Anonymous’ ‘Hack Israel Day’ Could Impact The Entire World

Israel was recently hit by a massive cyber offensive. But unlike other attacks (APTs, criminal campaigns, etc.) to hit the nation, this one has been announced in advance.

It’s Anonymous’ annual OpIsrael attack, which has been taking place on April 7 every year since 2013. According to most Israeli researchers, the attack will fail. It won’t cause any major damage to state infrastructure or scare the Israeli public, and it definitely won’t “erase the Zionist devil from the Internet” (OpIsrael’s declared objective).

The annual operation, which generally consists of DDoS attacks, website defacement and attempts at data theft, has made Israeli users more aware of cyber risks, and acts as a sort of training day for local security companies.

The operation, which generally consists of DDoS attacks, website defacement and attempts at data theft, has had some positive effects: It has made Israeli users more aware of cyber risks, and acts as a sort of training day for local security companies. But this attack has another side, which might have a worldwide impact in the future.

The operation is organized by threat actors from mostly Muslim countries, and relies on quantity rather than quality. Highly skilled attackers who have access to advanced tools won’t waste their time on such a fruitless attack, as the only possible gain is helping spread political propaganda. Hacking is a business, and if there’s no money to be made, most cyber mercenaries aren’t interested.

OpIsrael’s organizers know this, so they try to enlist as many low-level operatives as they can to launch vast DDoS attacks against Israeli websites. But even this vector requires some technical skill, and many OpIsrael enthusiasts simply don’t have the know-how.

Sure, an individual who wants to engage in cybercrime can get the tools and training they need online, but only as long as they can a) reach the crimeware underground and b) pay up (as I’ve stated, this is a business). Even if said individual managed to install TOR and use it, they might not find the relevant crime store or be able to buy what they need.

It is true that crimeware prices are plummeting, and malware costs as little as a few dozen dollars, but this is not small change for everybody. Many of the hacktivists who want to take part in OpIsrael come from countries with weak economies — Indonesia, Malaysia, Syria, Egypt, etc. For an Indonesian activist who makes less than $750 a month, cyber training could be beyond their financial reach. And even if they had the money, they might be refused by crimeware sellers: Newcomer buyers might raise a shopkeeper’s suspicions, and be blocked or marked as possible moles. This is where OpIsrael 2016’s organizers step in.

Teach a man to fish

Unlike in previous years, #OpIsrael 2016 has a well-organized training program. It contains hacker groups dedicated to showing newcomers the ropes. Their keyword is accessibility: If a hacktivist wants to jump in, all they need to do is join the relevant Facebook groups, follow the right Twitter accounts (which are being advertised across social media) and declare their undying hatred for Israel, and they’re one of the gang. 

Sensitive attack details and advanced tools won’t be available to these new hacktivists for reasons of operational security, but they’ll receive DDoS training (available in several languages) and other necessary tools, free of charge. Interactions between newcomer hacktivists and their seasoned guides resemble those found in online support forums, but instead make use of several webchat channels and Telegram groups. Hacking lessons are given by experienced players, some of whom enjoy, celebrity status in the underground communities.

This training program solves OpIsrael’s main problem — mass recruitment. It also lets everybody who wants to get into cybercrime do so, for free.

The next cybercriminals

After this year’s OpIsrael’s dust settles, newcomer hacktivists will come away with a new, albeit very basic, skill set that will enable them to engage in cybercrime. Many DDoS attacks include an extortion element: Attackers can threaten targets with a massive DDoS attack, and launch a low-volume one just to prove their abilities. They can also pose as security researchers claiming to have identified an imminent DDoS attack, and request money in return for stopping the threat.

This is OpIsrael’s unseen effect: Thousands of people will receive professional cybercrime training, which could cause an increase in the volume of worldwide low-level attacks.

Security-focused organizations will know how to treat threats such as these, but most small businesses won’t. Many small businesses fear any disruption to their business process, especially at sensitive times (online stores on Black Friday, for example). Therefore, such businesses tend to give in to a criminal’s demands, since criminals usually won’t ask for more than a few hundred or perhaps a thousand dollars in bitcoin.

This is OpIsrael’s unseen effect: The fact that thousands of people will receive professional cybercrime training. These cybercriminals probably won’t settle for hacktivism for long, or hold their breath until 2017’s OpIsrael. Basic attack tools can easily work like gateway drugs on OpIsrael’s new graduates, who might turn to better tools and tactics and use them to threaten companies all over the world — not just in security-aware Israel.

Anonymous’ training operations could cause an increase in the volume of worldwide low-level attacks. And while these aren’t considered as dangerous as APTs, they currently comprise the lion’s share of cyber attacks and could inflict major damage on multiple industries.

Recode:

 

« CyberScape – The Growing Influence of Cyber (£)
US Cyberwar Against ISIS Begins »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Infoblox

Infoblox

Infoblox solutions help businesses automate complex network control functions to reduce costs, increase security and maximize uptime.

CyberArk Software

CyberArk Software

CyberArk is an established leader in privileged access management and offers the most complete set of Identity Security capabilities.

Cymulate

Cymulate

Cymulate is a SaaS-based breach and attack simulation platform that makes it simple to know and optimize your security posture any time, all the time.

Vysk Communications

Vysk Communications

Vysk is an award-winning mobile security firm that has developed the world’s most secure system for voice communication.

CARICERT

CARICERT

CARICERT is the National Cyber Emergency Response Team of Curacao in the Caribbean.

US-Africa Cybersecurity Group (USAFCG)

US-Africa Cybersecurity Group (USAFCG)

USAFCG provides cybersecurity consulting services and delivers training programs for capacity building in Africa.

Zercurity

Zercurity

Zercurity is on a mission to build the ultimate cybersecurity operations platform for businesses. To help protect against a growing number of internal and external threats.

SystemExperts

SystemExperts

SystemExperts is a premier provider of IT compliance and cyber security consulting services.

UTMStack

UTMStack

UTMStack is a Unified Security Management system that includes SIEM, Vulnerability Management, Network and Host IDS/IPS, Asset Discovery, Endpoint Protection and Incident Response.

Outseer

Outseer

Outseer is a leading technology company in the fight against payments fraud. Outseer reliably determines authentic customers from fraudulent behavior.

RedHunt Labs

RedHunt Labs

RedHunt Labs is a premier Cybersecurity Solutions provider, offering Attack Surface Management solution 'NVADR' and Penetration Testing services.

Matrium Technologies

Matrium Technologies

Matrium Technologies has been a leading provider of technology solutions since 1991, with a strong industry background in Network Testing, Network Visibility and Security.

Gridware

Gridware

Gridware is a specialised cybersecurity consultancy firm and an emerging global player in the cybersecurity intelligence and advisory field.

Zluri

Zluri

Zluri is a cloud-native SaaSOps platform enabling modern enterprises with SaaS Management and Identity Governance.

GO Business

GO Business

GO Business are a specialised B2B team within GO that caters to the communication needs of the local business community in Malta.

The Aerospace Corporation

The Aerospace Corporation

The Aerospace Corporation is playing a key role in advancing space cybersecurity through innovative prototypes that can quickly detect and mitigate cyber threats.