OpIsrael: An Update

Michael Marriott | 6 April 2016

Last month our intelligence team published a blog on the use of ABI in understanding OpIsrael 2016, which suggested that the level of talk was indicative of an active campaign this year. But what can we learn from previous years?

On Monday, the target list for OpIsrael was posted to Pastebin, containing contact information and domains associated with a number of Israeli government services, education and financial institutions located in, or operating in Israel. There were 23 domains belonging to Israeli education institutions and six domains belonging to Israeli banks. The Israeli banks were posted alongside contact information for them (addresses, telephone numbers). Further to these entities, the post included contact information for a number of Israeli government ministries, tax authorities and government offices. Finally, the post featured contact information for non-Israeli banks that operated branches in Israel. We have not yet detected any successful attacks against these domains.

There has, however, already been some activity. For example, on March 31, 2016, we detected a claim of leaked credit card details for 97 individuals. The user provided a hyperlink to a Pastebin post on which the data was held, which further referenced OpIsrael and referenced the domain of an online gift shop. The data included full names, dates of birth, locations, addresses and credit card details – including card type, full long number and CVV number. Research into a random sample of the credit card numbers showed that they had not previously been posted to public sources. A random sample of the bank identification numbers (BINs) of the allegedly stolen card details pertained largely to Visa cards in the United States, however other countries such as Poland and Zimbabwe were included. There, therefore, a realistic possibility they were stolen as a result of a successful compromise of the online gift shop website. This targeting is indicative of how smaller, private companies based in or operating in Israel, or using the Israel top level domain (.il) are a potential target for OpIsrael hacktivist activity.

OpIsrael2015timeline

Fig 1: A timeline of incidents associated with OpIsrael in 2015.

 

So what can we expect tomorrow? There’s plenty we can learn from activity in previous years. Figure 1 demonstrates just how active this campaign was in 2015. The tactics used during OpIsrael covered a wide spectrum of DoS, defacement and data leaks, although there was a slight preference towards defacement attacks with messages pronouncing the motivations of the operation. Breaches achieved through SQL injection were also very common, as well as other application vulnerability exploits such as brute force and cross-site scripting.

While the precise tools employed by the many actors involved in this campaign remain unknown, we can garner some information. For example, during OpIsrael 2015, actors were able to launch several denial of service attacks and database leaks. Some of the DDoS tools allegedly used in OpIsrael 2015 included:

  • Anonymous External Attack - a tool developed by threat actor AnonGhost that generates a UDP Flood with payloads containing multiple zeros against port 80 by default
  • DoSeR 2.0 – a traffic generator with scanning capabilities with attack vectors that include TCP, UDP and HTTP floods.
  • LOIC Fallaga – a unique variation of the LOIC UDP/TCP flood tool created by Fallaga hacker group.

For organizations named in this target list, or indeed with a presence in Israel, this context is key. By understanding which methods and tools these actors have used in previous years, organizations can better align their security controls.