The Cyber Arena Attacks are Expanding, Both Against Iran and Against Israeli Society
While the cyber attack attributed to Israel paralyzed fuel stations in Iran this week, many in Israel are speculating about an Iranian 'influence campaign' aimed at sowing social discord here
Amir Rapaport
| 21/12/2023
Photo by Jorge Franganillo on Unsplash
It might be hard to believe, but hundreds of thousands of Israelis are collaborating with a cyber attack aimed at increasing hatred and polarization among different parts of society. Quite successfully, it must be said.
We will get to this unique attack on society, known professionally as an influence campaign, which is led primarily by Iran. However, it is crucial to understand that this is just one part of the broader cyber arena, which, in the past week, has escalated not only with an attack on the Ziv hospital in Safed, attributed to Hezbollah, but also – on the other hand - with an attack disrupting fuel supply in Iran, attributed to Israel.
And also this: Despite the cyber realm being an invisible domain, entirely based on virtual worlds and digital signals, it is possible to execute attacks within it that cause physical damage, much like on land, in the air, and at sea. The most well-known example is the sabotage of the centrifuges at Iran's Natanz uranium enrichment facility over a decade ago, through the Stuxnet cyberattack, attributed in foreign media to the United States, Britain, and Israel collectively.
One of the unique aspects of the cyber domain is that attacks can be carried out without explicitly taking responsibility, which is not possible in other domains. For example, if a missile is launched towards a certain party, it is always possible to determine its point of origin.
In the book Cybermania, which I co-authored with Prof. Eviatar Matania, the founder of the Israel National Cyber Directorate and currently heads the Security Studies program at Tel Aviv University – we emphasized that over time, the cyber dimension will play an increasingly significant role in global wars, much like the way the aerial dimension evolved with the advent of aviation a century ago and gradually became central.
What about the October 7th war? In contrast to several global publications, it began without a significant cyber attack from Hamas. There was no need for any: Hamas "blinded" the Israeli outposts by destroying cameras and communication facilities along the fence with firepower, and then flooded the area with thousands of Nukhba fighters. However, as time passed in the war, cyber attacks also increased.
Thus, websites in Israel have already been subjected to countless cyber attacks by Palestinian supporters worldwide. However, Israel is considered one of the most cyber-secure countries globally, and therefore, there has not been a significant impact on our national infrastructure.
One of the more harmful attacks recently occurred against the Ziv Hospital as part of Hezbollah's broader attack against Israel’s northern region.
As part of this attack, Hezbollah reportedly attempted to reach the central computers in the hospital to disable them, but managed to access only a few insignificant files. Nonetheless, according to expert estimates, this marks the first time that a hospital in Israel has been targeted in a cyber attack by an adversary. Previous attacks on hospitals, such as Hillel Yaffe and Misgav Ladach in recent years, were likely carried out by online criminal organizations attempting extortion.
In Cybermania, we also wrote that states can use a cyber attack in response to a physical attack, and it may be exactly what happened in the recent attack on Iran's fuel stations (according to Iran's Minister of Energy, about 70% of their activity was halted on Sunday): if Israel is indeed behind the attack, as foreign sources claim, it signals to the Iranians that they will pay a price not only within Israel but also for their support of their proxy organizations attacking us with real fire, from the Houthis in Yemen to Hezbollah.
Israel has not officially acknowledged responsibility for the attack, as stated by Iran's Minister of Energy. However, a group of hackers calling themselves "The Predatory Sparrow," which according to foreign publication is linked with Israel, published a message specifically addressed to the President of Iran, stating, "Khamenei - playing with fire has a price. A month ago, we warned you that we would make you pay for your provocations. Now, this is just a taste of what we are capable of." If this statement is accurate, it appears that cyber-attacks may only escalate further.
In the meantime, there is one area in cyberspace where the war against Israel has been quite successful: influence campaigns carried out by states against other states. These campaigns aim to weaken their targets and sow internal discord. The most successful influence campaign is often attributed to Russia and has caused a severe conflict between Democrats and Republicans in the United States.
The primary tool for any campaign is the dissemination of fake news. Technological tools now even allow for perfect forgery, also known as "deep fake." The problem is so severe that there is no ruling out the possibility that historians, in a few decades, will struggle to determine which events truly occurred in our world and what was merely fake, an absolute deception. In essence, the history itself may be subject to forgery. The struggle will be over truth and falsehood, what is accurate and what is not, what truly happened, and what is said to have happened. To the extent that the truth may become subjective.
Programs available today enable putting words in people's mouths which they did not say, and even showcase sophisticated forgeries as video clips. Deception is sown on the web by avatars, fictional characters created on the attacking body, and they even manage relationships among themselves to appear authentic. These avatars also establish connections with real humans on the web and infiltrate into groups within social networks and WhatsApp.
And there are also the trolls, whose main activity is focused on, well, trolling – deliberately provoking and disrupting discussions, smearing other participants in the network, bombarding them with false messages, and even diminishing other figures through sarcastic remarks against them or systematically contradicting their statements.
In the early stages of the war, Microsoft claimed that Russia was behind an influence campaign against Israel. However, a comprehensive investigation published this week by Haaretz in collaboration with the Fake Reporter organization, indicates that Iran is the one successfully systematically causing the heaviest damage within Israeli society.
Iran's activity has been known for some time, but its intensity is staggering. According to the investigation, Iran operates against Israeli society on WhatsApp, Twitter, Telegram, Facebook, and Instagram. It has created dozens of fake profiles and even dating platforms and fictional websites intended to play mind games with Israelis. Some of these websites generate news that never existed and was not created, then circulate it through various means.
During 2021-2022, the Iranian network focused on incitement and polarization within Israeli society, including spreading content aimed at sowing discord against the LGBTQ+ community or the ultra-Orthodox public. However, the main activity was, of course, related to the Israeli government’s judicial overhaul – spreading messages both for and against it. On election day, a "fake" was circulated in the name of Yair Netanyahu, as if the results were to be rigged.
And then came the war, and the conspiracy theories began spreading across the web about traitors from the inside and focusing on the hostages. The Iranians aim to destabilize Israeli society through the continuous dissemination of lies and relentless incitement.
Unfortunately, many in Israel collaborate with the Iranian campaign even when it is fairly clear that it involves fake or, at the very least, there is a good reason to be suspicious. The reasons for this collaboration can be political. The Iranians only need to release an image of the prime minister portrayed as Hitler, and the rest is done by us, for example. Unfortunately, social media platforms almost do not lift a finger to combat this phenomenon.
In recent days, a campaign has been launched against the phenomenon of excessive sharing, where we spread Iranian content ourselves. The initiative comes from the National Cyber Directorate. The head of the directorate, Brig. Gen. (res.) Gabi Portnoy, stated that "we have expanded our areas of activity beyond classical cyber issues to provide the public with tools to deal with intimidation and influence attempts...including technological tools that will continue to evolve over time."
However, as of now, the fight against sharing the ocean of fake news seems almost hopeless, much like the helplessness in the face of the human flood of the October 7th terrorists.
While the cyber attack attributed to Israel paralyzed fuel stations in Iran this week, many in Israel are speculating about an Iranian 'influence campaign' aimed at sowing social discord here
Photo by Jorge Franganillo on Unsplash
It might be hard to believe, but hundreds of thousands of Israelis are collaborating with a cyber attack aimed at increasing hatred and polarization among different parts of society. Quite successfully, it must be said.
We will get to this unique attack on society, known professionally as an influence campaign, which is led primarily by Iran. However, it is crucial to understand that this is just one part of the broader cyber arena, which, in the past week, has escalated not only with an attack on the Ziv hospital in Safed, attributed to Hezbollah, but also – on the other hand - with an attack disrupting fuel supply in Iran, attributed to Israel.
And also this: Despite the cyber realm being an invisible domain, entirely based on virtual worlds and digital signals, it is possible to execute attacks within it that cause physical damage, much like on land, in the air, and at sea. The most well-known example is the sabotage of the centrifuges at Iran's Natanz uranium enrichment facility over a decade ago, through the Stuxnet cyberattack, attributed in foreign media to the United States, Britain, and Israel collectively.
One of the unique aspects of the cyber domain is that attacks can be carried out without explicitly taking responsibility, which is not possible in other domains. For example, if a missile is launched towards a certain party, it is always possible to determine its point of origin.
In the book Cybermania, which I co-authored with Prof. Eviatar Matania, the founder of the Israel National Cyber Directorate and currently heads the Security Studies program at Tel Aviv University – we emphasized that over time, the cyber dimension will play an increasingly significant role in global wars, much like the way the aerial dimension evolved with the advent of aviation a century ago and gradually became central.
What about the October 7th war? In contrast to several global publications, it began without a significant cyber attack from Hamas. There was no need for any: Hamas "blinded" the Israeli outposts by destroying cameras and communication facilities along the fence with firepower, and then flooded the area with thousands of Nukhba fighters. However, as time passed in the war, cyber attacks also increased.
Thus, websites in Israel have already been subjected to countless cyber attacks by Palestinian supporters worldwide. However, Israel is considered one of the most cyber-secure countries globally, and therefore, there has not been a significant impact on our national infrastructure.
One of the more harmful attacks recently occurred against the Ziv Hospital as part of Hezbollah's broader attack against Israel’s northern region.
As part of this attack, Hezbollah reportedly attempted to reach the central computers in the hospital to disable them, but managed to access only a few insignificant files. Nonetheless, according to expert estimates, this marks the first time that a hospital in Israel has been targeted in a cyber attack by an adversary. Previous attacks on hospitals, such as Hillel Yaffe and Misgav Ladach in recent years, were likely carried out by online criminal organizations attempting extortion.
In Cybermania, we also wrote that states can use a cyber attack in response to a physical attack, and it may be exactly what happened in the recent attack on Iran's fuel stations (according to Iran's Minister of Energy, about 70% of their activity was halted on Sunday): if Israel is indeed behind the attack, as foreign sources claim, it signals to the Iranians that they will pay a price not only within Israel but also for their support of their proxy organizations attacking us with real fire, from the Houthis in Yemen to Hezbollah.
Israel has not officially acknowledged responsibility for the attack, as stated by Iran's Minister of Energy. However, a group of hackers calling themselves "The Predatory Sparrow," which according to foreign publication is linked with Israel, published a message specifically addressed to the President of Iran, stating, "Khamenei - playing with fire has a price. A month ago, we warned you that we would make you pay for your provocations. Now, this is just a taste of what we are capable of." If this statement is accurate, it appears that cyber-attacks may only escalate further.
In the meantime, there is one area in cyberspace where the war against Israel has been quite successful: influence campaigns carried out by states against other states. These campaigns aim to weaken their targets and sow internal discord. The most successful influence campaign is often attributed to Russia and has caused a severe conflict between Democrats and Republicans in the United States.
The primary tool for any campaign is the dissemination of fake news. Technological tools now even allow for perfect forgery, also known as "deep fake." The problem is so severe that there is no ruling out the possibility that historians, in a few decades, will struggle to determine which events truly occurred in our world and what was merely fake, an absolute deception. In essence, the history itself may be subject to forgery. The struggle will be over truth and falsehood, what is accurate and what is not, what truly happened, and what is said to have happened. To the extent that the truth may become subjective.
Programs available today enable putting words in people's mouths which they did not say, and even showcase sophisticated forgeries as video clips. Deception is sown on the web by avatars, fictional characters created on the attacking body, and they even manage relationships among themselves to appear authentic. These avatars also establish connections with real humans on the web and infiltrate into groups within social networks and WhatsApp.
And there are also the trolls, whose main activity is focused on, well, trolling – deliberately provoking and disrupting discussions, smearing other participants in the network, bombarding them with false messages, and even diminishing other figures through sarcastic remarks against them or systematically contradicting their statements.
In the early stages of the war, Microsoft claimed that Russia was behind an influence campaign against Israel. However, a comprehensive investigation published this week by Haaretz in collaboration with the Fake Reporter organization, indicates that Iran is the one successfully systematically causing the heaviest damage within Israeli society.
Iran's activity has been known for some time, but its intensity is staggering. According to the investigation, Iran operates against Israeli society on WhatsApp, Twitter, Telegram, Facebook, and Instagram. It has created dozens of fake profiles and even dating platforms and fictional websites intended to play mind games with Israelis. Some of these websites generate news that never existed and was not created, then circulate it through various means.
During 2021-2022, the Iranian network focused on incitement and polarization within Israeli society, including spreading content aimed at sowing discord against the LGBTQ+ community or the ultra-Orthodox public. However, the main activity was, of course, related to the Israeli government’s judicial overhaul – spreading messages both for and against it. On election day, a "fake" was circulated in the name of Yair Netanyahu, as if the results were to be rigged.
And then came the war, and the conspiracy theories began spreading across the web about traitors from the inside and focusing on the hostages. The Iranians aim to destabilize Israeli society through the continuous dissemination of lies and relentless incitement.
Unfortunately, many in Israel collaborate with the Iranian campaign even when it is fairly clear that it involves fake or, at the very least, there is a good reason to be suspicious. The reasons for this collaboration can be political. The Iranians only need to release an image of the prime minister portrayed as Hitler, and the rest is done by us, for example. Unfortunately, social media platforms almost do not lift a finger to combat this phenomenon.
In recent days, a campaign has been launched against the phenomenon of excessive sharing, where we spread Iranian content ourselves. The initiative comes from the National Cyber Directorate. The head of the directorate, Brig. Gen. (res.) Gabi Portnoy, stated that "we have expanded our areas of activity beyond classical cyber issues to provide the public with tools to deal with intimidation and influence attempts...including technological tools that will continue to evolve over time."
However, as of now, the fight against sharing the ocean of fake news seems almost hopeless, much like the helplessness in the face of the human flood of the October 7th terrorists.
