Archive for the ‘Cyberwar’ Category

The denials, now from the aforementioned Chinese schools (Shanghai Jiaotong University and Lanxiang Vocational School), are expected, but without foundation given the proof uncovered by Joe Stewart, a malware specialist with SecureWorks.

Mr. Stewart reverse-engineered code from the Hydraq trojan and, according to the NY Times, ‘determined the main program used in the attack contained a module based on an unusual algorithm from a Chinese technical paper that has been published exclusively on Chinese-language Web sites.’

For a much more detailed analysis beyond the scope of the Times article, jump to the original SecureWorks blog post by Mr. Stewart where he explains the basis of his conclusions about the unusual CRC algorithm.  As he says, “This information strongly indicates the Aurora codebase originated with someone who is comfortable reading simplified Chinese…In my opinion, the use of this unique CRC implementation in Hydraq is evidence that someone from within the PRC authored the Aurora codebase…”

I had fun hypothesizing about the evil genius of backdoors inside the source code of pirated copies of Windows (take the tin hat off now!), but this argument concludes that  someone or some group (PLA?) in the PRC is behind this.  As Mr. Stewart recognizes, this could still be the work of others, intent on blaming the Chinese government, but he refers to Occam’s Razor and its classic argument that the simplest explanation is probably the best one.

On the other hand, the counter argument, and some compelling evidence, has been raised in this blog piece.

To play the Devil’s Advocate for a moment;  say the U.S. government was behind this, to throw suspicion on the PRC for political and economic reasons, and to fight-back against the “persistent campaign of “espionage-by-malware” emanating from the People’s Republic of China (PRC)”, as Mr. Stewart describes it, who would be helping the U.S.?

As I stated before, maybe we’re doing it or maybe others are doing it for us.  If we’re doing it, we’re doing it directly or using inside assets.  If someone else is doing it for us – who?  My money is on the Israelis.  Israel has plenty of sharp coders and the Mossad is quite capable, as recent news has shown.  And, they’ve done this before.  If not Israel, what other nation would be likely to help the U.S.?  England,  Canada or Australia probably.

Then there’s the voice that says, ‘everyone’s doing it, so why worry?’ Sadly, all too true…  Most likely, we’ll never really know the answer.

by Bill Wildprett, Suspicious Minds blog, Copyright 2010


Read Full Post »

An excellent article in the N.Y. Times on February 18th stated that two Chinese schools, the Shanghai Jiaotong University and the Lanxiang Vocational School were involved in the recent online attacks against Google and dozens of other U.S. corporations.  These conclusions come from research by various security researchers, the NSA, and U.S. defense contractors.

There are multiple possibilities to consider here and more detailed information is required before making any final conclusions.  One the one hand, it appears to be obvious ~ yes, it’s the Chinese government/military working with or sponsoring patriotic student hacking activities.

On the other hand, perhaps not.  An important part of the covert Intelligence function and process is the dissemination of dis-information for various reasons, be they political, economic, strategic, etc.,  As the Times article speculates, this may be a false-flag intelligence operation led by another nation-state.

To do this successfully, you need insiders who work for you who can plant the trail of ‘bread crumbs’ that lead back to the source of origin or you need outsiders who can co-opt internal resources to make it look like the attacks came from the schools.  For the latter, you’d need to control individual servers or a botnet from within China to do the attacks, with just enough hard-to-find, but incriminating and hard-to-spoof pieces of evidence to prove the assertion.

Think about who might do this, why and how?

Image courtesy of scienceblogs.com

If you put the tinfoil conspiracy theory hat on, is it possible that pirated copies of Microsoft Windows could be involved?  That’ would be almost too perfect.  A completely new twist on the meaning of Trojan Horse!  The news that there was a completely undiscovered flaw in IE6 that was used for the attacks is plausible, but is it probable?  Are we talking undiscovered, or simply unrevealed?

I’m not a forensics expert or CS grad, so am more than curious about how you’d prove, absolutely, that the attacks came from specific machines, not just IP addresses.  We can’t use the Evil bit to solve this conundrum.

It’s interesting to speculate about all this and it certainly will be interesting to follow.  Will we ever know the Truth or just read stories; it’s like an Information Security version of the Allegory of the Cave

Later friends!

by Bill Wildprett, Suspicious Minds blog, Copyright 2010

Read Full Post »

I’ve been following the news about the Google hacks and ‘Operation Aurora‘ as McAfee called it, for a while.  There’s a plethora of online articles about this and why China would do this, which the PRC government denies pro forma.  It’s about nationalistic young Chinese and about PRC government, economic and military strategic interests.

An excellent source of discussion has been The Dark Visitor website, focused on Chinese hackers and also the SecurityMetrics.org mailing list.

From that, I learned the term Advanced Persistent Threat (APT), used by Mandiant and their M-unition blog.  One of the best comments came from Richard Bejtlich’s TaoSecurity blog; Richard explained what APT is and why it is dangerous.

The long and the short of it is that, in this case, the PRC will use any means whatsoever to obtain information to their advantage.  The usual resource constraints of time, money and people simply don’t matter, nor do ethics as we think of them.  Some have stated that these attacks against Google, Adobe, and according to McAfee, 32 other companies in the technology, financial and defense sectors, are only about malware and the quest for money.

In a sense, this argument is correct, but the financial motivation is different.  Yes, it’s about money because money is about power and the ability, long-term, of the PRC government to retain it against the tide of capitalist democracy.  In other words, as long as the PRC leaders can keep growing their economy, their entrepreneurial class makes money,  and the middle-class gets something, they’ll continue to stay in power.  They have a very vested interest in this odd form of trickle-down economics ~ political survival long enough to ensure their continued relevance and Chinese economic dominance sooner than later this century.

So, if it means the theft of intellectual property, commercial secrets, software, whatever from wherever, that is what China will do, and as their leaders see it, must do, if they are to not just catch-up, but succeed.  As the Mandiant M-unition blog puts it:

“No target is too small, or too obscure, or too well-defended. No organization is too large, too well-known, or too vulnerable. It’s not spy-versus-spy espionage. It’s spy-versus-everyone…

…The APT’s goals are twofold:

  • to steal information to achieve economic, political and strategic advantage.
  • to establish and maintain an occupying force in their target’s environment, a force they can call on at any time…”

It used to be French and Russian intelligence organs we worried about, as far as stealing corporate secrets went.  APT is a whole ‘nother ball game, without umpires and a playbook available to one side only.  Expect other nation-state actors to play the same game; it’s similar to the whack-a-mole the West is playing with Iran over nuclear weapons development where they deny everything vehemently while building enrichment centrifuges as quickly as possible.

The 800-lb Dragon has been around for thousands of years and is feeling re-born and contentious.  Witness the lashing-out and dissing of the West at the Copenhagen Climate summit, criticism of U.S arms sales to Taiwan, the Dalai Lama’s upcoming meeting with President Obama and China’s growing assertiveness in other areas.

Some have commented that criticizing China on this is racist; that opinion is disingenuous and is meant to deflect honest inquiry.  APT isn’t about race; it’s about the means, intentions and long-term motivations of an adversary ~ even one who tries not to seem adversarial, is a key trading partner, owns your debt, etc.,

APT, from China and other actors, will not go away.  This is the new reality and we’d all better begin to pay attention and think how to combat it.  That means working to understand the psychology behind it.  APT crosses the domains of information security, economics, psychology, politics, sociology and more.  It is ultimately about the maintenance of power, its true raison d’etre.

Read Full Post »

I sit, dumbfounded with amazement after reading that insurgents in Iraq have been intercepting Predator drone video feeds and that the Pentagon has known about this for a year now.

According to the Wall Street Journal, Department of Defense officials knew about this vulnerability back in 2004 when the possible risk of Russian or Chinese signal compromise came up.  While the DoD officials thought it possible that nation-state actors could do this, they vastly underestimated Iraqi insurgents.

My favorite quote from the article:

Officers at the time weren’t concerned about adversaries intercepting the signals in Iraq or Afghanistan because drones weren’t yet common there and militants weren’t thought to be technically sophisticated.

The underlined emphasis is mine.

Helloooo!  Anyone see an obvious need for encryption?  Now we learn that the Dod is working on encrypting video feeds from Predators, Reapers & Ravens, in Iraq and Afghanistan.  Sure, an added layer of encryption will slow the feed speed down an bit, thus increasing latency, but to think that the enemy isn’t sophisticated enough, so why bother is flat-out naive and borderline stupid.

Once upon a time, none of us knew about IEDs.  That unsophisticated enemy adapted pretty quickly, forcing our troops to adapt in return;  despite cell phone jammers, etc., the enemy still uses IEDs,  all too often to horrible effect.

So why on Earth wouldn’t you want to deny any real-time situational intelligence you have from your adversary?  This is basic Poker 101 ~ don’t let ’em see your cards…

The DoD argument is that encryption is complex and there are all sorts of signals, lots to do, etc.,  They say that now the drone video feeds are encrypted, but other video feeds such as the Remotely Operated Video Enhanced Receiver ( Rover) and the Scan Eagle drone still aren’t encrypted.

Cryptography means ‘Hidden Writing’ in Greek (kryptos, “hidden, secret”; and γράφω, gráphō,).  At the risk of an obvious Bad Pun, given the prior military use of cryptography from ancient Sparta forward, and in particular, during WWII in conjunction with the Brits, it’s Enigmatic why this happened.

A classic Epic Fail.  Shock & Awe indeed…

Read Full Post »

It lurks among us, waiting for who-knows-what to do exactly that.  It lurks, in the Microsoft Windows realm, because it’s the only viable environment to propagate in.

The smug ones pontificate about how safe they are with their Macs or Linux ~ that’s immaterial because the World is Windows, for better or worse and we need to learn about and from Conficker for the future’s sake.

An interesting piece in the N.Y. Times discussed how Conficker continues to morph following the advances or missteps of it’s adversaries.  The article also speculates that the original purpose of Conficker may not be financial, but state-sponsored.  It’s as if a five million zombie botnet, at current counts, sprang into being for no obvious reason.  Waledac spambots are one thing, financial gain from selling AV scareware is another, but is that all there is?

Anyone or group sophisticated enough to create Conficker and keep abreast and ahead of the Conficker Working Group, etc., must have a purpose and intent(s) in mind ~ we just don’t know yet what it/they are.

Calling Dr. Evil…

If somehow, the ‘good guys & gals’ could take over the Conficker botnet, the harnessed computing power could be used for good, like SETI research at least.  😉

Given the Microsoft emergency patch on October 23, 2008 and the media press during late March/early April 2009, this begs the question of why so many Windows machines remained un-patched long enough to continue the infection spread.  Variant C disabled Windows Update and blocked AV software lookups.  Perhaps the use of pirated copies of Windows has aided the worm’s spread; as unlicensed copies, my understanding is they are incapable of running Windows Update.

It may be another proof of concept and a way to test the waters, stimulus-response style.  In this chess match, there are vested interests watching the process and reactions on both sides of the aisle…


Read Full Post »

Ah Summer!

I recall the halcyon days of Summers past, when my teachers assigned reading lists, with the hope of broadening my mind and preventing recursive learning.  They needn’t have worried about me; I’m a compulsive book-a-holic and used to stalk the Bookmobile more frequently than the ice-cream truck…

This summer, besides the daily security reading via online newsletters, magazines, and blogs, I’ve added the following books:

I’ve finished the first and am marching through the second, saving the heavy-lifting tome for last.

I like the approach and arguments put forth by Adam Shostack and Andrew Stewart; we need a New School of thinking about information security, moving away from the FUD promulgated by many vendors and security practioners, and focused instead on objective measurement via empirical means and on multi-disciplinary thinking, particularly from the perspectives of economics, psychology, and sociology.

Following on that line of thought, I’m enjoying Andrew Jaquith’s book.  My academic training was in economic geography, statistics, and resource management, so I’ve been deeply immersed in data modeling and measurement before.  I’ve also done a fair amount of evaluation work, mostly post hoc.

I completely agree that we need better ways to measure information security risks; how to quantify and qualify them and how to present them cogently to our funding sources, i.e., management.

As Bruce Schneier said, “Security is not a product, it’s a process.” So too, is the collection, refinement and presentation of our empirical data to management.  You’ve got to have the ground truth if you want to make better decisions.

The last book is interesting to me, in light of the so-called North Korean ‘cyberwar’, the previous electronic adventures in the Republic of Georgia and Estonia, and the essential reality that the Internet and software is our primary infrastructure now, after concrete.  After I wade through this impressive work, it will take it’s place next to Sun Tzu and Carl von Clausewitz.

As the current Administration in Washington D.C. keeps shedding cybersecurity personnel the way our bodies slough-off skin, my hope is that the President might read this book and really put some impetus into finding and retaining a cybersecurity ‘czar’ who reports directly to the President, with sufficient funding, authority, and autonomy to make a difference!

Keep On Keepin’ On Folks…

Read Full Post »

Following this story, ShadowServer has an excellent write-up on the self-destructing nature of this botnet.  Interesting pieces of information:

  • The botnet size is around 200,000
  • Most of the compromised machines are in South Korea, although computers in four other countries were used
  • The botnet appeared virtually overnight
  • Compromised machines are set to begin overwriting essential files on their hard drives today, July 10, 2009

Cyberwar, according to the Rand Corporation, is about “disrupting or destroying information and communications systems”.

The term cyberwar has been ballyhoo’d by the media although it’s been in use for years along with ‘Netwar’; latest news from South Korean intelligence organs is that a North Korean Lab 110 was responsible.  If so, previous stories about a North Korean ‘Hacking Academy’ have substance, and with all it’s connotations, it is disturbing this  happened so quickly with specific geographic localization in origin and targeting.

From a Disaster Recovery/Business Continuity perspective, the advantages of distributed web hosting by providers such as Akamai is significant in mitigating DDoS attacks.

From a historical perspective, that approach was basically the original raison d’etre of the Internet when first conceived by DARPA and then ARPANET.  Protection from communications loss after nuclear attack by using distributed node computing.

This may be an early phase of a cyberwar campaign; it is at least an experiment of sorts, complete with the lab cleanup phase.   Pay attention to this story as more information becomes available ~ there will be applicable lessons for multiple perspectives.


Read Full Post »

Older Posts »