Posts Tagged ‘Defacement’

Winds Of Cyber War From The Middle East

August 8, 2012 3 comments

Approximately a couple of weeks ago, an Israeli hacker called You-r!-k@n, one of the early contenders of the Middle East Cyber War, had defaced the Iran Energy Water Website. The attack was claimed as a form of cyber protest (and cyber retaliation) against Iranian institutions executed by the same author.

Yesterday, two weeks later, with the same motivations, the same hacker has targeted and defaced 91 Iranian sites, including several government and education sites together with several important companies.

All the affected sites (at the time of writing the ones listed below are still defaced) show the same message against the “terror” and the nuclear strategy of Iran together with an Israeli flag.

According to the author, the list of the victims include:

According to the original statement of You-r!-k@n:

This is an attack against Iran than support terrorism and developing nuclear weapons to destroy Israel.

The situation between the two hot countries of the Middle East continues to be tense, and cyberspace is not an exception.

Iran Energy Water Website Defaced By An Israeli Hacker Against The Terrorist Attack in Burgas

You-r!-k@n keeps on his personal battle against Iran.

The latest target is the official website of Iran Energy Water (, which has been defaced, showing, in several sections, of the main page, a message against the Iran Nuclear Program and against the recent event in Bulgaria where five Israeli tourists (and their local driver) were killed in a terrorist attack in the Black Sea city of Burgas. At the time of writing the web site is unavailable, showing the well-familiar IIS7 Splash Screen (in spite of the embargo and the alleged Iranian Cyber Autarchy).

As you know, Israel blamed Iran for the latter event (backed by American Officials), and hence, easily predictable, the dispute between the two states has (once again) crossed the boundaries of the cyber world (but a defacement is quite a simple question in comparison with Stuxnet and The Flame).

The time of the Middle East Cyber War is well behind, nevertheless cyber events targeting both countries, whether state-sponsored or carried on by lone rangers, continue to happen at a constant rate.

July 2012 Cyber Attacks Timeline (Part I)

July 20, 2012 1 comment

Update 08/02/2012: July 2012 Cyber Attacks Timeline (Part II)

Although the number of attacks has considerably diminuished, the first half of July has left several high-profile attacks which deserverd huge attention, exposing in theory more than 2,000,000 individuals. Yahoo! Voice, Android Forums, Nvidia, Formspring, Billabong and ASUS are several of the well-known names that were victims of the high-profile breaches in the first two weeks of July.

World Health Organization and PBS (once again) were also illustrious victims of Cyber Attacks.

Besides these remarkable events, it looks like the actions carried on by the Law Enforcement agencies in the last period led to some results since the number of incidents looks undoubtably smaller than the previous months.

For what concerns the cyber attacks driven by hacktivism, it is particularly important to notice #OpPedoChat, still ongoing, which caused many pedophiles to be exposed, in several cases with unpredictable consequences, as in Belgium where a far-right official resigned after Anonymous’ Paedophilia Claims.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

Read more…

May 2012 Cyber Attacks Statistics

June 10, 2012 1 comment

As I did last month for the Cyber Attacks occurred in April, I have aggregated the data collected on the timelines of May (on the right) in order to provide a consolidated view of the month according to the three parameters of Motivations Behind Attacks, Distribution of Targets and Distribution of Attack Techniques. Again, no need to repeat that data must be taken very carefully since they do refers only to discovered attacks (the so-called tip of the iceberg), and hence do not pretend to be exhaustive but only aim to provide an high level overview of the “cyber landscape” of the month.

As far as Motivations Behind Attacks are concerned, month after month, the charts are becoming monotonous. Cyber Crime ranked undoubtedly at number one with the 61% of occurrences. Twice the occurrences of Hacktivism which ranked at number two. In this chart, Cyber Warfare and Cyber Espionage motivated-attacks are well behind although they were few but good (One Flame was enough for this month, wasn’t it?).

The Distribution of Targets chart is highly fragmented even if with a familar pattern:  Government targets ranked firmly on top of the preferences for the attackers, with Education and Law Enforcement targets completing the top three (although, compared to April, they swapped their positions in this unenviable chart). It worths to mention that targets belonging to organizations that offers on-line services are fragmented as well, but if the single entries are summed up, they would rank at number two with approximately the 15% of occurrences.

The Distribution of Attack Techniques chart whows that SQL Injection has been the preferred weapon used by Cyber Criminals in May, overtaking Distributed Denial of Service, the Cyber Paintball Pistol. Clearly the occurrences of DDoS attacks are influenced by the winds of hacktivism which did not blow so high in May. Interesting to notice a further important number of events (17% of the sample) related to unknown attacks targeting DBs, which clearly shows that data repositories are proving to be the weakes element of the chain. May the patch enFORCEment be with you!

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Sixteen Months of Cyber Attacks in Italy

Tomorrow, during the 2012 Security Summit, Edition of Rome, the June Update of the 2012 Italian Report on ICT Security will be unleashed.

I gave a contribution for the section concerning the Cyber Attacks in Italy. The following lines depict a summary of what you will be able to find in the full report (so far only in Italian).

During the period ranging from February 2011 to April 2012, I collected 127 cyber attacks, among which 112, corresponding to the 88% (that is almost the entire sample), driven by hacktivism. In only 15 cases different motivations were found, related to Cyber Crime (14 occurrences) and Cyber Espionage.

The collected sample shows that more than 43% of targets were government sites and political associations. Organizations related to education rank at number three even though most of the attacks were concentrated in a single event in July when as many as 18 universities were affected simultaneously.

Entertainment industry and Law Enforcement Agencies are far behind, but ahead all other categories, probably a consequence of the cyber attacks perpetrated in January and March 2012 during the waves of protests against SOPA and PIPA, (and the subsequent shutdown of MegaUpload). Please notice that not event the Holy See has been safe from hackers with a wave of DDoS attacks targeting several Vatican sites after some controversial declarations of a security vendor.

The trend analysis clearly reflects the influence of external factors on hacktivism in Italy: the first intervention in Libya, then the emotional impact of the collective LulzSec, and finally the protests against the proposed laws considered repressive to freedom of expression on the Internet.

As far as the attack distribution is concerned, Italy has just demonstrated to be a “Spaghetti DDOS” country. On the wake of hacktivism, our country has assisted, in the analyzed period, to a massive wave of Distributed Denial Of Service Attacks. SQL Injection and Defacement attacks are well behind (again remember that most of the SQLi attacks were concentrated on a single event occurring on July). In any case the distribution shows a tendency to perform those kinds of attacks (DDoS and Defacement) capable to gain the most attention from media.

Although the sample may provide an interesting snapshot, please keep in mind that it only includes those attacks that have been detected since the authors claimed them, or simply because the attacks themselves earned plenty of space on media. Given the times we are living in, I’m afraid these are just the tip of the iceberg.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

P.S. I did not include in the sample the controversial attack to CNAIPIC (Italian Cyber Police) since the origin of that event is far from being certain.

April 2012 Cyber Attacks Statistics

I have aggregated the data collected related to cyber attacks occurred in April 2012 (that you may find in the links on the right) in order to provide a consolidated view for the month. The statistics have been taken according to three parameters: Motivations Behind Attacks, Distribution of Targets and Distribution of Attack Techniques. Of course the information does not pretend to be exhaustive, in any case it is useful to provide a snapshot on the cyber landscape of the last month.

As far as the Motivations Behind Attacks are concerned, Cyber Crime ranks undoubtedly at number one with the 51% of the occurrences. Hacktivism is at number two with “only” the 39% of the occurrences. Other motivations such as Cyber Warfare or Cyber Espionage are far behind with respectively the 7 and 2 percent. This is not a surprise since attacks motivated by Cyber Espionage should be supposed to be subtle and hidden and this explains their rank (unlike the attacks motivated by hacktivism that use to attract the greatest attention by media).

As far as the Distribution Of Targets is concerned, Governements keep on to be preferred targets, with nearly one third of the occurrences. Law Enforcement Agencies rank at number two with 9% immediately followed by Educational Institutions with 7%. Online Platforms such as Online Games or other kind of platforms (such as email services) are behind with the 6% of occurrences for both of them. Of course the high position for governments and LEAs is quite simple to explain: both categories are the preferred targets for hactkivists.

A month characterized by Distributed Denial of Service, at least according to the Distribution of Attack Techniques chart. SQL Injection ranks at number two, immediately followed by Defacement. If we sum up also the indirect occurrences of SQLi (that is those cases whose symptoms seem the ones proper of SQLi but no direct evidences were found) the distribution of the two techniques is nearly the same (respectively 29% for DDoS and 27% for SQLi). Of course DDoS is the preferedd cyber weapon for hacktivists and this explain its dominion on this unwelcomed chart.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.


Get every new post delivered to your Inbox.

Join 3,788 other followers