Friday, August 8, 2014

Operation Protective Edge: The Iranian Cyber Botnet Offensive



Cyber-attacks against Israel have increased 500% in the last month and in a new report it is written that a powerful botnet is controlled by a pro-Islamic Iranian group of hackers and was used as part of a cyber-campaign with the support of Anonymous. 
 
The increase in attacks coincided with the launch of Israel's Operation Protective Edge offensive against Gaza.

Following three weeks of intensive attacks on the ground and in cyberspace, the volume of DDoS attacks decreased on 27 July, this coincided with a temporary ceasefire in fighting between Israel and Gaza.

The attack method (which uses things such as "malformed DNS queries", "layer-7 HTTP and HTTP/S attacks", and "repeated page downloads and GETs/POSTs against non-existent URIs") has a "striking resemblance to the Brobot-based attacks" which have been first seen in 2012, but which have been silent for almost a year.

Brobot is a powerful botnet (network of zombie computers) which was first used in 2012 as part of Operation Ababil, which was a series of cyber-attacks carried out by the Qassam Cyber Fighters (also known as the Cyber fighters of Izz Ad-Din Al Qassam) against US financial institutions and continued until July 2013.

Brobot is being used to attack Israeli civilian governmental agencies, military agencies, financial services and Israeli cc TLD DNS infrastructure, and as the Israeli-Gaza conflict continues to evolve, it is likely that we will see the cyber-conflict also evolve alongside it.