http://www.guardian.co.uk/technology/2013/apr/29/hacking-guardian-syria-background

 

Syrian Electronic Army: Assad's cyber warriors

Phishing attack is latest by pro-Assad hackers operating out of Dubai, who target sites with views opposed to their own

• Luke Harding and Charles Arthur
• The Guardian, Monday 29 April 2013

The logo for the Syrian Electronic Army.

In recent weeks, the self-styled Syrian Electronic Army (SEA) has launched hacking attacks on the BBC, the Associated Press (AP) and most recently the Guardian. Last week the group succeeded in hijacking AP's main Twitter account, with 1.9 million followers. It falsely claimed that President Obama had been injured in an explosion. AP corrected the message, but not before $130bn had been briefly wiped off the value of stocks.

Online pro-revolution activists have been one of the defining features of the ongoing Arab Spring. In Syria, opposition activists have played a crucial role in the struggle against President Bashar al-Assad. Over the past two years they have uploaded numerous videos of anti-Assad demonstrations to YouTube, posted gruesome footage of victims killed by government forces, and helped shape political perceptions in the west, as EU leaders inch towards arming Syria's moderate opposition.

But unlike Tunisia, Egypt and Libya – whose former regimes were caught badly off guard – Assad's government has been fighting back. It has created an increasingly rambunctious group of counter-revolutionary hackers. These hackers have a twin function: to punish western news organisations seen as critical of Syria's regime, and to spread Damascus's alternative narrative.This says that the war in Syria isn't a popular uprising against a brutal, despotic family-military dynasty but rather an attempt by Islamist terrorists to turn Syria into a crazy al-Qaida fiefdom.

The Syrian Electronic Army (SEA) sprang up in 2011 at the beginning of the anti-Assad revolution. According to defectors from inside its ranks, the group moved last year from Damascus to a secret base in Dubai. (Some pro-regime volunteers remain inside Syria, but they are at greater risk there of being unmasked and killed.) The Syrian government is widely believed to be behind the SEA's activities. In a speech to Damascus universityin 2011, Assad likened these anonymous online warriors to his frontline troops: "The army consists of the brothers of every Syrian citizen … Young people have an important role to play at this stage, because they have proven themselves to be an active power. There is the electronic army, which has been a real army in virtual reality."

Opposition activists claim Assad's billionaire cousin, Rami Makhlouf, bankrolls the SEA and masterminded its move out of Syria. The SEA now operates out of one of Makhlouf's shadowy Dubai companies, they add, citing information from a former SEA activist, who defected and is now in hiding. Makhlouf pays for food and accommodation. Pro-Assad activists earn around $500-$1,000 for high-profile attacks on western targets – a huge sum for most Syrians. The SEA mainly comprises Alawites from Assad's embattled minority Shia sect, but also includes Sunnis – most of whom back the opposition – and Christians. It receives sporadic technical assistance from Russia, Assad's key backer, opposition sources allege.Like their Syrian counterparts, Kremlin bloggers actively target Vladimir Putin's critics, with Russian hackers among the best in the world.

"There are a lot of [pro-regime] Syrian hackers inside Syria and outside Syria," Tareq al-Jaza'eere, an opposition cyber-activist, said. "The Syrian government gives them money to fight an electronic war against the rebels. They are doing hacks. They are doing social media. Their message is there is no revolution. They say there is a terrorist gang fighting the government."

Al-Jaza'eere added: "The SEA sometimes works according to orders from Damascus. Sometimes they work on their own. They attack websites like the Guardian or the BBC because they don't want them to tell the truth." Asked which side was winning this noisy cyber-battle, he said: "We are. The SEA are making fools of themselves."

Analysts say the SEA's hacking attacks are crude but effective.

The outfit's official website, hosted in Syria, boasts of its numerous successes and shows activists in military fatigues sitting in front of a bank of computers. Their faces are cropped out. It says that its hackers are organised into battalions, with names such as Wolf, the Pro and the Shadow. The site features two "martyrs": young men in T-shirts and mirrored sunglasses who are said to have died for the regime's cause. It also links to pro-Assad Facebook pages.

All the SEA attacks have been carried out via "phishing" emails which lure recipients into thinking that they are at the login site for their email, so that the hackers can capture email addresses and passwords. The phishing sites used against the Guardian were registered in Cyprus, though they pointed to a site in the US which "hosts a whole load of malware", according to Rik Ferguson of the security company Trend Micro. Ferguson described the hackers' work as ""very visible" and commented: "They aren't terrible at what they do, but you'd have to say from their choice of targets – the GuardianBooks Twitter account, the BBC Weather account – that the hacks aren't serving any great purpose." Other accounts hacked include BBC Arabic Online, Deutsche Welle, France 24 and Human Rights Watch.

The attacks differ sharply from those on the Washington Post and New York Times, where Chinese state-sponsored hackers silently broke into the systems in 2012 and monitored activities and connections within them for up to four months before being discovered. That is believed to have been done through documents carrying malware which infected specific users' computers when clicked on.

The SEA site says it fights "fabricated news" spread by the Arab and western media about what is happening in Syria. One member of the SEA told the website vice.com: "We're all Syrian youths who each have our specialised computer skills, such as hacking and graphic design. Our mission is to defend our proud and beloved country Syria against a bloody media war that has been waged against her. The controlled media of certain countries continues to publish lies and fabricated news about Syria."