Anonymous Launches OpIsrael DDoS Attacks After Internet Threat

Who Is Anonymous: 10 Key Facts

The hacktivist group Anonymous Thursday announced that it would begin launching online attacks against a number of Israeli government sites, as part of its ongoing Operation Israel (OpIsrael).

The Anonymous distributed denial-of-service (DDoS) attacks began at 10 a.m. Israeli time (3 a.m. Eastern time).

"Since this morning they've been trying to take down several Israeli websites, including the prime minister's website, the IDF [Israel Defense Force] website, banks, airlines, and so on," said Ronen Kenig, director of product marketing for security products at Radware, speaking by phone from Tel Aviv. "They published a list of four to five attack tools that they've asked their supporters to use, including the mobile LOIC, and network flooding attack tools." In addition, he said, attackers have been launching brute-force attacks against the IDF's blog, in an attempt to find working access credentials.

[ Read 10 Strategies To Fight Anonymous DDoS Attacks. ]

To date, however, the attacks -- which Kenig characterized as being "well coordinated" -- appear to have had minimal effect against the public-facing websites. "Some websites have suffered from defacements," he said. "None of the government ones, but some private ones that may relate somehow to military equipment have been defaced."

The Anonymous-organized attacks were preceded one hour earlier by the uploading of an Anonymous-issued statement to AnonPaste. It said that the Anonymous DDoS attacks were a response to Israel's reported threat to disconnect Gaza Strip from the Internet. "When the government of Israel publicly threatened to sever all Internet and other telecommunications into and out of Gaza they crossed a line in the sand," according to the statement.

In case the Gaza Strip's Internet connection does get severed, the Anonymous statement included a link to a downloadable "Care Package For Gaza," which is a 1 MB zipped file that it said "contains instructions in Arabic and English that can aid you in the event the Israel government makes good on it's (sic) threat to attempt to sever your Internet connection," as well as tips "on evading IDF surveillance."

The zipped file includes two documents, both written in Arabic and English. One is an oft-reprinted 2007 guide to basic first aid written by an Egyptian physician, Dr. Ehab El-Said Mohamed. The other, titled "TechGuideForInternetShutDownGAZA.pdf," tells people that if their Internet connection gets severed, they should attempt to find a short-wave radio and build a 65.5-foot antenna.

By comparison, the Anonymous DDoS attacks are more advanced. According to Radware, the attackers have been using SYN floods via TCP/IP, initiating more connection requests to a server than it can handle, which can make it unreachable. They've also been using ICMP attacks, which floods a network by exploiting misconfigured network devices to broadcast large quantities of packets to all devices connected to that network. Attackers have also been using LOIC, which is a PC-based tool for launching a DDoS attack against a website of the user's choosing, if used in manual mode. When used in "hive mind" mode, meanwhile, the tool's target can be controlled by attack organizers. Although an early version of LOIC, used in attacks against PayPal, broadcast the IP address of the person using it to the site being attacked -- unless they were using a VPN -- developers have since updated the tool to better hide users' tracks. A more recently released version of LOIC also now runs on mobile phones.

Kenig said it was impossible to tell from where the OpIsrael Anonymous DDoS attacks are being launched. "We don't know, but we know that according to what was published, it's mainly Anonymous members that are supporting the Palestinians in Gaza Strip. They are the ones who have been launching this campaign, and they're looking for supporters," he said. "We saw in the [IRC] channels loads of correspondence in Arabic, so we can guess where it comes from."

Previous DDoS Anonymous attacks, including against PayPal and record industry trade groups, succeeded in knocking those sites offline not via LOIC attacks, but rather through the participation of botnet controllers, who brought the necessary packet-spewing firepower to bear. So far, however, Kenig said there's no sign that botnets have been used in these OpIsrael attacks. "At this point, it looks like there is no botnet involved, but mainly supporters using LOIC, mobile LOIC, and the usual stuff for Anonymous," he said.

As of press time, the government websites under attack remained reachable, although the IDF website appeared to be loading slowly. Meanwhile, the website of an Israeli surveillance camera manufacturer had been defaced with an image of smoke rising from the Gaza Strip, together with a "Stop bombing Gaza!!" warning, saying that "millions of Israelis & Palestinians are lying awake, exposed & terrified." The website has been previously defaced with Anonymous messages.

The Anonymous OpIsrael campaign began after Israel and Gaza militants exchanged fire in what's been described as the most intense violence to have occurred in the Gaza Strip since 2009. The conflict escalated after Israel warned that that after days of rocket attacks emanating from the Gaza Strip, it would increase the frequency of its targeted assassinations of top Hamas officials.

Israel Wednesday launched "Operation Pillar of Defense," which opened with an airstrike against a car carrying Ahmed al-Jaabari, who headed the Izz el Deen al Qassam, which is the military wing of Hamas. The airstrike killed him, together with at least one other occupant. The Israeli Defense Force has begun releasing black-and-white footage of its airstrikes.

Recent breaches have tarnished digital certificates, the Web security technology. The new, all-digital Digital Certificates issue of Dark Reading gives five reasons to keep it going. (Free registration required.)