7

Did Planned Parenthood fake being hacked?

Example claims:

Via Twitter:

Their site is so hacked right now that someone has been rearranging CSS fonts and alignment.

Another tweet

Text below

If planned parenthood's site was hacked, why is the domain still loading content from the server?

And why is their site down template categorized as a campaign?

Because it is a campaign. Next time you lie, check your source code.

And Planned Parenthood “Hacking” Sure Looks Like An Orchestrated PR Stunt says that the Planned Parenthood Action Fund site http://ppaction.org redirects to a page saying the site has been hacked, but the domain houses a perfectly functional URL.

  • 4
    We might want to discuss some ground rules on what would constitute acceptable answers. My guess, given the prevalence of programming backgrounds among Stack Exchange users (especially web programming) that this is going to encourage a lot of answers from people based on their own personal expertise of how websites work and common hacking techniques. But that is not what we are looking for, under our usual rules. – Nate Eldredge Aug 2 '15 at 4:55
  • 4
    I'm not sure this is answerable without specific knowledge of their website and their CMS - perhaps the most expedient way to put up a "This site is down" message was to treat it as a "campaign" while they try to restore the rest of the site (the backdoor could have been installed months ago, perhaps predating their backup retention, which is why they can't just restore from a recent backup). The fact that one of their sites is up while other(s) are down sounds consistent with a hack. – Johnny Aug 2 '15 at 6:25
  • 14
    "why is the domain still loading content from the server?" Can someone explain me this sentence? I don't understand. If the server is hacked and the content is modified by the hackers directly on the server, then yes, the content will still be loaded from the server, and it's quite logical. Am I missing something here? – Einenlum Aug 2 '15 at 20:42
  • 4
    That article on TheFederalist clearly shows that they have no experience with hacked websites. Feed them any hacked site and they will find the same 'arguments' as they are presenting in this statement. – user22865 Aug 3 '15 at 9:25
  • 2
    Like any other question, we'll expect this to be answered through evidence and not expertise -- for example the results of an official investigation. – Sklivvz Aug 3 '15 at 9:29
3

Claim

This answer attempts to respond to the following claim (from the images in the question):

Planned Parenthood (PP) faked being hacked

Basis

This claim is based on:

  1. Claims that PP is hacked (from Twitter)
  2. Data is being loaded from PP servers
  3. Source code including keywords that imply a campaign
  4. The website is reachable despite claims of an attack

Summary - why this basis is not sufficient

Briefly said (see discussion below the answer), the claim that the hack was fake comes from the servers PP claims are hacked. If the servers are indeed hacked, the attacker has the same control over the servers that PP would normally have, and is therefore able to falsify the basis of the claim (at least, points 2 through 4). Without information from a source independent of these servers, it cannot be determined whether the attack occurred or not.

Background

"Hacked" refers to the situation where someone unauthorized has access to the server. This means that integrity was compromised (see this section and its reference on wikipedia, or a basic computer security course for more details). This means that the attacker can make modifications to the system as if she were the administrator of the website. What specific changes are possible depends on the details of the case, but in general this means it is not possible to distinguish changes made by an attacker from changes made by the administrators. Thus, strictly speaking, we can't make a judgement about whether a hack is "real"; the attacker/hacker can always make it look as if the attack was fake, unless there is an additional source of information independent of the potentially affected website. As the website in question discusses a sensitive issue for some, it is at least plausible that this occurred, and it similar to website defacement, a technique often used to discredit websites by teenagers in the past, and currently by activists and politically motivated persons.

  • Also, it's not based on evidence, but the author's speculation. – Sklivvz Aug 3 '15 at 9:30
  • 1
    @Sklivvz honestly, I disagree, but the amount of original research in my post is probably too high. The latter part of the post is directly based on the definition of integrity. Would references to teaching material, such as books, be acceptable? The content is considered obvious in security literature, but I can also try to find a paper that describes this more precisely if that is preferable. – Rens van der Heijden Aug 4 '15 at 6:23
  • 1
    I'm not sure what you mean. We expect evidence specifically related to the planned parenthood situation, but you only posted a link to Wikipedia for "information security". That's, at best, a definition. – Sklivvz Aug 4 '15 at 7:41
  • @Sklivvz right. I see where our misunderstanding comes from. I interpreted the question as "Based on (information), can we conclude that PP is faking the hack?" and my answer was, "The information comes from the supposedly compromised server, and if it is actually compromised, the attacker can by definition make it look like PP is faking it." I'll attempt to improve the answer after this comment. I think there might be a problem with the question in this case, though; it is impossible to objectively determine whether the hack was faked, without the ability to inspect the system directly. – Rens van der Heijden Aug 4 '15 at 19:18
  • @Sklivvz I hope the changes I made align the answer more towards what skeptics is looking for, but in case this is not what is intended, should I remove the answer in its entirety, or leave it until there is a better answer? – Rens van der Heijden Aug 4 '15 at 19:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .