For the FBI Haters, Check out Operation Cross Country

Posted on October 18, 2017October 18, 2017 by Denise Simon

FBI Announces Results of Operation Cross Country XI

Underage Sex Trafficking Crackdown Leads to Recovery of 84 Minors

The Federal Bureau of Investigation, along with the National Center for Missing & Exploited Children (NCMEC), announced today that 84 minors were recovered and 120 traffickers were arrested as part of Operation Cross Country XI, a nationwide effort focusing on underage human trafficking that ran from October 12-15, 2017.

This is the 11th iteration of the FBI-led Operation Cross Country (OCC), which took place this year in 55 FBI field offices and involved 78 state and local task forces, consisting of hundreds of law enforcement partners. This year’s coordinated operations took place with several international partners, including Canada (Operation Northern Spotlight), the United Kingdom (Aident 8), Thailand, Cambodia, and the Philippines.

“We at the FBI have no greater mission than to protect our nation’s children from harm. Unfortunately, the number of traffickers arrested—and the number of children recovered—reinforces why we need to continue to do this important work,” said FBI Director Christopher Wray. “This operation isn’t just about taking traffickers off the street. It’s about making sure we offer help and a way out to these young victims who find themselves caught in a vicious cycle of abuse.”

Story and Videos

Operation Cross Country XI

The 11th iteration of Operation Cross Country, the FBI’s annual law enforcement action focused on recovering underage victims of prostitution, concluded with the recovery of 84 sexually exploited juveniles.

As part of Operation Cross Country XI, FBI agents and task force officers staged operations in hotels, casinos, and truck stops, as well as on street corners and Internet websites. The youngest victim recovered during this year’s operation was 3 months old, and the average age of victims recovered during the operation was 15 years old. Minors recovered during Cross Country Operations are offered assistance from state protective services and the FBI’s Victim Services Division. Depending on the level of need, victims are offered medical and mental health counseling, as well as a number of other services.

“Child sex trafficking is happening in every community across America, and at the National Center for Missing & Exploited Children, we’re working to combat this problem every day,” said NCMEC President and CEO John Clark. “We’re proud to work with the FBI on Operation Cross Country to help find and recover child victims. We hope OCC generates more awareness about this crisis impacting our nation’s children.”

Operation Cross Country XI is part of the FBI’s Innocence Lost National Initiative, which began in 2003 and has yielded more than 6,500 child identifications and locations. For additional information on Operation Cross Country XI and the Innocence Lost initiative, please visit www.fbi.gov.

Examples of stories from various cities that took part in Operation Cross Country XI:

On October 13, FBI Denver recovered two minor girls—one 3-month-old and one five-year-old. The subject, a friend of the children’s family, offered an undercover officer access to the two children for sexual purposes in exchange for $600. The FBI is working with Child Protective Services to conduct a forensic interview and secure safe placement of the children. The subject was placed under arrest.
Also on October 13, a 16-year old female victim was recovered by FBI El Paso after an undercover agent called an online advertisement for entertainment. Shortly thereafter, the agent met with a 21-year-old female, who offered a fee of $200 to engage in sexual intercourse with her and another female, the 16-year-old victim. Further investigations revealed that a second adult female drove the minor and the 21-year-old to the undercover agent’s location. Both female subjects have been arrested on federal charges.

Note to Editors: B-Roll and interviews associated with Operation Cross Country can be downloaded at www.fbi.gov.

N Korean Hackers’ Heist from Taiwan Bank

Posted on October 18, 2017October 18, 2017 by Denise Simon

Taiwan Bank Heist Linked to North Korean Hackers

A recent cyber-heist that targeted a bank in Taiwan has been linked by security researchers to an infamous threat group believed to be operating out of North Korea.

Hackers exploited the SWIFT global financial network to steal roughly $60 million from Taiwan’s Far Eastern International Bank. The money was transferred to several countries, but bank officials claimed they had managed to recover most of it. Two individuals were arrested earlier this month in Sri Lanka for their role in the operation.

Researchers at BAE Systems have identified some of the tools used in the attack and found connections to the North Korean threat actor known as Lazarus. This group is also believed to be behind the 2014 attack on Sony Pictures and campaigns targeting several banks, including Bangladesh’s central bank.

The attack on the Bangladesh bank, which resulted in the theft of $81 million, also involved the SWIFT system. Similar methods were also used to target several other banks, but SWIFT said some of the operations failed due to the new security measures implemented by the company.

While it’s still unclear how attackers gained access to the systems of Far Eastern International Bank, an analysis of various malware samples apparently involved in the attack suggests that the hackers may have used a piece of ransomware as a distraction.

The ransomware involved in the attack is known as Hermes. According to Bleeping Computer, the threat surfaced in February and its latest version has an encryption mechanism that makes it impossible to recover files without paying the ransom.

However, researchers at McAfee discovered that the Hermes variant used in the attack on the Taiwanese bank did not display a ransom note, which led them to believe it may have been only a distraction.

“Was the ransomware used to distract the real purpose of this attack? We strongly believe so,” McAfee researchers said. “Based on our sources, the ransomware attack started in the network when the unauthorized payments were being sent.”

BAE Systems has seen samples that drop a ransom note in each encrypted folder, but even they believe Hermes may have been used to distract the bank’s security team.

Another malware sample linked by BAE Systems to this attack is a loader named Bitsran, which spreads a malicious payload on the targeted network. This threat contained what appeared to be hardcoded credentials for Far Eastern International’s network, which suggests the threat group may have conducted previous reconnaissance.

Some pieces of malware discovered by BAE Systems are known to have been used by the Lazarus group, including in attacks aimed at financial organizations in Poland and Mexico. The malware includes commands and other messages written in Russia, which experts believe is likely a false flag designed to throw off investigators.

It’s worth noting that the Hermes ransomware samples checked the infected machine’s language settings and stopped running if Russian, Ukrainian or Belarusian was detected. This is common for malware created by Russian and Ukrainian hackers who often avoid targeting their own country’s citizens. However, this could also be a false flag.

Another piece of evidence linking the Taiwan bank attacks to Lazarus is the fact that money was transferred to accounts in Sri Lanka and Cambodia, similar to other operations attributed to the group.

Some experts believe that these bank heists and the WannaCry attack, which has also been linked by some to Lazarus, are campaigns launched by North Korea for financial gain. However, many of these operations don’t appear to have been very successful on this front.

“Despite their continued success in getting onto payment systems in banks, the Lazarus group still struggle getting the cash in the end, with payments being reversed soon after the attacks are uncovered,” BAE Systems researchers explained.

“The group may be trying new tricks to disrupt victims and delay their ability to respond – such as different message formats, and the deployment of ransomware across the victim’s network as a smokescreen for their other activity. It’s likely they’ll continue their heist attempts against banks in the coming months and we expect they will evolve their modus operandi to incorporate new ways of disrupting victims (and possibly the wider community) from responding,” they added.

photo

*** Related reading: The Lazarus (aka DarkSeoul group) is allegedly controlled by Bureau 121, a division of the Reconnaissance General Bureau, a North Korean intelligence agency. Bureau 121 is responsible for conducting military cyber campaigns.

*** By the way, some of the North Korean hackers not only operate in China but many of those hackers are from India….

6,000 is the number of hackers working for North Korea, traced by American and British security officials.

Once scoffed at, North Korea’s cyber technology has now developed to a brink where it can create a havoc in the world’s cybersecurity. From theft to political agenda, North Korea now launches attacks in the form of ransomware, digital bank heists, online video game cracks and Bitcoin exchanges.

In the first week of October, India’s Ministry of External Affairs issued a strongly-worded statement condemning North Korea for conducting a powerful nuclear test. Few weeks down the line, a stunning report from the New York Times claims that India serves as a base for North Korea’s cyber warfare.

Citing a report by the Recorded Future, the American publication said nearly a fifth of the Pyongang’s attacks originate from India.

The report claims that most of North Korean cyber operations are carried out from foreign countries like India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, and Indonesia. While in some cases, the North Korean hackers route their attacks through their computers from abroad, in cases like that in India, hackers are physically stationed to carry out attacks.

The cyber mission as envisaged by Kim Jong-il in the 1990s was expanded by his dictator son Kim Jong-Un after he took power in 2011.

On of the most successful cyber attacks carried out by North Korea dates back to 2014 on Sony pictures to prevent them from releasing a comedy film that was based on the assassination of Kim Jong Un.

Last May, a widespread global ransomware attack caused panic and briefly stalled the Britain’s National Health Services.

The digital bank heists in Philippines in 2015 and in Vietnam in the same year also earned them some hard cash from cyber attacks.

The report by Recorded Future also indicates that India, despite serving as a base for North Korea’s cyberwar, also remains at a potential threat from similar attacks. While the world lives under the fear of North Korea emerging as a nuclear superpower, the country is silently building a strong brigade of hackers.

Scope of Russian Troll Operation Explained

Posted on October 17, 2017October 17, 2017 by Denise Simon

Information warfare = Troll warfare

Russian journalists publish massive investigation into St. Petersburg troll factory’s U.S. operations

A day after Dozhd television published an interview with a former member of Russia’s infamous Internet Research Agency, the magazine RBC released a new detailed report on the same organization’s efforts to meddle in U.S. domestic politics. Meduza summarizes RBC’s new report here.

photo

The Internet Research Agency, Russia’s infamous “troll farm,” reportedly devoted up to a third of its entire staff to meddling in U.S. politics during the 2016 presidential election. At the peak of the campaign, as many as 90 people were working for the IRA’s U.S. desk, sources told RBC, revealing that the entire agency employs upwards of 250 people. Salaries for staff working in the U.S. department apparently range from 80,000 to 120,000 rubles ($1,400 to $2,100) per month.

The head of the IRA’s U.S. desk is apparently a man originally from Azerbaijan named Dzheikhun Aslanov (though he denies any involvement with the troll factory).

In August and September this year, Facebook, Instagram, and Twitter suspended 118 communities and accounts run by the St. Petersburg “troll factory,” disabling a network capable of reaching 6 million subscribers. In 2016, at the height of the U.S. presidential campaign, this network reportedly produced content that reached 30 million people each week.

A source also told RBC that the Internet Research Agency spent almost $80,000 over two years, hiring roughly 100 local American activists to stage about 40 rallies in different cities across the United States. The activists were hired over the Internet, communicating in English, without their knowledge that they were accepting money or organizing support from a Russian organization. According to RBC, internal records from the IRA verify its role in these activities.

The main activity in the troll factory’s U.S. desk was to incite racial animosity (playing both sides of the issue), and promoting the secession of Texas, objections to illegal immigration, and gun rights.

RBC estimates that the Internet Research Agency’s total salary expenses approach $1 million per year, with another $200,000 allocated to buying ads on social media and hiring local activists in the U.S.

According to RBC, the IRA still has a U.S. desk, though its staff has apparently dropped to 50 employees.

Note: Formally, the Internet Research Agency ceased to exist roughly two years ago, rebranding itself under different names, but sources say the organization continues to operate as before.

***

One part of the factory had a particularly intriguing name and mission: a “Department of Provocations” dedicated to sowing fake news and social divisions in the West, according to internal company documents obtained by CNN.

Prigozhin is one of the Kremlin’s inner circle. His company is believed to be a main backer of the St. Petersburg-based “Internet Research Agency” (IRA), a secretive technology firm, according to US officials and the documents reviewed by CNN. Prigozhin was sanctioned by the US Treasury Department in December of 2016 for providing financial support for Russia’s military occupation of Ukraine. Two of his companies, including his catering business, were also sanctioned by Treasury this year.

CNN has examined scores of documents leaked from Prigozhin’s companies that show further evidence of his links to the troll factory.

One contract provided IRA with ways to monitor social media and a “system of automized promotion in search engines.”

Prigozhin has a colorful past. He spent nine years in prison in the 1980s for fraud and robbery, according to Russian media reports. After his release, he went into the catering business — renovating a boat and opening New Island, one of a half-dozen upscale restaurants he owns in St. Petersburg. Putin turned to him to cater his birthday parties as well as dinners with visiting leaders, including President Bush and Jacques Chirac of France. A headline in The Moscow Times referred to Prigozhin as Putin’s “Personal Chef.”

Prigozhin subsequently won lucrative catering contracts for schools and Russia’s armed forces. He escorted Putin around his new food-processing factory in 2010. By then he was very much a Kremlin insider with a growing commercial empire. More here.

***

Trolling NATO? Yuppers

Seventy percent of Russian-language tweets targeting NATO military activities in Eastern Europe are generated by automated Russian trolls, according to a survey done by the military alliance.

“Two in three Twitter users who write in Russian about the NATO presence in Eastern Europe are robotic or ‘bot’ accounts,” the NATO Strategic Communications Centre of Excellence stated in a report made public this week.

The Russian bots sent 84 percent of all Russian language messages. English language tweets against the alliance also were found to be automated, with some 46 percent generated by automated Twitter accounts.

The report criticized the global social media platform for not doing enough to counter Russian bot activities on Twitter. “Our impression is that Twitter in Russian is policed less effectively than it is in English,” the report said.

A Twitter spokesman could not be reached for comment. Colin Crowell, Twitter’s vice president for public policy, stated in a recent post on the company website that “we strictly prohibit the use of bots and other networks of manipulation to undermine the core functionality of our service.” Read more here.

U.S. ready for Chinese and Iranian Drone Program?

Posted on October 16, 2017October 16, 2017 by Denise Simon

Can the U.S. and allies counter the Chinese program of armed drones or Iran’s?

Beijing has developed an arsenal of unmanned aerial systems ranging from stealthy combat drones to networked-drone swarms. While the U.S. military still remains superior in technology and in number of drones – with the U.S. military reportedly operating some 7,000 and Chinese military operating at least 1,300 – China is quickly gaining traction.

China’s CH-3 and Ch-4 are broadly modeled off variations of the U.S. Predator and Reaper drones. The next iteration, the CH-5, with a 4400-mile flight range over 60 hours – soon to be 12,000 miles over 120 hours – and payload of over one ton of weapons and sensors, including modules designed for electronic warfare and early warning radar to detect enemy aircraft, is the country’s most advanced drone to date. It can even communicate with other combat drones such as earlier CH-3 and CH-4 models to conduct joint missions. Similarly, the smaller CH-805 Stealth Target Drone, which can fly at near supersonic speeds to mimic Chinese fighters on air defense systems, would likely be used operationally as a wingman for manned aircraft.

Notably, however, China must tailor its military doctrine to engage a conventionally superior foe in the United States, who has prioritized expensive and highly advanced drone hardware such as the Global Hawk. For this reason China has sought to foster drones that will enable it an asymmetric capability – an inexpensive attack force operating together and capable of quick yet not decisive attacks. For this reason, Beijing has sought swarms of small, low-tech, possibly 3-D printable drones linked together through high-tech artificial intelligence to create a cognitive hive mind, or swarm.

For example, China’s SW-6 is a small “marsupial” drone with folding wings that can be dropped en mass from cargo chutes or helicopters to conduct persistent surveillance, jam enemy communications, or even relay friendly communications in contested airspace. While the drone is unarmed, it could network with other SW-6s to hunt, swarm, and even dive-bomb enemy targets. This would allow Beijing to project power within its sphere of influence with a lower probability of outright military confrontation – the presence of unarmed drones do not trigger escalation in the same way that fighter jets or aircraft carriers do.

“Should a U.S. warship all of sudden get swarmed by hundreds if not a thousand small unarmed drones, it could have disruptive and distracting effects – impacting electronics and target acquisition for U.S. weapons systems by blinding them,” says Doug Wise, former Deputy Director of the U.S. Defense Intelligence Agency. “By having the nonlethal drone military capability, it also gives the Chinese a non-kinetic way to conduct military operations in the prosecution of the sovereign Chinese seas – expedite control of a disputed island or interdict maritime traffic to control the waters.”

Part of the reason the Chinese military has likely kept its drones near the mainland could be a lack of space-based communications for over-the-horizon flight control where there is not a direct line of sight between the Chinese-based ground control and the drone. But China has already displayed an ability to do conduct such operations in a limited fashion, and as Beijing’s constellation of satellites grows, so will its ability to conduct remote operations in far off places where it has national interests, such as Africa and the Middle East, where drones could be launched from its new military base strategically positioned in Djibouti.

While drones might play a narrow asymmetric roll in Chinese military doctrine at the moment, the prominence of Chinese drone technology in defense trade shows suggests Beijing is also seeking to incorporate the technology into its broader foreign policy. Besides the United States, who has sold armed drones to the British and Italian militaries, China is the only other exporter of lethal drones, providing them to governments with questionable human rights records, such as Pakistan, Iraq, Nigeria, Saudi Arabia, Egypt, the United Arab Emirates, and possibly even the Somali military. China is even building factories for its drones outside of its borders, in places like Saudi Arabia, Pakistan, and Myanmar, essentially bypassing plausible export restrictions all together.

But while China is becoming a true competitor of the U.S. in the provision of key weapons systems such as drones, it is also replacing Russia as the cheaper and less restricted alternative supplier. For example, a Chinese CH-4 drone costs a mere $4 million on the global market, while the MQ-1 Predator and ground station costs a reported $20 million. More here.

***

On Oct. 5, 2017, Maghreb Confidentiel — a professional journal covering Africa’s intelligence services — revealed that the Libyan National Army has obtained Iranian-made Mohajer-2 drones.

War Is Boring’s own sources in Libya confirmed the claim. A photo provided by LNA militants shows one of the Iranian UAVs at an unspecified air base.

The Libyan engineer in the picture – his face obscured for security reasons – works with the LNA. But the provenance of the drone is unclear.

There are two sources plausible sources. Iran and Sudan.

The Mohajer-2 is powered by a 25-horsepower WAE-342 twin-cylinder piston engine. Generally unarmed, the Mohajer-2 is optimized for reconnaissance missions. It boasts a 50-kilometer range and a maximum speed of 200 kilometers per hour. Its ceiling around 3,350 meter. Its endurance — 90 minutes or so.

Iran, Sudan and Venezuela all use the Mohajer-2.

The first possibility is that Iran itself supplied the drones to the Tobruk-based Libyan regime, possibly via an intermediary such as Russia, which has also transferred MiG-23s and spare parts to the LNA.

The transfer could have occurred via the air cargo companies that regularly visit LNA bases, including Moldovan firms Sky Prim Air and Oscar Jet.

All that said, some of the LNA’s strongest backers are Sunnia-Arab countries — major opponents of Iran. In accepting drones from Tehran, even indirectly, Tobruk could risk alienating its most important backers.

That leaves Sudan. Khartoum has, in general, supported militants in Misrata and the Libyan Government of National Accord — a rival of the LNA. Sudan has provided ammunition, spare parts and technical maintenance and Sudanese crews for the pro-GNA Libya Dawn Air Force.

** photo

But there are indications that Khartoum has occasionally aided the LNA.

The Justice and Equality Movement and the Sudan Liberation Movement are Sudanese Islamist opposition groups, most of whose members are Darfuris. They are part of the Sudanese Revolutionary Front, an alliance of Sudanese factions opposed to the government of Pres. Omar Al Bashir.

Rebels from these two armed groups regularly enter Libyan territory, notably the Kufra region. In February 2016, JEM and SLM fighters attacked the city of Kufra, which was then under the control of the Tobruk-based House of Representative.

Since October 2015, the main armed group in the area has been the Subol Al Salam brigade – a Salafist militia – which is said to be operating in alliance with the LNA’s leader Khalifa Haftar.

In October 2016, this militia reportedly killed 13 JEM militants and destroyed two vehicles near the oasis town of Jaghboub. Despite this, Sudan regularly complains that Libya — that is to say, the Tobruk government — does nothing to prevent the various Darfuri rebel groups from crossing into Libya.

Lacking infrastructure in the south of Libya, the LNA can only use light armed-reconnaissance aircraft – SIAI Marchetti SF.260s – to monitor the Sudanese-Libyan border. One of these Italian-made small planes crashed south of Kufra in May 2017, killing the two crew members.

Khartoum has operated Iranian-made UAVs since 2008, as Africa Confidential reported. That year, the Sudan Liberation Movement-Unity Commanda shot down a Ghods Ababil-3 over Darfur. According to Africa Confidential editor Patrick Smith, the drone was probably controlled by Iranian technicians in Sudan.

The Sudanese air force has used many types of UAVs and lost at least six in combat – most of them shot down by rebels.

Despite past tensions between Tobruk and Khartoum due to Sudan’s support of the regime in Tripoli, an agreement between the Libyans and Sudanese may have facilitated Sudan’s supply of Mohajer-2s to Tobruk and the training of operators, all in order to monitor and prevent the crossing of the Libyan border by JEM and SLM militants.

Of course, it’s also possible that the LNA captured the drones from the GNA when the former seized Al Jufra air base in June 2017. The LNA could have grabbed Mohajer-2s along with the ex-Libya Dawn MiG-23UB fighter that LNA fighters found at the base.

Should Voting Machines be Part of Critical Infrastructure?