German magazine reveals more information on elite NSA spy unit

NSA headquartersBy JOSEPH FITSANAKIS | intelNews.org
Last June, we reported on the existence of an elite cyberatack unit within the United States National Security Agency (NSA), which operates under the Agency’s Office of Tailored Access Operations. Veteran NSA watcher Matthew M. Aid, who made the initial revelation, said at the time that the Office, known at NSA simply as TAO, maintains a substantial “hacker army” that works in close cooperation with the Central Intelligence Agency (CIA) and the Federal Bureau of Investigation (FBI). Now German newsmagazine Der Spiegel says it viewed internal documents that confirm the existence of TAO as the NSA’s elite operational unit. The publication describes TAO as “something like a squad of plumbers that can be called in when normal access to a target is blocked”. It adds that TAO operatives are routinely detailed to a host of American intelligence agencies to help conduct intelligence operations ranging from traditional espionage to counterterrorism and cyberwarfare. Furthermore, TAO’s personnel, which are allegedly far younger than the average NSA officer, are experts in exploiting the technical deficiencies of the information-technology industry. They have therefore been able to compromise communications hardware and software produced by some of the world’s biggest IT companies and service providers, including Huawei, Cisco and Microsoft. The Spiegel article claims that TAO was established in 1997, several years before the Internet became a prominent engine of economic and cultural activity around the world. Its personnel, which initially consisted of a few select technical experts, was housed at the NSA headquarters in Fort George Meade, Maryland, but “in a separate wing, set apart from the rest of the agency”. Notably, Der Spiegel cites a paper produced by a former TAO unit head, which states that the program has produced “some of the most significant intelligence our country has ever seen” and urges for its continued growth. Read more of this post

About these ads

China ‘hacked European government computers’ prior to G20 summit

G20 Summit participantsBy IAN ALLEN | intelNews.org
A group of hackers from China managed to compromise computer networks belonging to the foreign ministries of several European governments prior to last September’s G20 Summit, according to a private computer security firm. The Summit, which took place in St. Petersburg, Russia, on September 5 and 6 of this year, brought together the heads of state of 20 major economies, including the United States and many European Union countries. The meeting agenda was dominated by discussions concerning the response of the international community to the chemical attacks in Ghouta, Syria. According to the Reuters news agency, the hackers managed to infiltrate carefully targeted computer networks by sending emails containing infected attachments to employees of foreign ministries. The attached files bore titles such as “US_military_options_in_Syria”, which appeared designed to bear reference to the upcoming G20 Summit. The hacking revelations were made by FireEye, Inc., a California-based security firm, which says it has proof the hackers came from China. The firm says its confidence on the matters stems from “a variety of technical evidence”, such as the language used on the control server used by the hackers, as well as the types of machines that were used to test the virus before it was deployed. FireEye said its experts were able to keep tabs on the “inner workings” of the primary computer server that the hackers used to monitor the compromised computer networks. However, shortly before the Summit begun, the hackers migrated to another server, at which point the FireEye team lost contact with them. Read more of this post

News you may have missed #857 (hacking edition)

Mossad sealBy IAN ALLEN | intelNews.org
►►UK spies hacked Belgian phone company using fake LinkedIn page. British spies hacked into the routers and networks of a Belgian telecommunications company Belgacom by tricking its telecom engineers into clicking on malicious LinkedIn and Slashdot pages, according to documents released by NSA whistleblower Edward Snowden. The primary aim, reports the German newsmagazine Der Spiegel, which obtained the documents, was to compromise the GRX router system that BICS controlled, in order to intercept mobile phone traffic that got transmitted by the router.
►►Indonesian hackers behind attack on Australian spy service website. Indonesian hackers are believed to have brought down the website of the Australian Secret Intelligence Service, Australia’s leading spy agency. The page was not working on Monday afternoon after hackers launched a “denial of service” attack. A “404 not found” message typically appears when a website crashes under a “denial of service” attack. The cyber attack is reportedly a response to revelations that Australia had been spying on its closest neighbor through its Jakarta embassy.
►►Hamas blasts alleged Mossad website. Hamas officials released a warning about a website called Holol (“solutions”), claiming it is a ruse set up by Israel’s Mossad intelligence agency to recruit Gazans as informants. The website’s “Employment” page states, “due to our connections with the Israeli Civil Administration, we can help you bypass the bureaucratic tape and procedural processes which prevent you from leaving Gaza”. The site also offers Israeli medical assistance, “due to connections with the Ministry of Health and the Israeli Civil Administration”. Palestinians interested in contacting the website’s officials are asked to provide their full name, telephone number, email, topic of inquiry, and an explanation of why they are asking for help. Last month, Lebanese group Hezbollah accused the Mossad of being behind a website seeking information on Hezbollah’s intelligence wing.

Secretive US cyber unit has been spying on China for 15 years

NSA headquartersBy JOSEPH FITSANAKIS | intelNews.org |
A secretive cyberattack unit within the United States National Security Agency (NSA) has been engaged in protracted offensive cyberespionage operations against China for nearly 15 years. The revelation, made this week by veteran NSA watcher Matthew M. Aid, appears to confirm recent allegations made by Chinese government officials that Beijing’s secrets come under regular attack by US government-sponsored hackers. It also agrees with claims made by several intelligence observers, including this blog, that America’s cyber-security posture is not purely defensive. According to Aid’s article, published this past Monday in Foreign Policy, China’s allegations that it has been the target of sustained cyberespionage attacks by the US “are essentially correct”. Citing “a number of highly confidential sources”, Aid alleges that the NSA maintains a substantial “hacker army”. These ‘cyberwarriors’ allegedly operate under the NSA’s Office of Tailored Access Operations, known inside NSA simply as TAO. Its personnel is said to have successfully penetrated the Chinese government’s telecommunications networks and servers since the late 1990s, generating “some of the best and most reliable intelligence information” gained by Washington. It does so through computer network exploitation (CNE) techniques, such as surreptitious hacking, password exploitation, and even by compromising Chinese network security technicians. Aid alleges that TAO works closely with the Central Intelligence Agency (CIA) and the Federal Bureau of Investigation (FBI), through a small “clandestine intelligence gathering unit”. The latter employs CIA and FBI operatives who perform what are known as “off-net operations”, a term that refers to physical break-ins of Chinese and other foreign diplomatic facilities, in order to compromise the security computer hardware. Read more of this post

News you may have missed #842 (world reaction to Snowden leak)

Edward SnowdenBy IAN ALLEN | intelNews.org |
►►Chinese media focus on Snowden leaks. The front pages of Chinese state media were covered Thursday with the allegations of ex-CIA employee Edward Snowden, who says the US government has been hacking computers in China for years. Speaking to media in Hong Kong, where he is currently staying, Snowden said the US has been hacking computers in Hong Kong and mainland China since 2009. He said targets include public officials, businesses and the Chinese University of Hong Kong. Those claims by Snowden were the top story on most of China’s major news portals on Thursday
►►Switzerland furious about Snowden’s charge that CIA spies on Swiss banks. One of the many lurid details in The Guardian’s remarkable interview with NSA whistleblower Edward Snowden was his account of what initially prompted him to leak: namely a CIA tour in Switzerland, where CIA officers recruited Swiss banking officials. The Snowden disclosure could not come at a worse time for the Swiss government, which is trying to convince parliament to back its emergency plan that would allow Swiss banks to turn over data on tax evaders to the US government.
►►Is Russia considering giving asylum to Snowden? Asked if the 29-year-old could claim asylum from Russia, a spokesman for President Vladimir Putin told the newspaper Kommersant: “If such a request is received, it will be considered”. Any attempt by the Kremlin to give refuge to Mr Snowden, amid calls for his prosecution under the US Espionage Act, is likely to infuriate the White House and provoke a major diplomatic standoff.

News you may have missed #838 (analysis edition)

Predator droneBy IAN ALLEN | intelNews.org |
►►Delisle spy case barely caused ripples between Canada and Russia. The arrest of Jeffrey Delisle, a Canadian naval officer spying for Russia, did little to discourage Canada from welcoming that country’s defense chief to a Newfoundland meeting of Arctic nations last year. The visit underscored the puzzling lengths to which the Canadian government went to carry on a business-as-usual relationship with the one-time Cold War adversary. Most other planned military contacts between the two nations last year —including participation in the anti-terrorism exercise Operation Vigilant Eagle— also remained curiously normal.
►►Don’t believe the hype on Chinese cyberespionage. Within a day of each other, The Washington Post published a shocking list of US defense programs whose designs have reportedly been stolen by Chinese cyberattacks, and ABC news said the plans for Australia’s spy headquarters were also stolen by Chinese hackers. It makes China sound like a secret-sucking cyber espionage machine, but is that really the case? The knee-jerk interpretation to this disclosure (and others) is that China is a powerhouse of cyber espionage capable of stealing whatever secrets they want and that the US is powerless to stop them. This seems very unlikely.
►►US Predator drone program quietly shifted from CIA to DoD. The White House has quietly shifted lead responsibility for its controversial armed drone program from the CIA to the Defense Department. In a landmark speech last week at National Defense University in Washington, US President Barack Obama offered some clues into the status of the program, opaquely signaling it will now primarily be conducted by the United States military.

Sophisticated cyberespionage operation focused on high-profile targets

Rocra malware programming codeBy JOSEPH FITSANAKIS | intelNews.org |
After Stuxnet and Flame, two computer programs believed to have made cyberespionage history, another super-sophisticated malware has been uncovered, this time targeting classified computer systems of diplomatic missions, energy and nuclear groups. The existence of the malware was publicly announced by Russian-based multi-national computer security firm Kaspersky Lab, which said its researchers had identified it as part of a cyberespionage operation called Rocra, short for Red October in Russian. The company’s report, published on Monday on Securelist, a computer security portal run by Kaspersky Lab, said that the malware has been active for at least six years. During that time, it spread slowly but steadily through infected emails sent to carefully targeted and vetted computer users. The purpose of the virus, which Kaspersky Lab said rivals Flame in complexity, is to extract “geopolitical data which can be used by nation states”. Most of the nearly 300 computers that have so far been found to have been infected belong to government installations, diplomatic missions, research organizations, trade groups, as well as nuclear, energy and aerospace agencies and companies. Interestingly, the majority of these targets appear to be located in Eastern Europe and former Soviet republics in Central Asia. On infected computers located in North America and Western Europe, the Rocra virus specifically targeted Acid Cryptofiler, an encryption program originally developed by the French military, which enjoys widespread use by European Union institutions, as well by executive organs belonging to the North Atlantic Treaty Organization. Read more of this post

Did US spies hack French government computers using Facebook?

The Palais de l'ÉlyséeBy JOSEPH FITSANAKIS | intelNews.org |
A sophisticated computer virus discovered at the center of the French government’s secure computer network was planted there by the United States, according to unnamed sources inside France’s intelligence community. Paris-based magazine L’Express, France’s version of Time magazine, says in its current issue that the alleged American cyberattack took place shortly before last April’s Presidential elections in France. It resulted in the infection of the entire computer system in the Palais de l’Élysée, which is the official residence of the President of France. The French magazine cites unnamed sources inside the French Network and Information Security Agency (ANSSI), which is responsible for cybersecurity throughout France. The sources claim that the snooping virus allowed its handlers to gain access to the computers of most senior French Presidential aides and advisers during the final weeks of the administration of French President Nicolas Sarkozy, including his Chief of Staff, Xavier Musca. The article claims that the virus used a source code nearly identical to that of Flame, a super-sophisticated version of Stuxnet, the virus unleashed a few years ago against the computer infrastructure of the Iranian nuclear energy program. Many cybersecurity analysts believe that the US and Israel were instrumental in designing both Stuxnet and Flame. IntelNews understands that the alleged virus was initially directed at employees of the Palais de l’Élysée through Facebook. The targets were allegedly befriended by fake Facebook profile accounts handled by the team that operated the virus. The targets were then sent phishing emails that contained links to phony copies of the login page for the Palais de l’Élysée intranet website. Read more of this post

News you may have missed #771

Shawn HenryBy IAN ALLEN | intelNews.org |
►►Analysis: Ex FBI official says foreign spies biggest online threat. Former FBI executive assistant director Shawn Henry has warned that the biggest threat online comes not from terrorists or hackers, but from foreign intelligence organizations looking to steal intellectual property. “The threat from computer attack is the most significant threat we face as a society, other than a weapon of mass destruction”, he said in his opening keynote at the Black Hat 2012 conference in Las Vegas. “Everything we do —R&D, intellectual property, and corporate strategies— is stored or transmitted electronically. The DNA of companies is available to bad guys”.
►►Taiwanese officials jailed for espionage. Two Taiwanese former officials have been sent to prison by the Taiwan High Court for leaking state secrets to China. Presidential Office official Wang Ren-bing was jailed for two years after being found guilty of passing confidential information about President Ma Ying-jeou’s May 2008 inauguration to Chinese intelligence operatives. Chen Pin-jen, a former aide of Chinese Nationalist Party (KMT) Legislator Liao Kuo-tung, was sentenced to eight months in prison for delivering the confidential information Wang gave him to China. The two were arrested in 2009.
►►Germany charges suspected Syrian spy. A spokeswoman for federal prosecutors in Germany said Sunday that they have filed charges against suspected Syrian spy Akram O., one of two men arrested on suspicion of having spied on Syrian opposition activists in Germany for several years. The two were arrested in February during a sting operation involving over 70 German counterintelligence operatives, who searched the suspects’ apartments. The spokeswoman said she could not give further details before an official confirmation is issued that the suspect and the defense team have received the indictment.

News you may have missed #770

Horn of Africa mapBy TIMOTHY W. COLEMAN | intelNews.org |
►►Kaspersky Lab is ‘thwarting US cyber spies’. According to an article in Wired magazine, Eugene Kaspersky, the CEO of Russia-based Kaspersky Labs has been working to support Russian allies in the Kremlin and the FSB. Kasperksy’s firm first discovered the cyber attack weapon known as Stuxnet. As the profile piece notes, “Kaspersky’s rise is particularly notable —and to some, downright troubling— given his KGB-sponsored training, his tenure as a Soviet intelligence officer, his alliance with Vladimir Putin’s regime, and his deep and ongoing relationship with Russia’s Federal Security Service, or FSB”.
►►Al-Shabaab executes alleged CIA and MI6 assets. Somalia’s largest and most deadly armed Islamist group, al-Shabaab, announced that it had captured and executed at least three informants who were allegedly passing intelligence to the CIA and to MI6. The Associated Press stated that Al-Shabaab’s official Twitter feed stated that the individuals, who were summarily interrogated and then executed by firing squad, “were part of a wide network of spies deployed by the British and American intelligence agencies”.
►►Australian intelligence briefed on Canadian spy. The espionage case against accused Canadian spy, former Sub-Lieutenant Jeffrey Paul Delisle, continues to garner intrigue. As was previously reported on this blog, Delisle, a former navy intelligence officer is accused of spying for Russia. But a report in The National Post states that representatives of Canada’s intelligence service briefed members of Australia’s intelligence services on the Delisle’s case and that information exchanges appear ongoing. The particulars of Australia’s involvement in the case are explained here.

Situation Report: Hacker convention brings out top NSA spy

DefConBy TIMOTHY W. COLEMAN | intelNews.org |
In less than a week, the 20th annual DefCon Hackers convention will take place in Las Vegas, Nevada. The yearly gathering brings out the good, the bad and the script kiddies alike. Computer security practitioners, cyber-criminals, grey and white hat hackers, law enforcement, and members of both the US intelligence community as well as probably foreign government representatives will be on hand to listen to presentations, see novel techniques, and view new innovative methods for cyber intrusion. DefCon has become a Mecca of sorts for those interested in groundbreaking developments and nefarious possibilities within the computer security and cyber realm. As organizers of the event explain in their call for presentations, “DefCon is all about thinking up cool and new ways to approach everything from the most complex modern technology to hacking grandma’s toaster [...] what attack exploits, defensive techniques, or unique research [have] you have been working on”. The focus is often two-fold “how to break it”, followed by a segment on “how to fix it”. “Spot the Fed” is an ongoing and widely popular contest at the convention. The task of regular attendees is to properly identify plain-clothed members of law enforcement or the intelligence community. As DefCon explains, “if you see some shady MIB (Men in Black) earphone penny loafer sunglass wearing Clint Eastwood to live and die in LA type lurking about, point him out”.

Read more of this post

News you may have missed #763

RedHack posterBy IAN ALLEN | intelNews.org |
►►Taiwan ex-colonel nabbed for spying for China. Cheng Lin-feng, a retired Lieutenant Colonel in the Taiwanese army, and civilian Tsai Teng-han, were taken in by Taiwanese police last week on suspicion of spying for China. Cheng was allegedly recruited by Chinese intelligence when he travelled to the mainland to do business, Taiwan’s Ministry of National Defense said in a statement, adding that he had been investigated ever since a tip-off in 2009. A court spokesman said that details of case will be held until the investigation is completed.
Russian law brands foreign-funded NGOs ‘foreign agents’. Russia’s Lower House of Parliament has approved a bill that brands non-governmental organizations receiving funding from abroad as “foreign agents”, a law that activists fear the Kremlin will use to target critics. The bill is almost certain to be approved by the Upper House before being signed into law by President Vladimir Putin, who last year accused the US State Department of funding protests against him. The bill is seen by many analysts as setting up a legal infrastructure for a crackdown on the opposition. Meanwhile, official statistics show that wiretapping in the Russian Federation has nearly doubled over the past five years. The main driver of the rise, analysts say, involves the myriad of Russia’s rival security services spying on each other.
►►Turkish hackers release names of police informants. Members of Turkey’s Marxist cyberactivist group RedHack have dumped online a 75-megabyte text file with thousands of emails from Turkish police informants. The group said it released the information in retaliation against ultra-nationalist hackers who have been threatening opposition academics and journalists. RedHack, which has been using ‘defacement hacking’ to promote a Marxist political agenda since its founding, in 1997, is included on the Turkish government’s list of terrorist organizations. In March of this year, RedHack stole data from the Turkish police’s network, forcing the police to shut down all its servers.

Comment: Who authored computer virus that ‘dwarfs Stuxnet’?

Flame virus code segmentBy JOSEPH FITSANAKIS | intelNews.org |
When the Stuxnet computer virus was detected, in 2010, it was recognized as the most sophisticated malware ever created. It had been specifically designed to sabotage Siemens industrial software systems, which were used in Iran’s nuclear energy program. Not surprisingly, most Stuxnet-infected computers were in Iran. Now a new, massive and extremely sophisticated piece of malware has been detected in computers belonging to the Iranian National Oil Company and Iran’s Ministry of Petroleum. It is called Flame and, according to antivirus company Kaspersky Lab, which first spotted the virus last week, it is “one of the most complex threats ever discovered”. Simply consider that Stuxnet, which caused unprecedented waves of panic among Iranian cybersecurity experts, was 500 kilobytes in size. Flame is over 20 megabytes in size, consisting of 650,000 lines of code; it is so complex that it is expected to take programming analysts around a decade to fully comprehend. The two are different, of course. Stuxnet was an infrastructure-sabotaging malware, which destroyed hundreds —maybe even thousands—of Iranian nuclear centrifuges. Flame, on the other hand, appears to be an espionage tool: it aims to surreptitiously collect information from infected systems. What connects them is their intended target: Iran. We now have Stuxnet, the most complex sabotaging malware ever discovered, which must have taken dozens of programmers several months to create, and Flame, the world’s most powerful cyberespionage tool ever detected by computer security experts. And both have been primarily directed at Iranian government computers. Read more of this post

News you may have missed #714

Tjostolv Moland and Joshua FrenchBy IAN ALLEN | intelNews.org |
►►British PM urged to intervene in Congo spy case. The mother of Joshua French, who has dual British and Norwegian nationality, and is facing execution in the Democratic Republic of Congo, has urged British Prime Minister David Cameron to ask Congolese authorities to pardon him. French, and his Norwegian friend Tjostolv Moland, were sentenced to death for murder and spying in the vast central African country in 2009. A prison official claimed in August last year that the pair had tried to escape, but their lawyer denies this.
►►Computers of Syrian activists infected with Trojan. Since the beginning of the year, pro-Syrian-government hackers have steadily escalated the frequency and sophistication of their attacks on Syrian opposition activists. Many of these attacks are carried out through Trojans, which covertly install spying software onto infected computers, as well as phishing attacks which steal YouTube and Facebook login credentials. According to the Electronic Frontier Foundation, the latest surveillance malware comes in the form of an extracting file which is made to look like a PDF if users have their file extensions turned off. The PDF purports to be a document concerning the formation of the leadership council of the Syrian revolution and is delivered via Skype message from a known friend.
►►Report claims Australian government spied on anti-coal activists. The leader of the Australian Greens, Bob Brown, says he is outraged at reports that the Australian Security Intelligence Organisation (ASIO) is spying on mining protesters, and says such action is a misuse of the spy agency’s resources. The revelations were reported in Australian newspapers yesterday, and are based on a Freedom of Information request to the Department of Resources, Energy and Tourism that was reportedly rejected because it involved “an intelligence agency document”. The ASIO says it cannot confirm whether it has conducted surveillance of anti-coal protesters, but it says it does not target particular groups or individuals unless there is a security-related reason to do so.

News you may have missed #703: US edition

NSA headquartersBy IAN ALLEN | intelNews.org |
►►NSA pressed to reveal details on Google deal. The Electronic Privacy Information Center is locking horns with the National Security Agency over a secret deal the agency cut with Google following an attack on Gmail by Chinese hackers in 2010. The information center has filed a Freedom of Information Act request with the NSA to obtain information about the deal. That request was rejected by a federal court and an appeal process continues.
►►US spy agencies can keep data on Americans longer. Until now, the US National Counterterrorism Center had to immediately destroy information about Americans that was already stored in other government databases when there were no clear ties to terrorism. But it will now be able to store information about Americans with no ties to terrorism for up to five years under new Obama administration guidelines. The new rules replace guidelines issued in 2008 and have privacy advocates concerned about the potential for data-mining information on innocent Americans.
►►Islam convert leads CIA’s Counterterrorism Center. Roger, which is the first name of his cover identity, has been chief of the CIA’s Counterterrorism Center for the past six years. Colleagues describe Roger as a collection of contradictions. A chain-smoker who spends countless hours on a treadmill. Notoriously surly yet able to win over enough support from subordinates and bosses to hold on to his job. He presides over a campaign that has killed thousands of Islamist militants and angered millions of Muslims, but he is himself a convert to Islam. His defenders don’t even try to make him sound likable. Instead, they emphasize his operational talents, encyclopedic understanding of the enemy and tireless work ethic.

Follow

Get every new post delivered to your Inbox.

Join 533 other followers