Understanding Behavior of Hacker
What Website Defacement is
Website defacement is similar to property vandalism. The difference would be just that the former happens online, unlike the latter. The changes of the website appearance indicate this; pictures and/or words are scrawled across the defaced website.
Bad Motives behind Website Defacement
Various motives might encourage a defacer to make such an attack. Some attackers who oppose the ruling government or a particular movement can tamper with the unsuspecting party's website to voice their opposing views. In different cases, attackers may mock the site owner by discovering vulnerabilities in the website and exploiting them to take destructive action. For the above cases, the website owners suffer damages, especially concerning their reputations.
Common Behaviors among Defacers
Seek Vulnerabilities; one of them is weak passwords.
Marking the Targeted Websites with their 'Signature'
Defacers aim to leave a signature on the targeted websites like real graffiti. This behavior indicates their glorious accomplishment in attacking the websites. The form of the signature might vary, such as “hacked by”, “defaced by”, “owned by”, and many more.
Distributing a Propaganda
The motive behind a website defacement often is to campaign propaganda regarding certain geopolitical issues. On the victim's website, a defacer may put his thoughts and ideas against particular governmental policies, wars, or even conflicts happening inside a country.
Provoking by Profanity
Last but not least, defacers usually use swearing and cursing in articulating their opinions. It is done to provoke their targets further.
Seeking Recognition from The Victims
Ultimately, defacers yearn to be recognized by others or become members of public or certain groups. They will leave their aliases, either as a full page defacement or a partial defacement, along with their contact addresses. No wonder they promote their "craft" through social media.
Defacer's social media posts are correlated with their work volume of web defacements.
Hackers do hacking or defacing the web, but they also have social media accounts and post something about defacement they commit.
This potential arises due to the correlation between hackers' social media accounts and web defacement attacks' volume (also pattern). A research team released this finding and insight from Georgia State University in 2017 titled "On the Relevance of Social Media Platforms in Predicting The Volume and Patterns of Web Defacement Attacks".
The researcher team disclosed that hackers tend to share their defacement works throughout social media accounts in the published paper. It also reflects that hackers learn, practice, and seek to troubleshoot from other hackers.
Those researchers use hackers’ self-reports over the website Zone-H (http://www.zone-h.org/ ) on web defacement attacks they launched and append with their own data collection from law enforcement agencies’ effort that established these hackers’ use of social media platforms.
The respective researchers also found that hackers' use of social media increases along the way of web defacement attacks volume they generate.
They also discover that among the different social media platforms available for hackers to use, Facebook and Twitter are the only two platforms that carry significant effects in the model.
Moreover, upon completing a web defacement attack, a hacker may get the maximum level of attention from other social media users when they post over the social media platforms regarding the attack he completed.
We can conclude that there is a correlation between hackers' usage of social media and their intention of defacement. There will be a potential for social media platforms to play a key role as information sources for further strategic cyber intelligence.