Middle East

Israeli military networks breached by hackers: researchers

A Palestinian child throws a stone towards Israeli forces during clashes between Palestinian protestors and security forces following a demonstration in support of Palestinian men imprisoned in Israeli jails and against the expropriation of land by Israel, on April 17, 2015 in the village of Kfar Qaddum, near Nablus in the occupied West Bank. AFP PHOTO / JAAFAR ASHTIYEH

SAN FRANCISCO: Hackers have managed to penetrate computer networks associated with the Israeli military in an espionage campaign that skillfully packages existing attack software with trick emails, according to security researchers at Blue Coat Systems Inc.

The four-month-old effort, most likely by Arabic-speaking programmers, shows how the Middle East continues to be a hotbed for cyber espionage and how widely the ability to carry off such attacks has spread, the researchers said.

Waylon Grange, a researcher with the Blue Coat [PRJCBB.UL who discovered the campaign, said the vast majority of the hackers' software was cobbled together from widely available tools, such as the remote-access Trojan called Poison Ivy.

The hackers were likely working on a budget and had no need to spend much on tailored code, Grange said, adding that most of their work appeared to have gone into so-called social engineering, or human trickery.

The hackers sent emails to various military addresses that purported to show breaking military news, or, in some cases, a clip featuring "Girls of the Israel Defense Forces." Some of the emails included attachments that established "back doors" for future access by the hackers and modules that could download and run additional programs, according to Blue Coat.

Using standard obfuscation techniques, the software was able to avoid detection by most antivirus engines, Blue Coat said. At least some software lodged inside government computers, because Blue Coat detected it "beaconing," or sending signals to the hackers that it was in place.

An Israei defense ministry spokeswoman referred questions to the military. Military officials said they were "not aware of hacking on IDF operational networks."

Blue Coat provided Reuters with an advance look at its findings and intends to publish a paper later. The security firm, based in Sunnyvale, California, is set to be acquired by private equity firm Bain Capital LLC.

Citing confidentiality agreements with clients, Blue Coat declined to say exactly where the campaign worked, and Grange said he did not know if any vital data had been stolen.

Blue Coat surmised that the attackers spoke Arabic because some of the data recovered in the investigation showed that was the default language setting in one of the programming tools.

"Not all targeted attackers need advanced tools," Blue Coat wrote in a draft paper. "As regional conflicts continue, cyber threats from groups of various skill levels will also accompany the conventional armed conflicts."

Last month, Israeli security firm Check Point Software Technologies said it had found spying programs in 10 countries that probably originated with a governmental or political group in Lebanon that deployed them over three years.

In February, Kaspersky Lab researchers said they found what they considered the first "advanced" Arabic-speaking hacking group, which they dubbed Desert Falcons. Kaspersky said the group operated from Palestine, Egypt and Turkey and claimed about 3,000 victims in 50 countries, especially targeting military, government, media, and activist computers.

 

Recommended





Advertisement

Comments

Your feedback is important to us!

We invite all our readers to share with us their views and comments about this article.

Disclaimer: Comments submitted by third parties on this site are the sole responsibility of the individual(s) whose content is submitted. The Daily Star accepts no responsibility for the content of comment(s), including, without limitation, any error, omission or inaccuracy therein. Please note that your email address will NOT appear on the site.

Alert: If you are facing problems with posting comments, please note that you must verify your email with Disqus prior to posting a comment. follow this link to make sure your account meets the requirements. (http://bit.ly/vDisqus)

comments powered by Disqus

Advertisement

FOLLOW THIS ARTICLE

Interested in knowing more about this story?

Click here