What happened: Thousands of Israeli websites were hacked yesterday with their content replaced with a video showing the “destruction of Israel”.
- The cyberattack, claimed by a group called Hackers of Saviour, is not thought to be related to Iran or its recent cyber exchange with Israel. The hackers, most likely from Gaza, Turkey and North Africa, operated through a Facebook group set up on 11 April with 9 members. The unsophisticated attack carried out site defacement. The hackers took advantage of a familiar weakness in the WordPress server in which they entered the Israeli company uPress who hosted the attacked sites.
- The Facebook group admin “Haloo Looya” boasted his success on the page, saying: “Our big surprise done. You can see each news all over the world!”
- uPress said in a statement that it is working with Israel’s National Cyber Security Authority to retrieve the website’s original content.
- The cyberattack came one day ahead of the Iranian Quds Day. Last week, the National Cyber Security Authority warned of potential cyberattacks ahead of Quds Day, in which rallies are held across the country and aim to show support for the Palestinians.
- Iran’s parliament on Monday unanimously passed legislation banning “any cooperation” with Israel — specifically including the use of Israeli computer hardware and software — as a crime against God. Earlier this week, Supreme Leader called for a “final solution” to the Israel problem, and for arming the West Bank, “just as Gaza,” in order to expedite it.
Context: Yesterday’s cyberattack follows a major cyber exchange between Israel and Iran.
- In late April, Israeli media attributed a recent cyberattack on Israeli water infrastructure to Iran. The attack, according to intelligence officials, attempted to introduce chlorine and other chemicals into the drinking water, but failed and did not do palpable damage.
- On 7 May, Israel reportedly carried out a sophisticated cyberattack on the Iranian Shahid Rajaee port, causing widespread chaos.
- The Washington Post‘s correspondent who first reported the Israeli retaliation, Joby Warrick, told Kan News diplomatic reporter Amichai Stein, “The damage was far more significant than what the Iranians describe. Satellite images show columns of trucks trying to reach the port, of ships waiting to reach the port, and we heard descriptions that everything was disabled and chaotic.”
- This week Maj. Gen. (res.) Amos Yadlin, director of the Institute for National Security Studies, said in an interview to Army Radio that the attack on the Iranian port “displayed the cyber ability of a world power”. Yadlin also tweeted: “If this cyberattack was indeed Israel’s response to the Iranian attack on civilian infrastructure (water and sewage systems), Israel is sending an important message to Iran regarding the vulnerability of key elements of Iran’s economy to Israeli cyber capabilities.”
- According to Yediot Ahronot security correspondent Alex Fishman, Iran chose to focus on cyberattacks in retaliation for what appeared to be a rising number of IDF attacks against Iranian military facilities and weapons in Syria.
Looking ahead: Cyberattacks between Israel and Iran is not a new development. However, the targeting of Israel’s national water infrastructure represented a serious escalation by Iran.
- Whether the Iranian cyberattack was a response to the rise of IDF activity in Syria or not, Israel made it clear that it would not hesitate to retaliate more severely.