Hackers acting in Turkey’s interests believed to be behind recent cyberattacks

A senior Turkish official did not respond directly to questions about the campaign but said Turkey was itself frequently a victim of cyberattacks. (File/Shutterstock)
Short Url
Updated 27 January 2020

Hackers acting in Turkey’s interests believed to be behind recent cyberattacks

  • The attacks involve intercepting Internet traffic to victim websites
  • Intelligence suggests the attacks bear the hallmarks of Turkish interests

LONDON: Sweeping cyberattacks targeting governments and other organizations in Europe and the Middle East are believed to be the work of hackers acting in the interests of the Turkish government, three senior Western security officials said.
The hackers have attacked at least 30 organizations, including government ministries, embassies and security services as well as companies and other groups, according to a Reuters review of public Internet records. Victims have included Cypriot and Greek government email services and the Iraqi government’s national security adviser, the records show.
The attacks involve intercepting Internet traffic to victim websites, potentially enabling hackers to obtain illicit access to the networks of government bodies and other organizations.
According to two British officials and one US official, the activity bears the hallmarks of a state-backed cyber espionage operation conducted to advance Turkish interests.
The officials said that conclusion was based on three elements: the identities and locations of the victims, which included governments of countries that are geopolitically significant to Turkey; similarities to previous attacks that they say used infrastructure registered from Turkey; and information contained in confidential intelligence assessments that they declined to detail.
The officials said it wasn’t clear which specific individuals or organizations were responsible but that they believed the waves of attacks were linked because they all used the same servers or other infrastructure.
Turkey’s Interior Ministry declined to comment. A senior Turkish official did not respond directly to questions about the campaign but said Turkey was itself frequently a victim of cyber attacks.
The Cypriot government said in a statement that the “relevant agencies were immediately aware of the attacks and moved to contain” them. “We will not comment on specifics for reasons of national security,” it added.
Officials in Athens said they had no evidence the Greek government email system was compromised. The Iraqi government did not respond to requests for comment.
The Cypriot, Greek and Iraqi attacks identified by Reuters all occurred in late 2018 or early 2019, according to the public Internet records. The broader series of attacks is ongoing, according to the officials as well as private cybersecurity investigators.
A spokeswoman for the UK’s National Cyber Security Center, which is part of the GCHQ signals intelligence agency, declined to comment on who was behind the attacks. In the United States, the Office of the Director of National Intelligence declined to comment on who was behind the attacks and the Federal Bureau of Investigation did not respond to a request for comment.

Hijacked
The attacks highlight a weakness in a core pillar of online infrastructure that can leave victims exposed to attacks that happen outside their own networks, making them difficult to detect and defend against, cybersecurity specialists said.
The hackers used a technique known as DNS hijacking, according to the Western officials and private cybersecurity experts. This involves tampering with the effective address book of the Internet, called the Domain Name System (DNS), which enables computers to match website addresses with the correct server.
By reconfiguring parts of this system, hackers were able to redirect visitors to imposter websites, such as a fake email service, and capture passwords and other text entered there.
Reuters reviewed public DNS records, which showed when website traffic was redirected to servers identified by private cybersecurity firms as being controlled by the hackers. All of the victims identified by Reuters had traffic to their websites hijacked — often traffic visiting login portals for email services, cloud storage servers and online networks — according to the records and cybersecurity experts who have studied the attacks.
The attacks have been occurring since at least early 2018, the records show.
While small-scale DNS attacks are relatively common, the scale of these attacks has alarmed Western intelligence agencies, said the three officials and two other US intelligence officials. The officials said they believed the attacks were unrelated to a campaign using a similar attack method uncovered in late 2018.
As part of these attacks, hackers successfully breached some organizations that control top-level domains, which are the suffixes that appear at the end of web addresses immediately after the dot symbol, said James Shank, a researcher at US cybersecurity firm Team Cymru, which notified some of the victims.

Victims
Victims also included Albanian state intelligence, according to the public Internet records. Albanian state intelligence had hundreds of usernames and passwords compromised as a result of the attacks, according to one of the private cybersecurity investigators, who was familiar with the intercepted web traffic.
The Albanian State Information Service said the attacks were on non-classified infrastructure, which does not store or process any “any information classified as ‘state secret’ of any level.”
Civilian organizations in Turkey have also been attacked, the records show, including a Turkish chapter of the Freemasons, which conservative Turkish media has said is linked to US-based Muslim cleric Fethullah Gulen accused by Ankara of masterminding a failed coup attempt in 2016.
The Great Liberal Lodge of Turkey said there were no records of cyber attacks against the hijacked domains identified by Reuters and that there had been “no data exfiltration.”
“Thanks to precautions, attacks against the sites are not possible,” a spokesman said, adding that the cleric has no affiliation with the organization.
The cleric has publicly denied masterminding the attempted coup, saying “it’s not possible,” and has said he is always against coups.
A spokesman for Gulen said Gulen was not involved in the coup attempt and has repeatedly condemned it and its perpetrators. Gulen has never been associated with the Freemason organization, the spokesman added.


Hit play: Sports content takes on new life on social media

Updated 26 October 2020

Hit play: Sports content takes on new life on social media

  • Sport — along with related topics like fitness and health — is one of the top three categories on TikTok right now

DUBAI: Whether you are playing or watching, sports are best enjoyed in person. But with social distancing measures in place since earlier this year, like many other activities, sports have gone virtual.

In May, when ESPN aired the final two episodes of its Michael Jordan docuseries “The Last Dance,” 20 of the 30 trending topics on Twitter were related to it. That night saw more than 1.5 million tweets about the final episode, bringing the total volume of tweets about the series above 11 million. Even before the pandemic, in 2019, 22 percent of consumers were seeking sports content on social media — up 47 percent from just 2016.

In fact, sport — along with related topics like fitness and health — is one of the top three categories on TikTok right now. “In the last couple of months, we have built a concentrated community that started allowing us to engage with different pillars of fitness and health,” said Rami Zeidan, head of video and creative at TikTok. These pillars include everything from fitness motivation and health, lifestyle and workout tips to stunts and street performances, such as parkour and freestyle football.

A 2020 study in Saudi Arabia found that 73 percent of people on Twitter are football fans, with 85 percent of them using Twitter to follow along while watching a game on TV. The respondents also said that they use Twitter to follow the official accounts of players (27 percent), to check out the latest video clips (38 percent) and to view pre-match news and post-match analysis (28 percent). The football fandom on the platform is evidenced by the 91 million tweets related to the 2019-20 Saudi Professional League (SPL) season just this month.

According to recent research by Twitter, football is the most popular sport on the platform in Saudi Arabia. In fact, the SPL season was marked by a three-day Twitter campaign that was launched on Oct. 19 under the hashtag روح_الدوري# (“The League’s Spirit”). The first day of the campaign saw Twitter’s account in the Middle East invite comedians to share their takes on the best SPL commentary moments. These were shared through voice tweets, which add a more human dimension to conversations and which allowed the comedians to incorporate their own personal style in the commentary. Although the feature is currently being tested on iOS devices, everyone on Twitter is able to hear voice tweets and reply to them.

FASTFACTS

Sport and Social Media

- 73% of Twitter users are football fans.

- Sports is one of the top three content categories on TikTok.

- 520% more Instagram Live videos were produced from March-July 2020, compared to 2019.

The focus for the second day of the campaign was Video Assistant Referee (VAR) technology. The comedians created their own VAR moments through humorous video content shared on the platform, which illustrated real-life scenarios in which VAR could come in handy — for example, to settle a challenge between friends or to find out who really spilled the popcorn. “Fans have always turned to Twitter to be part of the action in real time. We’re seeing the passion and energy of the football stadium now surging online. Twitter is where fans, players, experts and leagues weigh in with a range of viewpoints. With humor being a key element of Twitter conversation in Saudi, the روح_الدوري# campaign brought levity to a much-anticipated event in the Kingdom,” said Kinda Ibrahim, director of media partnerships, Middle East and North Africa, Twitter.

More than 170 million people follow fitness-related accounts (e.g. weightlifting, cycling, yoga, etc.) on Facebook, and more than 120 million people follow similar accounts on Instagram. Based on an index of Facebook and Instagram’s top fitness partners, 75 percent more Facebook Live videos were produced during the months of March through July in 2020 as compared to 2019, while 520 percent more Instagram Live videos were produced during the same months as compared to 2019. These numbers have resulted in the company capitalizing on the rise of sports and fitness content by building a team to focus on fitness, introducing products to help fitness businesses build an audience and generate revenue, and planning a Fitness Summit, where Facebook will share the latest product tips and best practices with fitness organizations. 

Even for fans that consume sports content on more traditional media like TV, social media platforms are almost always a part of the experience as a second screen. For instance, Snapchatters in the US send Snaps and Chats to their inner circle (29 percent), watch friends’ Stories (28 percent), post their own Stories (20 percent) and check out Discover highlights and shows (26 percent) while watching sports. Moreover, approximately 30 percent want sports leagues to use Snap to go behind the scenes, share news and player interviews, and tap into augmented reality (AR) that recreates the sporting venues they cannot visit.

The Middle East and North Africa region is among the most socially active and engaged regions, as well as one that loves consuming sports content. Social media plays a huge role, whether it is for clubs like Al-Ahli, celebrities like Mo Salah or independent social media fitness star Walid Yari. And with 26 to 33 percent of people in Saudi Arabia, the UAE, South Africa and Egypt saying that they use social media to follow sports news and events, it is time for brands to start paying attention. The sports industry is already realizing the power of social media, but advancements in technologies such as AR, accelerated by post-pandemic digitization, present new opportunities for growth.