French media groups to hold emergency meeting after Isis cyber-attack

France’s culture minister is to call an urgent meeting of French media groups to assess their vulnerability to hacking after the public service television network TV5Monde was taken over by individuals claiming to belong to Islamic State, blacking out broadcasts as well as hacking its websites and Facebook page.

All TV5Monde broadcasts were brought down in a blackout between 10pm and 1am local time on Wednesday to Thursday by hackers claiming allegiance to Isis. They were able to seize control of the television network founded by the French government in 1984, simultaneously hacking 11 channels as well as its website and social media accounts.

Experts say the cyber-attack represented a new level of sophistication for the Islamist group, which has claimed complex hacking before, but nothing as big as this. The Paris prosecutor’s office has opened a terrorism investigation into the attack.

The culture minister, Fleur Pellerin, said she would bring together all heads of big French TV companies as well as newspaper groups and the news agency Agence France-Presse within 24 hours “to assure myself of their vulnerable points, any risks that exist and the best way to deal with it”.

The interior minister, Bernard Cazeneuve, said France had already increased its anti-hacking measures to protect against cyber-attacks following January’s gun attacks on the satirical weekly Charlie Hebdo and the bloody hostage-taking at a Kosher grocery store in Paris, which left 17 people dead.

The prime minister, Manuel Valls, called the attack on TV5Monde “an unacceptable insult to freedom of information and expression”.

During the attack, the hackers posted documents on TV5Monde’s Facebook page purporting to be the identity cards and CVs of relatives of French soldiers involved in anti-Isis operations, along with threats against the troops.

“Soldiers of France, stay away from the Islamic State! You have the chance to save your families, take advantage of it,” read one message.

TV5Monde had regained control of its social networks by 2am on Thursday but said television broadcasts were likely to take hours, if not days, to return to normal. The station restored its signal later in the morning but was still only able to broadcast pre-recorded material.

At 6pm, TV5Monde had regained control of its social networks and television broadcasts had returned to normal, including live broadcasts.

The network’s director general, Yves Bigot, said its systems had been severely damaged and that hacking on this scale would have needed weeks of preparation.

He told RTL radio: “When you work in television and you hear that your 11 channels have been blacked out, it’s one of the most violent things that can happen to you. At the moment, we’re trying to analyse what happened: how this very powerful cyber-attack could happen when we have extremely powerful and certified firewalls.”

The cyber-attack on the station’s Paris headquarters completely shut down the computer systems – which run everything from email accounts to production equipment, including the servers used to broadcast TV5Monde’s television signals.

“This is a typical cyber-attack in today’s cyber landscape,” said Christophe Birkeland, vice-president of engineering at the US-based security firm Blue Coat Systems. “The initial infection is probably either someone’s stolen credentials, probably for remote networking access, or the installation of a remote administration tool used to access deeper and deeper levels of the network and attack systems. Both of these attacks typically use social engineering.”

Social engineering is the practice of tricking people into installing programs or giving up sensitive information, often via email or similar communications methods. Typically companies employ different zones within their computer networks to create a multilayered defence so that attackers cannot reach production systems, such as the computers that control broadcasting, even if they hack into a lower level of the network.

Reports indicate that TV5Monde did not use such tactics, making it easier for attackers to damage critical computers and equipment.

“Social engineering might be incredibly low-tech sometimes, but once you’ve got the compromise, most security systems are not set up to deal with the idea of someone using security credentials in a non-authorised way, which allows attackers to reach even the deepest, most secure sections of a corporate network, which is likely what has happened here,” said Robert Arandjelovic, also from Blue Coat Systems.

It is likely that this targeted attack by pro-Isis forces took weeks to implement, with multiple stages and attacks needed to take the French TV station offline.

“Typically you have difference phases in an attack like this. The first one would be identifying who has the necessary access to the systems to actually do harm. Infecting just some random computer generally isn’t enough. They go to unprecedented levels and a great deal of effort during the planning phase, researching the targets as apposed to actually hacking them,” said Birkeland and Arandjelovic.

“What we’re seeing here is real world impact, the disruption of critical infrastructure, access to information and an important part of a democratic society. The attackers are breaking new ground, and this might not be the last we hear of this. We could see a broader campaign, where TV5 was just one hit,” said Arandjelovic. “We’re seeing TV5 coming back online, but it’s entirely possible that they haven’t purged all traces of the attack from their systems and could still be compromised.”

The attack appears to have been orchestrated by the Isis hacking division, which took credit for alleged attacks resulting in the leak of personal information of US military personnel in March, prompting an investigation by the Pentagon. Hackers claiming to work on behalf of Isis have seized control of the Twitter accounts of other media groups, such as Newsweek, and in January they hacked into the Twitter page and YouTube site of the US military’s Central Command.

The message on the TV5Monde website had read in part “I am IS” with a banner by a group that called itself Cybercaliphate.

The hackers had accused the French president, François Hollande, of having committed “an unforgivable mistake” by getting involved in “a war that serves no purpose”.

“That’s why the French received the gifts of Charlie Hebdo and Hyper Cacher in January,” it said on the broadcaster’s Facebook page, referring to the bloody twin attacks by Islamist gunmen in Paris which traumatised France.

France is part of a US-led military coalition carrying out air strikes against Isis in Iraq and Syria, where the jihadi group has seized swaths of territory and declared a caliphate.

More than 1,500 French nationals have joined the militants’ ranks, where they represent almost half the number of European fighters present, according to a report released on Wednesday by the French senate.