The recent Israel-Gaza conflict has not only resulted in physical damage and casualties but has also given rise to cybersecurity threats. Threat actors have been observed targeting Israeli rocket alerting applications, using them as a means to spread fear and deploy mobile spyware. One such instance involved the exploitation of a vulnerability in the popular ‘Red Alert: Israel’ application, allowing the threat actors to intercept requests, expose APIs and servers, and send fake alerts, including alarming nuclear bomb messages to users. Additionally, a malicious version of the ‘RedAlert – Rocket Alerts’ app was hosted on a website, infecting users with spyware and collecting sensitive user information.
Methods used by threat actors
To carry out their malicious activities, the threat actors exploited a vulnerability present in the ‘Red Alert: Israel’ application. By taking advantage of this flaw, they were able to intercept user requests, expose internal APIs and servers, and manipulate the system to send false alerts to unsuspecting users. Shockingly, these fake alerts included messages conveying the presence of imminent nuclear bomb threats, exacerbating anxiety among Israeli citizens during an already tense period.
In another instance, a threat actor created a website specifically for hosting a malicious version of the ‘RedAlert – Rocket Alerts’ app, developed by Elad Nava. This deceptive version of the app was designed to infect users’ devices with spyware and secretly collect sensitive user information.
Features and behavior of the malicious application
The malicious version of the ‘RedAlert – Rocket Alerts’ app closely resembled the legitimate software, making it difficult for users to discern the malicious intent behind it. However, beneath its seemingly harmless facade, the app began running a background service, enabling it to clandestinely harvest data from the infected device. This data collection included various forms of sensitive information such as contacts, call logs, messages, account details, SIM information, and a comprehensive list of installed applications.
After gathering the user’s data, the malicious application initiated an HTTP connection to a remote server to transmit the stolen information. Although the transmitted data was encrypted, the use of RSA with a public key bundled within the app made it vulnerable to interception. This means that if a user’s device were compromised, the attacker would be able to decrypt the data package sent over the network.
Risks and implications for affected users
Although the website hosting the spyware-infected version of the ‘RedAlert – Rocket Alerts’ app has been taken offline, users who may have installed the malicious application are still at risk. The spyware continues to pose a significant threat to user privacy and security. Therefore, it is crucial for all users who suspect they may have installed the malicious app to take immediate action and clean up their devices.
Steps for users to determine if they have installed the malicious application
To determine whether they have unknowingly installed the malicious application, users should carefully examine the permissions requested by the software. Specifically, users should check if the app requests access to call logs, contacts, phone functions, and SMS capabilities. If any of these permissions are present and the app is suspicious or unrecognized, it is highly likely that the user’s device has been compromised.
The targeting of Israeli rocket alerting applications by threat actors during the Israel-Gaza conflict highlights the need for heightened cybersecurity measures. The exploitation of vulnerabilities in applications like ‘Red Alert: Israel’ and the creation of malicious versions of ‘RedAlert – Rocket Alerts’ have revealed the potential for spreading fear and acquiring sensitive user data. Affected users must prioritize cleaning up their devices promptly to mitigate the risk posed by such spyware. Additionally, it is essential for users to remain vigilant and exercise caution when installing applications from unknown sources to protect their privacy and security.