Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

56 5. CYBER ATTACK AGAINST INTERNAL DISSIDENTScustomized tools. 110 Despite their simplicity though, these attacks were actually somewhateffective. In an interesting counter-attack, the Iran news site Fars News added some codeto their home page that would redirect the attack to pro-opposition Web sites. However,it was noted that this did not discourage the dissident attacks. 111 This is possibly the sameincident described earlier in the chapter by the Harvard researchers.The Iranian Cyber Army (ICA)The Ahmadinejad regime ultimately weathered the storm following the June 2009 election.However, Twitter had caused great international embarrassment to the government as thisallowed first-hand information to be reported from the protesters to international news mediaorganizations. Supporters of the Iranian regime were likely interested in seeking some sortof retribution. In December 2009, the proregime element got their chance with a “hack” ofTwitter—disabling the service for several hours. 112 The group claiming responsibility isknown as the “Iranian Cyber Army” (hereafter, ICA) and had managed to replace Twitter’shome page with a Web site stating “THIS SITE HAS BEEN HACKED BY THE IRANIANCYBER ARMY” followed by some anti-US rhetoric. 113 The truth was that this hacking grouphad not actually broken into Twitter’s server, but conducted a domain name hijacking. Allcomputers connected to the Internet can be identified by their Internet protocol (IP) address.However, to avoid having users remember such addresses, domain name service (DNS)servers act as sort of an “address book” resolving standard Web site hostnames to IP addresses.The ICA managed to change the corresponding IP address for Twitter, directing user’s to one oftheir servers. 114 Though it is unclear how the ICA accomplished this, there are a few ways tohijack a domain name. One straightforward method is to deceive the domain name registraror register organizations into allowing the hijacker to reassign the site a new IP address. Analternative would be DNS poisoning. In this type of attack, the hackers corrupt the informationon the DNS server (by hacking into that system) causing it to send users to an IP address ofthe hacker’s choosing rather than the desired destination. Often, DNS poisoning attacks arelimited geographically as the user base of a given DNS server is normally limited in space.Either type of attack requires much less computing resources (from the attacker) than aDDoS, but is somewhat easier to overcome—particularly for a firm like Twitter. It is likely thatthe ICA wanted to simply grab headlines and give the appearance that they exacted revengeagainst Twitter. If that was their intent indeed, then they seem to have succeeded.In another high-profile attack, the ICA targeted the Chinese search engine Web siteBaidu. 115 The Baidu attack was similar to the Twitter incident and resulted in a similaroutcome—the site was unavailable for several hours. 116 A third site was DNS hijacked at thesame time of the Twitter attack—the homepage of the Green Movement—mowjcamp.com.The Green Movement is an opposition group that played a key role in the postelection protests.117 Unlike Twitter and Baidu, the Green Movement was offline (with respect to its DNSname) for 6 weeks following the attack. 118 The difference is whereas Twitter and Baidu areconnected to Tier 1 or Tier 2 ISPs, the Green Movement was more on the periphery of theInternet. As described in the introductory part of this chapter, Tier 3 ISPs are usually lackingthe technical expertise and bureaucratic resources of the larger companies, so that the GreenMovement was forced to work through the time-consuming bureaucracy encountered with