It was 'inevitable' that bombs would fall in response to a cyberattack

Israel's targeting of alleged Hamas hackers was the first instance of a 'kinetic' response to a cyberattack. But it wasn't a surprising outcome.

Israel’s military announced Sunday it had launched airstrikes on a building allegedly housing a number of Hamas soldiers that were preparing to launch a cyberattack against Israel.

Israel Defense Forces (IDF), which launched the airstrike jointly with the Israel Security Authority, did not detail the alleged cyberattack and other offensive capabilities Hamas was developing, but said it had neutralized the attack before launching the airstrikes.

The incident marks the first time a government has publicly announced it has immediately responded to a cyberattack by launching a “kinetic attack,” a military term that describes the use of lethal force.

Although this marks a first in cyberwarfare, Paul Rosenzweig, a former deputy assistant secretary for policy at the U.S. Department of Homeland Security, tells CyberScoop it’s not a surprising outcome.

“We mistakenly tend to think that the cyber domain exists apart from the physical world, but it doesn’t,” Rosenzweig, a senior fellow at R Street Institute, said. “It was always a claim — an unreasonable claim — that the two wouldn’t intersect. There were some people that had this phrase, ‘what happens in cyber stays in cyber,’ kind of like ‘what happens in Vegas stays in Vegas,’ but that wasn’t a realistic expectation.”

In the U.S., it is possible that the Pentagon could respond to a cyberattack on the nation in the kinetic realm as well, if directed to do so by the president. In 2015 the Obama administration said that the U.S. would, in theory, “use all necessary means, including military, to respond to a cyber attack on the nation.”

“Ever since it was clear cyberweaponry would have physical, kinetic effects it became inevitable that people would start using kinetic weaponry to affect operations in the cyber domain,” Rosenzweig said.

The U.S. Department of Defense has at least once before used a kinetic attack in response to cyberthreats when it launched a drone strike to kill British national Junaid Hussain, who ran the Islamic State’s hacking group. However, the strike was launched years after Hussain conducted his operations.

In a statement, IDF said Hamas’ cyber-operation “failed to achieve its goals.” But the fact that IDF was compelled to respond in the physical realm does not necessarily show Hamas is becoming more powerful or dangerous in cyberspace, John Hultquist, Director of Intelligence Analysis at FireEye, told CyberScoop.

“I don’t think it tells us anything about their capabilities,” Hultquist said. “The word ‘cyberattack’ is so broad.”

There was no public information available Monday as to what kind of cyberattack IDF alleges Hamas had attempted or what offensive capabilities Hamas was allegedly developing.

‘Not a formidable adversary’

Security researcher Eyal Sela, who has been tracking Hamas for years, told CyberScoop that its offensive capabilities in cyberspace are “not new,” but not particularly masterful, either.

“The capabilities are not ranked as high, it’s like medium-to-low in their level of sophistication, execution, and quality assurance. They are not a formidable adversary in this dimension,” said Sela, who is the head of intelligence at ClearkSky Cyber Security.

Over the last several years Hamas has been conducting cyber-espionage and reconnaissance operations, not those that necessarily threaten disruption, according to Sela.

“We know they have been … targeting mobile phones of soldiers, and breaching websites, sending phishing emails in various folders to people and infecting them,” Sela said, adding that some of their tools have been developed in house. “Some of them are generic sometimes they are self-developed.”

Hamas conducts some social engineering to make sure its emails and contacts truly trick their targets, according to ClearSky. For instance, Hamas has used fake social media accounts — primarily on Facebook — to trick IDF soldiers into befriending them, Sela says.

The kinetic response came amid several days of shelling in Israel. U.S. Secretary of State Mike Pompeo told Fox News on Sunday he believes Israel has a right to defend its sovereignty while discussing the strikes this weekend.

CNN reports that an apparent ceasefire was reached after Israel launched air strikes on over 300 targets. Four people had died in Israel and 23 people were killed in Gaza.

When asked if the IDF strike resulted in civilian casualties, the IDF directed CyberScoop to a statement that did not address the question.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure