Cyber Conflict, Chaos and Calamity

There have been several Congressional hearings on cyber-terrorism, yet with such an emergency and threat, no solution is forthcoming.

From AEI: “America’s intelligence leaders have made clear the biggest threat today is cyber and counterintelligence. Who are the largest perpetrators of these types of attacks? The intelligence report singles out Russia and China as first examples. These nations have “highly sophisticated cyber programs” and are regularly conducting “politically motivated” attacks. What are they up to exactly? Countries such as China are “reconnoitering and developing access to US critical infrastructure systems, which might be quickly exploited for disruption if an adversary’s intent became hostile.” Back in 2013, Verizon released a report detailing Chinese hackers lurking around inside American industrial control systems—the cyber equivalent to casing a robbery target. In 2014 alone, the FBI investigated a likely Russian hacking campaign against American banking backbone JP Morgan, while two cybersecurity firms blamed Iran for a major campaign against US critical infrastructure like major airliners, medical universities, and energy companies. As the year ended, the US government publicly accused North Korea of a devastating cyberattack against Sony.”

When of Office of National Intelligence produced a report, the first chapter is on cyber threats.

“Risk. Despite ever-improving network defenses, the diverse possibilities for remote hacking intrusions, supply chain operations to insert compromised hardware or software, and malevolent activities by human insiders will hold nearly all ICT systems at risk for years to come. In short, the cyber threat cannot be eliminated; rather, cyber risk must be managed. Moreover, the risk calculus employed by some private sector entities does not adequately account for foreign cyber threats or the systemic interdependencies between different critical infrastructure sectors.

Costs. During 2014, we saw an increase in the scale and scope of reporting on malevolent cyber activity that can be measured by the amount of corporate data stolen or deleted, personally identifiable information (PII) compromised, or remediation costs incurred by US victims. “

The stakes are higher than anyone will admit, most of all the White House. The Office of Personnel Management hack of personnel files now appears to exceed 18 million individuals. “FBI Director James Comey gave the 18 million estimate in a closed-door briefing to Senators in recent weeks, using the OPM’s own internal data, according to U.S. officials briefed on the matter. Those affected could include people who applied for government jobs, but never actually ended up working for the government.”

Just announced as a possible additional agency falling victim to hacking is the National Archives and Records Administration (NARA). What is chilling about this probability is all government reports, records and communications are by law to be maintained by NARA., even classified material.

EXCLUSIVE: Signs of OPM Hack Turn Up at Another Federal Agency

The National Archives and Records Administration recently detected unauthorized activity on three desktops indicative of the same hack that extracted sensitive details on millions of current and former federal employees, government officials said Monday. The revelation suggests the breadth of one of the most damaging cyber assaults known is wider than officials have disclosed.

The National Archives’ own intrusion-prevention technology successfully spotted the so-called indicators of compromise during a scan this spring, said a source involved in the investigation, who was not authorized to speak publicly about the incident. The discovery was made soon after the Department of Homeland Security’s U.S. Computer Emergency Readiness Team published signs of the wider attack — which targeted the Office of Personnel Management — to look for at agencies, according to NARA.

It is unclear when NARA computers were breached. Suspected Chinese-sponsored cyberspies reportedly had been inside OPM’s networks for a year before the agency discovered what happened in April. Subsequently, the government uncovered a related attack against OPM that mined biographical information on individuals who have filed background investigation forms to access classified secrets.

The National Archives has found no evidence intruders obtained “administrative access,” or took control, of systems, but files were found in places they did not belong, the investigator said.

NARA “systems” and “applications” were not compromised, National Archives spokeswoman Laura Diachenko emphasized to Nextgov,  “but we detected IOCs,” indicators of compromise, “on three workstations, which were cleaned and re-imaged,” or reinstalled.

“Other files found seemed to be legitimate,” such as those from a Microsoft website, she said. “We have requested further guidance from US-CERT on how to deal with these” and are still awaiting guidance on how to proceed.

It will take additional forensics assessments to determine whether attackers ever “owned” the National Archives computers, the investigator said.

Diachenko said, “Continued analysis with our monitoring and forensic tools has not detected any activity associated with a hack,” including alerts from the latest version of a governmentwide network-monitoring tool called EINSTEIN 3A.

EINSTEIN, like NARA’s own intrusion-prevention tool, is now configured to detect the tell-tale signs of the OPM attack.

“OPM isn’t the only agency getting probed by this group,” said John Prisco, president of security provider Triumphant, the company that developed the National Archives’ tool. “It could be happening in lots of other agencies.”

Prisco said he learned of the incident at a security industry conference June 9, from an agency official the company has worked with for years.

“They told us that they were really happy because we stopped the OPM attack in their agency,” Prisco said.

The malicious operation tries to open up ports to the Internet, so it can excise information, Prisco said.

“It’s doing exploration work laterally throughout the network and then it’s looking for a way to communicate what it finds back to its server,” he added.

Homeland Security officials on Monday would not confirm or deny the situation at the National Archives. DHS spokesman S.Y. Lee referred to the department’s earlier statement about the OPM hack: “DHS has shared information regarding the potential incident with all federal chief information officers to ensure that all agencies have the knowledge they need to defend against this cybersecurity incident.”

The assault on OPM represents the seventh raid on national security-sensitive or federal personnel information over the past year.

Well-funded hackers penetrated systems at the State Department, the White House, U.S. Postal Service and, previously in March 2014, OPM. Intruders also broke into networks twice at KeyPoint Government Solutions, an OPM background check provider, and once at USIS, which conducted most of OPM’s employee investigations until last summer.

On Wednesday, the House Oversight and Government Reform Committee is scheduled to hold a hearing on the OPM incident that, among other things, will examine the possibility that hackers got into the agency’s systems by using details taken from the contractors.

POTUS Approves U.S. Troops Sharing Base with Iran

Cant make this up…Iran has been an enemy of the United States for decades and now our uniformed personnel in Iraq are forced to share an air base, Taqqadum, in Anbar. This is not sitting well with one senator and frankly, we should be screaming about it. What is worse, is the Joint Chiefs are apparently cool with it unless there are chairs and tables being thrown about in the halls of the Pentagon?

Washington, D.C.— Senator Tom Cotton (R-Arkansas) today released the following statement in response to reports that the United States is sharing a military base with Iranian forces in Iraq:
“When I was a soldier fighting in Iraq, Iran supplied the most advanced, most lethal roadside bombs used against coalition forces. Many American soldiers lost their lives to Iran’s proxies and Iranian-supplied bombs.  Further, Iran is the leading state sponsor of terrorism and has been attacking the United States for decades. It’s deeply troubling that the President now finds it acceptable to share a military base with this enemy, even while we are attempting to negotiate a deal to keep Iran from obtaining nuclear weapons.
“This report is a stark and nearly absurd demonstration of the Obama administration’s tacit accommodation of Iran’s strategic aim of extending its influence in Iraq.  It echoes the president’s tacit accommodation of Iran’s wish to maintain Bashar al-Assad in Syria and his explicit accommodation of Iran’s nuclear ambitions.”
For background in MILCOM in Iraq and this base, see page 33.

Iran’s Forces and U.S. Share a Base in Iraq

 

NATO Arms up and Putin Pledges Cooperation

  • U.S. paratroopers assault opposing forces during Black Arrow on Rukla training area in Lithuania, May 17, 2014. The exercise focuses on defensive operations and interoperability between the two forces. Lithuanian Defense Ministry photo by Eugenijus ZygaitisDefense Secretary Ash Carter will travel to Germany, Estonia, and Belgium June 21 – 26 for a series of bilateral and multilateral meetings with European defense ministers and to participate in his first NATO Ministerial as secretary of defense.
  • In this important month for the alliance, Carter will hear directly from ministers, defense leaders, and service members about the progress we have made since the Wales Summit to address the new security environment, including the challenges from Russia and NATO’s southern front, and discuss what we must do in the future to enhance the effectiveness of the alliance.

NATO's Response Force and U.K., Swedish, Finnish and U.S. Marines conduct an amphibious assault during exercise Baltic Operations 2015, June 10, 2015. U.S. Marine Corps photo by Sgt. Tatum Vayavananda

For an interactive map of Operation Atlantic Resolve, click here.

 

: The European Union on Monday extended economic sanctions against Russia until January to keep pressure on Moscow over the conflict in eastern Ukraine, drawing a rebuke and a warning of retaliation from Russian officials.

An EU statement said the decision was taken without debate by the bloc’s foreign ministers at a meeting in Luxembourg, in response to “Russia’s destabilizing role in eastern Ukraine.”

The sanctions, along with U.S. and other Western measures against Russia, have contributed to a softening of the Russian economy at a time when the price of oil that is crucial to its economic output also has fallen. The sanctions have also put a pinch on some of Russia’s key EU trading partners.

Then Putin decides to moderate and cooperate?

From IB Times: Russian President Vladimir Putin has stated that Moscow is not averse to economic co-operation with the West despite the sanctions imposed on it over the Ukraine crisis. Mr Putin was addressing the Economic forum in St Petersburg and said Russia’s economy has adapted itself to face the pressures of sanctions. Significantly, Mr Putin avoided the usual anti-Western rhetoric, observers noted.

“The imposition of so-called sanctions has forced us to significantly step up efforts to replace imports with domestic products. We have made serious steps and achieved noticeable results in a number of areas”, said Mr Putin and claimed that economy has “stabilised” and its financial and banking systems are now attuned to the new conditions. He also stressed Russia’s desire to remain a key player in the world economy and desire to work with the west as well as other countries. Noting that Russia is open to the world, Mr Putin said active co-operation with new centres of global growth, implying China, it no way means that “we intend to pay less attention to our dialogue with our traditional Western partners.”

Secretary of Defense Carter, DoD and NATO step up offensive objectives.

WASHINGTON, June 22, 2015 – The challenges to NATO from Russia and on the alliance’s southern flank will be the focus of Defense Secretary Ash Carter’s trip to the continent this week.

Click photo for screen-resolution image
U.S. Defense Secretary Ash Carter talks with news reporters aboard an aircraft June 21, 2015, en route to Berlin. Carter plans to meet with European defense ministers and participate in his first NATO ministerial as defense secretary during the trip to Germany, Estonia and Belgium. DoD photo by U.S. Air Force Master Sgt. Adrian Cadiz
  

(Click photo for screen-resolution image);high-resolution image available.

Carter arrived in Berlin yesterday for talks with the German defense minister. From Germany, he will travel to Estonia and then end his trip at the NATO defense ministerial in Brussels.

Yesterday, the secretary spoke to reporters traveling with him.

NATO is Changing

The secretary said NATO must, and is, changing to confront the new threats. Russian President Vladimir Putin’s aggressive behavior in Georgia and Ukraine must be countered, and further aggression must be deterred, he said.

The secretary said he’ll explain America’s “strong but balanced approach” to dealing with Russia.

“It’s strong, in the sense that we are cognizant of the needs to deter and be prepared to respond to Russian aggression, if it occurs, around the world, but also especially in NATO and with NATO,” Carter told reporters.

U.S. soldiers in Stryker armored vehicles arrive at Smardan Training Area, Romania, March 24, 2015. The soldiers, assigned to 2nd Squadron, 2nd Cavalry Regiment, participated in Saber Junction 15, which included 5,000 troops from 17 nations that are NATO allies and partners. U.S. Army photo by Staff Sgt. Opal Vaughn

NATO is countering Russian behavior with the Spearhead Force designed to move quickly and powerfully to the scene of an incident, the secretary said.

“Another part of that is helping the states, both NATO members and non-NATO members, at the periphery of Russia … to harden themselves to malign influence or destabilization of the kind that Russia has fomented in eastern Ukraine,” he said.

Adapting to Challenges

The balance comes from needing to work with Russia on other issues, Carter said. Russia is a part of the P5-plus-1 talks with Iran. Russia also has a role in countering terrorism.

In short, Russia’s interests do in some areas align with those of the rest of the world, the secretary said.

“The United States, at least, continues to hold out the prospect that Russia — maybe not under Vladimir Putin, but maybe some time in the future — will return to a forward-moving course rather than a backward-looking course,” Carter said.

Southern Europe is threatened by extremism, the secretary said, noting that NATO defense ministers will discuss this threat. The dangers of extremism in the Middle East, he said, is manifested by increasing streams of refugees seeking to escape ungoverned or poorly governed areas of North Africa, sub-Saharan Africa and the Middle East.

“In both of those areas NATO needs to, and is, adapting,” Carter said. “These are challenges that are different in kind from the old Fulda Gap, Cold War challenge. They are different in their own ways from Afghanistan and the kinds of things that we’ve been doing there. So it’s new, but NATO … is adapting for both of them.”

Demanded bin Ladin’s Death Certificate, Denied

 

As written about in detail here, a hacking group calling itself the Yemen Cyber Army performed a cyber intrusion into the Saudi ministry of Foreign Affairs. A particular set of communications points to the request for Usama bin Ladin’s death certificate, and the United States denied the request. Other Freedom of Information requests were also made and the response was, there is no record.

Osama bin Laden’s son asked the U.S. government for his father’s death certificate. The U.S. said no.

by: Adam Taylor, Washington Post

According to a recently leaked document, the son of al-Qaeda mastermind Osama bin Laden, Abdullah bin Laden, sent a letter to the U.S. Embassy in Saudi Arabia to ask for his father’s death certificate.

In response, the embassy wrote to Abdullah to inform him that there was no death certificate issued for the older bin Laden.

The letter went on to suggest other ways that the al-Qaeda leader’s death could be officially confirmed.

The remarkable exchange has come to light thanks to the latest release from WikiLeaks, the controversial secret sharing organization helmed by Julian Assange. On Friday, the organization released what it said was the first part of more than a half-million cables and other documents from the Saudi Foreign Ministry, which it had dubbed “The Saudi Cables.”

The U.S. Embassy’s response to Abdallah was included within the release. It is dated Sept. 9, 2011, approximately four months after bin Laden was killed by U.S. forces during a raid on his hideout in Pakistan. U.S. officials have said that bin Laden was later buried at sea. Requests to publish photographs of bin Laden’s body or his burial have been denied and any photographs taken are suspected to have been destroyed.

In the letter to Abdullah bin Laden, Glen Keiser, a consul general at the U.S. Embassy in Riyadh, explains that the lack of a death certificate for bin Laden is “consistent with regular practice for individuals killed in the course of military operations.”

Keiser goes on to suggest that the criminal case against Osama bin Laden had effectively been dropped due to his death since June 2011, and describes a process for requesting the order of “nolle prosequi” (which literally means “unwilling to pursue”) from the court, which could act as proof of death.

It’s unclear why Abdullah bin Laden had requested the death certificate.

In 2012, the Department of Defense responded to an Associated Press Freedom of Information Act request and said that it was unable to find a death certificate for bin Laden.

Newly declassified documents from the compound in Pakistan where Osama bin Laden was killed in 2011 have revealed the late al-Qaeda leader’s remarkable English-language library, including books by Noam Chomsky, Bob Woodward and even 9/11 conspiracy theorist David Ray Griffin.

Yet the Office of the Director of National Intelligence, which released the files on Wednesday, has not released all the material found in the compound. In fact, there’s a rather notorious stash that the U.S. government apparently doesn’t want you to see: a cache of pornography.

Newly declassified documents from the compound in Pakistan where Osama bin Laden was killed in 2011 have revealed the late al-Qaeda leader’s remarkable English-language library, including books by Noam Chomsky, Bob Woodward and even 9/11 conspiracy theorist David Ray Griffin.

Yet the Office of the Director of National Intelligence, which released the files on Wednesday, has not released all the material found in the compound. In fact, there’s a rather notorious stash that the U.S. government apparently doesn’t want you to see: a cache of pornography. More on the bin Ladin book shelf here.

Yemen Cyber Army, Saudi and Wikileaks

Here it comes again, a major hack that took place earlier this month and the documents are in a pipeline to be published. Some are out there now.

From www.securityaffairs.co who I just interviewed for radio last week:

“We have gained access to the Saudi Ministry of Foreign Affairs (MOFA) network and have full control over more than 3000 computers and servers, and thousands of users. We also have access to the emails, personal and secret information of hundreds of thousands of their diplomats in different missions around the world.” states the group.

The following image was left on the PC of the employees at the Saudi foreign ministry on Thursday morning

Yemen Cyber Army vs Saudi Gov

More details here on the Yemen Cyber Army and the Saudi hack. The Yemen Cyber Army left behind these messages for file access as well:

OPERATION Name : “Syed Hussein Badreddin al-Houthi”
OPERATION Key  : b919117da9954bd82e65677cb240bbb3e4ddbd9ac93e10f0a399257ad54d851a

Saudi Arabia Ministry of Foreign Affairs Hacked By Yemen Cyber Army
All MOFA.GOV.SA Subdomains And Servers Hacked and HDD Encrypted
Allah is the enemy of those who oppress people

This is to convey a message to Saudi Dictators, if they’ve got a listening ear!

It’s us again, Yemen Cyber Army!

We are an Islamic Group who fights against you oppressors.

What you and your puppets commit in Yemen, Syria, Bahrain, Iraq and Lebanon, remind us of crimes your forefather Yazid-ibn-Muawiya committed in Karbala. And indeed you are good successors to him. You are ISIS and ISIS is you.

Never assume our calmness is due to weakness. We are oppressed! God will judge between you and us. As we never seek help from other than him.
You are pagan oppressors as you always fawn for US and Israel, that’s what you deserve.
So congratulations to those who achieve martyrdom in fight against pagan oppressors.

“And never think of those who have been killed in the cause of Allah as dead. Rather, they are alive with their Lord, receiving provision ”

Our cyber operation is just started and by the grace of God we are expecting the Saudi regime’s collapse by the “Labbaik Ya-Hossain” slogan.
This second operation is blessed by the name of martyred “Syed Hussein Badreddin al-Houthi” and is going to be a beginning to Saudi’s overthrow, Inshallah.

We have gained access to the Saudi Ministry of Foreign Affairs (MOFA) network and have full control over more than 3000 computers and servers, and thousands of users. We also have access to the emails, personal and secret information of hundreds of thousands of their diplomats in different missions around the world.

We publish only few portions of vital information we have, just to let them know that “truly the flimsiest of houses is the spider´s house”

Some portions of visa secret information, thousands of documents from the MOFA’s automation system and secret emails will be published gradually so as to keep Saudi puppets always in fear of their identity disclosure.

This way they might slightly come to know how it feels when our innocent women and children rush into havens crying and looking for their beloved once in dark.

And that’s not all! All your computers will be automatically wiped on Wednesday – 2015 20 May and at 12:00 to become a lesson for oppressors.

We have the same access to the Interior Ministry (MOI) and Defense Ministry (MOD) of which the details will be published in near future. Wish such shocking news make Saudi dictators to come to their senses and recapture those young wild dogs’ leash to avoid Muslims exploiting hate against Saudi family.
If you did not stop attacks on Muslims in Yemen, do not blame anyone but yourself and expect greater harms.
Files PASSWORD : [email protected]

Your Network Hacked By Yemen Cyber Army
We Are Cutting Sword of Justice
All Your Data is Encrypted and You Can’t Access Them without Key
Find Out the Decryption Key This Way :
Number of Yemeni Children Killed in Saudi Air Attacks   +
Number of Yemeni Homes Destroyed By Saudi-USA Bombs   –
Number of Saudis Killed By Yemenis   –
Number of Israeli Soldiers Killed by Saudi and Arab Union in 1984!!!!

#OPSAUDI
#YEMEN_UNDER_ATTACK
#OPKSA

We Are Anonymous
We Are Everywhere
We Are Legion
We do Not Forgive
We do Not Forget
Stop Attacking To Our Country!

****

Now enter the documents and Wikileaks.

WikiLeaks says it’s leaking over 500,000 Saudi documents

ISTANBUL (AP) — WikiLeaks is in the process of publishing more than 500,000 Saudi diplomatic documents to the Internet, the transparency website said Friday, a move that echoes its famous release of U.S. State Department cables in 2010.

WikiLeaks said in a statement that it has already posted roughly 60,000 files. Most of them appear to be in Arabic.

There was no immediate way to verify the authenticity of the documents, although WikiLeaks has a long track record of hosting large-scale leaks of government material. Many of the documents carried green letterhead marked “Kingdom of Saudi Arabia” or “Ministry of Foreign Affairs.” Some were marked “urgent” or “classified.” At least one appeared to be from the Saudi Embassy in Washington.

If genuine, the documents would offer a rare glimpse into the inner workings of the notoriously opaque kingdom. They might also shed light on Riyadh’s longstanding regional rivalry with Iran, its support for Syrian rebels and Egypt’s military-backed government, and its opposition to an emerging international agreement on Tehran’s nuclear program.

One of the documents, dated to 2012, appears to highlight Saudi Arabia’s well-known skepticism about the Iranian nuclear talks. A message from the Saudi Arabian Embassy in Tehran to the Foreign Ministry in Riyadh describes “flirting American messages” being carried to Iran via an unnamed Turkish mediator.

Another 2012 missive, this time sent from the Saudi Embassy in Abu Dhabi, said the United Arab Emirates was putting “heavy pressure” on the Egyptian government not to try former president Hosni Mubarak, who had been overthrown in a popular uprising the year before.

Some of the concerns appear specific to Saudi Arabia.

In an Aug. 14, 2008 message marked “classified and very urgent,” the Foreign Ministry wrote to the Saudi Embassy in Washington to warn that dozens of students from Saudi Arabia and other Gulf countries had visited the Israeli Embassy in the U.S. capital as part of an international leadership program.

“They listened to diplomats’ briefings from the embassy employees, they asked questions and then they took pictures,” the message said, asking the embassy for a speedy update on the situation.

Another eye-catching item was a document addressed to the interior and justice ministers notifying them that a son of Osama bin Laden had obtained a certificate from the American Embassy in Riyadh “showing (the) death of his father.”

Many more of the dozens of documents examined by The Associated Press appeared to be the product of mundane administrative work, such as emails about setting up a website or operating an office fax machine.

The AP was able to partially verify a handful of documents’ authenticity by calling the telephone numbers included in many of them. WikiLeaks spokesman Kristinn Hrafnsson told AP he was confident that the material was genuine.

It is not clear how WikiLeaks got the documents, although in its statement the website referred to a recent electronic attack on the Saudi Foreign Ministry by a group calling itself the Yemen Cyber Army. Hrafnsson declined to elaborate on the statement or say whether the hackers subsequently passed documents on to WikiLeaks.

“As a matter of policy we’re not going to discuss the source of the material,” he said.

The Saudi Embassy in Washington did not immediately return repeated messages seeking comment.

In its statement, WikiLeaks said the release coincided with the three-year anniversary of its founder, Julian Assange, seeking asylum in the Ecuadorian Embassy in London.

Assange took refuge in the embassy to avoid extradition to Sweden, where he is wanted for questioning about alleged sex crimes. Assange has denied any wrongdoing.  To access: WikiLeaks’ Saudi Cables site: https://wikileaks.org/saudi-cables/