From Damascus with... not love —

US Army website defaced by Syrian Electronic Army [Updated]

Hack appeared to exploit Army's commercial content delivery network provider.

US Army website defaced by Syrian Electronic Army [Updated]

 

Early today, the official website of the US Army (www.army.mil) was defaced by attackers claiming to be with the Syrian Electronic Army. In addition to a message on the page claiming attribution, the attackers also included a pop-up message to anyone visiting: "Your commanders admit they are training the people they have sent you to die fighting."

Based on screenshots published in the Syrian Electronic Army's Twitter account, it appears the attack gained access to the webpage through the Limelight Networks content delivery network. A screenshot shows a Limelight control panel for the account belonging to the US Army Office of Public Affairs. [Update:  A spokesperson from Limelight contacted by Ars said, "We take security concerns extremely seriously and, in an abundance of caution, we are conducting a full investigation.  At this point we have no reason to believe any customer data has been compromised."]

One of several messages popped up by the defaced Army.mil sites.
Enlarge / One of several messages popped up by the defaced Army.mil sites.

At the time of publication, the Army main homepage is down, although other Army websites have not been affected. The website of the US Strategic Command—the joint Department of Defense command overseeing space and nuclear forces—is also down, as is the official page for US Cyber Command hosted on its domain, though it does not appear to be related.

Screenshots of the attack were posted this afternoon on a Syrian Electronic Army Twitter account, one which has in the past posted links to "leaked" files about connections between the US, Turkish, and Saudi Arabian governments and Syrian rebels. This account has also previously shared information about defacements of other websites (including that of the International Business Times and the Telegraph last year) and the hijacking of Twitter accounts belonging to a number of Western media outlets. The SEA claims to have created its own distribution of Linux based on Ubuntu for use by its supporters.

Ars has attempted to reach the Army and US Cyber Command for comment, but we have not yet received a response. This story will be updated as more information becomes available.

Channel Ars Technica