Alternative news websites hit by alleged state-backed cyberattacks: digital forensics | ABS-CBN
ADVERTISEMENT

Welcome, Kapamilya! We use cookies to improve your browsing experience. Continuing to use this site means you agree to our use of cookies. Tell me more!
Alternative news websites hit by alleged state-backed cyberattacks: digital forensics
Alternative news websites hit by alleged state-backed cyberattacks: digital forensics
Jauhn Etienne Villaruel,
ABS-CBN News
Published Jun 24, 2021 11:28 AM PHT
|
Updated Jun 25, 2021 02:57 PM PHT

MANILA (2ND UPDATE) — Two alternative news organizations cried foul Wednesday after a Sweden-based digital forensics group uncovered a barrage of potentially state-backed cyberattacks against their websites.
MANILA (2ND UPDATE) — Two alternative news organizations cried foul Wednesday after a Sweden-based digital forensics group uncovered a barrage of potentially state-backed cyberattacks against their websites.
Qurium Media Foundation reported Tuesday that it recorded in the past months "brief but frequent denial attacks against" websites bulatlat.com, altermidya.org, as well as karapatan.org.
Qurium Media Foundation reported Tuesday that it recorded in the past months "brief but frequent denial attacks against" websites bulatlat.com, altermidya.org, as well as karapatan.org.
Notably, on June 5, Qurium said a machine from the Department of Science and Technology (DOST) launched a vulnerability scan against Bulatlat.
Notably, on June 5, Qurium said a machine from the Department of Science and Technology (DOST) launched a vulnerability scan against Bulatlat.
The National Union of Journalists of the Philippines (NUJP) described a vulnerability scan as an "automated, high level test that creates an inventory of all known and potential weaknesses in a network," adding such test is "highly irregular" when done without permission from the system owner.
The National Union of Journalists of the Philippines (NUJP) described a vulnerability scan as an "automated, high level test that creates an inventory of all known and potential weaknesses in a network," adding such test is "highly irregular" when done without permission from the system owner.
ADVERTISEMENT
Qurium Media Foundation said several IP addresses linked to the DOST and the military have launched a series of attacks in the past two months against the websites of Bulatlat and Altermidya and human rights group Karapatan pic.twitter.com/5jilCkQtBe
— NUJP (@nujp) June 22, 2021
Qurium Media Foundation said several IP addresses linked to the DOST and the military have launched a series of attacks in the past two months against the websites of Bulatlat and Altermidya and human rights group Karapatan pic.twitter.com/5jilCkQtBe
— NUJP (@nujp) June 22, 2021
Looking closely at the IP address and firewall, Qurium extracted the email address "acepcionecjr@army.mil.ph." The URL "https://army.mil.ph" is the official website of the Philippine Army.
Looking closely at the IP address and firewall, Qurium extracted the email address "acepcionecjr@army.mil.ph." The URL "https://army.mil.ph" is the official website of the Philippine Army.
"Another interesting finding was to find the attacker IP in the Edits of Wikipedia for the article 'Chief of Army (Philippines)' and many others related to the Army," Qurium reported.
"Another interesting finding was to find the attacker IP in the Edits of Wikipedia for the article 'Chief of Army (Philippines)' and many others related to the Army," Qurium reported.
UNFAIR, SAYS PALACE
Launching a cyber attack "is a crime," noted Malacañang spokesman Harry Roque.
Launching a cyber attack "is a crime," noted Malacañang spokesman Harry Roque.
"It will be investigated, and I will reiterate that it is unfair to link government officers to these cyber attacks, pending investigation," he said in a press briefing.
"It will be investigated, and I will reiterate that it is unfair to link government officers to these cyber attacks, pending investigation," he said in a press briefing.
He added that he was not familiar with the Qurium group.
He added that he was not familiar with the Qurium group.
ADVERTISEMENT
"At hindi ko po alam kung talagang competent siyang magbigay ng testimonya dito sa ating bansa," said the Palace official.
(And I do not know if this group really has competence to give testimony here in our country.)
"At hindi ko po alam kung talagang competent siyang magbigay ng testimonya dito sa ating bansa," said the Palace official.
(And I do not know if this group really has competence to give testimony here in our country.)
'NOT SURPRISED'
In separate statements, Altermidya and Bulatlat condemned the cyberattacks.
In separate statements, Altermidya and Bulatlat condemned the cyberattacks.
"We are not surprised by the results of the recent digital forensic… Still, we are angered that taxpayers’ money is being spent to bring down our website, and to deny our readers access to our reportage,” Bulatlat said Wednesday in a series of tweets.
"We are not surprised by the results of the recent digital forensic… Still, we are angered that taxpayers’ money is being spent to bring down our website, and to deny our readers access to our reportage,” Bulatlat said Wednesday in a series of tweets.
Bulatlat emphasized that the cyberattacks happened in light of the red tagging by the National Task Force to End Local Communist Armed Conflict (NTF-ELCAC) and other "state agents."
Bulatlat emphasized that the cyberattacks happened in light of the red tagging by the National Task Force to End Local Communist Armed Conflict (NTF-ELCAC) and other "state agents."
"We enjoin our colleagues in the Philippine media, and our audience to continue asserting press freedom," Bulatlat said.
"We enjoin our colleagues in the Philippine media, and our audience to continue asserting press freedom," Bulatlat said.
ADVERTISEMENT
Altermidya, for its part, said it "condemns these cyberattacks on our websites, as well as those against other progressive groups."
Altermidya, for its part, said it "condemns these cyberattacks on our websites, as well as those against other progressive groups."
DOST EXPLAINS
In a statement Thursday, DOST said accusations it was behind cyberattacks against the news websites were "unfounded and patently false."
In a statement Thursday, DOST said accusations it was behind cyberattacks against the news websites were "unfounded and patently false."
"The implication of DOST’s involvement in said cyber-attacks is unfounded and patently false."
"The implication of DOST’s involvement in said cyber-attacks is unfounded and patently false."
The agency said part of its mandate was to "assist other government agencies by allowing the use of some of its IP addresses in the local networks of other government agencies."
The agency said part of its mandate was to "assist other government agencies by allowing the use of some of its IP addresses in the local networks of other government agencies."
"This statement [of Qurium] was solely based on the tracked IP address and does not translate to the Department’s involvement in the matter. DOST remains committed to working towards a progressive Philippines, with science in full service of the Filipino people," it added.
"This statement [of Qurium] was solely based on the tracked IP address and does not translate to the Department’s involvement in the matter. DOST remains committed to working towards a progressive Philippines, with science in full service of the Filipino people," it added.
ADVERTISEMENT
ARMY 'TO LOOK INTO IT'
Philippine Army spokesperson Col. Ramon Zagala on Wednesday told ABS-CBN News they "respect" freedom of expression and will not tolerate such attacks.
Philippine Army spokesperson Col. Ramon Zagala on Wednesday told ABS-CBN News they "respect" freedom of expression and will not tolerate such attacks.
"The Philippine Army respects freedom of expression and per policy, will never infringe [on] that freedom. We take these accusations of cyberattack seriously and we will not condone or tolerate it if such occurred against media entities. Rest assured we are servants of the people and protector of freedom of expression," Zagala said.
"The Philippine Army respects freedom of expression and per policy, will never infringe [on] that freedom. We take these accusations of cyberattack seriously and we will not condone or tolerate it if such occurred against media entities. Rest assured we are servants of the people and protector of freedom of expression," Zagala said.
Asked if the Army will investigate the matter, Zagala said "we will look into it."
Asked if the Army will investigate the matter, Zagala said "we will look into it."
Last September, Facebook removed pages, accounts, groups and Instagram profiles of two unnamed networks, with one linked to individuals associated with the Philippine military and police, due to "coordinated inauthentic behavior" or manipulation campaigns on the platform.
Last September, Facebook removed pages, accounts, groups and Instagram profiles of two unnamed networks, with one linked to individuals associated with the Philippine military and police, due to "coordinated inauthentic behavior" or manipulation campaigns on the platform.
'DAMNING EVIDENCE'
According to Bayan Muna Rep. Ferdinand Gaite, Quirium's report was "damning evidence" of the government's agenda to silence the press.
According to Bayan Muna Rep. Ferdinand Gaite, Quirium's report was "damning evidence" of the government's agenda to silence the press.
ADVERTISEMENT
"This is damning evidence that the government is out to silence the press, and belies the administration's repeated claims that they are not attacking press freedom. Malinaw na malinaw ito, the cyberattacks were traced back to the government, which means it is an official policy of this administration to attack media organizations," Gaite said in a statement.
"This is damning evidence that the government is out to silence the press, and belies the administration's repeated claims that they are not attacking press freedom. Malinaw na malinaw ito, the cyberattacks were traced back to the government, which means it is an official policy of this administration to attack media organizations," Gaite said in a statement.
He added that the report proves the Duterte administration is "indeed operating troll farms" to attack government critics.
He added that the report proves the Duterte administration is "indeed operating troll farms" to attack government critics.
"Kailangan na talaga isapubliko ang mga impormasyong una nang nilantad ni Sen. Lacson patungkol sa troll farms ng gobyerno. Our taxes are funding these illegal operations, these operations that are meant to attack our country's democracy," said Gaite.
"Kailangan na talaga isapubliko ang mga impormasyong una nang nilantad ni Sen. Lacson patungkol sa troll farms ng gobyerno. Our taxes are funding these illegal operations, these operations that are meant to attack our country's democracy," said Gaite.
Gaite was referring to Sen. Panfilo Lacson's exposé that an "undersecretary" is assembling "2 troll farms each" in every province ahead of the 2022 national elections, possibly using public funds.
Gaite was referring to Sen. Panfilo Lacson's exposé that an "undersecretary" is assembling "2 troll farms each" in every province ahead of the 2022 national elections, possibly using public funds.
Lacson has yet to identify the official but said he would do so if his whistleblower agrees.
Lacson has yet to identify the official but said he would do so if his whistleblower agrees.
RELATED VIDEO
— With a report from Jamaine Punzalan, ABS-CBN News
Read More:
Altermidya
Bulatlat
press freedom
Philippine Army
cyberattacks
cybersecurity
journalism
Qurium
NUJP
National Union of Journalists of the Philippines
ADVERTISEMENT
ADVERTISEMENT