Chapter 1 Spotlight on Cyber Threats Website Defacements 873 websites in Singapore were defaced in 2019, a 44 per cent increase from 605 Known Motivations Breakdown of hackers’ motivations for defacing websites in 2019, by percentage 18 per cent or 234 of the website defacements in 2019 were by hacker groups with known motivations and agendas. in 2018. This increase can be attributed in part to a surge • A single hacktivist mass-defaced 66 local websites in January 2019 alone, posting various messages on the affected websites. in hacktivism fuelled by the global wave of protests in 2019. The majority of the • The spike in defacements in March 2019 was attributed to an Indonesia-based hacker group which defaced and inserted messages into 60 websites. defaced websites belonged to Small and Medium Enterprises (SMEs) from sectors such Defacements in the second half of 2019 coincided with major conflicts and political developments in the Middle East, as hacktivists from opposing camps conducted mass defacement campaigns to air their political views. as education, finance, manufacturing and retail. No Singapore Government websites were defaced. Number of defaced Singapore websites reported in 2019 • A hacktivist claiming to support the Kurdish nationalist movement in the Middle East was responsible for most of the defacements observed in Singapore in August 2019. This coincided with the period when several mayors were asked to step down from political office in Turkey. Indiscriminate and Opportunistic • In October 2019, mass defacements of websites were carried out not just in Singapore, but also in India and the United States of America (USA). The perpetrators made various references to the ongoing Syrian civil war. Many defacements were opportunistic and self-aggrandising in nature. These threat actors exploit websites and web-hosting servers with vulnerabilities, and many aim to show off their skills in exposing security flaws at the same time. For instance, one hacker group was largely responsible for the spike in mass defacements in April 2019. In the course of its indiscriminate defacement attacks, this group replaced affected websites with random pictures and messages of mischief, and took the opportunity to promote its social media channels and blog addresses. 6 7 10 SINGAPORE CYBER LANDSCAPE 2019 WordPress — The Most Targeted Content Management System Globally, WordPress was the most targeted content management system (CMS) by threat actors due to its popularity. As of end2019, WordPress websites accounted for more than 35 per cent of all websites on the Internet.6 There were similar observations in Singapore, where websites published on the WordPress platform made up the majority of defacements — 159 (about 20 per cent) — in 2019, as compared to 235 (about 40 per cent) in 2018. This decrease might be due to WordPress forcing autoupdates on older versions of the CMS in various stages beginning August 2019, which enhanced the security of the WordPress ecosystem and consequently, the Internet.7 “Historical trends in the usage statistics of content management systems,” W3Techs — World Wide Web Technology Surveys, 3 January 2020, https://www.w3techs.com/ technologies/history_overview/content_management/all. Dunn, Ian. “Proposal: Auto-Update Old Versions to 4.7”, Make WordPress Core, 8 August 2019, https://make.wordpress.org/core/2019/08/07/proposal-auto-update-oldversions-to-4-7. 11