Syrian Hackers Running Amok

So who is in charge of the Syrian Electronic Army and what are they trying to accomplish?

It’s the question of the moment inside the murky realm of cybersecurity: Just who — or what — is the Syrian Electronic Army?

The hacking group that calls itself the S.E.A. struck again on Friday, this time breaking into the Twitter accounts and blog headlines of The Financial Times. The attack was part of a crusade that has targeted dozens of media outlets as varied as The Associated Press and The Onion, the parody news site.

But just who is behind the S.E.A.’s cybervandalism remains a mystery. Paralleling the group’s boisterous, pro-Syrian government activity has been a much quieter Internet surveillance campaign aimed at revealing the identities, activities and whereabouts of the Syrian rebels fighting the government of President Bashar al-Assad.

Now sleuths are trying to figure out how much overlap there is between the rowdy pranks playing out on Twitter and the silent spying that also increasingly includes the monitoring of foreign aid workers. It’s a high-stakes search. If researchers prove the Assad regime is closely tied to the group, foreign governments may choose to respond because the attacks have real-world consequences. The S.E.A. nearly crashed the stock market, for example, by planting false tales of White House explosions in a recent hijacking of The A.P.’s Twitter feed.

The mystery is made more curious by the belief among researchers that the hackers currently parading as the S.E.A. are not the same people who started the pro-Assad campaign two years ago.

Experts say the Assad regime benefits from the ambiguity. “They have created extra space between themselves and international law and international opinion,” said James A. Lewis, a security expert with the Center for Strategic and International Studies.

The S.E.A. emerged during the Syrian uprisings in May 2011, they said, to offer a pro-Assad counternarrative to news coming out of Syria. In speeches, Mr. Assad likened the S.E.A. to the government’s own online security corps, referring to the group as “a real army in a virtual reality.”

We'll probably start seeing more and more of these types of 'loosely associated' groups, especially when cyber warfare is largely independent of geography.

By: Brant

The Guys That Exposed China's Military Hacking

By now, you've all heard about the Chinese Army's hacking unit that's been attacking the US.

“Either they are coming from inside Unit 61398,” said Kevin Mandia, the founder and chief executive of Mandiant, in an interview last week, “or the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.” Other security firms that have tracked “Comment Crew” say they also believe the group is state-sponsored, and a recent classified National Intelligence Estimate, issued as a consensus document for all 16 of the United States intelligence agencies, makes a strong case that many of these hacking groups are either run by army officers or are contractors working for commands like Unit 61398, according to officials with knowledge of its classified content.

But now more info is coming out about the guys that are responsible for exposing them.

When Kevin Mandia, a retired military cybercrime investigator, decided to expose China as a primary threat to U.S. computer networks, he didn't have to consult with American diplomats in Beijing or declassify tactics to safely reveal government secrets.
He pulled together a 76-page report based on seven years of his company's work and produced the most detailed public account yet of how, he says, the Chinese government has been rummaging through the networks of major U.S. companies.
It wasn't news to Mandia's commercial competitors, or the federal government, that systematic attacks could be traced back to a nondescript office building outside Shanghai that he believes was run by the Chinese army. What was remarkable was that the extraordinary details — code names of hackers, one's affection for Harry Potter and how they stole sensitive trade secrets and passwords — came from a private security company without the official backing of the U.S. military or intelligence agencies that are responsible for protecting the nation from a cyberattack.
The report, embraced by stakeholders in both government and industry, represented a notable alignment of interests in Washington: The Obama administration has pressed for new evidence of Chinese hacking that it can leverage in diplomatic talks — without revealing secrets about its own hacking investigations — and Mandiant makes headlines with its sensational revelations.
The report also shows the balance of power in America's cyberwar has shifted into the hands of the $30 billion-a-year computer security industry.
"We probably kicked the hornet's nest," Mandia, 42, said in an interview at the Alexandria, Va., headquarters of Mandiant. But "tolerance is just dwindling. People are tired of the status quo of being hacked with impunity, where there's no risk or repercussion."
China has disputed Mandiant's allegations.
Mandiant, which took in some $100 million in business last year — up 60 percent from the year before — is part of a lucrative and exploding market that goes beyond antivirus software and firewalls. These "digital forensics" outfits can tell a business whether its systems have been breached and — if the company pays extra — who attacked it.
Mandiant's staff is stocked with retired intelligence and law enforcement agents who specialize in computer forensics and promise their clients confidentiality and control over the investigation. In turn, they get unfettered access to the crime scene and resources to fix the problem (Mandiant won't say exactly how much it charges, but it's estimated to average around $400 an hour).

Now what we need is an open, frank public dialog about what to do about it.

By: Brant

Cybersecurity - Now a Taliban Problem, too!

I guess if you're going to fail, fail big!

Somewhere out there, Mullah Omar must be shaking his head.

In a Dilbert-esque faux pax, a Taliban spokesperson sent out a routine email last week with one notable difference.He publicly CC'd the names of everyone on his mailing list.

The names were disclosed in an email by Qari Yousuf Ahmedi, an official Taliban spokesperson, on Saturday. The email was a press release he received from the account of Zabihullah Mujahid, another Taliban spokesperson. Ahmedi then forwarded Mujahid's email to the full Taliban mailing list, but rather than using the BCC function, or blind carbon copy which keeps email addresses private, Ahmedi made the addresses public.

"Taliban have included all 4 of my email addresses on the leaked distribution list," tweeted journalist Mustafa Kazemi, a prolific Kabul-based tweeter with more than 9,500 followers. "Quite reassuring to my safety."

The list, made up of more than 400 recipients, consists mostly of journalists, but also includes an address appearing to belong to a provincial governor, an Afghan legislator, several academics and activists, an l Afghan consultative committee, and a representative of Gulbuddein Hekmatar, an Afghan warlord whose outlawed group Hezb-i-Islami is believed to be behind several attacks against coalition troops.

The Taliban routinely send out press releases to their mailing list, often claiming responsibility for attacks against Afghan and coalition targets. They are known for exaggerating casualty figures.

By: Brant

GrogHeads is Down, Thanks to Anonymous

GoDaddy, the online host for GrogHeads, is down right now and Anonymous is claiming responsibility.

GoDaddy, the domain registrar and Web hosting company, is down, perhaps taking millions of websites down as a result.

"Status Alert: Hey, all. We're aware of the trouble people are having with our site. We're working on it," @GoDaddy tweeted Monday.

While GoDaddy.com's site is up and running, websites hosted by the company are still experiencing outages.

TechCrunch reports that GoDaddy email addresses are down, as well. The blog suggests customers concerned with that their site has been affected can check online status at Down For Everyone Or Just Me.

A quick call to the company's customer service line resulted in a voice message stating that the company is aware of issues involving several services, including web hosting and emails. The company suggest following its Twitter page for updates.

Twitter accounts claiming to be associated with the hacking group Anonymous claimed responsibility for the attack.

"Basically, every GoDaddy site on the planet just crashed," @TibitXimer tweeted.

"#TangoDown - godaddy.com," @AnonOpsLegion tweeted Monday, claiming that the Twitter account @AnonymousOwn3r was responsible for the breach. "TangoDown" is the term that Anonymous generally uses to signify that a website is down.

By: Brant

GameTalk - Cyber Warfare

How the hell do you model cyber warfare?!


Your digits below!

By: Brant

UPDATE: This just posed on 2/2
Secret cyber meeting of top intel officials – CNN Security Clearance

The Coming Cyberwar

Foreign Policy magazine is looking ahead at "The Calm Before the Storm".

In one remote attack on the Pentagon's information systems about 10 years ago, the Chinese hauled away up to 20 terabytes of information. If the information had been on paper, they'd have needed a line of moving vans stretching from the Pentagon to freighters docked 50 miles away in Baltimore harbor just to haul it away. Had they done so, the military district of Washington would've become an active theater of operations for the first time since 1865, and the Navy would've blockaded the Chesapeake Bay. But the Chinese did it electronically, so who noticed?

Corporate espionage by both competitors and foreign intelligence services or their surrogates is also increasing. Intelligence officials see this but can't speak openly about the specifics, and I'm seeing it now in my law practice. The victims rarely admit it, for understandable reasons. Oracle, which successfully sued SAP for theft of its software code, was a prominent exception. Google was another.

When the Chinese penetrated Google in late 2009 -- yes, that operation was Chinese, and yes, it was done with the blessing of a member of the Politburo -- they weren't after customer information. They were after the source code that makes Google unique. Nor was Google the only victim: Thousands of U.S. and Western firms were penetrated in that affair. Foreign governments -- and not only the Chinese -- understand that they cannot compete with the United States militarily and politically if they cannot compete with it economically, so their intelligence services want to steal its corporate intellectual property. This is the technology that gives America its competitive edge, and often it has nothing to do with defense. Ordinary companies with valuable technology are now being targeted by nation-states. This is a new era. National security and economic security have converged.

The danger is not limited to the loss of technology and information, however. The owners and operators of the North American electricity grid are hooking up their control systems to the Internet as fast as they can. Exposing the grid to the Internet makes it marginally more efficient, but it also makes it dramatically more vulnerable to disruption. If you can remotely penetrate an electronic system to steal information, you can remotely penetrate it to shut it down or make it go haywire. This is why there is no longer a meaningful difference between information security and operational security. And the biggest operational risk is the grid. In contemporary society, nothing moves without electricity. If the grid goes out, the country stops.

By: Brant

Another Undeclared War

[Link in the headline.]
Link is now here... Brant

McAfee, one of the leading IT security companies, has uncovered a five year-long hacking campaign against Western companies and international organizations including the UN conducted by a "foreign government" (almost certainly China). I can only conclude that our sick financial co-dependency with China, in which they loan us back our own money to buy more of their junk, has us so cowed that we are reluctant to offend the Chinese government by calling them out on these shenanigans.

Yes, this has become a rant. In my opinion, our relationship with China is the tip of an iceberg of some very fundamental, structural issues in American society.

By: Guardian

DoD's New Cyber Strategy Website

The DoD has launched a new Cyber Strategy Website

The Department of Defense today launched a new website http://www.defense.gov/cyber to highlight DoD’s first unified strategy for cyberspace announced on July 14. The website is a tool to help explain and consolidate DoD’s cybersecurity accomplishments and new way forward for military, intelligence and business operations in cyberspace.

The new website is designed to help users explore the five pillars of DoD’s cyber strategy:
- treating cyberspace as an operational domain
- employing new defense operating concepts
- partnering with the public and private sector
- building international partnerships
- leveraging talent and innovation.
Additional content includes links to cybersecurity jobs in government, key news items, press releases, and video of discussions on cybersecurity.

If I gave you 65 days before it gets hacked, would you take the over or under?

By: Brant

Sound Off! Cybercriminals or Cyberwar?

Do we treat cyber attacks as criminal acts or acts of war?

Sound off below!

By: Brant

Booz-Allen Hacked

Cyber-hacktivist group Anonymous attacked Booz-Allen-Hamilton and supposedly got 90,000 email IDs. Which is interesting, considering they don't have 90,000 employees.

They apparently were able to get encrypted versions of the email passwords only, 53,000 of which carried the military ".mil" domains, the report said.

The hackers also wiped out 4GB of Booz Allen source code in an attack they called "Military Meltdown Monday". The group said, "We infiltrated a server on their network that basically had no security measures in place."

Booz Allen provides technological services including cyber-security consulting to the American military and other US government agencies. Its staff includes Michael McConnell, former director of the National Security Agency.

And if you'd like to here Mike McConnell talk about cybersecurity, you can listen to him talk about the "Cybersecurity Balancing Act" on BAH's own website. One of the bullet-point highlights of the talk? "Protecting against insider and outsider threats". Indeed.

UPDATE:
Doctrine Man weighs in...

By: Brant

Cyber Attack = Act of War?

A new Pentagon policy has elevated cyber attacks to "acts of war".

The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the U.S. to respond using traditional military force.

The Pentagon's first formal cyber strategy, unclassified portions of which are expected to become public next month, represents an early attempt to grapple with a changing world in which a hacker could pose as significant a threat to U.S. nuclear reactors, subways or pipelines as a hostile country's military.

In part, the Pentagon intends its plan as a warning to potential adversaries of the consequences of attacking the U.S. in this way. "If you shut down our power grid, maybe we will put a missile down one of your smokestacks," said a military official.

poll by twiigs.com

By: Brant

Random Friday Wargaming: Cybernaut

Long out of print, but still very cool is the magazine game Cybernaut from Joe Miranda and Jon Compton**



Although it's out of print, you can still track it down over at Noble Knight games.

There's actually no CSW board for this one, either. Doesn't stop it from being a cool little early cyberwar game, though, and worth checking out. I've got a copy in storage somewhere I should probably dig out and look into...

Master links/images from Boardgamegeek.com; message boards linked to Consimworld. Other links to the actual game pages...

** yes, he's the same as 'our' Jon Compton :)

By: Brant

CyberAttacks-A-Go-Go

This weekend featured a few cyberattacks around the world... connected or not?

The French government was apparently poked by China.

The French finance ministry has shut down 10,000 computers after a "spectacular" cyber attack from hackers using Internet addresses in China, officials and reports said on Monday.

And the South Koreans were hit by an international botnet.

South Korean police have isolated 30 overseas servers that were ordering more than 34,000 zombie computers to carry out DDoS attacks, Yonhap news agency said.
These servers have been traced to 18 countries and territories around the world, including the United States, Russia, Italy, Mexico, Israel and Hong Kong.

By: Brant

Chinese Cyber Spies Attack Canadian Government Departments

A recent cyber attack on Canadian government departments might have given Chinese hackers access to classified defence data, among other sensitive material.

Foreign cyber hackers who attacked federal government departments could have been looking for information on weapon technology and natural resource policy, an expert in China's cyber spying program says.

The attacks, revealed by CBC News, targeted the Finance Department, the Treasury Board and Defence Research and Development Canada.

It's unclear what information the hackers, believed to based in China, were after.

Charles Burton, who teaches Chinese politics at Brock University and has written extensively on Chinese cyber spying programs, said that in the case of DRDC, the hackers were looking for information on new weapons.

"Canada has access to secrets that are shared with other Western industrial countries, such as the United States, with regard to sophisticated weaponry. And the Chinese government would have strong interest in getting hold of technologies," Burton said.

In the case of the Finance Department and the Treasury Board, Burton said, the hackers may have been looking for evidence of new international plans to pressure China to revalue its currency.

"With regard to the Treasury Board, the hackers would be able to get information about the passwords of key government officials that would then give them access to a wide range of classified data," Burton said.

But the hackers are interested in more than defence and economic information, he said.

China also has great interest in Canada's resource sector — oil and gas in particular, where it's a big investor. Companies in those fields have been targets for hackers in the past, although the source has never been pinned down.

Information on evolving federal government resource policy would give China useful information as it continues to expand its investments in Canada.

"Natural resources and the oil sector are very important to them, and there have been allegations of Chinese sources also hacking into computers of companies involved in those particular areas as well," Burton said.

China has denied any responsibility for the attacks.

By: Shelldrake

BUB: A Deeper Look at the Ideological Struggle Over WikiLeaks

It's no secret that there's a lot of sound and fury surrounding WikiLeaks. It's also not hard to infer that we're not huge fans of WikiLeaks here at GrogNews. Opinions on GrogNews are everywhere, but it's particularly entertaining when people completely shoot themselves in the foot when talking about WikiLeaks.

One such essay comes from The Atlantic magazine, in an article entitled "Truth Lies Here ". The whole tenor of the article is that right-wing websites, especially newsblogs and other opinion sites, are manipulating the "truth" by trying to bury factual accounts of news that they don't like. By contrast, The Atlantic holds up WikiLeaks as a bastion of truth for truth's sake.

“We believe prima facie that true information does good,” Assange told The Economist in July. But even in his world of unmediated information, truth can be murky, as Assange noted in a CNN interview in which he defended the Afghanistan release as “legitimate reports,” but conceded: “It doesn’t mean the contents are true.” Assange was on surer ground last spring with his blockbuster leak of video footage that showed an American helicopter strike killing civilians in Iraq. The footage was grotesque, compelling, and a helpful reminder that war is far from the antiseptic experience usually portrayed in the U.S. media, and morally complex even in the most clear-cut of cases.

And yet, as chronicled by the New York Times - hardly a bastion of right-wing defensiveness - WikiLeaks have themselves been guilty of playing fast and loose with the "truth".

WikiLeaks’s biggest coup to that point was the release, last April, of video footage taken from one of two U.S. helicopters involved in firing down on a crowd and a building in Baghdad in 2007, killing at least 18 people. While some of the people in the video were armed, others gave no indication of menace; two were in fact journalists for the news agency Reuters. The video, with its soundtrack of callous banter, was horrifying to watch and was an embarrassment to the U.S. military. But in its zeal to make the video a work of antiwar propaganda, WikiLeaks also released a version that didn’t call attention to an Iraqi who was toting a rocket-propelled grenade and packaged the manipulated version under the tendentious rubric “Collateral Murder.”

(see both videos here)

Back to the Atlantic, where the author argues that the partisan "feedback loop" that one finds online is a bad thing, without bothering to acknowledge that similar sites exist for numerous left-wing causes like Palestinian 'independence' and the banning of private military contractors.

But factual counterterrorism is a tricky enterprise in this era of asymmetric information warfare. The urge to shape the data to suit the message, to outfit one’s argument with a set of misappropriated, cynically edited, or simply fabricated facts that can be fed into a self-sustaining partisan feedback loop, will no doubt prove irresistible to many. WikiLeaks’s Assange is playing an old game (see the Pentagon Papers; whistle-blowers in general) with powerful new tools. But the Breitbarts, Gingriches, and bury brigades are engaged in an enterprise uniquely enabled by the collapse of the center and the ubiquitous means by which information can spread instantly

.

Cracks are developing within the WikiLeaks hierarchy, too A new book from a former high-placed coder at WikiLeaks blasts Assange and his approach to the website.

WikiLeaks editor Julian Assange went from being "imaginative, energetic (and) brilliant" to a "paranoid, power-hungry, megalomaniac," a former colleague charges in a new book out Thursday.
Assange also has "a very free and easy relationship with the truth," Daniel Domscheit-Berg claims

That "free and easy relationship with the truth" is something that the New York Times clearly demonstrated, and yet The Atlantic - usually so very good about their articles - celebrates WikiLeaks as the truth standard against which we should judge conservative websites. That's setting the bar pretty low, eh?

And the greatest irony of all? WikiLeaks key transport mechanism was written by the US government, and it's an American hacker that makes it all go for them.

The Tor Project has received funding not only from major corporations like Google and activist groups like Human Rights Watch but also from the U.S. military, which sees Tor as an important tool in intelligence work. The Pentagon was not particularly pleased, however, when Tor was used to reveal its secrets. Wikileaks runs on Tor, which helps to preserve the anonymity of its informants. Though Appelbaum is a Tor employee, he volunteers for Wikileaks and works closely with Julian Assange, the group's founder. "Tor's importance to Wikileaks cannot be understated," Assange says. "Jake has been a tireless promoter behind the scenes of our cause."

By: Brant

COA Analysis: NATO-Russia Cyber-Faceoff

So which way might it go if there's another Russian attack on Estonia? NATO involvement? Article 5? Or willful avoidance of the "attack" so as not to provoke Russia?

By: Brant

Russia Warns NATO Of Cyber Attack Danger

I wonder whether the creators of Stuxnet appreciated the potential for a regional disaster when the computer worm was used to attack Iran's nuclear facilities.

A recent cyber attack on Iran's nuclear program could have triggered a disaster comparable to the one in Chernobyl 25 years ago, Russia's envoy to NATO said Wednesday.

Dmitry Rogozin urged NATO to join Moscow in investigating who created and unleashed the mysterious and destructive computer worm known as Stuxnet. The virus hit Iran's nuclear facilities last year, temporarily crippling its uranium enrichment program, which can make both nuclear fuel and the fissile core of warheads.

Iran is under four sets of U.N. Security Council sanctions for refusing to freeze the activity, which it says it needs to create fuel for a future nuclear power network.

Rogozin told journalists at NATO headquarters that the virus could have caused the control system of Iran's Bushehr nuclear reactor to malfunction, leading to the release of poisonous radioactive dust into the atmosphere, as happened in Chernobyl.

[snip...]

Rogozin, who attended the panel's meeting on Wednesday along with Russia's military chief, Gen. Nikolai Makarov, said greater cooperation is needed between NATO and Russia in cyber defense. The former Cold War rivals already are cooperating closely in other fields such as missile defense, the war in Afghanistan, counter-narcotics, the battle against terrorism and maritime piracy.

By: Shelldrake

GrogNews Daily Headlines

That 'cyberwar' the WikiDrips started? Yeah, turns out they can't even hit the right targets. Oops.

There were arrests in the Afghan attack that killed 6 US troops. Yep, arrests. Not deaths. Not mass explosions. Arrests. In one of the most corrupt nations on the planet. Yippee.
Why not arrest the tuckfards who are killing teachers in Pakistan?

The Norks are threatening nuclear war. Yawn. The US and China apparently discussed this, as well as maritime security in recent talks.

And the bombing in Stockholm might could have been worse.

By: Brant

GrogNews Weekend Headlines

Winter fighting in Afghanistan? Yep, and there's a bunch of dead insurgents.

Dennis Blair, former US national intel director, thinks South Korea might attack the Norks. Given Blair's sketchy (at best) performance as DNI, you gotta wonder if this is just another reason to be glad he's not in charge.

Are the Assange's WikiDrips crusaders bailing on their cyberwar? Yeah, probably, now that the school week is about to start again. They all need to turn in their 11th grade trig homework.

Israel is publicly saying what everyone's whispered all along... they don't want to share Jerusalem.

By: Brant

GrogNews Daily Headlines

The WikiDrips hackwar continues, and has now roped in Amazon, whose servers quit hosting the site a few days ago, Visa, Mastercard, and PayPall, all of whom quit processing donations for the site, and a Swedish government website. The anonymous twits running the hacks? They say they'll continue.

The latest revelations? The US is monitoring China's activities in Africa. Oh, and apparently the US and Canada are close allies.

Tensions are still rising in Korea.

Israel has launched strikes on Gaza.

And what do the holidays look like in Afghanistan?


By: Brant