January 2, 2009 | 3:13 pm

Muslim hackers roll out virtual offensive

Posted by Adam Wills

Rerouted users found this page rather than Ynetnews.

A Morocco-based Islamic group hacked into DomainTheNet’s registration system server today, hijacking several domain names, including ynetnews.com (the English-language Web site of Yedioth Ahronoth) and Bank Discount, and sending users to pages featuring anti-Israeli messages. One of the messages read: “The only solution for peace for all peoples in Palestine, Jews and Muslims and Christians is the demise of the Zionist and that the treatment of malignant cancer tumor.”

This latest attack follows the defacement of more than 300 Israeli Web sites with anti-Israeli and anti-U.S. messages in a 48-hour period last weekend.

Today’s attack did not hack particular Web sites, and are believed to be retaliation for Operation Cast Lead in Gaza.

Appearing as a defacement attempt at first, the attack soon turned out to be more sophisticated: The hackers were able to obtain a password which granted them access to the server which updates and “translates” the websites’ IP addresses into a Domain Name Service; and change the IP’s numeral values, effectively rerouting users away from the original websites.

The attack was claimed by a Moroccan group calling itself “Team Evil,” which had previously hacked other Israeli brands such as Cellcom, Shilav and BlueSquare. Ynet has learned that the server hosting the hackers’ website is based in Japan.

Ynet’s Editor in Chief Jon Feder, said that “the fact that hackers were able to breach DomainTheNet, by allegedly using valid client passwords, is highly disturbing.

“Ynet is looking into all aspects of the incident, be they technical, procedural or legal vis-à-vis the domain registration service and the matter will be dealt with without delay.”

Information security solutions developer Applicure Technologies has reported a surge in hackers trying to shut down Israeli Web sites, including protected sites.

Applicure founder and CTO David Allouch told Globes, “We’re talking about Iranian organizations, some of which call themselves communist, and organizations affiliated with Syria and Hizbullah. In contrast, during the Second Lebanon War in 2006, hackers were mostly kids from Morocco.”

Last weekend more than 300 Israeli Web sites were defaced in 48 hour period, according to Gary Warner, director of Research in Computer Forensics at the University of Alabama at Birmingham,

“As soon as Israel started bombing Gaza we began to look for signs of a cyber response,” Warner said. “In the current situation, the hackers supporting Gaza clearly believe Israel and the U.S. are culpable. That means American Web masters may wish to be especially vigilant right now.”

Warner’s tips:

Each Web master should decide on an appropriate level of security for his or her own site. A hobbyist Web site may be able to get by with less security than a corporate Web site or a site used for financial transactions. However, Warner said, any site hosted in the United States is at risk in the current scenario. Warner suggests the following to prevent a Web site from being used in the propaganda war.
• Review Web pages regularly for unauthorized changes.
• Search for products used on your Web site at the National Vulnerability Database to learn if they have known security holes.
• Use a strong password and change it regularly.
• Use a secure file transfer program to update your Web site.
• Consider having your Web site professionally tested for weaknesses

0 Comments — Leave your comment

Share this post: del.icio.us Digg Facebook Google Reddit StumbleUpon Technorati YahooMyWeb