German magazine reveals more information on elite NSA spy unit

NSA headquartersBy JOSEPH FITSANAKIS | intelNews.org
Last June, we reported on the existence of an elite cyberatack unit within the United States National Security Agency (NSA), which operates under the Agency’s Office of Tailored Access Operations. Veteran NSA watcher Matthew M. Aid, who made the initial revelation, said at the time that the Office, known at NSA simply as TAO, maintains a substantial “hacker army” that works in close cooperation with the Central Intelligence Agency (CIA) and the Federal Bureau of Investigation (FBI). Now German newsmagazine Der Spiegel says it viewed internal documents that confirm the existence of TAO as the NSA’s elite operational unit. The publication describes TAO as “something like a squad of plumbers that can be called in when normal access to a target is blocked”. It adds that TAO operatives are routinely detailed to a host of American intelligence agencies to help conduct intelligence operations ranging from traditional espionage to counterterrorism and cyberwarfare. Furthermore, TAO’s personnel, which are allegedly far younger than the average NSA officer, are experts in exploiting the technical deficiencies of the information-technology industry. They have therefore been able to compromise communications hardware and software produced by some of the world’s biggest IT companies and service providers, including Huawei, Cisco and Microsoft. The Spiegel article claims that TAO was established in 1997, several years before the Internet became a prominent engine of economic and cultural activity around the world. Its personnel, which initially consisted of a few select technical experts, was housed at the NSA headquarters in Fort George Meade, Maryland, but “in a separate wing, set apart from the rest of the agency”. Notably, Der Spiegel cites a paper produced by a former TAO unit head, which states that the program has produced “some of the most significant intelligence our country has ever seen” and urges for its continued growth. Read more of this post

About these ads

Belgian state telecom targeted by ‘international espionage’

Belgacom headquartersBy JOSEPH FITSANAKIS | intelNews.org
Belgium’s largest telecommunications service provider has fallen victim to a sophisticated cyberespionage operation that was most likely carried out by a government agency of another country. According to Flemish newspaper De Standaard, the operation targeted Belgacom, which is Belgium’s state-owned telecommunications company. The paper said that the cyberhacking was uncovered in June of this year during a routine maintenance check by technicians, who detected an “unidentified virus” that had infected several dozen mainframe computers. Belgacom’s technical experts seem to think that the malware had been active for at least two years on Belgacom’s computers, and that it specifically targeted telecommunications traffic carried by Belgacom’s international subsidiaries. Among them is Belgacom International Carrier Services (BCIS), which specializes in providing wholesale carrier services to over 1,000 telecommunications service providers across Africa and the Middle East. De Standaard’s article said that the sophisticated malware had been designed so as to prevent disruption of BCIS’ voice and Internet traffic, thus remaining unnoticed. Its ultimate goal, said the paper, was “not sabotage, but rather collecting strategic communications content”. Federal prosecutors told the Reuters news agency that the technical complexity of the virus meant that it must have been designed by “an intruder with significant financial and logistic means”. The malware’s complexity, coupled with its grand scale, “points towards international state-sponsored cyber espionage”, said the Federal prosecutors. Commenting on the story, De Standaard claimed that “everything points to the [United States] National Security Agency as the culprit” of the cyberespionage. Read more of this post

Secretive US cyber unit has been spying on China for 15 years

NSA headquartersBy JOSEPH FITSANAKIS | intelNews.org |
A secretive cyberattack unit within the United States National Security Agency (NSA) has been engaged in protracted offensive cyberespionage operations against China for nearly 15 years. The revelation, made this week by veteran NSA watcher Matthew M. Aid, appears to confirm recent allegations made by Chinese government officials that Beijing’s secrets come under regular attack by US government-sponsored hackers. It also agrees with claims made by several intelligence observers, including this blog, that America’s cyber-security posture is not purely defensive. According to Aid’s article, published this past Monday in Foreign Policy, China’s allegations that it has been the target of sustained cyberespionage attacks by the US “are essentially correct”. Citing “a number of highly confidential sources”, Aid alleges that the NSA maintains a substantial “hacker army”. These ‘cyberwarriors’ allegedly operate under the NSA’s Office of Tailored Access Operations, known inside NSA simply as TAO. Its personnel is said to have successfully penetrated the Chinese government’s telecommunications networks and servers since the late 1990s, generating “some of the best and most reliable intelligence information” gained by Washington. It does so through computer network exploitation (CNE) techniques, such as surreptitious hacking, password exploitation, and even by compromising Chinese network security technicians. Aid alleges that TAO works closely with the Central Intelligence Agency (CIA) and the Federal Bureau of Investigation (FBI), through a small “clandestine intelligence gathering unit”. The latter employs CIA and FBI operatives who perform what are known as “off-net operations”, a term that refers to physical break-ins of Chinese and other foreign diplomatic facilities, in order to compromise the security computer hardware. Read more of this post

News you may have missed #838 (analysis edition)

Predator droneBy IAN ALLEN | intelNews.org |
►►Delisle spy case barely caused ripples between Canada and Russia. The arrest of Jeffrey Delisle, a Canadian naval officer spying for Russia, did little to discourage Canada from welcoming that country’s defense chief to a Newfoundland meeting of Arctic nations last year. The visit underscored the puzzling lengths to which the Canadian government went to carry on a business-as-usual relationship with the one-time Cold War adversary. Most other planned military contacts between the two nations last year —including participation in the anti-terrorism exercise Operation Vigilant Eagle— also remained curiously normal.
►►Don’t believe the hype on Chinese cyberespionage. Within a day of each other, The Washington Post published a shocking list of US defense programs whose designs have reportedly been stolen by Chinese cyberattacks, and ABC news said the plans for Australia’s spy headquarters were also stolen by Chinese hackers. It makes China sound like a secret-sucking cyber espionage machine, but is that really the case? The knee-jerk interpretation to this disclosure (and others) is that China is a powerhouse of cyber espionage capable of stealing whatever secrets they want and that the US is powerless to stop them. This seems very unlikely.
►►US Predator drone program quietly shifted from CIA to DoD. The White House has quietly shifted lead responsibility for its controversial armed drone program from the CIA to the Defense Department. In a landmark speech last week at National Defense University in Washington, US President Barack Obama offered some clues into the status of the program, opaquely signaling it will now primarily be conducted by the United States military.

Chinese hackers ‘stole blueprints’ of Australian spy agency’s new HQ

ASIO's new headquartersBy JOSEPH FITSANAKIS | intelNews.org |
Chinese government hackers allegedly stole the master blueprints and other highly classified technical information relating to the new headquarters of the Australian Security Intelligence Organisation (ASIO). The state-of-the-art building, which is located at the shore of Lake Burley Griffin in Australian capital Canberra, has so far cost taxpayers in excess of AUD $631 million (US $608 million). Although it remains under construction, the new headquarters is said to feature the most sophisticated security features of any government building in Canberra. But a report aired on May 28 by Australian television’s Four Corners investigative program, alleged that a Chinese government agency managed to steal the building’s blueprints. The program claimed that the highly classified blueprints were stolen when hackers mounted a sophisticated cyberattack on a private-sector contractor involved in constructing the ASIO’s new headquarters. Four Corners suggested that the cyberattack, which was “traced to a server in China”, also compromised the building’s communications diagram, server locations and physical security systems. The revelation will undoubtedly add to the stream of public criticism about the project, which has been severely plagued by budget increases and construction delays. As recently as 2010, the government was insisting that the project was “progressing on time and on budget, with completion scheduled for mid-2012”. Today, however, the building’s budget has gone over by AUD $171 million and the building is expected to open its doors no earlier than the fall of 2013, with some commentators suggesting that it could be 2014 before ASIO’s personnel are able to start moving in. Read more of this post

Sophisticated cyberespionage operation focused on high-profile targets

Rocra malware programming codeBy JOSEPH FITSANAKIS | intelNews.org |
After Stuxnet and Flame, two computer programs believed to have made cyberespionage history, another super-sophisticated malware has been uncovered, this time targeting classified computer systems of diplomatic missions, energy and nuclear groups. The existence of the malware was publicly announced by Russian-based multi-national computer security firm Kaspersky Lab, which said its researchers had identified it as part of a cyberespionage operation called Rocra, short for Red October in Russian. The company’s report, published on Monday on Securelist, a computer security portal run by Kaspersky Lab, said that the malware has been active for at least six years. During that time, it spread slowly but steadily through infected emails sent to carefully targeted and vetted computer users. The purpose of the virus, which Kaspersky Lab said rivals Flame in complexity, is to extract “geopolitical data which can be used by nation states”. Most of the nearly 300 computers that have so far been found to have been infected belong to government installations, diplomatic missions, research organizations, trade groups, as well as nuclear, energy and aerospace agencies and companies. Interestingly, the majority of these targets appear to be located in Eastern Europe and former Soviet republics in Central Asia. On infected computers located in North America and Western Europe, the Rocra virus specifically targeted Acid Cryptofiler, an encryption program originally developed by the French military, which enjoys widespread use by European Union institutions, as well by executive organs belonging to the North Atlantic Treaty Organization. Read more of this post

News you may have missed #818 (USA edition)

Osama bin LadenBy IAN ALLEN | intelNews.org |
►►The real-life female CIA officer who helped track bin Laden. The Washington Post has a good article on the real-life career of a female CIA officer who helped the Agency track al-Qaeda founder Osama bin Laden. It is disappointing, however that the article, authored by Greg Miller and Toby Warrick, is headlined “In Zero Dark Thirty she’s the hero; in real life, CIA agent’s career is more complicated”. The CIA employee in question is not an “agent”; she is an officer. In the CIA, agents are assets, people recruited and handled by CIA officers. Amazing that The Post, with its experienced journalists and editors would confuse such a basic operational distinction.
►►US spy agencies to detail cyber-attacks from abroad. The US intelligence community is nearing completion of its first detailed review of cyber-spying against American targets from abroad, including an attempt to calculate US financial losses from hacker attacks based in China. The National Intelligence Estimate, the first involving cyber-espionage, will also seek to determine how large a role the Chinese government plays in directing or coordinating digital attacks aimed at stealing US intellectual property, according to officials who spoke on the condition of anonymity to discuss a classified undertaking.
►►CIA begins LGBT recruiting. As part of the CIA’s efforts to diversify its workforce, the spy agency is reaching out to a group that once was unable to get security clearance: lesbians and gay men. CIA officials have held a networking event for the Miami gay community sponsored by the Miami-Dade Gay and Lesbian Chamber of Commerce and the CIA. “This is the first time we’ve done a networking event of this type with any of the gay and lesbian chamber of commerces in the United States,” says Michael Barber, a self-identified “straight ally” and the spy agency’s LGBT Community Outreach and Liaison program manager.

Ex-intelligence official: cyber espionage more dangerous than terrorism

Raymond BoisvertBy JOSEPH FITSANAKIS | intelNews.org |
A former senior member of Canada’s intelligence community has said that the threat of cyber espionage requires more resources that are currently being diverted to counterterrorism. Ray Boisvert, who retired last year from the post of Assistant Director of Intelligence for the Canadian Security Intelligence Service (CSIS), said in an assertive speech last week that cyber espionage is “fundamentally undermining [Canada's] future prosperity as a nation”. Speaking on Friday in Ottawa, Boisvert compared cyber espionage to the climate-change debate, which has been marked by a series of ignored warnings, due to “some willful blindness on behalf of individuals”. As a result, he said, the need to establish essential security measures to protect worldwide electronic infrastructure is being neglected, while desperately needed resources are being diverted to counterterrorism. He explained the lack of action on three levels: first, the resistance emanating from technologically challenged decision-makers in the government and private sector, who simply do not understand the technical complexities of digital telecommunications security. Second, it is rooted in the government’s reluctance to invest the funds required to shield the nation’s communications infrastructure from espionage attacks. Finally, he placed the blame on the fragmentation and shortsightedness of the private sector, which owns and operates nearly 90 percent of Canada’s critical communications infrastructure and yet is too consumed by competition to sit around the same table on matters of security. In giving examples of the seriousness of the threat of cyber espionage, Boisvert cited the attacks last year on the computer systems of Canada’s Treasury Board and Finance Department, which compromised trade secrets of several national industries. He also mentioned the attacks on Nortel Networks Inc., which he said lasted for over a decade and may have contributed to the company’s 2009 demise. Read more of this post

News you may have missed #783

Uri SaguyBy IAN ALLEN | intelNews.org |
►►Israeli ex-intel chief says warns of ‘hysteria’ over Iran. Major General Uri Saguy (a.k.a. Uri Sagi), who was head of the IDF’s Operations Directorate during the 1982 Lebanon war, and Military Intelligence chief from 1991 to 1995, has warned of an “orchestrated and purposely timed hysteria that puts the country into a state of anxiety, artificial or not”, regarding the Iranian nuclear issue. Saguy, who resigned from the IDF in 1995 due to a conflict between him and the Chief of General Staff, added that “it would be a mistake if Israel uses force, certainly now, in order to thwart the Iranian nuclear potential”. The essence of Saguy’s message, notes Ha’aretz‘s Amir Oren, is that Israel’s citizens cannot trust Defense Minister Ehud Barak or Prime Minister Benjamin Netanyahu.
►►Australian spy chief warns of economic espionage. The director-general of the Australian Security Intelligence Organisation, David Irvine, has warned that the online revolution has left Australian companies increasingly vulnerable to cyber attacks and commercial espionage. Speaking to a business audience in Canberra, Irvine said that most online attacks in the business world go undetected, despite growing awareness of the threat. Asked how much commercial cyber crime went undetected, he said: “I would be very surprised if we who are active in this area are picking up the greater proportion of it, in fact, quite the reverse”.
►►Top US military official objects to attack on Iran. As Israeli officials are telling local reporters that they’re really, really ready to attack Iran’s nuclear facilities, and they mean it this time, the top US military officer is saying what a terrible idea that would be. “I may not know about all of [Israel's] capabilities”, said General Martin Dempsey, the chairman of the Joint Chiefs of Staff. “But I think that it’s a fair characterization to say that they could delay but not destroy Iran’s nuclear capabilities”. Left unsaid: in a few years, the US and Israel would be back to the same standoff with Iran —except this time it might do so amidst a proxy terrorist war to avenge the Iranians.

News you may have missed #771

Shawn HenryBy IAN ALLEN | intelNews.org |
►►Analysis: Ex FBI official says foreign spies biggest online threat. Former FBI executive assistant director Shawn Henry has warned that the biggest threat online comes not from terrorists or hackers, but from foreign intelligence organizations looking to steal intellectual property. “The threat from computer attack is the most significant threat we face as a society, other than a weapon of mass destruction”, he said in his opening keynote at the Black Hat 2012 conference in Las Vegas. “Everything we do —R&D, intellectual property, and corporate strategies— is stored or transmitted electronically. The DNA of companies is available to bad guys”.
►►Taiwanese officials jailed for espionage. Two Taiwanese former officials have been sent to prison by the Taiwan High Court for leaking state secrets to China. Presidential Office official Wang Ren-bing was jailed for two years after being found guilty of passing confidential information about President Ma Ying-jeou’s May 2008 inauguration to Chinese intelligence operatives. Chen Pin-jen, a former aide of Chinese Nationalist Party (KMT) Legislator Liao Kuo-tung, was sentenced to eight months in prison for delivering the confidential information Wang gave him to China. The two were arrested in 2009.
►►Germany charges suspected Syrian spy. A spokeswoman for federal prosecutors in Germany said Sunday that they have filed charges against suspected Syrian spy Akram O., one of two men arrested on suspicion of having spied on Syrian opposition activists in Germany for several years. The two were arrested in February during a sting operation involving over 70 German counterintelligence operatives, who searched the suspects’ apartments. The spokeswoman said she could not give further details before an official confirmation is issued that the suspect and the defense team have received the indictment.

News you may have missed #754

Jonathan EvansBy IAN ALLEN | intelNews.org |
►►New German spy HQ to open a year late. The BND, Germany’s foreign intelligence service, was due to move from its base in Pullach, near Munich, to an enormous newly built center in Berlin, at the end of 2014. But that has now been officially put back by a year. The Berliner Morgenpost newspaper quoted BND president Gerhard Schindler saying he was “regularly losing young new staff”, due to the delay. The uncertainty has meant “they leave our authority and find themselves another employer”, he said.
►►UK spy chief warns of ‘astonishing’ levels of cyberespionage. In a rare public speech, Jonathan Evans, director general of MI5, Britain’s domestic spy service, has said that the West now faces an “astonishing” cyberespionage threat on an “industrial scale” from specific nation states. He said that cyberespionage is now conducted “with industrial-scale processes involving many thousands of people lying behind both state-sponsored cyber espionage and organized cyber crime”. Surely, however, Evans does not mean to imply that the West’s role in cyberespionage is purely defensive?
►►Aussie spy agency lacks resources to vet asylum seekers. An official audit into the Australian Security Intelligence Organisation’s ability to vet asylum seekers for potential security threats, has found that it is struggling with the “sharp increase” in boat arrivals, rudimentary computer systems and 30 per cent fewer staff than needed. The audit report examined 411 cases as a sample of the almost 180,000 security assessments ASIO completes each year.

US and Israel behind computer virus that hit Iran, say sources

Flame virus code segmentBy JOSEPH FITSANAKIS | intelNews.org |
Flame, a sophisticated computer malware that was detected last month in computers belonging to the Iranian National Oil Company and Iran’s Ministry of Petroleum, was created by Israel and the United States, according to a leading American newspaper. Quoting “officials familiar with US cyber-operations”, The Washington Post reported on Wednesday that the malware, which is said to be “massive in size”, is part of a wider covert program codenamed OLYMPIC GAMES. The paper said that the US portion of the program is spearheaded by the National Security Agency, which specializes in cyberespionage, and the CIA’s Information Operations Center. The Post further claims that OLYMPIC GAMES has a three-fold mission: to delay the development of the Iranian nuclear program; to discourage Israeli and American officials from resorting to a conventional military attack on Iran; and to buy time for those officials who favor addressing the Iranian nuclear stalemate with diplomatic pressures coupled with sanctions. According to one “former intelligence official” quoted in The Post, the scale of OLYMPIC GAMES “is proportionate to the problem that’s trying to be resolved”. Russian antivirus company Kaspersky Lab, which first spotted the Flame virus in May, said that it is “one of the most complex threats ever discovered”. It is over 20 megabytes in size, consisting of 650,000 lines of code. In comparison, Stuxnet, a computer super-virus that was detected by experts in 2010, and caused unprecedented waves of panic among Iranian cybersecurity experts, was 500 kilobytes in size. Read more of this post

Comment: Who authored computer virus that ‘dwarfs Stuxnet’?

Flame virus code segmentBy JOSEPH FITSANAKIS | intelNews.org |
When the Stuxnet computer virus was detected, in 2010, it was recognized as the most sophisticated malware ever created. It had been specifically designed to sabotage Siemens industrial software systems, which were used in Iran’s nuclear energy program. Not surprisingly, most Stuxnet-infected computers were in Iran. Now a new, massive and extremely sophisticated piece of malware has been detected in computers belonging to the Iranian National Oil Company and Iran’s Ministry of Petroleum. It is called Flame and, according to antivirus company Kaspersky Lab, which first spotted the virus last week, it is “one of the most complex threats ever discovered”. Simply consider that Stuxnet, which caused unprecedented waves of panic among Iranian cybersecurity experts, was 500 kilobytes in size. Flame is over 20 megabytes in size, consisting of 650,000 lines of code; it is so complex that it is expected to take programming analysts around a decade to fully comprehend. The two are different, of course. Stuxnet was an infrastructure-sabotaging malware, which destroyed hundreds —maybe even thousands—of Iranian nuclear centrifuges. Flame, on the other hand, appears to be an espionage tool: it aims to surreptitiously collect information from infected systems. What connects them is their intended target: Iran. We now have Stuxnet, the most complex sabotaging malware ever discovered, which must have taken dozens of programmers several months to create, and Flame, the world’s most powerful cyberespionage tool ever detected by computer security experts. And both have been primarily directed at Iranian government computers. Read more of this post

Comment: US cybersecurity posture is not purely defensive

NSA headquartersBy JOSEPH FITSANAKIS | intelNews.org |
In recent years, news coverage of cyberespionage and cybersecurity has increased several times over; both subjects have escaped the narrow confines of technical literature and have entered the broad expanses of popular news media. This blog is no exception; since 2008, we have covered both cybersecurity and cyberespionage at length. In looking back at our coverage, it takes but a cursory glance to conclude that most of our reports feature the names of two countries: China and –to a far lesser extent– Russia. Moreover, the vast majority of our cybersecurity and cyberespionage coverage portrays the United States as a defensive actor, trying desperately to protect the integrity of its networks from foreign hackers. But is this accurate? How realistic is it to assume that the US, the world’s leading military power, abstains from offensive cyberespionage as a matter of strategy? The most likely answer is: not very. The problem is that much of the reporting on cybersecurity is based on national allegiances. Many American media pundits thus tend to forget that Washington, too, conducts cyberespionage. Read more of this post

News you may have missed #735

Blast site in Deir Ezzor, SyriaBy IAN ALLEN | intelNews.org |
►►Pakistan imposes new restrictions on CIA operatives. The government of Pakistan has issued a set of new rules and regulations for officials, ambassadors and contractors of the United States Central Intelligence Agency (CIA). According to Pakistani news reports, Pakistan and the US finalized these new rules in the course of 13 meetings between representatives of both countries. Under the new rules, CIA officers deployed in Pakistan “must prove their identity” to Pakistani counterintelligence officials. Some officials, including former Pakistani ambassador to the United States Sherry Rehman, are already talking of a “new beginning for US-Pakistani relations”.
►►Car bomb strikes near Syrian intelligence agency. The Syrian Observatory for Human Rights confirmed reports on Saturday of an explosion in the Ghazi Ayyash neighborhood of the eastern Syrian city Deir Ezzor. The site of the blast, which killed at least seven people and injured 100 others, was close to the city branches of the Military Intelligence Directorate and Air Force Intelligence, the London-based activist group reported. There has been no immediate claim of responsibility for the attack.
►►China denies US cyberespionage claims. The Chinese government has hit back at a US Pentagon report that said it is carrying out aggressive cyber-spying as part of a military build-up. Chinese Foreign Ministry spokesman Hong Lei said “China’s justified and normal military development” had been unjustly criticized in the annual report, which was released on Friday. The development of China’s “limited” military force was only geared towards safeguarding its independence, sovereignty and territorial integrity, said the spokesman.

Follow

Get every new post delivered to your Inbox.

Join 533 other followers