Fake URL’s and Shortening During Arab Spring/Iran

In 2014, it was reported but not widely so.

Edward Snowden leaked a top-secret GCHQ document which details the operations and the techniques used by JTRIG unit for propaganda and internet deception.

SecurityAffairs: The JTRIG unit of the British GCHQ intelligence agency has designed a collection of applications that were used to manipulate for internet deception and surveillance, including the modification of the results of the online polls. The hacking tools have the capability to disseminate fake information, for example artificially increasing the counter of visit for specific web sites, and could be also used to censor video content judged to be “extremist.” The set of application remembers me the NSA catalog published in December when the Germany’s Der Spiegel has revealed another disturbing article on the NSAsurveillance, the document leaked by tge media agency was an internal NSA catalog that offers spies backdoors into a wide range of equipment from major vendors.

The existence of the tools was revealed by the last collection of documents leaked by Edward Snowden, the applications were created by GCHQ’s Joint Threat Research Intelligence Group (JTRIG) and are considered one of the most advanced system for propaganda and internet deception. JTRIG is the secret unit mentioned for the first time in a collection of documents leaked by Snowden which describe the Rolling Thunder operation, the group ran DoS attack against chatrooms used by hacktivists. More here.

It is being reported again and it may be just good tradecraft by British intelligence.

British Spies Used a URL Shortener to Honeypot Arab Spring Dissidents

Motherboard: A shadowy unit of the British intelligence agency GCHQ tried to influence online activists during the 2009 Iranian presidential election protests and the 2011 democratic uprisings largely known as the Arab Spring, as new evidence gathered from documents leaked by Edward Snowden shows.

The GCHQ’s special unit, known as the Joint Threat Research Intelligence Group or JTRIG, was first revealed in 2014, when leaked top secret documents showed it tried to infiltrate and manipulate—using “dirty trick” tactics such as honeypots—online communities including those of Anonymous hacktivists, among others.

The group’s tactics against hacktivists have been previously reported, but its influence campaign in the Middle East has never been reported before. I was able to uncover it because I was myself targeted in the past, and was aware of a key detail, a URL shortening service, that was actually redacted in Snowden documents published in 2014.

THE HONEYPOT

A now-defunct free URL shortening service—lurl.me—was set up by GCHQ that enabled social media signals intelligence. Lurl.me was used on Twitter and other social media platforms for the dissemination of pro-revolution messages in the Middle East.

These messages were intended to attract people who were protesting against their government in order to manipulate them and collect intelligence that would help the agency further its aims around the world. The URL shortener made it easy to track them.

I was able to uncover it because I was myself targeted in the past

The project is linked to the GCHQ unit called the Joint Threat Research Intelligence Group or JTRIG, whose mission is to use “dirty tricks” to “destroy, deny, degrade [and] disrupt” enemies by “discrediting” them, according to leaked documents.

The URL shortening service was codenamed DEADPOOL and was one of JTRIG’s “shaping and honeypots” tools, according to a GCHQ document leaked in 2014.

Leaked GCHQ document listing shaping and honeypot tools used by JTRIG.

Earlier in the same year, NBC News released a leaked document showing that JTRIG attacked the hacktivist outfits Anonymous and LulzSec by launching Distributed Denial of Service (DDoS) attacks on chatroom servers know as Internet Relay Chat (IRC) networks.

The group also identified individuals by using social engineering techniques to trick them into clicking links—a technique commonly used by cybercriminals.

One slide showed a covert agent sending a link—redacted by NBC in the slide—to an individual known as P0ke. According to the slide, this enabled the signals intelligence needed to deanonymize P0ke and discover his name, along with his Facebook and email accounts.

In the fall of 2010, I was an early member of the AnonOps IRC network attacked by JTRIG and used by a covert GCHQ agent to contact P0ke, and in 2011 I co-founded LulzSec with three others. The leaked document also shows that JTRIG was monitoring conversations between P0ke and the LulzSec ex-member Jake Davis, who went by the pseudonym Topiary.

Through multiple sources, I was able to confirm that the redacted deanonymizing link sent to P0ke by a covert agent was to the website lurl.me.

Leaked GCHQ slide from document titled “Hacktivism: Online Covert Action.”

COVERT DISRUPTION

Further investigation of the URL shortener using public data on the web exposed a revealing case study of JTRIG’s other operations that used the DEADPOOL tool, including covert operations in the Middle East.

The Internet Archive shows that the website was active as early as June 2009 and was last seen online on November 2013. A snapshot of the website shows it was a ”free URL shortening service” to ”help you get links to your friends and family fast.”

Snapshot of lurl.me.

Public online resources, search engines and social media websites such as Twitter, Blogspot and YouTube show it being used to fulfill GCHQ geopolitical objectives outlined in previously leaked documents. Almost all 69 Twitter pages that Google has indexed referencing lurl.me are anti-government tweets from supposed Iranian or Middle Eastern activists.

The vast majority are from Twitter accounts with an egg avatar only active for a few days and have a few tweets, but there were a couple from legitimate accounts that have been tweeting for years, who have retweeted or quoted the other accounts tweeting from the URL shortener.

According to agency documents published by The Intercept, one of the strategies for measuring the effectiveness of an operation is to check online to see if a message has been “understood accepted, remembered and changed behaviour”. This could for example involve tracking those who shared or clicked on the lurl.me links created by GCHQ.

The group also identified individuals by using social engineering techniques to trick them into clicking links

Another JTRIG document published by The Intercept titled “Behavioural Science Support for JTRIG’S Effects and Online HUMINT Operations” can be used to understand the content associated with social media accounts that used the URL shortener.

JTRIG has an operations group for global targets, which then has a subteam for Iran, According to the document. It further states that “the Iran team currently aims to achieve counter-proliferation by: (1) discrediting the Iranian leadership and its nuclear programme; (2) delaying and disrupting access to materials used in the nuclear programme; (3) conducting online HUMINT; and (4) counter-censorship.”

The document goes on to detail the methods that JTRIG employs to achieve these goals, such as creating false personas, uploading YouTube videos, and starting Facebook groups to push specific information or agendas. Many of the techniques outlined are evident in social media accounts that aggressively use the URL shortener.

Page from leaked GCHQ document titled “Behavioural Science Support for JTRIG’S Effects and Online HUMINT Operations,” published at The Intercept.

AGENTS OF THE CAMPAIGN

There appear to be a small number of Twitter accounts that were only active during the month of June 2009, have very few followers, and repeatedly tweet the same content and links from lurl.me. One of the earliest and prolific accounts to tweet using the URL shortener is 2009iranfree.   Read more here from Motherboard.

Hillary’s Relationship with Russia is Approved Espionage

Dealing with evil, the evil empire as President Reagan declared. Quite actually under the Barack Obama administration it is nothing more than groveling with the Kremlin.

The United States has an Open Skies Treaty. and one must question why. Further, the Russians have taken full advantage of it.

Then there was the red line threat by Obama where it was later dismissed and handed over to Putin to handle those chemical weapons in Syria for removal.

Then we heard about the Bill and Hillary deal with the Canadian operative on Uranium One giving over rights of U.S. uranium supply to Russia.

But now we have yet another operation concocted by the White House and the Hillary State Department and this one is a blockbuster as noted by going back in history through the original WikiLeaks cables.

It is highly suggested to read the full document below, as it summarizes how Hillary allowed trade secrets and professional Russian espionage within the United States.

****

The full document is here.

FROM RUSSIA WITH Money

Hillary Clinton, the Russian Reset, and Cronyism

NYPost: Key players in a main component of the reset — a Moscow-based, Silicon Valley-styled campus for developing biomed, space, nuclear and IT technologies called “Skolkovo” — poured tens of millions of dollars into the Clinton Foundation, the report by journalist Peter Schweizer alleges.

As the Obama administration’s top diplomat, Hillary Clinton was at the center of US efforts on the reset in general and Skolkovo in particular, Schweizer argues.

Yet, “Of the 28 US, European and Russian companies that participated in Skolkovo, 17 of them were Clinton Foundation donors” or sponsored speeches by former President Bill Clinton, Schweizer told The Post.

“It raises the question — do you need to pay money to sit at the table?”

In one example cited by Schweizer, Skolkovo Foundation member and then-Cisco CEO John Chambers donated between $1 million and $5 million in personal and corporate cash to the Clinton Foundation, the report says.

But Skolkovo wound up making America less safe, Schweizer argues, because it shared advanced US technology that Russia can develop for both civilian and military applications, a concern raised already by Army and FBI officials.

Many of Skolkovo’s research projects involved “dual-use” technologies, meaning they would have both civilian and military uses, the report said, citing one in particular — a hybrid airship called an “Atlant” developed at the Skolkovo Aeronautical Center.

“Particularly noteworthy is Atlant’s ability to deliver military cargoes,” including “radar surveillance, air and missile defense and delivery of airborne troops,” the Skolkovo Foundation bragged in a document Schweizer cites.

Hillary Clinton personally launched the State Department’s efforts toward a Russian reset, presenting her Russian then-counterpart, Sergei Lavrov, with a prop reset button in Geneva in 2009.

The reset petered out by the end of 2011, when Russian President Vladimir Putin accused Hillary of fomenting Russian protests over suspicions of fraud in that year’s parliamentary elections.

But by then, the damage had already been done, Schweizer feels.

“I think the idea that you’re going to help develop a Russian version of Silicon Valley, which, by the way, will be controlled by the Russian government, and then not to expect that the technology will be siphoned off for military uses, is incredibly naive,” Schweizer said.

As early as 2010, cybersecurity experts also expressed deep concerns about Russia using Skolkovo to develop hacking capabilities.

Russia’s FSB spy agency — the successor to the KGB — reportedly keeps two of its information warfare “security centers” at Skolkovo, the report says.

“There certainly is an irony that as we are now concerned about Russian cyber-attacks on the US, that the reset played a role in enhancing their cyber-capabilities,” Schweizer said.

In this latest report, as in his book, “Clinton Cash: The Untold Story of How and Why Foreign Governments and Businesses Helped Make Bill and Hillary Rich,” Schweizer concedes he found no “smoking gun” evidence that any of the donors who poured cash into the Clinton coffers actually were promised, or received, any State Department favors in return.

“We don’t have an email or a pirated voice mail message saying, ‘We’ll give you money if you help us with Skokovo,’” Schweizer told The Post. “But what we do have is a pattern that shows a high percentage of participants in Skolkovo who happen to be Clinton Foundation donors.

“I think that everybody at the Russian reset table seems to walk away with something,” he added.

“The Clintons, they get their donations and speaking fees in the millions of dollars. The Russians get access to advanced US technology. The tech companies [that participated in the reset, including Cisco, Intel, Microsoft] get special access to the Russian market and workforce.

“But the American people get nothing. In fact, we get a rival — Russia — with enhanced technological capabilities. At best, that makes them a tougher competitor [in legitimate commerce],” Schweizer said.

“At worst, they get a more robust military, with technologies that we helped develop, and that can be sold to our enemies.”

The Clinton Foundation is sure to be a sore spot in Hillary’s campaign for the presidency, Schweizer predicted — tainted as it is, despite its laudable philanthropy.

“At the entire Democratic convention, they did not mention the Clinton Foundation once,” he said. “And it’s been the Clintons’ life work for 16-plus years.”

The Clinton campaign did not respond to requests from The Post for comment on the report.

“All I ask is that people look at the money. Who made the deals, who benefited from the deals,” Schweizer said. “We can’t get inside people’s heads as to why they did something, but we should follow the money.”

 

‘Breaking the Cross’, When not If…

U.K. Police Chief Says Attack Is a Matter of ‘When, Not If’

In part from Newsweek: U.K. police are treating the prospect of an attempted extremist attack on home soil as an inevitability said the head of the Metropolitan police, The Guardian reports.

Over the last 12 months France, Germany, Belgium and Turkey have experienced deadly attacks claimed by militant group Islamic State (ISIS). Sir Bernard Hogan-Howe said he wanted to offer reassurance to the British public that the trend would not endanger the U.K., and said police vigilance has not changed.

“I know that with each new outrage and especially those on our doorstep in Europe, there is a greater sense of fear that Britain will be the next victim in this wave of cruel and mindless mass murder,” he said.

“Our threat level has been at severe for two years—it remains there. It means an attack is highly likely. You could say it is a case of when, not if.”

Hogan-Howe spoke as Britain’s most senior counter-terrorism police officer, assistant commissioner Mark Rowley, said the greatest advantage U.K. police had in preventing attacks was public assistance. The BBC reported that relevant hotlines receive over 3,600 calls a day and Rowley said even more input was appreciated. More here.

Breaking the Cross: Latest ISIS Magazine Aimed At Christians

Russian spies claim they can now collect crypto keys

Filed under Vlad’s Glad…ah ha ha

Russian spies claim they can now collect crypto keys—but don’t say how

Putin gave KGB’s successor agency two weeks to deal with encrypted services.

ArsTechnica: Russia’s intelligence agency the FSB, successor to the KGB, has posted a notice on its website claiming that it now has the ability to collect crypto keys for Internet services that use encryption. This meets a two-week deadline given by Vladimir Putin to the FSB to develop such a capability. However, no details have been provided of how the FSB is able to do this.

The FSB’s announcement follows the passage of Russia’s wide-ranging surveillance law, which calls for metadata and content to be stored for six months, plus access to encrypted services, as Ars reported back in June.

The new capability seems to go even further, since the FSB notice (in Russian) speaks of obtaining the “information necessary for decoding the electronic messaging received, sent, delivered, and (or) processed by users of the ‘Internet’ network.”

Being able to decode Internet communications would seem to imply getting hold of any crypto keys that are used. However, as an article on The Daily Dot points out, it is still not clear what the new laws will require: “No one seems to know what this new law means in the slightest. Or, more accurately, the people who do know are keeping mum.”

Three of the services that are likely to be most affected by the new requirements are Facebook’s WhatsApp, Telegram, and Viber. Ars has asked all three for clarification on what the Russian authorities have asked for, and what information the companies are or will be providing, but has not yet received any reply. This post will be updated with responses when they are received.

Related reading: Is the U.S. Hacking Back? Uh Huh

The Daily Dot quotes Russian technologist Anton Nesterov as saying that it’s not even clear whether the new legislation applies to VPNs or basic SSL keys, nor whether mainstream electronic payment systems must hand over their keys as a matter of routine.

Nesterov also points out the dangers involved in providing this information, not least because leaks of such valuable data are always a risk.

***** 

In part from CSO: Networks at some 20 organizations in Russia — including scientific and military institutions, defense contractors, and public authorities — were found to be infected with the malware, the Russian Federal Security Service (FSB) said Saturday. The range of infected sites suggests that the targets were deliberately selected as part of a cyber-espionage operation, the FSB said.

Analysis of the attack showed that filenames, parameters and infection methods used in the malware are similar to those involved in other high-profile cyber-espionage operations around the world.

The software was adapted to the characteristics of each PC targeted, and delivered in a malicious email attachment, the FSB said.

Once installed, it downloaded additional modules to perform tasks such as monitoring network traffic, capturing and transmitting screenshots and keystroke logs, or recording audio and video using the PC’s microphone and webcam.

The FSB is working with ministries and other government agencies to identify all the victims of the malware, and to limit its effects, it said.

Russia is said to be the source, not the target, of another government-related cyber-attack. Last week, evidence emerged suggesting Russian involvement in an attack on computers at the Democratic National Committee, where recent data leaks have tarnished the campaign of presidential candidate Hillary Clinton.

 

 

Partial List of Documents Hacked from the Clinton Foundation

Guccifer 2.0: In the post he says the following:

Zerohedge: This’s time to keep my word and here’re the docs I promised you.

It’s not a report in one file, it’s a big folder of docs devoted to Hillary Clinton that I found on the DNC server.

The DNC collected all info about the attacks on Hillary Clinton and
prepared the ways of her defense, memos, etc., including the most
sensitive issues like email hacks.

As an example here’re some files:

This’s time to keep my word and here’re the docs I promised you.

It’s not a report in one file, it’s a big folder of docs devoted to Hillary Clinton that I found on the DNC server.

The DNC collected all info about the attacks on Hillary Clinton and
prepared the ways of her defense, memos, etc., including the most
sensitive issues like email hacks.

As an example here’re some files:

2016er Attacks – HRC Defense Master Doc [updated]

04.29.15 CGEP

2016 Democrats Positions Cheat Sheet 7-7-15

20150426 MEMO- Clinton Cash Unravels

Attacks on Clinton Family Members

Clinton Foundation Donors $25K+

Clinton Foundation Vulnerabilities Master Doc FINAL

Clintons PFD 2015

HRC Defense – Emails

HRC Travel – Private Jets FINAL

MEMO — Clinton Cash Claims (2)

Most notable among these files is the file called “Clinton Foundation Vulnerabilities Master Doc FINAL” which, as the title implies, is an extensive 42-page summary of how the Clinton Foundation views its biggest vulnerabilities based on mentions, references and attacks from the press.

Here are some of the section titles:

  • THE CLINTON FOUNDATION RECEIVED DONATIONS FROM INDIVIDUALS TIED TO SAUDI ARABIA WHILE CLINTON SERVED AS SECRETARY OF STATE
  • AN EMBATTLED BUSINESSMAN WITH “TIES TO BAHRAIN’S STATE-OWNED ALUMINUM COMPANY” GAVE BETWEEN $1 MILLION AND $5 MILLION TO THE CLINTON FOUNDATION
  • A VENEZUELAN MEDIA MOGUL WHO WAS ACTIVE IN VENEZUELAN POLITICS DONATED TO THE CLINTON FOUNDATION DURING CLINTON’S TENURE AS SECRETARY OF STATE
  • GERMAN INVESTOR WHO HAS LOBBIED CHANCELLOR MERKEL’S ADMINISTRATION GAVE BETWEEN $1 MILLION AND $5 MILLION TO THE CLINTON FOUNDATION, SOME OF WHICH WAS DURING MRS. CLINTON’S TENURE AT THE STATE DEPARTMENT
  • THE CEO OF AN AMSTERDAM BASED ENERGY COMPANY DONATED AT LEAST $1 MILLION TO THE CLINTON FOUNDATION AND LATER ANNOUNCED AT THE 2009 CGI MEETING A $5 BILLION PROJECT TO DEVELOP ENVIRONMENTALLY FRIENDLY POWER GENERATION IN INDIA AND CHINA
  • INDIAN POLITICIAN AMAR SINGH, WHO HAD DONATED AT LEAST $1 MILLION TO THE CLINTON FOUNDATION, MET WITH HILLARY CLINTON IN SEPTEMBER 2008 TO DISCUSS AN INDIA-U.S. CIVIL NUCLEAR AGREEMENT
  • THE CLINTON FOUNDATION RECEIVED ADDITIONAL DONATIONS FROM INDIAN BUSINESS INTERESTS PRIOR TO HER BECOMING SECRETARY OF STATE
  • BILLIONAIRE STEEL EXECUTIVE AND MEMBER OF THE FOREIGN INVESTMENT COUNCIL IN KAZAKHSTAN LAKSHMI MITTAL GAVE $1 MILLION TO $5 MILLION TO THE CLINTON FOUNDATION BEFORE CLINTON BECAME SECRETARY OF STATE
  • SOON AFTER SECRETARY CLINTON LEFT THE STATE DEPARTMENT, THE CLINTON
    FOUNDATION “RECEIVED A LARGE DONATION FROM A CONGLOMERATE RUN BY A
    MEMBER OF CHINA’S NATIONAL PEOPLE’S CONGRESS”
  • …AND THE CLINTON FOUNDATION DEFENDED ITS PARTNERSHIPS WITH BOTH FOREIGN AND DOMESTIC CORPORATE INTERESTS
  • POWERFUL AND CONTROVERSIAL CORPORATE INTERESTS BASED IN THE U.S. ALSO DONATED TO THE CLINTON FOUNDATION
  • AMONG THE CLINTON FOUNDATION DONORS REVEALED IN 2009 WERE SEVERAL FOREIGN GOVERNMENTS WHO HAD GIVEN MILLIONS OF DOLLARS
  • WHEN HILLARY CLINTON BECAME SECRETARY OF STATE IN 2009, BILL CLINTON AGREED TO STOP ACCEPTING CONTRIBUTIONS TO THE CLINTON FOUNDATION FROM MOST FOREIGN COUNTRIES
  • IN THE PAST, SOME OBSERVERS HAD LINKED FOREIGN GOVERNMENT DONATIONS TO THE CLINTON FOUNDATION AND SECRETARY CLINTON’S WORK AT THE STATE DEPARTMENT
  • THE CLINTON FOUNDATION CAME UNDER INTENSE SCRUTINY IN FEBRUARY 2015 WHEN IT WAS REVEALED THAT THE FOUNDATION HAD ACCEPTED DONATIONS FROM FOREIGN GOVERNMENTS AFTER SECRETARY CLINTON LEFT THE STATE DEPARTMENT
  • THE WALL STREET JOURNAL TIED FOREIGN GOVERNMENT DONORS TO THE CLINTON FOUNDATION’S ENDOWMENT FUNDRAISING UNDER SECRETARY CLINTON
  • CLINTON FOUNDATION ANNOUNCED THAT SHOULD HILLARY CLINTON DECIDE TO RUN FOR PRESIDENT, THE FOUNDATION WOULD FOLLOW APPROPRIATE PROCEDURES FOR ACCEPTING DONATIONS FROM FOREIGN DONATIONS, JUST LIKE IT HAD HAD UNDER SECRETARY CLINTON…
  • REPORTS THAT STATE DEPARTMENT LAWYERS DID NOT EXHAUSTIVELY VET BILL CLINTON’S PAID SPEECHES DURING SECRETARY CLINTON’S TENURE RAISED QUESTIONS ABOUT THE ROLE CLINTON FOUNDATION DONATIONS MAY HAVE PLAYED IN ORGANIZING THOSE SPEECHES
  • SOME CONSERVATIVES USED THE FOREIGN DONATIONS CONTROVERSY TO IMPLY THAT THE CLINTON FOUNDATION IS NOT A CHARITY AND QUESTION THE FOUNDATION’S CHARITABLE WORK
  • THE CLINTON FOUNDATION HAS ACCEPTED DONATIONS FROM INDIVIDUALS, SOME OF WHOM HAD TIES TO FOREIGN GOVERNMENTS, DURING HER TENURE AS SECRETARY OF STATE
  • THE CLINTON FOUNDATION RECEIVED MONEY FROM A FOUNDATION FORMED BY FORMER UKRAINIAN PARLIAMENT MEMBER VICTOR PINCHUK
  • WALL STREET JOURNAL COLUMNIST MARY O’GRADY CITED A CONTRACT BETWEEN TWO CLINTON DONORS FOR HAITI AID AS EVIDENCE OF A CONFLICT OF INTEREST FOR THE CLINTONS

There is much more in the full document presented below (link).

* * *

One important thing to note: according to an interview that Motherboard conducted with Guccifer2 on Tuesday, the hacker makes it clear he is not Russian. He is, in fact, from Romania, just like the Original Guccifer. 

“I’m a hacker, manager, philosopher, women lover,” Guccifer 2.0 told Motherboard on Tuesday in a Twitter chat. “I also like Gucci! I bring the light to people. I’m a freedom fighter! So u can choose what u like!”

The hacker, who claimed to have chosen the name in reference to the notorious hacker who leaked the George W. Bush paintings and claims to have hacked Hillary Clinton’s email server, denied working for the Russian government, as several experts believe.

“I don’t like Russians and their foreign policy. I hate being attributed to Russia,” he said, adding that he was from Romania, just like the first Guccifer.

When asked to explain how he hacked into the DNC in Romanian, “he seemed to stall us, and said he didn’t want to “waste” his time doing that. The few short sentences he sent in Romanian were filled with mistakes, according to several Romanian native speakers.”

The hacker said he left Russian metadata in the leaked documents as his personal ”watermark.” He also said he got kicked out of the network on June 12, when the DNC “rebooted their system.”

A senior DNC official said in an emailed statement that “our experts are confident in their assessment that the Russian government hackers were the actors responsible for the breach detected in April, and we believe that the subsequent release and the claims around it may be a part of a disinformation campaign by the Russians.”

Guccifer 2.0 also said the DNC isn’t the only victim of his hacks, but declined to name any others because “my safety depends on it.”

It appears the Clinton Foundation was one of the other hacks.

Finally, when asked why he targeted the DNC, “Guccifer 2.0 said he simply did it to follow the lead of Marcel Lazar, the original Guccifer, and that he doesn’t “care at all” about Donald Trump. The hacker declined to say whether he knew him personally, “cause I care for Marcel.” “I think we must fight for freedom of minds,” he wrote. “Fight for the world without Illuminati.”

Good luck.

* * *

So while we are going through the full data dump (found here), here is the leaked document revealing the “Clinton Foundation’s Vulnerabilities.”

 

Clinton Foundation Vulnerabilities Master Doc Final by zerohedge on Scribd