Category Archives: Cyber War

The Accurate ISIS News Agency

Posted on by

A News Agency With Scoops Directly From ISIS, and a Veneer of Objectivity

NYT: The San Bernardino shootings. The killing rampage this week in a Baghdad mall. On Thursday, it was the explosion that ripped through a Starbucks in Jakarta.

In each of those terrorist attacks, an outlet called the Amaq News Agency was first with the news that the Islamic State was going to claim responsibility. The agency has been getting the scoops because it gets tips straight from ISIS, and for those of us on the terrorism beat, that has made Amaq a must-read every time a bomb goes off.

It publishes a heavy stream of short releases on an encrypted phone app called Telegram, functioning much like an official news agency might inside a totalitarian state. The alerts, articles and videos take on the trappings of mainstream journalism, with “Breaking News” and “Exclusive” headings.

And its reporters try to appear objective, toning down the jihadist hyperbole ISIS uses in its official releases. (The Jakarta attackers were “Islamic State fighters” rather than the ISIS-preferred “soldiers of the Caliphate.” Victims are “foreign citizens” rather than “Crusaders.”)

Make no mistake, though: Amaq is putting out the Islamic State’s message, and the veneer of separation between the terrorist group and what has now become its unacknowledged wire service is quickly disintegrating. Though the group is not officially part of the ISIS media apparatus, it functions much that way.

“It has become much more assimilated into the Islamic State’s propaganda infrastructure, and now it’s a fully fledged and very important part of it. It has become the first point of publication for claims of responsibility by the group — though not as a rule,” said Charlie Winter, a senior researcher at the Transcultural Conflict and Violence Initiative at Georgia State. He pointed out that one of the biggest attacks — the Nov. 13 killings in Paris — followed the more traditional route, with the claim of responsibility published directly by ISIS.

The Islamic State maintains its official Al Bayan radio station, which puts out daily news bulletins, and its monthly magazine Dabiq, as well as many production companies that put out its grisly videos. Beyond those, there are also media offices in each of the Islamic State’s provinces. The material that goes out on these official outlets has the ultimate stamp of ISIS approval — that’s what they want us to know about their ideology and their tactics.

Those messages are tightly controlled, honed to both appeal to the largest numbers of recruits as well as designed to intimidate and sow fear.

As one example of how much they control their messaging, consider what happened to the British jihadist Omar Hussain. This month, Mr. Hussain published a string of essays about life under the Islamic State — and then he was served a cease-and-desist order by the ISIS Media Committee.

The terror group ordered him to shut down his Telegram account or face the consequences, according to a screen grab of the message which he shared with his followers in his farewell post. Perhaps they didn’t like the 6,000-word diatribe he posted, ranting against Arabs and accusing Syrian children of stealing his phone charger.

Amaq appears to have been created, or allowed to develop, as a way to create a source of information that is still basically controlled by the Islamic State but is somewhat removed from the group, giving ISIS more of the appearance of legitimacy.

One of the closest watchers of jihadist propaganda for years has been SITE Intelligence in Washington. The researchers there say they first saw the Amaq name pop up during the drawn-out battle for Kobani, the Kurdish town on the Syria-Turkey border that ISIS captured in 2014. The tracking group’s director, Rita Katz, said she and her staff noticed that ISIS fighters were sharing the Amaq updates on their personal accounts.

For much of its evolution, Amaq appeared to be posting updates and on-the-ground developments, but there was no clear pattern of Amaq preceding ISIS in claims of responsibility.

That changed last month, when a married couple, Syed Rizwan Farook and Tashfeen Malik, burst into the holiday party at the San Bernardino County Health Department and began shooting. Amaq was the first to report that the two supported the Islamic State. A day later, the Islamic State said the same thing in its official broadcast.

As more and more attacks have broken out in recent days, Amaq has almost always been first to report that the Islamic State was behind them.

“They are behaving like a state media. ISIS sees themselves as a state, as a country — and a country needs to have its own media,” Ms. Katz said.

Taking its cues from the Western media, Amaq has even been featuring “embedded” reporters at the scenes of major ISIS battles. When ISIS took the ancient city of Palmyra in Syria, it was an Amaq cameraman who captured the first footage, Mr. Winter said.

One thing to remember, though, is that Amaq’s function is to spread Islamic State propaganda. You hardly have to dig to see the spin. When United State Special Forces helped Kurdish forces free dozens of prisoners from an ISIS jail in northern Iraq in October, one American soldier was killed. But the Amaq headline had a different take: The headline was “A Failed Airdrop Operation by the American Army.”

Obama Cool with Iran’s Aggressions

Posted on by

Unabated Hostility

Smith, WeeklyStandard: Early last Wednesday, Iran released the ten American sailors it had detained to coincide with President Obama’s State of the Union address Tuesday night. The administration understood clearly that the Iranians were both trying to ruin Obama’s victory lap and sending a message—on the eve of implementing the Joint Comprehensive Plan of Action—that Tehran will be calling the shots. So Obama made no mention of Iran’s capturing 10 Americans during his speech: No way were the Iranians going to get a rise out of him on his day.

The administration would prefer to forget the incident entirely—along with a series of other hostile acts by Iran since the nuclear deal was signed in July. In addition to its customary “Death to America” rallies, in the last few months the Islamic Republic has sentenced, in secret, Washington Post journalist Jason Rezaian; imprisoned U.S. citizen Siamak Namazi; tested ballistic missiles, in violation of U.N. Security Council resolutions; fired rockets near a U.S. aircraft carrier in the Straits of Hormuz; and attacked two diplomatic missions belonging to longtime American ally Saudi Arabia. Detaining American sailors comports perfectly with this pattern.

Some American lawmakers aren’t willing to let it slide. Representative Mike Pompeo (R-Kan.) released a statement saying “we now must fully investigate Iran for possible violations of the Geneva Convention and ensure these sailors were treated properly.”

Pompeo is on solid ground. When the Iranians detained British sailors in 2007 and paraded them on television, Prime Minister Tony Blair rightly described it as a breach of the Geneva Conventions. Article 13 stipulates that “prisoners of war must at all times be protected, particularly against acts of violence or intimidation and against insults and public curiosity.” The first piece of evidence that the Iranians violated Geneva are the photographs and videos of the American sailors, especially those of them kneeling with their hands behind their heads, which were shown repeatedly in the Iranian media; further evidence is the coerced apology from the commanding officer.

It’s worth noting that Iran’s latest hostile action has given us a clearer picture of how the regime actually functions. As the event unfolded, CNN and other American media spoke of the “two Irans,” meaning the hardliners and the moderates. This has been the administration’s working theory, which holds that the former comprises the Islamic Revolutionary Guard Corps and Supreme Leader Ali Khamenei. The “moderates” in this view are figures like President Hassan Rouhani and Foreign Minister Mohammad Javad Zarif. In this scenario, it was the “hardliners” who were responsible for detaining the 10 Americans, and it was thanks to the diplomatic channel that John Kerry opened with Zarif while negotiating the nuclear deal that the sailors were freed without much delay. This theory posits that the hardliners kidnapped the Americans in an effort to embarrass the moderates, who want warmer relations with the White House. Therefore, the fact that the moderates prevailed signals a great victory for moderation and American diplomacy—for “principled diplomacy,” to use Obama’s phrase.

This scenario may be possible, but it isn’t likely. If there really is a split in the regime, why would the hardliners put themselves in a position to lose an intra-regime battle against the moderates? It would show the world that they’re not only weaker than the moderates, they’re also weaker than the moderates’ new partners, John Kerry and Barack Obama. Indeed, if it was the moderates who liberated the sailors from the grip of the extremists, it means the supreme leader himself required them to free the Great Satan’s seamen. Which would mean that the supreme leader has sided with the moderates and the Americans against the extremists.

That’s a stretch, to say the least. What is far more likely is that there is no such split between moderates and hardliners. The two camps—if there are indeed two camps—work in tandem. The hardliners take prisoners and the moderates negotiate the price of their release. Iran’s moderates are a ministry of bagmen sent out to collect on behalf of the hard men.

In short, the regime with which the White House has negotiated the future of American national security is still a regime that takes Americans hostage. Unless you believe that hijacking a U.S. Navy boat, humiliating its crew, photographing them with their hands above their heads, and broadcasting their apologies on state television is a demonstration of peaceful, moderate intentions.

Ukraine Cyber Attack on Power Grid, U.S. Warning

Posted on by

Ex-spy chief: Ukrainian cyberattack a warning sign for US utilities

Retired Gen. Michael Hayden, the former director of the National Security Agency and the CIA, says the US faces ‘darkening skies’ after malware linked power outages in Ukraine.

MIAMI — Former National Security Agency chief Gen. Michael Hayden warned that a recent malware attack on the Ukrainian power grid is yet another troubling sign that the US electric supply is vulnerable to hackers.

The Dec. 23 attack on utilities serving the Ivano-Frankivsk region of Ukraine appears to be the second confirmed incident of a computer-based attack to damage physical infrastructure. The attack led to blackouts throughout the region for several hours before power was restored. The Stuxnet worm that targeted the Iranian nuclear program is the only other such incident.

What happened in Ukraine is a harbinger for the kinds of cyberthreats the US faces, possibly from rival nations such as Russia and North Korea, the retired Air Force general told a crowd of critical infrastructure experts at the S4x16 security conference in Miami. General Hayden served as director of the NSA from 1999 to 2005 and served as CIA chief from 2006 to 2009.

“There a darkening sky,” he told reporters after his speech Tuesday, referring to the increasing threat of malware infections leading to physical damages. “This is another data point on an arc that we’ve long predicted,” he said, acknowledging that the Ukraine attack reinforces concerns in official circles about security of the American power grid. What’s more, he said, if early analysis of malware discovered at the Ukrainian facility that links it to Russia is accurate, the incident foreshadows a troubling uptick in the conflict between Ukraine and Russia over the disputed Crimea region.

The Department of Homeland Security has acknowledged that a version of the BlackEnergy program linked to the Ukraine attack has been discovered in US facilities. Hayden said that the link was troubling. “If they have a presence on the grid [with BlackEnergy] then they have already achieved what they need to carry out a destructive attack.”
Analysis of the malware recovered from the Ukrainian facility conducted by the security firm iSight Partners and SANS Institute revealed that a variant of BlackEnergy, dubbed “BlackEnergy3,” was present in the compromised utilities. However, security experts caution that it is premature to conclude that BlackEnergy was actually involved in the outages.

“It is possible but far too early in the technical analysis to state that,” wrote Michael Assante, who heads up industrial control system research for SANS. “Simply put, there is still evidence that has yet to be uncovered that may refute the minutia of the specific components of the malware portion of the attack.”

Hayden also remarked during his talk Friday on the general state of overall cybersecurity, calling on US lawmakers to pass legislation that will help bolster the nation’s digital defenses.

He also criticized of efforts by FBI Director James Comey, and others in the Obama administration, to weaken strong encryption on consumer devices to make it easier for law enforcement to conduct surveillance operations. “End-to-end encryption is good for America,” he said. “I know that it represents challenges for the FBI, but on balance it creates more security for Americans than the alternative – backdoors.”

Regarding the recent Office of Personnel Management hack – which US intelligence agencies and cybersecurity expert have blamed on China – Hayden said that as head of the NSA he would have absolutely stolen similar data from the Chinese government if given the opportunity. What’s more, he said, he wouldn’t have had to ask permission to carry out the operation.

“Fundamentally, the limiting factor now is a lack of legal and policy framework to do what we are capable of doing today,” Hayden said. “OPM isn’t a bad on China,” he said. “It’s a bad on us.”

What is vulnerable in the United States?

Project ‘Gridstrike’ Finds Substations To Hit For A US Power Grid Blackout

Turns out free and publicly available information can be used to determine the most critical electric substations in the US, which if attacked, could result in a nationwide blackout.

Remember that million-dollar Federal Energy Regulatory Commission (FERC) study in 2013 that found that attacks on just nine electric substations in the US could cause a blackout across the entire grid? Well, a group of researchers decided to see just what it would take for a small group of domestic terrorists to identify the US’s most critical substations — using only free and public sources of information.

While FERC relied on confidential and private information in its shocking report and spent a whopping $1 million in research, researchers at iSIGHT Partners used only so-called open-source intelligence, at a cost of just $15,000 total for 250 man-hours by their estimates. The Wall Street Journal, which obtained and first reported on the confidential FERC report, never publicly revealed the crucial substations ID’ed by FERC for obvious reasons, nor does iSIGHT plan to disclose publicly the ones it found.

Sean McBride, lead analyst for critical infrastructure at iSIGHT, says the goal of his team’s so-called “Gridstrike” project was to determine how a small local-grown terror group could sniff out the key substations to target if it were looking to cause a power blackout — either via physical means, a cyberattack, or a combination of the two. “How would an adversary go about striking at the grid?” McBride said in an interview with Dark Reading. He will speak publicly for the first time about the Gridstrike research next week at the S4x2016 ICS/SCADA conference in Miami.

The iSIGHT researchers drew from a combination of publicly available transmission substation information, maps, Google Earth, and grid congestion documentation, and drew correlations among the substations that serve the top ten cities in the US. They then were able to come up with 15 substations that serve as the backbone for much of the electric grid: knocking out those substations would result in a nationwide blackout, they say.

FERC’s report had concluded that the US could suffer a nationwide blackout if nine of the nation’s 55,000 electric transmission substations were shut down by attackers.

“We looked at maps and tried to … identify [power] generation facilities, and looked up both centers and what substations are in the middle that would make high-value targets,” for example, McBride says. “We tried to identify which substations have the highest number of transmission lines coming in and out,” as well, and weighed their significance.

The researchers shared the findings from Gridstrike with their customers as well as “organizations most interested from a defense perspective” to such attacks, says McBride, who declined to provide any further details on the specific organizations.

“We were extremely concerned about the amount of publicly available information” on the critical substations, McBride says. There were several documents available publicly that should not have been: in some cases, a sensitive document was sitting on an organization’s public website even though it specified that the report was not for public consumption.

The hope is that the findings will alert critical infrastructure and other organizations with ties to the power grid that understanding how an adversary thinks can help shore up defenses, McBride says. “They need to manage their recon exposure.”

What does all of this mean for the US power grid’s actual vulnerability to a physical or cyber-physical attack? McBride says the openly available intel is “reason for concern.” He says he worries more about the possibility of a regional, localized, grid attack targeting a city or area, than a nationwide attack.

As for the recent power blackout in the Ukraine that appears to have been due in part to a cyberattack, McBride says he’d be surprised if the attackers didn’t gather some of their reconnaissance via open source intelligence.

 

EW, Jamming GPS by IRGC vs. U.S. Navy

Posted on by

EW = Electronic warfare is any military action involving the use of the EM spectrum to include directed energy (DE) to control the EM spectrum or to attack an enemy. This is not limited to radio or radar frequencies but includes IR, visible, ultraviolet, and other less used portions of the EM spectrum. This includes self-protection, standoff, and escort jamming, and anti-radiation attacks. EW is a specialized tool that enhances many air and space functions at multiple levels of conflict.

Tuesday, October 4, 2011
Iran Develops GPS jammer
Iran Unveils Major Achievements in Electronic Warfare

TEHRAN (FNA)- Iran on Tuesday displayed three of its latest and most
important achievements in the field of electronic warfare.

The country’s achievements were unveiled in a ceremony attended by
Khatami-ol-Anbia Air Defense Base Commander General Farzad Esmayeeli.

The hi-tech products which went on display included Shahed Electronic
Warfare Simulator, an electronic warfare tester of Radar systems called
‘Sabah’, and a GPS jamming system all designed and produced by Iranian
experts inside the country.

Electronic warfare is amongst the most crucial elements in air defense and
military observers believe that Iran enjoys an excellent capability in
electronic warfare technology and in designing and manufacturing electronic
warfare systems.

Farsi island is an exclusive IRGC base likely with very sophisticated and advanced systems to gain access to communications regardless of platform in the region, all of the Persian Gulf and land based infrastructure. (Just keep in mind, when Iran got their hands on a U.S. drone, where they likely reversed engineered our  systems)

On 4 December 2011, an American Lockheed Martin RQ-170 Sentinel unmanned aerial vehicle (UAV) was captured by Iranian forces near the city of Kashmar in northeastern Iran. The Iranian government announced that the UAV was brought down by its cyberwarfare unit which commandeered the aircraft and safely landed it, after initial reports from Western news sources inaccurately claimed that it had been “shot down”. The United States government initially denied the claims but later President Obama acknowledged that the downed aircraft was a US drone and requested that Iran return it.[2][3]

General Dynamics will deliver Block 1B3 system upgrades over the next five years. The upgrades will be integrated into new and existing Navy ships providing significantly improved situational awareness of the tactical environment surrounding the ship, the company said in a statement Monday.

General Dynamics has been involved with the SEWIP Block 1 program since 2003 and received a low-rate initial production contracts for the SEWIP Block 1B3 in 2014. Work on the contract will take place in Pittsfield, Massachusetts.

SEWIP is comprised of capability improvements divided into production blocks. This contract is part of Block 1, which provides enhanced electronic warfare capabilities to Navy ship combat systems improving anti-ship missile defense, counter targeting and surveillance. The block 1B3 system is the final upgrade for Block 1, providing high-gain/high-sensitivity electronic capability.

Electronic warfare system provides greater detection and identification of threats to Navy combat ships.

Military Jamming GPS document is here.

Broken Navigation System Led U.S. Navy Boats Into Iranian Waters

Published 13 January 2016

RFE: The top naval commander for Iran’s Revolutionary Guard, Rear Admiral Ali Fadavi, has told the Tasnim news agency that an internal investigation found a broken navigation system was to blame for leading two U.S. Navy patrol boats into Iranian waters. The vessels and 10 sailors were seized by Iran on January 12. The U.S. Department of Defense has released file video showing the type of Navy boats that were seized. (U.S. Department of Defense file, Reuters)

The Pentagon Is Worried About Hacked GPS

GPS is a two-edged sword. The Global Positioning System has been the foundation of a revolution in warfare that enables highly accurate smart bombs and navigation systems. With all the furor over civilian casualties caused by smart bombs, imagine what the toll would be without GPS weapons.

On the other hand, GPS is the device that allows civilian drivers to follow its directions while driving off a cliff. Which raises the question: what happens when GPS isn’t available?

It’s a question the U.S. military is taking very seriously. The advent of cheap GPS jammers allows terrorists as well as hostile nations to block navigation signals. Hackers can disrupt the system, while the GPS satellites themselves—even at 12,500 miles high—are potentially vulnerable to anti-satellite weapons. And that’s assuming that America doesn’t wreck its own GPS system; the U.S. Air Force’s plan to develop the next generation of GPS ground control stations has been described by the Pentagon as a “disaster.”

So it is no surprise that the U.S. military is pursuing several backup technologies for GPS. The Air Force and Navy are asking the defense industry to come up with alternatives for when GPS isn’t available.

The Navy, for example, wants a Positioning, Navigation and Timing (PNT) system that allows users to navigate from radio signals when GPS is down. Ironically, one alternative the Navy is proposing is LORAN-C, the radio navigation system that the United States shut down in 2010 because GPS supposedly rendered it obsolete. “Since then, the government has realized that GPS represents a single point of failure which can be denied through unintentional and intentional interference,” explains the Navy, which also notes that the technology can be used by civilian airliners when their GPS navigation has been disrupted.

The Air Force is also looking for a PNT system. Their approach is focusing on pseudo-satellites (pseudolites), ground or airborne transmitters that perform the same function as GPS satellites, but can overpower jamming because they are a lot closer to the user’s location than an orbital GPS station.

Not to be outdone are the people who get themselves into situations where accurately knowing your location is more than a luxury. Special Operations Command (SOCOM), which oversees America’s commandos, wants a GPS alternative for its aircraft.

SOCOM does not paint an optimistic picture of current GPS technology. “Some of the issues with the current GPS include blind spots as well as spoofing and jamming of the GPS signal,” states the research proposal. “Additionally, many GPS satellites are outside of their designed lifetime and are likely to become less reliable in the future. Finally, it is uncertain whether current budget cuts will allow the funding needed to launch new GPS satellites.”

No doubt the Pentagon will find alternative technologies, perhaps something that will replace GPS. But the larger question is technological dependence. If the U.S. military, not to mention civilian airliners and ships, are that helpless when GPS is down, then perhaps the problem is with the user as well as the technology.

This should answer some questions when it comes to the IRGC activities on Farsi Island and why 2 riverine boats came into the possession of the IRGC along with 10 sailors. Is it any wonder why Defense Secretary Ash Carter asked Iran to be merciful to our sailors and John Kerry begged forgiveness?

ODNI Chief Clapper, Hacked Again

Posted on by

Teen Who Hacked CIA Email Is Back to Prank US Spy Chief

Motherboard: One of the “teenage hackers” who broke into the CIA director’s AOL email account last year hasn’t given up targeting government intelligence officials. His latest victim is the Director of National Intelligence James Clapper, Motherboard has learned.

A group of hackers calling themselves “Crackas With Attitude” or CWA made headlines in October, hacking into CIA Director John Brennan’s email account and apparently getting access to several online tools and portals used by US law enforcement agencies.The hackers’ exploits prompted the FBI to issue an alert warning government officials of their attacks.

One of the group’s hackers, who’s known as “Cracka,” contacted me on Monday, claiming to have broken into a series of accounts connected to Clapper, including his home telephone and internet, his personal email, and his wife’s Yahoo email. While in control of Clapper’s Verizon FiOS account, Cracka claimed to have changed the settings so that every call to his house number would get forwarded to the Free Palestine Movement. When they gained notoriety last year, Cracka and CWA claimed their actions were all in support of the Palestine cause.

“I’m pretty sure they don’t even know they’ve been hacked,” Cracka told me in an online chat.

But Brian Hale, a spokesperson for the Office of the Director of National Intelligence, confirmed the hack to Motherboard on Tuesday.

“We’re aware of the matter and we reported it to the appropriate authorities,” Hale said, declining to answer any other questions on the record. (The FBI declined to comment.)

Cracka, or whoever is pretending to be him, taunted authorities on Twitter (the hacker used a new Twitter account, not the same one he used at the time of the Brennan hack. But the hacker also is in control of a chat app account who’s been using to communicate with me since last October).
Cracka provided me with what he claimed to be Clapper’s home number. When I called it on Monday evening, I got an answer from Paul Larudee, the co-founder of the Free Palestine Movement. Larudee told me that he had been getting calls for Clapper for the last hour, after an anonymous caller told him that he had set Clapper’s number to forward calls to him. Larudee said that one of the callers said he was sitting in Clapper’s house next to his wife.

According to public records, the phone number does belong to James Clapper’s household. Cracka also provided another number, a cellphone, which he said belonged to either Clapper or Clapper’s wife, Susan. When I called, a woman picked up and I asked if this was Susan Clapper. The woman responded that Susan wasn’t there, but that she’d tell her to call me back. But nobody ever did.

Cracka also claimed to have gotten into Susan’s Yahoo email account, as well as Clapper’s email account. He provided a series of screenshots to prove he had control of their Verizon FiOS account, as well as Susan’s Yahoo account. Motherboard couldn’t independently verify the authenticity of the screenshots.

The hacker also sent me a list of call logs to Clapper’s home number. In the log, there was a number listed as belonging to Vonna Heaton, an executive at Ball Aerospace and a former senior executive at the National Geospatial-Intelligence Agency. When I called that number, the woman who picked up identified as Vonna Heaton. When I told her who I was, she declined to answer any questions.

“A journalist? Oh my gosh” she said, laughing uncomfortably. “I have somebody on the line, I’m sorry, I have no insight into that. But that’s really unfortunate, have a great day.”

“I just wanted the gov to know people aren’t fucking around, people know what they’re doing and people don’t agree #FreePalestine.”
Michael Adams, an information security expert who served more than two decades in the US Special Operations Command, said that this looks “more of a social engineering hack than a real hack,” but also added that “every serious hack starts with social engineering.”

Adams also said that it’s “insane” that Clapper doesn’t do more to hide his home address and phone number (both can be found with a Google search).

“If I’m the Director of National Intelligence of the United States of America nobody is going to know where the fuck I live, nobody is going to have my goddamn phone number or address,” Adams told me in a phone interview.

On Tuesday, Cracka asked me not to name him in the article, saying he “doesn’t like the attention.”

“You Asked why I did it,” he added. “I just wanted the gov to know people aren’t fucking around, people know what they’re doing and people don’t agree #FreePalestine.”