Increased Use of Botnets by Activists

Infoworld published an article discussing the increased use of botnets for politically motivated Denial-of-Service (DoS) attacks. These attacks appear to target political campaigns in Russia andUkraine.

This article is related to an article in The Register last week but provides a little more information concerning the types of attacks:

"Now new evidence has been discovered that indicates the same sort of political activism believed to have driven the 2007 Estonian Web site attacks not only exists but is becoming more popular.

"We spent some time after the Estonia attacks looking into this part of the world, and we've found evidence of other politically motivated botnet DOS attacks," said Jose Nazario, senior software engineer at Arbor. "It's hard to tell who is responsible for these campaigns, but they definitely appear to be tied to some recent Russian and Ukrainian elections."

Botnets: The new political activism

Recommended Reading: The Dark Web of Cyber Terror

Sammy Elrom has complete his multi-part analysis of the "Jihadist's Dark Web". Part one was reviewed earlier (see Analysis of Jihadist's "Dark Web"). The three part series explores the threat of terrorist organizations use (and misuse) of technology and includes case studies and an analysis of both sides of the "cyber terror" debate.

Mr. Elrom's argument can be summed up as:

"What is the likelihood of such a catastrophic event [terrorist cyber attack] to ever unfold? Very high in my opinion, because we’ve seen the extreme changes in the way terrorists use the internet (detailed in Part One on this subject). It makes perfectly sense that the almost total reliance on the internet by business, government, military, academia and society in general, only emphasized what a huge target it became for terrorists to hit. Imagine a simultaneous attack targeting a critical infrastructure site like a nuclear power plant and its supporting and connecting network; beside the physical damage and the psychological effect, the collapse of the communication network may send a shock wave of secondary crashes impacting connected, related and remote networks and locations, which like a delayed earthquake shock create an unstoppable ripple effect. And it is not rocket science to comprehend that from the terrorists’ point of view scores of casualties may be the ultimate goal PR wise, but financial havoc and business chaos can be more destructive, because it impacts the immediate lives of everybody."

Each part was published separately on the globalpolitician.com website:

Part I: The Dark Web Of Cyber Terror – An Inescapable Reality
Part II: The Dark Web Of Cyber Terror - The Threat That Got Lost in Traffic
Part III: Dark Web Terror

Russian Political 'Hackers' Growing Capabilities

The Register has an article with some details of the Estonia attack last year showing that the attack, while not as organized or sophisticated as it could have been was, nonetheless, effective. The article also discusses the growing threat and capabilities of politically motivated computer criminals in Russia:

"By Western standards, the attacks weren't all that sophisticated. They topped out at about 100MB per second, compared with as much as 40GB per second unleashed against some targets. They also employed protocols such as ICMP and TCP SYN, which have been used for so long that they are no longer effective against many hardened targets.

But more recent events may show that politically motivated attackers are growing more savvy. Over the past several months, Nazario has documented attacks on sites belonging to groups on both sides of the Russian establishment. Targets include the Party of Regions, a pro-Russian party led by Ukrainian Prime Minister Viktor Yanukovych; the site of Gary Kasparov, the Russian chess grandmaster turned critic of Russian President Vladimir Putin; and namarsh.ru, another dissident site. All attacks have been carried out using botnets, Nazario says."

The article also discusses 'BlackEnergy' a new, more stealthy tool, to carry out distributed denial of service attacks.

'Ragtag' Russian army shows the new face of DDoS attacks

A Fine Line between Cybercrime and War? Not Really.

StrategyPage.com ran an article on the blurring line between criminal attacks and acts of war in cyberspace.

"In the computer age -- and 2008 is definitely in the computer age -- the difference between an act of war and crime is often a matter of interpretation as well as degree.

Attack a nation's highways and railroads, and you've attacked transportation infrastructure. You've also committed an obvious, recognized act of war.

An electronic attack doesn't leave craters or bleeding human casualties, at least not in the same overt sense of an assault with artillery and bombs. However, the economic costs can be much larger than a classic barrage or bombing campaign."

This article, like others, points out the problems and appears to want to label many attacks as acts of war or terrorism. The problem is real but answers are not simple. Cyber attacks are no different from physical attacks - what separates crime from terrorism or acts of war is not the medium or even the impact but the motivation, resources and organization behind the attack.

If a seventeen year old in China vandalizes a website because he disagrees with its content, it is a criminal act. If a nation state (whether directly or indirectly) orchestrates an online denial of service attack against another nation state, it's probably an act of war. The problem is the victim rarely knows who or why they have been attacked.

The difference in cyberspace is that it is very difficult to understand the adversary's motive. Corporations and other organizations rarely investigate the actual source of or reason behind the attack. Law enforcement and intelligence agencies are usually ill-equipped and underfunded or staffed.

These types of investigations are not impossible, but they are both costly and time consuming. Yet, as society's dependence on information infrastructures grows, so does the impact of attacks. Understanding the nature of the threat is vital to proper response. Simply labeling every attack as 'cyberwar' or 'cyber terrorism' is counter productive. Society - corporations, governments, academia and security vendors - need to invest in new and better methods and technologies to investigate cyber attacks.

Unfortunately, it will probably take a serious attack before this happens.


War -- or Crime -- in Cyberspace

Chinese 'Hackers' Accused in Dissedent Website Attack

A website for the group Boxun was attacked with a Distributed Denial of Service attack which began on December 24th. The attack was so severe that the hosting ISP has refused to continue hosting the site.

Site administrators accuse Chinese 'hackers' of the attacks in retaliation for articles written by Chinese dissidents.

The article also reports on unnamed sources predicting that China will organize more online attacks to reduce critics in advance of the 2008 Olympics.

"Other observers have said recently that China is likely to embark on a coordinated effort to shut up and shut down critics of the Communist regime there in advance of the Olympics in 2008."

Hackers smash Chinese dissident Web site

Recommended Reading: Cisco Threat Report Includes Increasing Threat from Military and Espionage

It has become a tradition for security companies to issue some type of "annual security report". Most focus on the continued increase in vulnerabilities or incidents and ignore the underlying risk factors that enable threats or increase their impact.

In a welcomed departure from this monotony, Cisco Systems, Inc. has created a new security report that includes not only the standard technical issues but explores seven different areas of risk to enterprises:

1. Vulnerability
2. Physical
3. Legal
4. Trust
5. Identity
6. Human
7. Geopolitical

The section of geopolitical issues includes discussions on terrorism, environmental issues and a discussion on military and espionage threats in cyberspace:

Emergence of Cyberspace as a Major Theatre for War and Espionage

As industries, governments, and individuals have become more connected over the past decade, cyberspace has become an increasingly significant domain for military and espionage activities. Examples in 2007 include:

• The creation of a “Cyber Command” by the U.S. Air Force, demonstrating the U.S. military’s recognition of cyberspace as a major area of military focus, both in terms of defense and as a potential launching point for offensive action
• Growing evidence of international espionage as the motive behind network attacks in the United States, Australia, New Zealand, the United Kingdom, Germany, and elsewhere
• Arrests and convictions of a large number of individuals who were caught stealing sensitive intellectual property and selling it to foreign governments
• Accusations by political opponents of Russian president Vladimir Putin that the Kremlin had orchestrated network security attacks against them
• Network security attacks in Estonia, which brought down many government and financial computers
  

The report gives high level recommendations and potential issues to address in 2008.

Cisco 2007 Annual Security Report

Report Discusses Limitations of Terrorists' Use of the Internet

Stratfor.com issued an analysis report on the limitations of the Internet to terrorist organizations.

"Although the Internet has been a boon for grassroots cells in spreading their ideology and recruiting new acolytes, the Web has some serious limitations as a terrorism enabler. Some things are very difficult to accomplish online -- namely, absorbing technical information and the tradecraft of terrorism and applying it to a real-world situation, particularly in a dangerous environment."

Additionally, use of the Internet for any aspect of conspiracy, planning or communication enables law enforcement and intelligence agencies to monitor activity:

"As these sites proliferate, so does the attention devoted to them. It is important to note that visiting such Web sites is an operational security hazard that can allow counterterrorism forces to identify potential militants and close in on them..."

U.S.: The Role and Limitations of the 'Dark Web' In Jihadist Training

German Federal Prosecutor Defends Online Survillance of Islamists

Deutsche Welle is reporting on a center in Germany created to monitor the online activity of Islamist groups in Germany:

"[The] Joint Internet Center (GIZ), consisting of about 30 German police and intelligence officers, had been working full time since January, monitoring Islamist activity on the Internet and analyzing Islamist Web sites. "

"The Internet has developed into the decisive means of communication within international Islamist terrorism," [Federal Prosecutor General Monika Harms] said during a press conference in Karlsruhe to review the year."

Top German Prosecutor Backs Online Terror Surveillance

Call for Companies to Block IP Addresses from Russia and China

David Utter at SecurityProNews has called for U.S. Companies to block the IP netblocks from Russia and China in response to alleged criminal and political computer intrusions.

"Unless there is an absolute business need for employees to visit sites in these countries, we are hard-pressed to see a reason to let people actively or unknowingly hit potentially malicious sites in countries that have demonstrated over and over they cannot or will not crack down on Internet criminal actions.

Or in China, where state sponsored hackers labor at the pleasure of the central government, grabbing data from corporate and government computers. Is the government going to crack down on itself?"

It's Time To Block Russia And China

More News on China Cyber Attacks and Capabilities

Several other articles have recently been published concerning Chinese capabilities:

The Heritage Foundation published a WebMemo on "Trojan Dragons: China's International Cyber Warriors" and Time Magazine has an article on "Enemies at the Firewall".

The Time article takes an interesting look at 'hacker' groups in China and western responses.

U.S. Congress Requires Report on China's Cyber Capabilities

A provision in the 2008 National Defense Authorization Act passed by the House of Representatives on December 13th, requires an annual report on Chinese military power to include a section on China's cyber capabilities including "efforts to aquire, develop and deploy cyberwarfare capabilities".


Washington Times - Inside the Ring: Cyberwarfare

"Cyber Terror" Label Too Easily Applied to Lesser Crimes

Zeid Nasser has posted an excellent commentary concerning the overuse of the word "cyber terror".

"In the first couple of years following the events of September 11, 2001, a hysteria regarding Internet-fueled terrorism reached fever pitch.

In the midst of this atmosphere, many Islamic movements and organizations on the web were banned, blocked, censored or monitored. With time, the term “cyber terror” emerged to describe any form of Internet aided attack for political causes, yet many still disagree to this day on the use of the word ‘terror’, opposed to more accurate words like ‘vandalism’ or simply just ‘hacking’."

Sensationalizing words will often grab headlines but diminishes their impact and create ambiguity - a problem that is rampant in the IT security profession. The articles presented here often overuse this and other words such as "cyber war", "infowar" and will often be offset in quotations to identify their inappropriate application. "Cyber war" and similar words should only be used for offensive use of technology to further a political or idealogical agenda, not for simple misuse such as hacking (trespass), web defacements (vandalism) or data theft (see Hacktivism & Politically Motivated Computer Crime for a discussion on political 'use', 'misuse' and 'offensive use' of technology for political purposes).

Nomina si nescis, perit et cognitio rerum

(Who knows not the names, knows not the subject)

- Linnaeus

Zeid Nasser's Tech Blog: Cyber-terror makes a comeback in the news

Update: China Linked to U.S. Lab Attacks

The New York Times is quoting a U.S. Department of Homeland Security document alleging the attacks on U.S. research labs originated from China. The article does state that China may have only been an intermediary in the attacks:

"Security researchers said the memorandum, which was obtained by The New York Times from an executive at a private company, included a list of Web and Internet addresses that were linked to locations in China. However, they noted that such links did not prove that the Chinese government or Chinese citizens were involved in the attacks. In the past, intruders have compromised computers in China and then used them to disguise their true location."

China Link Suspected in Lab Hacking

First Indications that November 11th "Cyber Jihad" Was Real

Investor's Business Daily is running a story that indicates the November 11th "Cyber Jihad" attacks resulted in real attacks although they were ineffective.

The attacks were purported to have targeted 15 non-profit organizations critical of Islamist's activity and non-disclosed U.S. government systems. The attacks are reported to have failed due to limitations in the software used in the attacks.

Electronic Jihad Is Another Battlefront Vs. Terrorists

India Issues Arrest Warrents for Dutch Web Activists

An Indian court in Bangalore has issued arrest warrants and will request extradition of eight Dutch nationals who are members of several labor activist groups including Clean Clothes Campaign (CCC), the India Committee of the Netherlands (ICN) and the director a Dutch ISP "antenna.org". The charges relate to an ongoing activist campaign against Dutch jeans company"G-Star" and their India based manufacturing supplier Fibres and Fabrics International (FFI) and its subsidiary Jeans Knits Pvt. Ltd.

The activist groups are protesting working conditions at the Indian factory (for example, see "Make it clear that labour rights organisations will not be silenced - Support freedom of speech and freedom of association"). This and other web postings resulted in a defamation case brought against the activists by FFI in India.

Most recently, the Dutch jeans maker "G-Star" has announced it will terminate its contract with the Indian manufacturer (see "G-star ends jeans contract with Indian firm").

This case is a classic example of three important issues with technology and political issues:

1. Where does free speech end and crime begin? What are the limits involving web postings, online communications and attempts by various interest groups in using technology to organize?
2. The lack of any consistent international definitions of computer crime or tort and delict civil laws. What is a crime in one country may be a privileged right in another; and
3. The power of (negative) press is often the most important aspect. In fact, one of the most attractive attribute of the Internet for activist groups is its power as a PR mechanism.
   

Indian court orders 'arrest without bail' of Dutch activists

US Research Labs Compromised - Again

In yet more bad security news for US research laboratories, the Director of Oak Ridge National Laboratory (ORNL) in Tennessee announced a series of computer intrusions:

"ORNL director, Thom Mason, described the attacks in an e-mail to staff earlier this week as being a "coordinated attempt to gain access to computer networks at numerous laboratories and other institutions across the country."

One of the other labs is believed to be Los Alamos National Laboratory (LANL) in New Mexico.

No motive or sources has been provided but considerations should be give to the types of targets and the "coordinated" nature of the intrusions. It remains to be seen if there was any political motivation to the computer attacks.

"The possibility that the latest attacks were the work of fraudsters will be seen by some as optimistic -- less positive would be the possibility of a rival government having been involved. Given the apparently coordinated nature of events, speculation will inevitably point to this scenario, with the data theft a cover motivation for more serious incursions."

Hackers launch major attack on U.S. military labs

Saudi Security Conference Calls for Better International Cooperation Combating Extremists Online

Saudi Arabia recently hosted a conference on Information Technology and National Security where attendees called for increased international regulations to combat the spread of extremist ideologies.

The conference generated yet another estimate of Al-Qaeda supporting websites - 17,000 and growing by 9,000 a year:

"At yesterday’s final sessions, Khaled Al-Firm, an IT specialist, called for the establishment of an international media forum to combat radicalism and terror. Al-Firm quoted Prince Abdul Aziz as saying that there were 17,000 websites on the Internet which fuel Al-Qaeda ideology, with an annual increase of 9,000 websites per year that seek to find new recruits by brainwashing people."

A very important aspect of political computer crime is the need for media coverage as discussed at the conference:

"[Khaled Al-Firm] said that media battles waged by Al-Qaeda were as deadly as the military operations themselves. He pointed out that while the December 2004 attack on the US Consulate in Jeddah was a failure, it received huge publicity providing PR boon to the militants that planned the attack.

“Terrorists do not just focus on military success. There is a third angle to the operation which is the glory of publicity, which compensates for the failure of the operation,” he said."

Experts Recommend Special Laws to Combat Terror

More Discussion of Alleged Chinese Activity Online

Bob Brewin published a commentary in GovernmentExecutive.com on the allegations of Chinese cyber attacks and the U.S. response or lack there of.

What's Brewin: Of Cyber War, Chiles and ERP

Saudi Intelligence Estimate 17,000 websites 'Adhere to the Takfir Ideology'

In a recent commentary, Tariq Alhomayed, the Editor-in-Chief of Asharq Al-Awsat, an Arabic daily newspaper, discussed the importance of the Internet to the spread of terrorist ideals and discusses Saudi intelligence estimates of Internet activity:

"One should never disregard the internet and the level of intellectual misguidance and the spread of terrorism that is taking place through it. It is enough to refer to the recent announcement made by Saudi intelligence authorities in which it stated that there are nearly 17,000 websites that adhere to the Takfir ideology. Fundamentalist websites in Europe have rushed to translate the Al Qaeda leader’s recent speech into English, French, German and other languages."

The complete commentary is located at:

Is London Tora Bora?

U.K. Links Computer Intrusions to China - Targets Include Rolls Royce and Royal Dutch Shell

MI5 has linked recent computer intrusions against major UK industries to economic espionage by several countries including China and Russia. The intrusions extended into Scandanavian and U.S. systems as well. Various news sources quoted a memo from Jonathan Evans, Director-General of MI5, warning companies:

“The contents of the letter highlight the following: the Director-General’s concerns about the possible damage to UK business resulting from electronic attack sponsored by Chinese state organisations, and the fact that the attacks are designed to defeat best-practice IT security systems.”

"A number of countries continue to devote considerable time and energy trying to steal our sensitive technology on civilian and military projects, and trying to obtain political and economic intelligence at our expense."

"They do not only use traditional methods to collect intelligence but increasingly deploy sophisticated technical attacks, using the Internet to penetrate computer networks," [Mr. Evans] said."

Secrets of Shell and Rolls-Royce come under attack from China’s spies

Shell, Rolls Royce reportedly hacked by Chinese spies