Spies seen behind fake Facebook profile of senior NATO commander

James G. StavridisBy JOSEPH FITSANAKIS| intelNews.org |
A Facebook account bearing the name of a senior commander of the North Atlantic Treaty Organization was set up by Chinese spies to siphon information from unsuspecting Western military officials, according to a British newspaper. The London-based Daily Telegraph said in an article that the fake Facebook account was discovered a year ago by NATO counterintelligence officers. It bore the name of United States Admiral James Stavridis, who serves as Supreme Allied Commander in Europe and currently leads the Organization’s mission in Libya. The account was reportedly used to befriend Western military officials, primarily in Britain and other European countries, probably in an attempt to collect personal information found on their personal pages on the popular social networking site. This sort of practice is known as ‘spear phishing’, and consists of messages sent to carefully targeted individuals, seemingly sent from a trusted source. The operation involving Admiral Stavridis appears to have been purposely targeted at high-ranking Western officials, a technique sometimes known as ‘whaling’. The London-based daily says NATO officials have been “reluctant to say publicly who was behind the attack”. But the paper claims it has been told that declassified briefings from NATO point to a series of Internet protocol addresses belonging to Chinese government facilities. Organization officials insist —correctly— that the individuals or government agencies behind the operation to falsify Stavridis’ social networking identity are unlikely to have acquired any actual military secrets. However, the information collected from Western military officials befriended online by Admiral Stavridis’ fake Facebook account could aid the compilation of personal and psychological profiles of these officials produced by foreign intelligence agencies. Read more of this post

News you may have missed #691

Thomas DrakeBy IAN ALLEN| intelNews.org |
►►NSA whistleblower says Obama worse than Bush. Thomas Drake, the whistleblower whom the administration of US President Barack Obama tried and failed to prosecute for leaking information about waste, fraud and abuse at the National Security Agency, now works at an Apple store in Maryland. In an interview with Salon, Drake says the Obama administration is “expanding the secrecy regime far beyond what Bush ever intended”.
►►Australian spies reportedly buying computer bugs. The Australian government is buying computer security weaknesses found by hackers before they are sold on the black market, as part of its defense strategy, according to an Australian security consultant who wishes to remain anonymous. He says while the government won’t admit it, buying vulnerabilities is an obvious part of “gathering intelligence”.
►►Refugees in Finland face spying threats. Foreign governments and groups are carrying out more spying on refugees and dissidents living in Finland, according to SUPO, the country’s security intelligence service. SUPO issued a report last week contending that while the Scandinavian country isn’t seeing an increased threat of terrorist acts on its soil, it still faces several terror-related challenges. One of them is “regular” surveillance activity by foreign intelligence services operating within Finland, whose aim is spy on their home countries’ dissidents and develop links with other refugees and expatriates.

News you may have missed #686

Folkert Arie van KoutrikBy IAN ALLEN| intelNews.org |
►►WikiLeaks to publish 5 million StratFor emails. In its latest high-profile data dump, WikiLeaks is to reveal five million internal and external emails from StratFor today. In a press release late Sunday, Wikileaks said the emails “show StratFor’s web of informers, pay-off structure, payment-laundering techniques and psychological methods”, and reveal “how StratFor has recruited a global network of informants who are paid via Swiss banks accounts and pre-paid credit cards. Stratfor has a mix of covert and overt informants, which includes government employees, embassy staff and journalists around the world”.
►►Analysis: Blurred line between espionage and truth under Obama. “There is plenty of authorized leaking going on, but this particular boat leaks from the top. Leaks from the decks below, especially ones that might embarrass the administration, have been dealt with very differently […]. And it’s worth pointing out that the administration’s emphasis on secrecy comes and goes depending on the news. Reporters were immediately and endlessly briefed on the “secret” operation that successfully found and killed Osama bin Laden. And the drone program in Pakistan and Afghanistan comes to light in a very organized and systematic way every time there is a successful mission”.
►►Nazis had spy in MI5 but failed to use him. Dutchman Folkert Arie van Koutrik was the first German agent to ever infiltrate MI5 when he was employed by them in 1940, just a month before Anthony Blunt, who was later exposed as a Soviet spy. Koutrik had already worked for Abwehr, the German secret service, before the war as a double agent with MI6 in Europe and exposed some of the UK’s top agents. But, incredibly, after he moved to the UK and joined MI5 all contact appears to have broken off.

News you may have missed #679

Salem al-HassiBy IAN ALLEN | intelNews.org |
►►New spy chief in Libya. Libya’s ruling National Transitional Council yesterday appointed a lifelong opponent of slain Libyan leader Muammar Gaddafi as the country’s new intelligence chief. Salem al-Hassi, who was involved in a bid to assassinate Gaddafi in 1984, was appointed as the intelligence chief at a meeting of the council.
►►Anonymous hackers release German classified information. Hackers from the group Anonymous said last week they had accessed classified German files and posted them online, revealing details of the country’s military operations in Afghanistan. The military documents were collected for an inquiry, now finished, into a September 2009 airstrike by US jets under German orders that killed more than 140 Taliban fighters and Afghan civilians. Anonymous said it obtained the data from a server at the Bundestag  (German parliament).
►►Did Chinese espionage lead to F-35 delays? Did Chinese cyber spying cause the United States’ F-35 Joint Strike Fighter’s cost spikes and production delays? This is the question being asked by US Pentagon budget officials, according to industry magazine Aviation Week. Chinese spies apparently hacked into secure conference calls and listened to meetings discussing the classified technologies aboard the jets. In particular, China may have stolen info about the F-35’s secure communications and antenna systems, leading to costly software rewrites and other redesigns to compromised parts of the plane.

News you may have missed #662: UK edition

Edward VIII and Wallis Simpson with Adolf HitlerBy IAN ALLEN | intelNews.org |
►►Hacked StratFor info exposes thousands of intel officials. Customer user data obtained from StratFor by Anonymous last month includes the private details of 221 British military officials and 242 NATO staff. Civil servants working at the heart of the UK government —including several in the Cabinet Office as well as advisers to the Joint Intelligence Organisation, which acts as the British Prime Minister’s eyes and ears on sensitive information— have also been exposed.
►►Book claims MI5 tapped phones of King Edward. According to a new biography of Tommy Robertson, who pioneered Britain’s wartime counterintelligence operations, MI5 agents tapped the phones of King Edward VIII and his brother the Duke of York, at the height of the ‘abdication crisis’. Edward VIII was infatuated with –and, in 1936, gave up his throne to marry– American divorcee and socialite Wallis Simpson, who was suspected by many in the British government of having Nazi sympathies.
►►UK spy watchdog wants to stop court disclosure of state secrets. The parliamentary watchdog for Britain’s spies, the Intelligence and Security Committee (ISC), is lobbying the government to introduce sweeping curbs that could prevent UK courts from examining intelligence material. The committee claims that its proposed new powers would ensure that intelligence obtained from foreign agencies, such as the CIA, is never publicly disclosed. This proposal clearly goes back the case of Binyam Mohamed; he was detained in Pakistan, where he was questioned by MI5, and eventually ended up in Guantánamo Bay, where he says he was tortured. In late 2009, British courts clashed with David Miliband, the then foreign secretary, over the publication of a summary of US intelligence material relating to Mohamed.

Did cell phone companies help India spy on the United States?

Page from the Lords of Dharamraja document leakBy JOSEPH FITSANAKIS | intelNews.org |
Leaked documents acquired by a computer hacker collective appear to show that international cell phone manufacturers helped Indian intelligence agencies spy on the United States, in return for access to the Indian cellular phone market. The documents, which are written in English, were posted online on Saturday by a group of Indian hackers calling themselves Lords of Dharamraja. In a statement, the group said they obtained the documents by breaking into the computer servers of Indian Military Intelligence, after managing to acquire the source code of Symantec Corporation, makers of Norton antivirus software. According to the documents, the companies arm-twisted to assist Indian intelligence agencies to spy on the US included Apple, Nokia, and Research in Motion, the company that builds BlackBerry devices. The documents also appear to show that Indian intelligence agencies were particularly eager to spy on the United States-China Economic and Security Review Commission. Established by the US Congress in 2000, the Commission is tasked with researching and reporting on the national security implications of bilateral trade between the US and China. Allegedly, the cellular telephone makers provided Indian intelligence agencies with backdoor access to personal phones used by Commission members. These back doors allegedly allowed the Indian Military Intelligence Directorate and India’s Central Bureau of Investigation to spy on Commission members beginning in April of 2011. Read more of this post

News you may have missed #654

Aleksandr ShlyakhturovBy IAN ALLEN | intelNews.org |
►►Anonymous hacks intel analysis firm StratFor. The loose-knit hacking movement Anonymous claimed Sunday via Twitter that it had stolen thousands of credit card numbers and other personal information belonging to clients of intelligence analysis firm Stratfor. The company had apparently failed to encrypt its customers’ credit card account information. The hackers announced their intention to use the credit cards for charitable donations.
►►CIA Inspector General clears assistance with NYPD. Back in August, The CIA denied allegations by the Associated Press that it helped the New York Police Department conduct covert surveillance on New York Muslims. The agency said the report “mischaracterized the nature and scope” of the CIA’s support for the NYPD. Now a report by the office of the CIA Inspector General, the CIA’s internal watchdog, has concluded that there was “no evidence that any part of the agency’s support to the NYPD constituted ‘domestic spying’”. The Associated Press notes that it is not clear if this report opens the door for other municipal police departments nationwide to work closely with the CIA in the war on terrorism.
►►Russia replaces head of military spy agency. After denying initial rumors, Russia’s Defense Ministry said on Monday that “Major General Igor Sergun has been appointed head of the GRU [Russia’s Main Intelligence Directorate] through a Kremlin decree”. Sergun replaces Aleksandr Shlyakhturov, who had spearheaded a shake-up of the service since his appointment in 2009. The state RIA Novosti news agency quoted a ministry spokesman suggesting that Shlyakhturov had reached retirement age. No other reason was given for the move. Incidentally, if you are wondering how spies are faring in Dmitri Medvedev’s and Vladimir Putin’s administration, read this enlightening analysis by Mark Galeotti, Professor of Global Affairs at New York University.

Comment: Is China the New Spy Superpower?

US and China

US and China

By JOSEPH FITSANAKIS* | intelNews.org |
In fifteen years of monitoring intelligence-related developments, I have rarely seen so many news items about China appear simultaneously in the Western press, as I did during the past fortnight. On December 5, financial news network Bloomberg reported that the United States government invoked “Cold War-era national security powers” to compel telecommunications companies operating on American soil to disclose confidential data about their networks. The plan, spearheaded by the US Department of Commerce, but undoubtedly prompted and monitored by the National Security Agency, features a detailed survey distributed to dozens of telecommunications service providers, as well as hardware and software developers. The latter are reportedly required to supply “a detailed accounting” of every piece of “foreign-made hardware and software” installed on their networks, in a move that Bloomberg interprets as “a hunt for Chinese cyber-spying”. A few days later, intelligence researcher and author David Wise opined in The New York Times that the West had better recognize that China “has developed a world-class espionage service —one that rivals the CIA”. He qualified his statement by providing several examples of major espionage triumphs achieved by the Chinese intelligence services in the last decade, such as the acquisition of design blueprints for the US-built B-1 bomber and Northrop Grumman’s B-2 stealth bomber. Other examples given by Wise include China’s attainment of the design specifications for the US Navy’s Quiet Electric Drive system, aimed at enhancing the stealth abilities of submarines, as well as the remains of the modified Black Hawk helicopter that crashed in Abbottabad, Pakistan, during the CIA-led operation to assassinate al-Qaeda founder Osama bin Laden last May. Most of all, Wise laments the acquisition by the Chinese of the design specifications for the W-88 warhead, the symbol of America’s next-generation of mini-nuke weapons. Read more of this post

Russian spy agencies accused of hacking election monitor sites

FSB officer

FSB officer

By JOSEPH FITSANAKIS | intelNews.org |
Election monitors have accused Russia’s domestic intelligence service of launching a series of coordinated hacking attacks on opposition websites, timed to coincide with last Sunday’s elections. On that day, Russians voted —as they have done every five years since 1991— to determine the composition of the Duma, the country’s lower house. Election results show an unprecedented 14 percent drop for Prime Minister Vladimir Putin’s United Russia party, coupled with an equally sharp rise in the Communist Party share of the votes, which doubled to about 20 percent. But the election drew strong condemnations from international election monitors, including the Organization for Security and Cooperation in Europe, which said that the campaign was “slanted in favor of the ruling party”. Now Russian opposition organizations are accusing the government of launching a series of “massive” distributed denial of service (DDoS) attacks against their websites on the night of the elections. Websites affected include the prominent opposition magazine The New Times, the Ekho Moskvy radio station, the Russian arm of the Livejournal blogging website, business daily Kommersant, popular online news portal Slon.ru, as well as the Western-financed political watchdog group Golos. All of these outlets were simultaneously attacked on Sunday evening; their servers were bombarded with data that overwhelmed their computer systems and eventually knocked them offline. Liliya Shibanova, who directs Golos, told a news conference in Moscow late on Sunday night that the organization’s Internet and telephone systems, including an election violation hotline, had been blocked. She claimed that only Russia’s Federal Security Service (FSB), successor to the domestic intelligence wing of the Soviet-era KGB, had the resources required to launch such a massive attack. Read more of this post

Leaked documents show capabilities of new surveillance technologies

Net Optics logo

Net Optics logo

By JOSEPH FITSANAKIS | intelNews.org |
A trove of hundreds of documents, obtained by participants in a secretive surveillance conference, displays in unprecedented detail the extent of monitoring technologies used by governments around the world. The Wall Street Journal, which obtained the leaked documents, says they number in the hundreds; they were reportedly authored by 36 different private companies that specialize in supplying government agencies with the latest surveillance hardware and software. They were among dozens of vendors that participated in an unnamed conference near Washington, DC, in October, which attracted interested buyers from numerous government agencies in America and beyond. The Journal, which has uploaded scanned copies of the leaked documents, says that many include descriptions of computer hacking tools. The latter enable government agencies to break into targeted computers and access data stored in hard drives, as well as log keystrokes by the targeted computers’ users. Other applications target cellular telecommunications, especially the latest models of so-called ‘smartphones’; one vendor in particular, Vupen Security, gave a presentation at the conference, which describes how its products allow for electronic surveillance of cell phones by exploiting security holes unknown to manufacturers. Some of the most popular products at the conference related to what the industry calls “massive intercept” monitoring, namely large-scale software systems designed to siphon vast amounts of telephonic or email communications data, or to capture all Internet exchanges taking place within a country’s computer network. One conference participant, California-based Net Optics Inc., bragged in its presentation about having enabled “a major mobile operator in China” to conduct “real-time monitoring” of all cell phone [and] Internet content on its network. The stated goal of the surveillance was to “analyze criminal activity” and “detect and filter undesirable content”. Read more of this post

Analysis: China an ‘easy scapegoat’, says leading cybersecurity expert

Mikko Hypponen

Mikko Hypponen

By JOSEPH FITSANAKIS | intelNews.org |
It is fashionable nowadays to single out China as the primary source of global cyberespionage. During the past few days alone, the Japanese government said Chinese hackers had attacked computers systems in its Lower Parliament, while Britain’s General Communications Headquarters (GCHQ) pointed to Beijing as the main culprit behind an unprecedented rise in organized cyberattacks. A few days ago, the United States intelligence community publicly named for the first time China and Russia as “the most aggressive collectors” of US economic information and technology online. But is the image of China as the ultimate cyber-villain accurate? Not necessarily, according to leading cybersecurity expert Mikko Hypponen. Speaking earlier this week at the PacSec 2011 conference in Tokyo, Japan, Hypponen, who leads computer security firm F-Secure, disputed the predominant view that a single country could be the source of the majority of organized cyberattacks directed against governmental and corporate targets. It is true, said Hypponen, that cyberespionage attacks “are commonly attributed to the Chinese government”. Moreover, it does appear like “a lot” of these attacks are indeed coming from Chinese sources, he said. But the problem of attribution —accurately and conclusively determining the responsible agency behind a cyberattack— remains unresolved in our time. Even if Chinese servers are conclusively identified as sources of such attacks, it would be dangerous to assume that Chinese government operatives —and not rogue agents, or nationalist hacker gangs— are necessarily behind them. Additionally, it is entirely possible that other countries —perhaps even Western countries— could be behind such attacks, but that they consciously try to mask them in such a way as to make China appear responsible. The reason is that Beijing is “such an easy scapegoat”, said Hypponen. Read more of this post

News you may have missed #620 (cyberespionage edition)

GCHQ

GCHQ

►►Canada government ‘warned prior to cyberattack’. Canada’s spy agency, CSIS, warned the government that federal departments were under assault from rogue hackers just weeks before an attack crippled key computers. A newly released intelligence assessment, prepared last November, sounded a security alarm about malicious, targeted emails disguised as legitimate messages —the very kind that shut down networks two months later.
►►GCHQ warns cyber crime reaches ‘disturbing’ levels. Cyber attacks on the British government, the public and industry have reached “disturbing” levels, according to the director of Britain’s biggest intelligence agency. Iain Lobban, who runs the British government’s listening centre, GCHQ, has warned that the “UK’s continued economic wellbeing” is under threat.
►►Japanese parliament hit by cyber-attack. Alleged Chinese hackers were able to snoop upon emails and steal passwords from computers belonging to lawmakers at the Japanese parliament for over a month, according to Japanese daily Asahi Shimbun. The paper claims that computers and servers were infected after a Trojan virus was emailed to a Lower House member in July. The Trojan then allegedly downloaded malware from a server allegedly based in China —allowing remote hackers to secretly spy on email communications and steal usernames and passwords from Japanese lawmakers.

News you may have missed #617

Ilan Grapel

Ilan Grapel

►►Analysis: Is the CIA Still an Intelligence Agency? Early September 2011, a former intelligence official commented to The Washington Post that, “The CIA has become one hell of a killing machine”. He then attempted to retract, but his words were on record. But is that really what it should be: a hell of a killing machine?
►►US National Security Agency helps Wall Street battle hackers. The National Security Agency, a secretive arm of the US military, has begun providing Wall Street banks with intelligence on foreign hackers, a sign of growing US fears of financial sabotage. While government and private sector security sources are reluctant to discuss specific lines of investigations, they paint worst-case scenarios of hackers ensconcing themselves inside a bank’s network to disable trading systems for stocks, bonds and currencies, trigger flash crashes, initiate large transfers of funds or turn off all ATM machines.
►►Israel okays deal with Egypt to free alleged spy. Israel’s security cabinet unanimously approved an agreement Tuesday for the release of Israeli-American law student Ilan Grapel (pictured), who has been in jail in Egypt since June 12 on spying allegations that were later reduced to incitement. In exchange, Israel will release 22 Egyptian prisoners, most of them Bedouin from the Sinai jailed for smuggling drugs or weapons.

German government admits using Trojan to spy on private computers

CCC logo

CCC logo

By JOSEPH FITSANAKIS | intelNews.org |
The local government of at least one German federal state has admitted using specially designed computer software to spy on citizens, after a hacker group revealed the existence of the software. On Saturday, the German Chaos Computer Club (CCC), one of the world’s most reputable ‘white hat’ hacker groups, said that German authorities regularly employ the so-called ‘Bundestrojaner’ (‘Federal Trojan’) virus in order to spy on the users of targeted computers. Club member Frank Rieger told German newsmedia that the virus, which was revealed to the Club via an anonymous tipster, was developed by German police experts, and is used by government agents it to intercept electronic information during investigations. The Trojan is reportedly capable of surreptitiously taking screenshots of infected computers, keylogging, recording Skype conversations, and taking control of networked webcams or microphones, thus permitting physical eavesdropping of a person’s home or workplace. In doing so, the Trojan would appear to facilitate warrantless communications interception that exceeds legal limits set under German law. Moreover, according to CCC, the virus acts as a backdoor to infected systems, thus allowing the uploading and execution of unauthorized programs, and potentially may even facilitate the planting of incriminating evidence on targeted computers. Initially, German government officials denied the CCC’s allegations; on Monday, however, officials in the southern German state of Bavaria confirmed that local police forces have been using the Bundestrojaner virus since at least 2009. Read more of this post

Computer virus found on CIA’s Predator drone remote-control system

Predator drone

Predator drone

By JOSEPH FITSANAKIS | intelNews.org |
The remote control cockpits of the US Central Intelligence Agency’s Predator drones have been infected by a potentially disastrous computer virus, which surreptitiously records every keystroke made by the pilots. Wired magazine’s Danger Room blog, which aired the exclusive report, said that the virus was discovered by the US Pentagon’s network security specialists less than two weeks ago. It also said that the virus has successfully resisted “multiple efforts” to remove it from the computers that guide the remote-controlled missions of the Agency’s unmanned drones. The blog cited a Pentagon computer specialist, who claims that he and his network security team “keep wiping it off and it keeps coming back”. The specialist also said that it is unclear at the present stage whether the computer virus is malicious or benign, in terms of its security implications. It also remains unknown whether the virus was introduced to the system intentionally or by accident, and how far it has spread into the system. It has been confirmed that the primary task of the virus is keylogging —recording all keystrokes made by users. But nobody at the Pentagon seems to know what happens to the keylogged data —that is, whether it remains within the Predator drone computer system, or whether it is clandestinely transmitted to individuals located outside the US military’s chain of command. The Wired report notes that there have been no reports of incidents relating to compromised information as a result of the keylogging virus. Read more of this post