE:
2010-08

AFFECTED COUNTRIES:
USA, Egypt

AFFECTED SITES:
facebook.com

EFFECT OF ATTACKS:
Hacked

SOURCE COUNTRY:
Egypt

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
The "Yes to Gamal Mubarak" group on FaceBook was hacked. Page supporting anticipated Presidential candidate and son of the current President Gamal Mubarak was hacked and its name changed to [translation] "Denied you the beauty and unwanted you." (1) Other text read "we don't want you or your father."

URLS:
1. http://www.almasryalyoum.com/en/news/hackers-target-news-website-gamal-mubarak-facebook-page

Mustafa Hosny's website (Egypt) defaced - August 2010

DATE:
2010-08

AFFECTED COUNTRIES:
Egypt

AFFECTED SITES:
mustafahosny.com

EFFECT OF ATTACKS:
Defaced, down for an hour

SOURCE COUNTRY:
Iran

ALLEGED ATTACKERS:
n/a

TYPE OF ATTACK:
Hack, defacement

ATTACK SPECIFICS:
n/a

EVENT DESCRIPTION:
Islamic televangelist's site defaced. Defacement text in part read "any act against the enemies of Iran will not remain without a response" (1)

URLS:
1. http://www.shorouknews.com/ContentData.aspx?ID=277548

Sunday, August 8, 2010

Archive