Threat modelling of hacktivist groups Organization, chain of command, and attack methods

Abstract

As the social web emerges, increasingly more people are starting to adopt the Internet as a means of communication. Activists are no exception to the rule, as can be seen by the number of online protests and movements organized through Facebook or Twitter. As a consequence of this, a particular branch of online activists, also known as hacktivists, have evolved into a full-blown online threat. The aim of this report is to provide a technical insight on the attack methods and motivations of hacktivist groups, and provide a solid understanding of the full extent of their capacities. The report includes a technical background on hacker and activist culture, which is essential in order to properly understand the hacktivist mindset. Some real-world incidents have been selected, and their attack scenarios have been reconstructed as precisely as possible in order to evaluate, in each case, the technical skills of the attacker. Based on an evaluation of both technical expertise and motivations, we have deduced a threat model that corresponds to most hacktivist groups. At last, the research also covers the way in which these kinds of threats fit into the geopolitical landscape; how important the threat is, and what are its limitations.