Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
We might want to discuss some ground rules on what would constitute acceptable answers. My guess, given the prevalence of programming backgrounds among Stack Exchange users (especially web programming) that this is going to encourage a lot of answers from people based on their own personal expertise of how websites work and common hacking techniques. But that is not what we are looking for, under our usual rules.
I'm not sure this is answerable without specific knowledge of their website and their CMS - perhaps the most expedient way to put up a "This site is down" message was to treat it as a "campaign" while they try to restore the rest of the site (the backdoor could have been installed months ago, perhaps predating their backup retention, which is why they can't just restore from a recent backup). The fact that one of their sites is up while other(s) are down sounds consistent with a hack.
"why is the domain still loading content from the server?" Can someone explain me this sentence? I don't understand. If the server is hacked and the content is modified by the hackers directly on the server, then yes, the content will still be loaded from the server, and it's quite logical. Am I missing something here?
That article on TheFederalist clearly shows that they have no experience with hacked websites. Feed them any hacked site and they will find the same 'arguments' as they are presenting in this statement.
– user22865
Aug 3, 2015 at 9:25
2
Like any other question, we'll expect this to be answered through evidence and not expertise -- for example the results of an official investigation.
This answer attempts to respond to the following claim (from the images in the question):
Planned Parenthood (PP) faked being hacked
Basis
This claim is based on:
Claims that PP is hacked (from Twitter)
Data is being loaded from PP servers
Source code including keywords that imply a campaign
The website is reachable despite claims of an attack
Summary - why this basis is not sufficient
Briefly said (see discussion below the answer), the claim that the hack was fake comes from the servers PP claims are hacked. If the servers are indeed hacked, the attacker has the same control over the servers that PP would normally have, and is therefore able to falsify the basis of the claim (at least, points 2 through 4). Without information from a source independent of these servers, it cannot be determined whether the attack occurred or not.
Background
"Hacked" refers to the situation where someone unauthorized has access to the server. This means that integrity was compromised (see this section and its reference on wikipedia, or a basic computer security course for more details). This means that the attacker can make modifications to the system as if she were the administrator of the website. What specific changes are possible depends on the details of the case, but in general this means it is not possible to distinguish changes made by an attacker from changes made by the administrators. Thus, strictly speaking, we can't make a judgement about whether a hack is "real"; the attacker/hacker can always make it look as if the attack was fake, unless there is an additional source of information independent of the potentially affected website. As the website in question discusses a sensitive issue for some, it is at least plausible that this occurred, and it similar to website defacement, a technique often used to discredit websites by teenagers in the past, and currently by activists and politically motivated persons.
@Sklivvz honestly, I disagree, but the amount of original research in my post is probably too high. The latter part of the post is directly based on the definition of integrity. Would references to teaching material, such as books, be acceptable? The content is considered obvious in security literature, but I can also try to find a paper that describes this more precisely if that is preferable.
I'm not sure what you mean. We expect evidence specifically related to the planned parenthood situation, but you only posted a link to Wikipedia for "information security". That's, at best, a definition.
@Sklivvz right. I see where our misunderstanding comes from. I interpreted the question as "Based on (information), can we conclude that PP is faking the hack?" and my answer was, "The information comes from the supposedly compromised server, and if it is actually compromised, the attacker can by definition make it look like PP is faking it." I'll attempt to improve the answer after this comment. I think there might be a problem with the question in this case, though; it is impossible to objectively determine whether the hack was faked, without the ability to inspect the system directly.
@Sklivvz I hope the changes I made align the answer more towards what skeptics is looking for, but in case this is not what is intended, should I remove the answer in its entirety, or leave it until there is a better answer?
