Category Archives: NSA Spying

Iran Swapping Nuclear Material with Russia

Posted on by

Sheesh, what could go wrong and what uranium and why to Russia?

In part from FreeBeacon: Russia and Iran are beginning to trade sensitive nuclear materials, an activity that is at least in part condoned by the Obama administration and permissible under the tenets of the recent nuclear accord, according to U.S. and Iranian officials.

Russian-made yellow cake, a type of uranium powder that helps turn it into a nuclear fuel, “is in Iran and Iran’s enriched uranium cargo will be sent to Russia” within the next several days, according to top Iranian officials quoted this week in the country’s state-run press.

Senior U.S. officials confirmed on Thursday that the Obama administration backs the opening of commercial nuclear trade between Moscow and Tehran.

“Commercial contracts are in place for Iran to ship its enriched uranium stockpiles to Russia,” Stephen Mull, a State Department official who is leading the administration’s charge to implement the nuclear deal, told lawmakers. More details here.

This condition is quite familiar especially with regard to Iran.

Bishkek (AKIpress) – nuke plant Russia and Kazakhstan are preparing an intergovernmental agreement on construction of a nuclear power plant, Presidential aide Yuri Ushakov told TASS on Friday.

“An intergovernmental cooperation agreement is being prepared for construction of a Russia-designed nuclear power plant within the territory of Kazakhstan,” he said, adding that the issue may be touched upon on December 21 at the meeting of presidents of Russia and Kazakhstan “on the sidelines” of the CSTO (Collective Security Treaty Organization) and the SEEC (Supreme Eurasian Economic Council) summit.

“The leaders of the two countries are expected to dwell upon the problem of boosting trade and economic cooperation,” Ushakov said.

Then there is India:

BusinessInsider: India is expected to offer Russia land in Andhra Pradesh to set up units five and six of Kudankulam nuclear power plant. This is in line with the ‘Make in India‘ initiative. The decision would be finalised during Prime Minister Narendra Modi‘s visit to Moscow this week.

“We will follow principles of ‘localisation’ as per Make in India initiative for setting up Kudankulam nuclear power plant five and six,” sources told PTI.

Russia is working a deal in Jordan but back to Iran:

Back in 2013-14: WASHINGTON — Russia has agreed to build Iran two additional nuclear power plants, Iran’s state-run Press TV announced on Wednesday.

Russia will construct the new facilities next to Iran’s sole existing nuclear power plant in the city of Bushehr.

That plant was also built with Russian assistance, and was fueled for operation in 2011. The reactor was put under full Iranian control in 2013.

The deal includes two desalination plants and is reportedly in exchange for oil; Russia built first and only reactor at Bushehr.

Iran To Ship Enriched Uranium To Russia

 RFEL: Iranian nuclear officials say Tehran will export most of its enriched uranium stockpile to Russia in the coming days as it implements a nuclear deal to secure relief from international sanctions.

The Iranian news agency IRNA quotes nuclear chief Ali Akbar Salehi as saying on December 19 that “around nine tons of Iran’s enriched uranium will be exported to Russia.”

That is roughly the amount that Iran must export to bring its stockpile down to the required level under the sanctions-relief deal.

Salehi did not give a precise timetable for what he meant by “in the coming days.”

Under the terms of the deal it reached in July with world powers, Iran must reduce its stockpile of enriched uranium to around 300 kilograms. It must also deactivate and store most of its centrifuges, and remove the core of a heavy water reactor in Arak so it cannot be used to produce plutonium.

On December 16, Tehran said it was working to complete the requirements in the next two to three weeks, after the International Atomic Energy Agency (IAEA) closed its investigation of Iran’s past nuclear activities.

The 35-nation governing board of the IAEA passed a resolution on December 15 ending the UN nuclear watchdog agency’s 12-year-long inquiry into suspicions of “possible military dimensions” to Iran’s nuclear work.

IAEA chief Yukiya Amano said afterward that Tehran has taken the necessary steps to cooperate with the agency and that it was “not impossible” that sanctions could be lifted in January.

Iran has shown a strong apparent desire in recent weeks to build on the momentum of the nuclear deal and restore international economic links after years of sanctions.

Iranian Industry Minister Mohammad Reza Nematzadeh said on December 17 that Tehran is prepared to begin negotiations for membership in the World Trade Organization (WTO).

Iran first applied for WTO membership in July 1996, but progress had been minimal since then due to tensions over the Iranian nuclear crisis.

Forget the EMP, It’s the Hack, You’re at Risk

Posted on by

Iranian hackers infiltrated computers of small dam in NY

WASHINGTON (Reuters) – Iranian hackers breached the control system of a dam near New York City in 2013, an infiltration that raised concerns about the security of the country’s infrastructure, the Wall Street Journal reported on Monday, citing former and current U.S. officials.

Two people familiar with the breach told the newspaper it occurred at the Bowman Avenue Dam in Rye, New York. The small structure about 20 miles from New York City is used for flood control.

The hackers gained access to the dam through a cellular modem, the Journal said, citing an unclassified Department of Homeland Security summary of the incident that did not specify the type of infrastructure.

The dam is a 20-foot-tall concrete slab across Blind Brook, about five miles from Long Island Sound.

“It’s very, very small,” Rye City Manager Marcus Serrano told the newspaper. He said FBI agents visited in 2013 to ask the city’s information-technology manager about a hacking incident.

The dam breach was difficult to pin down, and federal investigators at first thought the target was a much larger dam in Oregon, the Journal said.

The breach came as hackers linked to the Iranian government were attacking U.S. bank websites after American spies damaged an Iranian nuclear facility with the Stuxnet computer worm.

It illustrated concerns about many of the old computers controlling industrial systems, and the White House was notified of the infiltration, the Journal said.

The newspaper said the United States had more than 57,000 industrial control systems connected to the Internet, citing Shodan, a search engine that catalogs each machine.

Homeland Security spokesman S.Y. Lee would not confirm the breach to Reuters. He said the department’s 24-hour cybersecurity information-sharing hub and an emergency response team coordinate responses to threats to and vulnerabilities in critical infrastructure.

***

Cant Sleep, You are at Risk

In part from Wired: If you want to keep yourself up at night, spend some time reading about the latest developments in cybersecurity. Airplanes hacked, cars hacked, vulnerabilities in a breathtaking range of sensitive equipment from TSA locks to voting booths to medical devices.

The big picture is even scarier. Former NSA Director Mike McConnell suspects China has hacked “every major corporation” in the US. Edward Snowden’s NSA leaks revealed the US government has its own national and international hacking to account for. And the Ponemon Institute says 110 million Americans saw their identities compromised in 2014. That’s one in two American adults.

The system is broken. It isn’t keeping us, our companies, or our government safe. Worse yet, no one seems to know how to fix it.

How Did We Get Here?

One deceptive truth seems to drive much of the cybersecurity industry down a rabbit hole: If you keep bad actors and bad software out of your system, you have nothing to worry about.

Malicious actors target “endpoints”—any device or sensor connected to a network—to break into that network. Network security seeks to protect those endpoints with firewalls, certificates, passwords, and the like, creating a secure perimeter to keep the whole system safe.

This wasn’t difficult in the early days of the Internet and online threats. But today, most private networks have far too many endpoints to properly secure. In an age of “Bring Your Own Device,” the cloud, remote access, and the Internet of Things, there are too many vulnerabilities hackers can exploit. As Ajay Arora, CEO of file security company Vera, notes, there is no perimeter anymore. It’s a dream of the past.

But the security paradigm remains focused on perimeter defense because, frankly, no one knows what else to do. To address threats, security experts should assume compromise – that hackers and malware already have breached their defenses, or soon will – and instead classify and mitigate threats.

The CIA Triad

The information security community has a model to assess and respond to threats, at least as a starting point. It breaks information security into three essential components: confidentiality, integrity, and availability.

Confidentiality means protecting and keeping your secrets. Espionage and data theft are threats to confidentiality.

Availability means keeping your services running, and giving administrators access to key networks and controls. Denial of service and data deletion attacks threaten availability.

Integrity means assessing whether the software and critical data within your networks and systems are compromised with malicious or unauthorized code or bugs. Viruses and malware compromise the integrity of the systems they infect.

The Biggest Threat

Of these, integrity is the least understood and most nebulous. And what many people don’t realize is it’s the greatest threat to businesses and governments today.

Meanwhile, the cybersecurity industry remains overwhelmingly focused on confidentiality. Its mantra is “encrypt everything.” This is noble, and essential to good security. But without integrity protection, the keys that protect encrypted data are themselves vulnerable to malicious alteration. This is true even of authenticated encryption algorithms like AES-GCM.

In the bigger picture, as cybercrime evolves, it will become clear that loss of integrity is a bigger danger than loss of confidentiality. One merely has to compare different kinds of breaches to see the truth of this:

A confidentiality breach in your car means someone learns your driving habits. An integrity breach means they could take over your brakes. In a power grid, a confidentiality breach exposes system operating information. An integrity breach would compromise critical systems, risking failure or shutdown. And a confidentiality breach in the military would mean hackers could obtain data about sensitive systems. If they made an integrity beach, they could gain control over these weapons systems. Full details and actions you can take to protect yourself, go here.

A Money Trail: Iran to Hamas to Islamic State

Posted on by

For Hamas and Islamic State, the common enemy is Egypt. Prime Minister Netanyahu of Israel spoke truth to power on this relationship months ago.

Analysis: Money Trail Leads From Iran to ISIS, by Way of Hamas

TheTower: A report published Monday in Ynet that documents ties between Hamas and the Sinai-based branch of ISIS also shows Iran’s role in supporting ISIS.

Israel’s security establishment has pointed out a clear paradox in this dangerous collaboration: the bulk of Hamas’ financial support comes from Iran, which is persistently fighting ISIS in Syria and Iraq. Many Iranians have already been killed on the frontline of this battle. Furthermore, the Iranians are specifically funding the Gaza front against ISIS’s Sinai branch – via Hamas.

The Times of Israel reported in September that Iran, in expectation of the sanctions relief it would receive under terms of the nuclear deal, was smuggling “suitcases of cash” to Hamas so that the terror group could upgrade its arsenal.

Since the deal was signed, Iran has significantly increased its financial support for two of the largest terror groups in the region that have become political players, Hamas and Hezbollah. In the years before the deal was signed, the crippling sanctions limited this support, which had significantly diminished along with Iran’s economy. But Tehran’s belief that tens, or hundreds, of billions of dollars will flow into the country in the coming years as a result of sanctions relief has led to a decision to boost the cash flow to these terror organizations.

At around the same time, Major General Ataollah Salehi, the commander-in-chief of Iran’s armed forces, boasted of the support Iran was giving to terror groups such as Hamas and Hezbollah to help them fight terror wars against Israel.

The Ynet article, coming a week after the leader of ISIS’s Sinai branch was reported in Gaza, highlighted the operational cooperation between Hamas and ISIS. Hamas has been giving funds, received from Iran, to ISIS to finance its operations. Hamas has also provided training to ISIS and treated ISIS terrorists in Gaza hospitals. In return, ISIS has helped Hamas smuggle weapons into Gaza.

Because Hamas has a clear hierarchy and command structure, it is highly unlikely that funds would go to ISIS without approval from both the highest echelons of Hamas and their funders in Iran.

  • Hamas’ military wing in the Gaza Strip has been transferring tens of thousands of dollars a month to the Islamic State group’s Sinai branch over the past year, via one of its emissaries.
  • The transfer of cash is just one part of the military and strategic cooperation between the two groups. The finances of Hamas’ military arm, the Izz ad-Din al-Qassam Brigades, are independent of those of the organization’s political bureau. Hamas is paying the Islamic State militants in Egypt to secure weapons shipments being smuggled through the Sinai to Gaza. More details here.

Juniper Hacked, Several Govt Agencies at Risk

Posted on by

Backdoor Code Found in Firewall

Engadget: One of the reasons corporate users and the privacy-minded rely on VPNs is to control access to their networks and (hopefully) not expose secrets over insecure connections. Today Juniper Networks revealed that some of its products may not have been living up to that standard, after discovering “unauthorized code” in the software that runs on its NetScreen firewalls during a code review. Pointed out by security researcher “The Grugq,” the backdoor has been present since late 2012 and can only be fixed by upgrading to a new version of software just released today.

Telnet / ssh exposes a backdoor added by attackers to ScreenOS source code. This has been there since August 2012. Noted code here.

The pair of issues that created the backdoor would allow anyone who knows about it to remotely log in to the firewall as an administrator, decrypt and spy on supposedly secure traffic, and then remove any trace of their activity. Obviously this is a Very Bad Thing, although Juniper claims it has not heard of any exploitation in the wild (which would be difficult, since no one knew it existed and attackers could hide their traces) so far.

Beyond sending IT people sprinting to patch and test their setups, now we can all speculate about which friendly group of state-sponsored attackers is responsible. US government officials have recently been pushing for mandated backdoor access to secure networks and services, but the Edward Snowden saga made clear that even our own country’s personnel aren’t always going to ask permission before snooping on any information they want to check out. I contacted Juniper Networks regarding the issue, but have not received a response at this time.

Update: A Juniper Networks spokesperson told us:

During a recent internal code review, Juniper discovered unauthorized code in ScreenOS® that could allow a knowledgeable attacker to gain administrative access and if they could monitor VPN traffic to decrypt that traffic. Once we identified these vulnerabilities, we launched an investigation and worked to develop and issue patched releases for the impacted devices. We also reached out to affected customers, strongly recommending that they update their systems and apply the patched releases with the highest priority.

The patched releases also address an SSH bug in ScreenOS that could allow an attacker to conduct DoS attacks against ScreenOS devices. These two issues are independent of each other.

Newly discovered hack has U.S. fearing foreign infiltration

Washington (CNN) A major breach at computer network company Juniper Networks has U.S. officials worried that hackers working for a foreign government were able to spy on the encrypted communications of the U.S. government and private companies for the past three years.

The FBI is investigating the breach, which involved hackers installing a back door on computer equipment, U.S. officials told CNN. Juniper disclosed the issue Thursday along with an emergency security patch that it urged customers to use to update their systems “with the highest priority.”

The concern, U.S. officials said, is that sophisticated hackers who compromised the equipment could use their access to get into any company or government agency that used it.

One U.S. official described it as akin to “stealing a master key to get into any government building.”

The breach is believed to be the work of a foreign government, U.S. officials said, because of the sophistication involved. The U.S. officials said they are certain U.S. spy agencies themselves aren’t behind the back door. China and Russia are among the top suspected governments, though officials cautioned the investigation hasn’t reached conclusions.

It’s not yet clear what if any classified information could be affected, but U.S. officials said the Juniper Networks equipment is so widely used that it may take some time to determine what damage was done.

A senior administration official told CNN, “We are aware of the vulnerabilities recently announced by Juniper. The Department of Homeland Security has been and remains in close touch with the company. The administration remains committed to enhancing our national cybersecurity by raising our cyber defenses, disrupting adversary activity, and effectively responding to incidents when they occur.”

Juniper Networks’ security fix is intended to seal a back door that hackers created in order to remotely log into commonly used VPN networks to spy on communications that were supposed to be among the most secure. A free trial vpn has been helpful for those new to the VPN world to decide if it is right for them.

Juniper said that someone managed to get into its systems and write “unauthorized code” that “could allow a knowledgeable attacker to gain administrative access.”

Such access would allow the hacker to monitor encrypted traffic on the computer network and decrypt communications.

Juniper sells computer network equipment and routers to big companies and to U.S. government clients such as the Defense Department, Justice Department, FBI and Treasury Department. On its website, the company boasts of providing networks that “US intelligence agencies require.”

Its routers and network equipment are widely used by corporations, including for secure communications. Homeland Security officials are now trying to determine how many such systems are in use for U.S. government networks.

Juniper said in its security alert that it wasn’t aware of any “malicious exploitation of these vulnerabilities.” However, the alert also said that attackers would leave behind no trace of their activity by removing security logs that would show a breach.

“Note that a skilled attacker would likely remove these entries from the log file, thus effectively eliminating any reliable signature that the device had been compromised,” the Juniper security alert said. If encrypted communications were being monitored, “There is no way to detect that this vulnerability was exploited,” according to the Juniper security alert.

According to a Juniper Networks spokeswoman’s statement, “Once we identified these vulnerabilities, we launched an investigation and worked to develop and issue patched releases for the impacted devices. We also reached out to affected customers, strongly recommending that they update their systems.”

U.S. officials said it’s not clear how the Juniper source code was altered, whether from an outside attack or someone inside.

The work to alter millions of lines of source code is sophisticated. The system was compromised for three years before Juniper uncovered it in a routine review in recent weeks.

Juniper said it was also issuing a security fix for a separate bug that could allow a hacker to launch denial-of-service attacks on networks.

FBI Prevented from Using Open Source?

Posted on by

‘ISIS Supporters’ Twitter Accounts Traced To UK Government Department’: Report

NDTV: London:  Hackers in Britain have claimed that a number of ISIS supporters’ social media accounts are being run from internet addresses linked to the UK government’s Department for Work and Pensions (DWP).

A group of four young computer experts, who call themselves VandaSec, have unearthed evidence indicating that at least three ISIS-supporting accounts can be traced back to the DWP’s London offices, the ‘Daily Mirror’ reported.

Every computer and mobile phone logs onto the internet using an IP address, which is a type of identification number. The hacking collective showed the newspaper details of the IP addresses used by three separate so-called “digital jihadis” to access Twitter accounts, which were then used to carry out online recruitment and propaganda campaigns.

At first glance, the IP addresses seem to be based in Saudi Arabia, but upon further inspection using specialist tools they appeared to link back to the DWP.

The newspaper learned that the British government had sold on a large number of IP addresses to two Saudi Arabian firms.

After the sale completed in October of this year, they were used by extremists to spread their message of hate.

A Cabinet Office spokesperson said: “The government owns millions of unused IP addresses which we are selling to get a good return for hardworking taxpayers.

“We have sold a number of these addresses to telecoms companies both in the UK and internationally to allow their customers to connect to the internet. We think carefully about which companies we sell addresses to, but how their customers use this internet connection is beyond our control.”

The UK government has not revealed how much money it has made from the sale of IP addresses.

Now we have learned that DHS has an edit to not use social media or open source for reasons of profiling, which likely has handicapped the FBI from sourcing and connecting intelligence when it comes to cultivating data on would-be jihadists.

Jihadists are making their plans public. Why hasn’t the FBI caught on?

Each week, In Theory takes on a big idea in the news and explores it from a range of perspectives. This week we’re talking about Internet encryption. Need a primer? Catch up here.

WaPo: Rita Katz is the director of the SITE Intelligence Group and has spent nearly two decades tracking, studying and reporting on jihadists. She has testified before Congress and in terrorism trials, briefed the White House, and is the author of the book “Terrorist Hunter: The Extraordinary Story of a Woman who Went Undercover to Infiltrate the Radical Islamic Groups Operating in America.”

Following the terrorist attacks in Paris and San Bernardino, Calif., FBI Director James Comey revealed to the Senate Judiciary Committee that one of the two Islamic State-inspired shooters in the May 3 attack in Garland, Tex., “exchanged 109 messages with an overseas terrorist” the morning of the attack. He followed up by saying that the FBI was unable to read those messages. His implication? Better regulation of message-disguising encryption technology could have revealed the shooters’ plans earlier and could help prevent attacks.

However, regulation of encryption is unlikely to provide the government with the counterterrorism benefit it says it will.  Jihadists’ main tool for planning and executing attacks in recent years has been social media — to which the government has full access — not encrypted messaging. In addition, regulation of one messaging technology will lead to immediate adaptation and the creation of ways to circumvent it.

In recent years, smartphones and social media have enabled users from around the world to communicate easily, safely and free of charge. Programs facilitating such communications sprouted, and jihadists — the Islamic State in particular — quickly adopted them as their main means of communication. For over three years, Twitter has been the Islamic State’s most important platform. High-level operatives within the group have used Twitter’s unencrypted direct messaging to recruit, give instructions for donating and plan attacks. Jihadists even rely on Twitter to promote their channels on other platforms, such as Telegram, which supporters would otherwise have difficulty finding.

Jihadists’ presence on social media has also spread the Islamic State around the world, with people of all ages, sexes and ethnicities leaving their families and friends to join the group. Social media use has been linked to executed and attempted lone-wolf attacks in the United States, Canada, Australia, France, Denmark and other Western nations.

The Garland, Tex., shooting — the only example Comey used  as an impetus to regulate encrypted technology — in fact makes the opposite point. Attacker Elton Simpson, who was under previous FBI terror-related investigations, used Twitter to openly follow and communicate with high-profile terrorists. His account was followed by prominent English-speaking Islamic State fighters and recruiters Abu Rahin Aziz and Junaid Hussain — both of whom for a long time were known to provide manuals on how to carry out lone-wolf attacks from Raqqa, Syria, before they were killed. Simpson also followed and communicated with Mohamed Abdullahi Hassan, a known American jihadist in Somalia who pledged allegiance to the Islamic State.

Relatedly, the incitement for the Texas shooting came from Hassan’s 31st Twitter account. Simpson, a friend and follower of Hassan, retweeted the call and later requested that Hassan send him a direct message. We at SITE, using only open-source information, reported on the call before the attack took place, and the FBI had a week to investigate the matter before the shooting. Though only nine Twitter users retweeted the call for attack, the FBI failed to prevent it.

The encrypted messages Comey mentioned before the Judiciary Committee were discovered by the FBI only after the attack took place, but Simpson’s open-source communication was available far in advance. There is in fact no evidence that this or any of these other lone-wolf attacks could have been prevented by regulation of encryption technology.

In stark contrast, a proper, targeted open-source investigation could have. Yet the FBI is reluctant to recognize open-source as an important — arguably the most important — tool to track jihadists online.

It’s also important to note that jihadists are very quick to adapt online. In the past year alone, the Islamic State and al-Qaeda fighters have moved quickly from WhatsApp to Kik, Wickr, Surespot, then to Telegram – all different encryption programs created to give smartphone users safe and free text messaging available across multiple devices.  Jihadists are constantly ranking, debating and explaining which of the services is the safest and most effective. Regulation of these programs will take jihadists next to no time to circumvent; the U.S. government would be the one taking years to catch up. And even if successful, they may be able to regulate companies based in the United States, but such programs would appear everywhere else, from Russia to India to China

SITE’s leadership and continued success do not stem from access to secret databases. Our research, investigations and reporting are based on open-source information — social media, forums, websites, blogs, IP addresses — which can be immensely powerful if used wisely. Government agencies, however, seem blind to this bountiful intelligence resource, and too often rely solely on classified documents and back-end access to websites.

Rather than try to create backdoors to encrypted communication services, or use the lack thereof as an excuse to intelligence failures, the U.S. government must first know how to utilize the mass amount of data it has been collecting and to improve its monitoring of jihadist activity online. A focused approach of this sort is much more likely to lead to success in the war on terrorism.