Who Is Syrian Electronic Army: 9 Facts

[kalu_miah]

Who Is Syrian Electronic Army: 9 Facts -- InformationWeek

Who Is Syrian Electronic Army: 9 Facts

SEA: Virtual Army In A Civil War

Beware patriotic Syrian hackers holding a media grudge.

That's one takeaway from the ongoing exploits of the Syrian Electronic Army, a self-described group of grassroots Syrian hackers who support Syrian President Bashar al-Assad.
During the country's two-year -- and counting -- civil war, the Syrian Electronic Army has been deployed as a propaganda tool to correct perceived slights or misinformation being disseminated via media outlets that the group sees as sympathetic to Syrian rebels. Its modus operandi is to compromise the Twitter and Facebook accounts of its targets, which are predominantly media outlets. The group's most well-known exploit to date was seizing control of multiple Associated Press (AP) Twitter feeds, then using them to issue bogus messages, including the following alert on April 23: "Breaking: Two Explosions in the White House and Barack Obama is injured."
In the wake of that tweet, the White House confirmed that the president was unharmed, that there had been no explosions and that the FBI was investigating the hoax tweets. Due to automated high-speed trading systems set to monitor Twitter feeds, however, the news triggered a temporary downturn in the U.S. stock market that briefly erased $200 billion in value. According to Th3 Pr0 (pronounced "the pro"), the self-described 18-year-old "leader of special operations department" for the Syrian Electronic Army -- personal website tagline: "proud to be pro-Assad hacker" -- the hack was in retaliation for Network Solutions having seized the group's domain names, as well as for the United States "supporting the terrorist groups in Syria."
"We generally target the most malicious media, especially those who refuse to cover both sides of the war," a member of the SEA's "Special Operations Division," known as the Shadow, told Vice magazine.
Other media outlets targeted by the group have included CBS, AFP, Sky News Arabia and E! Online, with the hackers using a seized Twitter feed at the celebrity news site to announce earlier this month that Justin Bieber was gay, before telling Bieber fans they'd been "trolled." That followed its March compromise of multiple BBC Twitter accounts, which the group used to post anti-Semitic rants as well as to offer the following report via the BBC's Twitter weather feed: "Saudi weather station down due to head-on collision with camel."
In May, meanwhile, the group seized control of the Twitter account for satire site the Onion. "UN retracts report of Syrian chemical weapon use: 'Lab tests confirm it is Jehadi body odor,'" reported one hoax tweet. Another said that the Onion's CEO said he regretted "taking Zionist money to defame Syria."
Obviously, the hacking group has its own perspective on not only the Syrian conflict, but what constitutes balanced reporting. For example, another hoax tweet -- posted to a hacked a Reuters Twitter account last year -- read: "White house spokesperson says financial and technical support given to #AlQaeda operatives in #Syria."
As that tweet illustrates, the Syrian Electronic Army persistently attempts to reframe the country's civil war as a conflict perpetrated by foreign powers that are arming terrorists and bringing them into the country in a bid to overthrow the legitimate Syrian government.
The hackers' perspective parallels more widespread, pro-Assad propaganda based on accusing many Western media outlets of not just bias, but also "persistent media warmongering, faking news and fabricating … stories." That's according to a report on the Syria News website, which claimed that "terror NATO sponsors" were "airlifting, training, arming, financing and smuggling Al-Qaeda terrorists" into Syria.

No Love Lost For Angelina Jolie

The Syrian Electronic Army emerged soon after the Syrian uprising began in 2011, defacing Facebook pages with pro-Assad messages that ranged from sweet -- "I love Bashar" -- to threatening. Anti-Assad activists said at the time that the group was founded by former intelligence agents and hardcore Assad supporters.
In September 2011, the group defaced Harvard University's website with a picture of Assad, and threatened retaliation against the United States for supporting the uprising. The defacement was signed with this message: "Syrian Electronic Army were here." The group also targeted the websites for Newsweek, Oprah Winfrey and Brad Pitt, after his partner, Angelina Jolie -- a U.N. special envoy -- visited Syrian refugees in Turkey.
A subsequent hoax tweet said that Angelina Jolie -- after she visited a Syrian refugee camp in Jordan in December 2012 -- had admitted that "Jordan is to blame for the Syrian refugees' atrocious conditions." Links included with the tweets redirected to malicious websites, as the group had done with its CBS Twitter account takeover.
Jolie appears to be an ongoing source of anger for the SEA. "We know the likes of Jolie, who under the 'humanitarian' cover, only serve American imperialism," said the Shadow.

Syrian Civil War Continues

The bigger picture is that the Syrian Electronic Army is serving as a propaganda tool in the ongoing, bloody two-year Syrian civil war. To date, the conflict has likely killed at least 94,000 people, although new information suggests that combatants are underreporting causalities, and more than 120,000 people may have been killed, according to the Syrian Observatory for Human Rights (SOHR).
"The number of documented casualties since the beginning of the Syrian uprising [March 18, 2011] exceeds 94,000 people," according to a post to the group's Facebook account. "The SOHR estimates that the actual number of violent deaths is more than 120,000, due to the tens of thousands of captives, detainees and forcibly disappeared persons. As well as the secrecy of all combatant sides about the actual number of dead during clashes."
At least 41,000 of the soldiers and civilians killed were Alawites, which is the sect of President Bashar al-Assad, reported Reuters. The Alawite sect spun off from Shi'ite Islam and comprises about 12% of Syria's population. The Alawites were an oppressed minority until 1970, when President Assad's father Hafez took control of the country via a coup.
The Syrian civil war grew out of nonviolent protests against four decades of rule by the Assad family. The 2011 protests were comprised largely of Sunni Muslims, a sect that comprises about 70% of Syria's population, as well as Syrian Kurds, who are an ethnic minority. The government's violent crackdown on the so-called Arab Spring protests helped trigger a full-blown conflict between the Assad regime and factions seeking to remove his Ba'ath Party from power.

Origin Story: Patriot Hackers Emerge

The Syrian Electronic Army most likely wasn't created to serve as a social media nuisance operation for revenging perceived slights against the Assad regime, perpetrated by Western media. So, where did it come from?
By some accounts, the group began as a grassroots movement, staffed by "volunteers without any known backing" who proved their mettle, gaining the support of Assad "loyalists" as well as the head of the country himself.
But according to a National Public Radio report in March 2013, the Syrian Electronic Army was launched by the Syrian government in 2011 to use Facebook to identify, track and facilitate the arrest -- and according to critics of the regime, torture -- of anti-government activists.
Syrian hacker Ahmad Heidar ("Harvester") told NPR that in the summer of 2011, as protests in Syria began to spread and intensify, a government recruiter signed him up to the new unit, which operated from an underground bunker filled with state-of-the-art computer equipment. Heidar was told that working for the unit would count toward his mandatory national military service, and one of his tasks was to hack into the Facebook and Skype accounts of arrested activists, to remove all traces of their anti-government work.
In response to the report, the Syrian Electronic Army last month hacked into the National Public Radio Twitter feed.

 

[kalu_miah]

Assad's Computer Club Connection

The Syrian Electronic Army has more than passing ties to Assad. Although the Syrian leader trained in Britain as an eye doctor, in the 1990s he headed Syria's Computer Society -- pushing for better computer education for the country's children -- before succeeding his father as president of the country in 2000. Interestingly, the Syrian Electronic Army's first domain name "was registered by the Syrian Computer Society," Helmi Noman, a senior researcher at the Citizen Lab at Toronto University, told CNN.
In addition, the domain is "hosted on the network of the Syrian government, which is interesting because it's the first time we've seen a group with questionable activities being hosted on a national computer network," he said, though he also noted that it's not proof that the hackers are government-funded.
A recent Guardian report, however, said the Syrian Electronic Army is bankrolled by Assad's billionaire cousin Rami Makhlouf, and that the group recently relocated from Syria to Dubai. "Makhlouf pays the pro-regime hackers for their activities, and they typically earn $500-$1,000 for a successful attack," according to the Guardian. "They also get free accommodation and food. Sometimes Syrian government officials tell the SEA which western sites to hack; on other occasions the SEA selects its own targets."
In response to that report, the Syrian Electronic Army seized more than 11 Guardian Twitter feeds, using them to decry the British paper's "lies and slander about Syria."
A pro-Assad media outlet likewise dismissed the paper's reporting. "Dubai is located in the United Arab Emirates, some 3,000 kilometers away from Damascus, but sitting in London thinking how to amuse the readers with fancy tales, our best guess is the authors, especially Mr. Harding, thought Dubai is somewhere in Syria, or Damascus is somewhere near Dubai."

Blackout Triggered Syrian Hacker Holiday

Is the Syrian Electronic Army based in Syria? After Syria reestablished its Internet connection last week -- following a blackout that lasted approximately 24 hours -- security experts wondered when the hackers might resume their attacks.
With that question floating around the Internet, the group responded: "But wait ... we are in Dubai!" read a tweet from the @Official_SEA12 Twitter account.
The Dubai quip was made in response to the aforementioned Guardian report last month that "according to defectors from inside its ranks, the group moved last year from Damascus to a secret base in Dubai."
The group's members later clarified that they were in Syria, and had been affected by the Internet outage. "Unfortunately it is true, though mobile phones worked intermittently due to a large number of Syrians using them as an alternate form of communication," said the Shadow. "These kinds of cuts do not affect the terrorists operating in Syria as they have their own US-supplied communication equipment. The blackout effectively shut down our operations, we are glad to be back."
Ditto, no doubt, for an eight-hour blackout that -- according to data provided by Arbor Networks -- began at about 8:30 a.m. Eastern Time on May 15, and lasted until just after 4 p.m. The cause of the blackout isn't known, although Internet monitoring firms suspect last week's blackout was due to the civil-war-torn country's weak infrastructure.

Phishing Attacks Seize Twitter Accounts

How does the Syrian Electronic Army compromise targeted Twitter or Facebook accounts? According to an account published by the Onion, the attackers used spear-phishing emails that included an apparent link to a Washington Post story, but which really lead to a malicious website that requested users input their Gmail credentials. Attackers then used that information to gain access to Twitter accounts with that email on file.
While no other media outlets have offered details of how they were compromised, security experts suspect that phishing attacks were also used against AP and Human Rights Watch, with the phishing email links redirecting to Google or Microsoft webmail sites.
In the wake of the AP breach, Twitter was reportedly testing a two-factor authentication system. Once implemented, such a system should make it more difficult for attackers to compromise accounts via spear-phishing attacks.
The Syrian Electronic Army, however, has promised to continue compromising Twitter accounts. "It will definitely make it harder on Twitter, but this was never our primary attack vector," said the Shadow. "Nevertheless, there are still some security holes in Twitter's model that we hope to exploit in the future so no one should get too comfortable, we are not going to give up."

Group Denies Israel Control System Hack

The Syrian Electronic Army's hacking remit has limits. Notably, the group last week denied reports that it claimed to have hacked into a primary Israeli critical infrastructure system. "We would like to announce that in response to the unfair and illegal attacks, taken place by Israel on DATE, SEA has penetrated one of the main infrastructural systems (SCADA) in Haifa and managed to gain access to some sensitive data. Also SEA is now able to cause irrecoverable damages to the Israeli's infrastructural systems," read an email sent to some news outlets and signed as being from the Syrian Electronic Army (SEA), which included a link to a PDF file meant to validate the supposed control system intrusion.
But a member of the Syrian Electronic Army told Softpedia that the email was a fake, and said the group never emails media outlets.

Hack-And-Tell Hurdle: Domain Name Seizures

Beyond hoax hacking reports, the Syrian Electronic Army has faced a few other recent challenges, such as having multiple domains seized by its domain registration firm. "After we communicated with the host/domain names company 'Network Solutions' [it] ... said that the reason for shut down the domains names is 'U.S. sanctions,'" according to a post to the group's subsequently launched site, sea.sy. It said the seized domains were syrian-es.org, syrian-es.com and syrian-es.net, and that it would continue to use its backup domain, syrianelectronicarmy.com.
"Current domain registration information for syrian-es.com, syrian-es.org, and syrian-es.net shows that the current registrant is OFAC Holding," according to a report published by HP Security Research. "OFAC is the Treasury Department Office of Foreign Assets Control under their Office of Terrorism and Financial Intelligence."
Domain names aren't the only online real estate that the Syrian Electronic Army is having difficulty retaining. As the group has used Twitter accounts to publicize attacks, Twitter has suspended those accounts, creating a whack-a-mole situation that saw the introduction of new account "@Official_SEA," which Twitter subsequently froze, leading to multiple variations. Currently the count stands at @Official_SEA12, which the group has held for a relatively long time, suggesting that it has stopped using the account to announce its latest Twitter hacks.

 

[Syrian Lion]

S.E.A is independent organization defending Syrians and Syria in the media war...

 

[Yzd Khalifa]

Eh? Their endless defence mechanism was exposed long time ago.