TagCyberwarfare

CloudFlare Speaks Out About Their Experience Hosting LulzSec

My colleague Kit Dotson writes:

In every statement about allowing LulzSec to use their free service, CloudFlare has been pointed about mentioning that while they had received queries from law enforcement—they had never been asked by any authority to terminate service. Of course, the company had very little information to provide about their free client because all that’s needed to sign up is an e-mail address, a username, and a password.

Prince describes the experience as causing several existential crises for his colleagues, after all, who wants to be described as the person who provided anonymity to a group of hackers? Still, in the end, they decided that it was not their job to act as censors when housing information on hacking subjects itself is not illegal.

SiliconAngle: CloudFlare Speaks Out About Their Experience Hosting LulzSec

Prince also said ““You can’t pay for pen testing like this.” No kidding!

The Rise of the Hactivist

From SiliconAngle:

Hacktivism is the result of mashing up the words hack and activism and was coined in 1998 by Omega, a member of the Cult of the Dead Crow hacker crew. By definition, hacktivism is the use of computers and computer networks as a means of protest to promote political ends or “the nonviolent use of legal and/or illegal digital tools in pursuit of political ends”. Hacktivism can be in the form of web site defacements, redirects, denial-of-service attacks, information theft, web site parodies,virtual sit-ins, typosquatting, and virtual sabotage. Wikipedia also defines hacktivism as “the writing of code to promote political ideology: promoting expressive politics, free speech, human rights, and information ethics through software development.”

Inside the World of Wannabe Cyberspooks for Hire

Many of you have probably heard about the internal e-mails from the security firm HBGary. Ars Technica summarizes much of it in a length article, including HBGary’s aspirations to provide various PSYOPS services – such as cartoons and social media propaganda management – to federal agencies. Ars Technica details one proposal the firm sent to DARPA, which agency declined to fund:

So Barr and Hoglund drafted a plan to create something like a lie detector, except that it would look for signs of “paranoia” instead.

“Like a lie detector detects physical changes in the body based on sensitivities to specific questions, we believe there are physical changes in the body that are represented in observable behavioral changes when committing actions someone knows is wrong,” said the proposal. “Our solution is to develop a paranoia-meter to measure these observables.”

The idea was to take an HBGary rootkit like 12 Monkeys and install it on user machines in such a way that users could not remove it and might not even be aware of its presence. The rootkit would log user keystrokes, of course, but it would also take “as many behavioral measurements as possible” in order to look for suspicious activity that might indicate wrongdoing.

What sort of measurements? The rootkit would monitor “keystrokes, mouse movements, and visual cues through the system camera. We believe that during particularly risky activities we will see more erratic mouse movements and keystrokes as well as physical observations such as surveying surroundings, shifting more frequently, etc.”

But HBGary was also interested in applying its techniques for private clients as well:

But the e-mails also remind us how much of this work is carried out privately and beyond the control of government agencies. We found no evidence that HBGary sold malware to nongovernment entities intent on hacking, though the company did have plans to repurpose its DARPA rootkit idea for corporate surveillance work. (“HBGary plans to transition technology into commercial products,” it told DARPA.)

And another document, listing HBGary’s work over the last few years, included this entry: “HBGary had multiple contracts with a consumer software company to add stealth capability to their host agent.”

The actions of HBGary Federal’s Aaron Barr also serve as a good reminder that, when they’re searching for work, private security companies are more than happy to switch from military to corporate clients—and they bring some of the same tools to bear.

When asked to investigate pro-union websites and WikiLeaks, Barr turned immediately to his social media toolkit and was ready to deploy personas, Facebook scraping, link analysis, and fake websites; he also suggested computer attacks on WikiLeaks infrastructure and pressure be brought upon journalists like Glenn Greenwald.

His compatriots at Palantir and Berico showed, in their many e-mails, few if any qualms about turning their national security techniques upon private dissenting voices. Barr’s ideas showed up in Palantir-branded PowerPoints and Berico-branded “scope of work” documents. “Reconnaissance cells” were proposed, network attacks were acceptable, “target dossiers” on “adversaries” would be compiled, and “complex information campaigns” involving fake personas were on the table.

Ars Technica: Black ops: how HBGary wrote backdoors for the government

One of the more interesting proposals was for a “persona management” software for the Air Force. Raw Story has more details on this project. A mysterious company called Ntrepid eventually won that contract.

This isn’t the Air Force’s first foray into social media propaganda, it launched a blog commenting campaign in 2009.

Are we starting a full-out war on the Internet?

WikiLeaks is the perfect storm for all past issues on the net, but I’m afraid it also will draw us into a future that I’ve believed was coming and didn’t want to talk about. We don’t like to think about how much our civilization depends on the proper running of computer networks, and how vulnerable they are. Whoever it is that attacking Mastercard and Paypal are anonymous. They could be teenagers (that’s what we hope) but they could also be professionals working for foreign governments, or even the US government.

I watch my friends root for the attackers and think this is the way wars always begin. The “fighting the good fight” spirit. Let’s go over there and show them who we are. Let’s make a symbolic statement. By the time the war is underway, we won’t remember any of that. We will wonder how we could have been so naive to think that war was something wonderful or glorious. People don’t necessarily think of wars being fought on the net and over the net, but new technology comes to war all the time, and one side often doesn’t understand.

Are we starting a full-out war on the Internet?

This is as good a time as any to re-iterate my anti-vigilante stance.

However, that cyberwar is breaking out largely between non-state actors (in response to actions by state actors, but still).

NSA and Raytheon Team-Up for Cybersnooping Project

Nuclear Power Plant in  Limerick, Pa.

A piece I wrote for RWW today:

The Wall Street Journal reports, citing unnamed sources, that the NSA is launching a program to help protect critical infrastructure – including private enterprises – from cyber attacks. According to the paper, defense contractor Raytheon has received the contract for the project, which would rely on a series of sensors to detect “unusual activity suggesting an impending cyber attack.” This follows the Lieberman-Collins bill passing committee in the Senate.

The Orwellian nature of the name was alledgedly not lost on Raytheon: The Wall Street Journal claims to have seen an internal Raytheon e-mail saying “Perfect Citizen is Big Brother.”

ReadWriteEnterprise: Do Private Enterprises Need the NSA to Protect Them From Cyber Attacks?

White House Cyber Czar: ‘There Is No Cyberwar’

White House Cyber Czar Howard Schmidt

Howard Schmidt, the new cybersecurity czar for the Obama administration, has a short answer for the drumbeat of rhetoric claiming the United States is caught up in a cyberwar that it is losing.

“There is no cyberwar,” Schmidt told Wired.com in a sit-down interview Wednesday at the RSA Security Conference in San Francisco.

“I think that is a terrible metaphor and I think that is a terrible concept,” Schmidt said. “There are no winners in that environment.”

Instead, Schmidt said the government needs to focus its cybersecurity efforts to fight online crime and espionage.

His stance contradicts Michael McConnell, the former director of national intelligence who made headlines last week when he testified to Congress that the country was already in the midst of a cyberwar — and was losing it.

Threat Level: White House Cyber Czar: ‘There Is No Cyberwar’

See also:

Cyberwar Hype Intended to Destroy the Open Internet

Cyber warfare: don’t inflate it, don’t underestimate it

Comprehensive National Cybersecurity Initiative

Cyberwar Hype Intended to Destroy the Open Internet

Michael McConnell on the right

Above: that’s McConnell on the right.

The biggest threat to the open internet is not Chinese government hackers or greedy anti-net-neutrality ISPs, it’s Michael McConnell, the former director of national intelligence.

McConnell’s not dangerous because he knows anything about SQL injection hacks, but because he knows about social engineering. He’s the nice-seeming guy who’s willing and able to use fear-mongering to manipulate the federal bureaucracy for his own ends, while coming off like a straight shooter to those who are not in the know. […]

He’s talking about changing the internet to make everything anyone does on the net traceable and geo-located so the National Security Agency can pinpoint users and their computers for retaliation if the U.S. government doesn’t like what’s written in an e-mail, what search terms were used, what movies were downloaded. Or the tech could be useful if a computer got hijacked without your knowledge and used as part of a botnet.

Threat Level: Cyberwar Hype Intended to Destroy the Open Internet

The Next Global Superpower is… Korea?

Haeundae Marine city, Busan, Korea

Korea?! Are you scoffing? Readers, when you spied my headline did you think, “Mr. Hyena’s insane! Korea’s not a superpower; it’s a dwarf peninsula shuddering in China and Japan’s shadow! Korea’s a bisected baby-tiger south / starving-hermit north mess! Korea? Superpower?! Absurd!” Hear me out, netizens. I’ve categorized abundant facts explaining why a unified Korea (or even a solitary south) will emerge as world leader. It’s already preeminent in crucial categories. South Korea is not the destitute orphan pickled vegetable of the 1960’s or the laughable Hyundai of the mid-1980’s. SK is wired, willing, savvy, sexy and it works harder than any other hominid nation. Reunited with its surly sibling, it’ll be the Seoul center of the planet.

The reasons (explained in detail at the link):

Direct E-Democracy

Hardworking Economy

Robot Future

Military Might

Massive Mineral Wealth

Education & IQ Edge

Green Goals

Cyber Warriors

Seductive K-Culture

Read More – h+: The Next Global Superpower is… Korea?

(Photo Credit: http://www.flickr.com/photos/hero8989/3952513186/ / CC)

(via Wade)

Cyber warfare: don’t inflate it, don’t underestimate it

inside cyber warfare

Interview with Inside Cyber Warfare author Jeffrey Carr:

MS: For China in particular: what are the things to consider and what are the things to look out for?

JC: China clearly has a lot of problems internally. Their economy is growing, but it’s still relatively fragile and highly dependent on the U.S. The difference in economic conditions varies radically from the countryside to the cities. On the other hand, they own over a trillion dollars of U.S. debt. That gives them incredible leverage. So that’s a balancing act that’s going to be very interesting to watch, especially over this Google issue. But they’ll never concede to eliminating censorship on their Internet. They’ll walk away from Google if that’s what it takes.

People inflate fear about China, but China has no interest in attacking the U.S. They want the same things that any country would want. And they’re going about it the same way that we would go about it. We’re doing espionage. We’re looking after our interests. We’re exerting our will as a nation. It’s silly to try to take the moral high ground here. It doesn’t serve any useful purpose.

MS: One of the interesting points that came out of the Google-China analysis is the idea that Google has its own foreign policy now. Do you think that’s the case?

JC: Honestly, I don’t see it as anything new. The idea of a new, more sophisticated attack against Google that we’ve never seen before, I think that’s overblown. The idea that you have hackers who gain entrance to a network and then exploit data from that network, that’s not new. This is all just espionage. Google is just another company that has something of value.

But Google does represent a turning point because it’s getting so much press. It’s raising the issue to the point where the U.S State Department got involved. That’s all good.

Read More – O’Reilly Radar: Cyber warfare: don’t inflate it, don’t underestimate it

(via Chris Arkenberg)

See also:

US oil industry hit by cyberattacks: Was China involved?

Bruce Sterling on cyberwar and cyberpeace treaties.

‘Cyber Genome Project’ kicked off by DARPA

dna

Applecart-bothering Pentagon boffinry bureau DARPA is at it again. This time, the military scientists want to establish a “Cyber Genome” project which will allow any digital artifact – a document, a piece of malware – to be probed to its very origins. […]

Or in other words, any code you write, perhaps even any document you create, might one day be traceable back to you – just as your DNA could be if found at a crime scene, and just as it used to be possible to identify radio operators even on encrypted channels by the distinctive “fist” with which they operated their Morse keys. Or something like that, anyway.

The Register: ‘Cyber Genome Project’ kicked off by DARPA

(via William Gibson)

Hard to see this working out well.

© 2014 Technoccult

Theme by Anders NorenUp ↑