Syrian Electronic Army's Latin American Connection

There's been a lot of press today about how the Syrian Electronic Army is using Russian servers and who some of it's early website administrators are. One of Digital Dao's readers sent me an email this morning with some new information from a PhP shell left on a host that points to a Latin American supporter.

----// START

    <?php  

    #  .. SyRiAn Sh3ll V7 .... PRIV8! ... DONT LEAK! .... f0r t3am memberz 0nly!

    #  ,--^----------,--------,-----,-------^--,                                

    #  | |||||||||   `--------'     |          O    .. SyRiAn Sh3ll V7 ....     

    #  `+---------------------------^----------|                           

    #    `_,-------, __EH << SyRiAn | 34G13__|                             

    #      / XXXXXX /`|     /                   

    #     / XXXXXX /  `   /                   

    #    / XXXXXX /______(   

    #   / XXXXXX /!        

    #  / XXXXXX /!     rep0rt bugz t0: sy34[at]msn[dot]com

    # (________(!                                         

    #  `-------'                                          

    #.... PRIV8! ... DONT LEAK! .... f0r t3am memberz 0nly!

    #.... PRIV8! ... DONT LEAK! .... f0r t3am memberz 0nly!

    #                                                      

    # SyRiAn Sh3ll V7 .                                    

    # Copyright (C) 2011 - SyRiAn 34G13

    $user = 'ar3sw0rmed';  // Username 

    $pass = 'ar3sw0rmed-controlremoto';  // Password

    $shellColor = '#990000'; // Shell Color         

    #------------------------------------# 

    #       Powered By SyRiAn Shell      # 

    #       By EH SyRiAn 34G13           #

    #       wWw.syrian-shell.com         #

    #       Version 7 - priv8            #

    #       Made In SyRiA                #

    #------------------------------------#

    ?>                                    

----// End

Terms of Interest

controlremoto

"controlremoto" is Spanish for "remote control".  

ar3sw0rmed

"ar3sw0rmed" is the name of a hacktivist pulling these same DDoS style attacks all across Chile, Brazil, etc.

His email address is mkrlosl@ar3sw0rmed.com

His website is http://www.ar3sw0rmed.blogspot.com/

And his defacements per Zone-H are extensive

Summary

This is a micro example of why it's a mistake to think of the digital landscape as if it's a physical landscape. The Syrian Electronic Army like many of its fellow hacktivist organizations is not limited to Syria's physical borders nor Syrian nationals for its members. In fact, for many hacktivists in particular and some Millennials in general, digital allegiances are replacing physical borders.

We'll be exploring this phenomenon in-depth with experts like Dave Kilcullen, Joel Brenner, Mike Janke and 15 other speakers at the Suits and Spooks conference in New York on Oct 5-6, 2013.

Add to Cart View detail

Syrian Electronic Army: Background, Operations, Gov't Affiliations

The Syrian Electronic Army (originally called Syrian Electronic Soldiers) was created in May 2011 by the Syrian Computer Society who registered the domain Syria-es.com and .org with Network Solutions. 

The Syrian Computer Society was founded in 1989 by Bassel al-Assad, the son of then Syrian President Hafez al-Assad. Later, his brother Bashar took over the SCS presidency and Bashar later become the current President of Syria. The SCS is affiliated with the Ministry of Information and the Ministry of Higher Education. Its original goal was to "introduce information technology to all the economic sectors in Syria".

The following domains are all associated with the Syrian Electronic Army and all point to IP address 213.178.227.152, which is hosted at the Syrian Computer Society's ISP (SCS-net) located in Damascus, Syria:

• mail.syrian-es.com
• mail.syrian-es.net
• mail.syrian-es.org
• syrian-es.com
• syrian-es.net
• syrian-es.org
• syrianelectronicarmy.com
• www.syrian-es.com
• www.syrian-es.org

The Syrian government also uses SCS-net hosting for its Ministry of Defense (mod.gov.sy) at IP address: 213.178.225.248. The website presently shows as under construction. This may be significant because there are at least nine ISPs operating in Syria which offer hosting options for the Syrian Electronic Army, yet they continue to use the same service which hosts the Ministry of Defense and other government websites.

The domain name syrianelectronicarmy.com was recently created (Feb 24, 2013) and remains active. They promote themselves via social media accounts on Twitter, Facebook, and YouTube:

• https://twitter.com/SEA_Official7
• https://www.facebook.com/SEA.205
• http://www.youtube.com/user/syrianes1

Other than being the registration agent for the domain name Syrian-es.com, as well as providing hosting services for SEA websites, neither the Syrian Computer Society nor anyone in the Syrian government has claimed an official capacity for the Syrian Electronic Army however President Assad referred to them in a speech on June 20, 2011 when he mentioned the "electronic army" while praising Syria's actual Army:

The army consists of the brothers of every Syrian citizen, and the army always stands for honour and dignity. Young people have an important role to play at this stage, because they have proven themselves to be an active power. There is the electronic army which has been a real army in virtual reality.

According to the SEA website, their objective is to fight Arab and Western media who are "fabricating the truth about what is happening in Syria". Their operations have included attacks against social media outlets for:

• Associated Press
• 60 Minutes
• 48 Hours
• CBS Denver
• ENERGY 103.7 San Diego
• NPR
• BBC
• Al Jazeera
• Agence France-Presse (AFP)
• Reuters
• Haaretz

They've also leaked documents from the following organizations:

• Qatari Ministry of Foreign Affairs
• Qatar Armed Forces
• Qatar Amiri Diwan
• League of Arab States

Syria, like Iran, Israel, Estonia, China, Russia, and other countries, is leveraging the talent, patriotism, and enthusiasm of its Internet-savvy youth to act as a force multiplier in its military and geopolitical operations at almost zero cost and very little risk.

Related Sources:

"Pattern of Attacks of Syrian Electronic Army" - Live analysis by RecordedFuture
"The Emergence of Open and Organized Pro-Government Cyber Attacks in the Middle East: The Case of the Syrian Electronic Army"

"Syrian Electronic Army: Disruptive Attacks and Hyped Targets"

"The Media War in Syria"

"The Syrian Electronic Army are at cyber war with Anonymous"

Add to Cart View detail