intrud3rs deface screenshot

Well, this is a new one: a Muslim hacker crew attacking the US because they believe the US created ISIS, and ISIS makes Muslims look bad. And then moving on to French universities in protest of what they say are racist admission policies and also, to show that , as their spokesman told us, “We have a mission: the mission is the muslims are not TERRORISTS !!”

Whether attacking government and educational institutions is or is not the best way to go about proving you’re not terrorists, nonetheless this newly-emergent crew has doubled down on the strategy and reached out to us to cover the hacks, which have taken place throughout the latter half of September.

As has become almost traditional, the attack consisted of the deface of single pages of much larger websites. Seven NASA URLs were hacked (not nine as claimed), all old and apparently unused pages belonging to the Kennedy Space Center, which has long since moved to a new URL from the old ksc.nasa.gov address which was defaced. The pages are now offline, although the deface can be seen at the Zone-H hacker tracker site. The affected  domains from this hacker sweep are: http://empl.ksc.nasa.gov/sys.htm, http://www.oakwoodohio.gov/x.php, http://science.ksc.nasa.gov/v.htm, http://weboflife.ksc.nasa.gov/v.htm, http://spectrum.ksc.nasa.gov/v.htm, http://physics.ksc.nasa.gov/v.htm, http://www.ci.miamisburg.oh.us/robots.txt, http://titan04.ksc.nasa.gov/mw.htm, and http://images.ksc.nasa.gov/mw.htm. The City of Oakwood site is back online, while the Miamisburg site is “under construction”.

We asked Sys Gh0st, the crew member who had contacted us about the attack, why NASA? He replied, “We targeted NASA  because it is a US government based site, and we are thinking that US government has something to have with the martyrs of Palestine.” S/He is referring here to the US’s ongoing support for Israel and Israel’s attacks on Palestinians in Gaza, a long-running inspiration for hacktivists over the last several years, from OpIsrael onward.

“We are not searching fame, but as you can see  we are spreading a certain message. We can be called “Intrud3rs” but we haven’t really a name, since we are not searching fame.” This in the email equivalent of cold-calling the newspaper, asking for coverage.

Sys Gh0st says the crew members responsible are Kuro’Sh, Prosox,  AkaTo’SH, and Rxr, and tweets from Kuro’SH’s account would appear to confirm this.

More ominously, Sys Gh0st told us that they’d found a vulnerability in the sites, and gained control of the database. There’s no evidence to support this claim, and for now it appears to be a simple deface rather than anything more sinister: the digital equivalent of slapping your own band flyer on top of your rival’s concert poster.

The French University sites were defaced in a similar manner: http://upv.univ-montp3.fr/, http://idefi-um3d.upv.univ-montp3.fr/sys.php, http://rirra21.upv.univ-montp3.fr , http://saeh.upv.univ-montp3.fr , http://relations-internationales.upv.univ-montp3.fr, http://culture.upv.univ-montp3.fr , http://crises.upv.univ-montp3.fr, http://hbgeo.upv.univ-montp3.fr, http://hbgeo.upv.univ-montp3.fr, http://boutique.upv.univ-montp3.fr/, http://beziers.upv.univ-montp3.fr/, and http://bio-eco-env.upv.univ-montp3.fr/ were the domains affected, the “upv” referring to the Université Paul Valéry. Some of the pages remain offline, while others have been restored. Again, the defaces were confirmed by Zone-H.

All of the French defaces are “signed” by IrBlood, aka Kuroi’SH aka Sys Gh0st, and according to Zone-H his hacking spree lasted up until October 5. Most of the sites simply have a one-line credit to the hacker, but others decry socialism, capitalism, and the attacks against Palestinians in Gaza. One of the defaces reads (all [sic]):

Hacked by IrBl00d (aka Kuroi’SH)
One day the marytrs of Palestine you caused will be paid…
If I say go to hell mofos…
For The creation of the pretext called Islamic State by your governement (if not you)
In addition to the Gaza Massacre, for the usage of our religion to take credit of your crimes, and for the false thoughts about the freedom ? your country is a trap for everyone, if you protest like I do, they will find a pretext to step by step kill you.
And after that we search to be respectable by trying to make the world better?
Let me laugh…
You’re the real terrorists
I prefer dying and tell what I think rather than living the same life everydays, and thinking I am free.. we are not some despisable tools for you fucking gov…
./Kuroi’SH Sahrawi Hacker
http://twitter.com/sh_kuroi

As is also traditional, the hacker has chosen ear-pummelling music to accompany their visual deface, so you might want to turn down your speakers before checking the mirror at Zone-H.

Sys Gh0st claims the defaces were retaliation for anti-Muslim bigotry and racism in the French system. “We do not like the French educational system, we think that we’re being imprisoned. The French system racist, One day the martyrs of Palestine you caused will be paid. We send a message in Our Deface : , Meanwhile, you’re punished, expensive government, which brings order, communism, there is of course not, and it is a free country.
It is for that education is the future, the future is to get married, have childrens, a life and repeat, obey such a good piece?
In short, decided a life?

The group has also targeted AC-Grenoble and the University Of Paris Boitiers, and claims to be preparing a much larger strike against the entire French post-secondary system. “Soon we will start an attack to all website of education In French.”

“We have a mission: the mission is the Muslims are not TERRORISTS!”

Trying to make that point by defacing a space exploration organization site and some French university web pages may be a particularly counterintuitive way to go about spreading that message.

Categories: Activism, Attack, Breaking, Crews, Crime, Cyber, Cyberwar, Defaces, France, Hackers, Hacktivism, News, Politics, The Intrud3rs