Sophisticated cyberespionage operation focused on high-profile targets

Rocra malware programming codeBy JOSEPH FITSANAKIS | intelNews.org |
After Stuxnet and Flame, two computer programs believed to have made cyberespionage history, another super-sophisticated malware has been uncovered, this time targeting classified computer systems of diplomatic missions, energy and nuclear groups. The existence of the malware was publicly announced by Russian-based multi-national computer security firm Kaspersky Lab, which said its researchers had identified it as part of a cyberespionage operation called Rocra, short for Red October in Russian. The company’s report, published on Monday on Securelist, a computer security portal run by Kaspersky Lab, said that the malware has been active for at least six years. During that time, it spread slowly but steadily through infected emails sent to carefully targeted and vetted computer users. The purpose of the virus, which Kaspersky Lab said rivals Flame in complexity, is to extract “geopolitical data which can be used by nation states”. Most of the nearly 300 computers that have so far been found to have been infected belong to government installations, diplomatic missions, research organizations, trade groups, as well as nuclear, energy and aerospace agencies and companies. Interestingly, the majority of these targets appear to be located in Eastern Europe and former Soviet republics in Central Asia. On infected computers located in North America and Western Europe, the Rocra virus specifically targeted Acid Cryptofiler, an encryption program originally developed by the French military, which enjoys widespread use by European Union institutions, as well by executive organs belonging to the North Atlantic Treaty Organization. Read more of this post

News you may have missed #818 (USA edition)

Osama bin LadenBy IAN ALLEN | intelNews.org |
►►The real-life female CIA officer who helped track bin Laden. The Washington Post has a good article on the real-life career of a female CIA officer who helped the Agency track al-Qaeda founder Osama bin Laden. It is disappointing, however that the article, authored by Greg Miller and Toby Warrick, is headlined “In Zero Dark Thirty she’s the hero; in real life, CIA agent’s career is more complicated”. The CIA employee in question is not an “agent”; she is an officer. In the CIA, agents are assets, people recruited and handled by CIA officers. Amazing that The Post, with its experienced journalists and editors would confuse such a basic operational distinction.
►►US spy agencies to detail cyber-attacks from abroad. The US intelligence community is nearing completion of its first detailed review of cyber-spying against American targets from abroad, including an attempt to calculate US financial losses from hacker attacks based in China. The National Intelligence Estimate, the first involving cyber-espionage, will also seek to determine how large a role the Chinese government plays in directing or coordinating digital attacks aimed at stealing US intellectual property, according to officials who spoke on the condition of anonymity to discuss a classified undertaking.
►►CIA begins LGBT recruiting. As part of the CIA’s efforts to diversify its workforce, the spy agency is reaching out to a group that once was unable to get security clearance: lesbians and gay men. CIA officials have held a networking event for the Miami gay community sponsored by the Miami-Dade Gay and Lesbian Chamber of Commerce and the CIA. “This is the first time we’ve done a networking event of this type with any of the gay and lesbian chamber of commerces in the United States,” says Michael Barber, a self-identified “straight ally” and the spy agency’s LGBT Community Outreach and Liaison program manager.

Ex-intelligence official: cyber espionage more dangerous than terrorism

Raymond BoisvertBy JOSEPH FITSANAKIS | intelNews.org |
A former senior member of Canada’s intelligence community has said that the threat of cyber espionage requires more resources that are currently being diverted to counterterrorism. Ray Boisvert, who retired last year from the post of Assistant Director of Intelligence for the Canadian Security Intelligence Service (CSIS), said in an assertive speech last week that cyber espionage is “fundamentally undermining [Canada’s] future prosperity as a nation”. Speaking on Friday in Ottawa, Boisvert compared cyber espionage to the climate-change debate, which has been marked by a series of ignored warnings, due to “some willful blindness on behalf of individuals”. As a result, he said, the need to establish essential security measures to protect worldwide electronic infrastructure is being neglected, while desperately needed resources are being diverted to counterterrorism. He explained the lack of action on three levels: first, the resistance emanating from technologically challenged decision-makers in the government and private sector, who simply do not understand the technical complexities of digital telecommunications security. Second, it is rooted in the government’s reluctance to invest the funds required to shield the nation’s communications infrastructure from espionage attacks. Finally, he placed the blame on the fragmentation and shortsightedness of the private sector, which owns and operates nearly 90 percent of Canada’s critical communications infrastructure and yet is too consumed by competition to sit around the same table on matters of security. In giving examples of the seriousness of the threat of cyber espionage, Boisvert cited the attacks last year on the computer systems of Canada’s Treasury Board and Finance Department, which compromised trade secrets of several national industries. He also mentioned the attacks on Nortel Networks Inc., which he said lasted for over a decade and may have contributed to the company’s 2009 demise. Read more of this post

News you may have missed #783

Uri SaguyBy IAN ALLEN | intelNews.org |
►►Israeli ex-intel chief says warns of ‘hysteria’ over Iran. Major General Uri Saguy (a.k.a. Uri Sagi), who was head of the IDF’s Operations Directorate during the 1982 Lebanon war, and Military Intelligence chief from 1991 to 1995, has warned of an “orchestrated and purposely timed hysteria that puts the country into a state of anxiety, artificial or not”, regarding the Iranian nuclear issue. Saguy, who resigned from the IDF in 1995 due to a conflict between him and the Chief of General Staff, added that “it would be a mistake if Israel uses force, certainly now, in order to thwart the Iranian nuclear potential”. The essence of Saguy’s message, notes Ha’aretz‘s Amir Oren, is that Israel’s citizens cannot trust Defense Minister Ehud Barak or Prime Minister Benjamin Netanyahu.
►►Australian spy chief warns of economic espionage. The director-general of the Australian Security Intelligence Organisation, David Irvine, has warned that the online revolution has left Australian companies increasingly vulnerable to cyber attacks and commercial espionage. Speaking to a business audience in Canberra, Irvine said that most online attacks in the business world go undetected, despite growing awareness of the threat. Asked how much commercial cyber crime went undetected, he said: “I would be very surprised if we who are active in this area are picking up the greater proportion of it, in fact, quite the reverse”.
►►Top US military official objects to attack on Iran. As Israeli officials are telling local reporters that they’re really, really ready to attack Iran’s nuclear facilities, and they mean it this time, the top US military officer is saying what a terrible idea that would be. “I may not know about all of [Israel’s] capabilities”, said General Martin Dempsey, the chairman of the Joint Chiefs of Staff. “But I think that it’s a fair characterization to say that they could delay but not destroy Iran’s nuclear capabilities”. Left unsaid: in a few years, the US and Israel would be back to the same standoff with Iran —except this time it might do so amidst a proxy terrorist war to avenge the Iranians.

News you may have missed #771

Shawn HenryBy IAN ALLEN | intelNews.org |
►►Analysis: Ex FBI official says foreign spies biggest online threat. Former FBI executive assistant director Shawn Henry has warned that the biggest threat online comes not from terrorists or hackers, but from foreign intelligence organizations looking to steal intellectual property. “The threat from computer attack is the most significant threat we face as a society, other than a weapon of mass destruction”, he said in his opening keynote at the Black Hat 2012 conference in Las Vegas. “Everything we do —R&D, intellectual property, and corporate strategies— is stored or transmitted electronically. The DNA of companies is available to bad guys”.
►►Taiwanese officials jailed for espionage. Two Taiwanese former officials have been sent to prison by the Taiwan High Court for leaking state secrets to China. Presidential Office official Wang Ren-bing was jailed for two years after being found guilty of passing confidential information about President Ma Ying-jeou’s May 2008 inauguration to Chinese intelligence operatives. Chen Pin-jen, a former aide of Chinese Nationalist Party (KMT) Legislator Liao Kuo-tung, was sentenced to eight months in prison for delivering the confidential information Wang gave him to China. The two were arrested in 2009.
►►Germany charges suspected Syrian spy. A spokeswoman for federal prosecutors in Germany said Sunday that they have filed charges against suspected Syrian spy Akram O., one of two men arrested on suspicion of having spied on Syrian opposition activists in Germany for several years. The two were arrested in February during a sting operation involving over 70 German counterintelligence operatives, who searched the suspects’ apartments. The spokeswoman said she could not give further details before an official confirmation is issued that the suspect and the defense team have received the indictment.

News you may have missed #754

Jonathan EvansBy IAN ALLEN | intelNews.org |
►►New German spy HQ to open a year late. The BND, Germany’s foreign intelligence service, was due to move from its base in Pullach, near Munich, to an enormous newly built center in Berlin, at the end of 2014. But that has now been officially put back by a year. The Berliner Morgenpost newspaper quoted BND president Gerhard Schindler saying he was “regularly losing young new staff”, due to the delay. The uncertainty has meant “they leave our authority and find themselves another employer”, he said.
►►UK spy chief warns of ‘astonishing’ levels of cyberespionage. In a rare public speech, Jonathan Evans, director general of MI5, Britain’s domestic spy service, has said that the West now faces an “astonishing” cyberespionage threat on an “industrial scale” from specific nation states. He said that cyberespionage is now conducted “with industrial-scale processes involving many thousands of people lying behind both state-sponsored cyber espionage and organized cyber crime”. Surely, however, Evans does not mean to imply that the West’s role in cyberespionage is purely defensive?
►►Aussie spy agency lacks resources to vet asylum seekers. An official audit into the Australian Security Intelligence Organisation’s ability to vet asylum seekers for potential security threats, has found that it is struggling with the “sharp increase” in boat arrivals, rudimentary computer systems and 30 per cent fewer staff than needed. The audit report examined 411 cases as a sample of the almost 180,000 security assessments ASIO completes each year.

US and Israel behind computer virus that hit Iran, say sources

Flame virus code segmentBy JOSEPH FITSANAKIS | intelNews.org |
Flame, a sophisticated computer malware that was detected last month in computers belonging to the Iranian National Oil Company and Iran’s Ministry of Petroleum, was created by Israel and the United States, according to a leading American newspaper. Quoting “officials familiar with US cyber-operations”, The Washington Post reported on Wednesday that the malware, which is said to be “massive in size”, is part of a wider covert program codenamed OLYMPIC GAMES. The paper said that the US portion of the program is spearheaded by the National Security Agency, which specializes in cyberespionage, and the CIA’s Information Operations Center. The Post further claims that OLYMPIC GAMES has a three-fold mission: to delay the development of the Iranian nuclear program; to discourage Israeli and American officials from resorting to a conventional military attack on Iran; and to buy time for those officials who favor addressing the Iranian nuclear stalemate with diplomatic pressures coupled with sanctions. According to one “former intelligence official” quoted in The Post, the scale of OLYMPIC GAMES “is proportionate to the problem that’s trying to be resolved”. Russian antivirus company Kaspersky Lab, which first spotted the Flame virus in May, said that it is “one of the most complex threats ever discovered”. It is over 20 megabytes in size, consisting of 650,000 lines of code. In comparison, Stuxnet, a computer super-virus that was detected by experts in 2010, and caused unprecedented waves of panic among Iranian cybersecurity experts, was 500 kilobytes in size. Read more of this post

Comment: Who authored computer virus that ‘dwarfs Stuxnet’?

Flame virus code segmentBy JOSEPH FITSANAKIS | intelNews.org |
When the Stuxnet computer virus was detected, in 2010, it was recognized as the most sophisticated malware ever created. It had been specifically designed to sabotage Siemens industrial software systems, which were used in Iran’s nuclear energy program. Not surprisingly, most Stuxnet-infected computers were in Iran. Now a new, massive and extremely sophisticated piece of malware has been detected in computers belonging to the Iranian National Oil Company and Iran’s Ministry of Petroleum. It is called Flame and, according to antivirus company Kaspersky Lab, which first spotted the virus last week, it is “one of the most complex threats ever discovered”. Simply consider that Stuxnet, which caused unprecedented waves of panic among Iranian cybersecurity experts, was 500 kilobytes in size. Flame is over 20 megabytes in size, consisting of 650,000 lines of code; it is so complex that it is expected to take programming analysts around a decade to fully comprehend. The two are different, of course. Stuxnet was an infrastructure-sabotaging malware, which destroyed hundreds —maybe even thousands—of Iranian nuclear centrifuges. Flame, on the other hand, appears to be an espionage tool: it aims to surreptitiously collect information from infected systems. What connects them is their intended target: Iran. We now have Stuxnet, the most complex sabotaging malware ever discovered, which must have taken dozens of programmers several months to create, and Flame, the world’s most powerful cyberespionage tool ever detected by computer security experts. And both have been primarily directed at Iranian government computers. Read more of this post

Comment: US cybersecurity posture is not purely defensive

NSA headquartersBy JOSEPH FITSANAKIS | intelNews.org |
In recent years, news coverage of cyberespionage and cybersecurity has increased several times over; both subjects have escaped the narrow confines of technical literature and have entered the broad expanses of popular news media. This blog is no exception; since 2008, we have covered both cybersecurity and cyberespionage at length. In looking back at our coverage, it takes but a cursory glance to conclude that most of our reports feature the names of two countries: China and –to a far lesser extent– Russia. Moreover, the vast majority of our cybersecurity and cyberespionage coverage portrays the United States as a defensive actor, trying desperately to protect the integrity of its networks from foreign hackers. But is this accurate? How realistic is it to assume that the US, the world’s leading military power, abstains from offensive cyberespionage as a matter of strategy? The most likely answer is: not very. The problem is that much of the reporting on cybersecurity is based on national allegiances. Many American media pundits thus tend to forget that Washington, too, conducts cyberespionage. Read more of this post

News you may have missed #735

Blast site in Deir Ezzor, SyriaBy IAN ALLEN | intelNews.org |
►►Pakistan imposes new restrictions on CIA operatives. The government of Pakistan has issued a set of new rules and regulations for officials, ambassadors and contractors of the United States Central Intelligence Agency (CIA). According to Pakistani news reports, Pakistan and the US finalized these new rules in the course of 13 meetings between representatives of both countries. Under the new rules, CIA officers deployed in Pakistan “must prove their identity” to Pakistani counterintelligence officials. Some officials, including former Pakistani ambassador to the United States Sherry Rehman, are already talking of a “new beginning for US-Pakistani relations”.
►►Car bomb strikes near Syrian intelligence agency. The Syrian Observatory for Human Rights confirmed reports on Saturday of an explosion in the Ghazi Ayyash neighborhood of the eastern Syrian city Deir al-Zour. The site of the blast, which killed at least seven people and injured 100 others, was close to the city branches of the Military Intelligence Directorate and Air Force Intelligence, the London-based activist group reported. There has been no immediate claim of responsibility for the attack.
►►China denies US cyberespionage claims. The Chinese government has hit back at a US Pentagon report that said it is carrying out aggressive cyber-spying as part of a military build-up. Chinese Foreign Ministry spokesman Hong Lei said “China’s justified and normal military development” had been unjustly criticized in the annual report, which was released on Friday. The development of China’s “limited” military force was only geared towards safeguarding its independence, sovereignty and territorial integrity, said the spokesman.

News you may have missed #714

Tjostolv Moland and Joshua FrenchBy IAN ALLEN | intelNews.org |
►►British PM urged to intervene in Congo spy case. The mother of Joshua French, who has dual British and Norwegian nationality, and is facing execution in the Democratic Republic of Congo, has urged British Prime Minister David Cameron to ask Congolese authorities to pardon him. French, and his Norwegian friend Tjostolv Moland, were sentenced to death for murder and spying in the vast central African country in 2009. A prison official claimed in August last year that the pair had tried to escape, but their lawyer denies this.
►►Computers of Syrian activists infected with Trojan. Since the beginning of the year, pro-Syrian-government hackers have steadily escalated the frequency and sophistication of their attacks on Syrian opposition activists. Many of these attacks are carried out through Trojans, which covertly install spying software onto infected computers, as well as phishing attacks which steal YouTube and Facebook login credentials. According to the Electronic Frontier Foundation, the latest surveillance malware comes in the form of an extracting file which is made to look like a PDF if users have their file extensions turned off. The PDF purports to be a document concerning the formation of the leadership council of the Syrian revolution and is delivered via Skype message from a known friend.
►►Report claims Australian government spied on anti-coal activists. The leader of the Australian Greens, Bob Brown, says he is outraged at reports that the Australian Security Intelligence Organisation (ASIO) is spying on mining protesters, and says such action is a misuse of the spy agency’s resources. The revelations were reported in Australian newspapers yesterday, and are based on a Freedom of Information request to the Department of Resources, Energy and Tourism that was reportedly rejected because it involved “an intelligence agency document”. The ASIO says it cannot confirm whether it has conducted surveillance of anti-coal protesters, but it says it does not target particular groups or individuals unless there is a security-related reason to do so.

News you may have missed #688

U-2 surveillance aircraftBy IAN ALLEN| intelNews.org |
►►Analysis: StratFor email leaks offer frightening view of government intelligence. As promised in December, WikiLeaks has begun to release a stash of emails related to the modus operandi of the private intelligence sector, using Texas-based StratFor as a case study. The CIA has long used private intelligence firms for ‘black ops’, allowing for plausible deniability in the event that an operation goes pear-shaped and public accountability threatens. But these emails suggest that there’s now far more to the incompetence of America’s intelligence services than meets the eye.
►►US still using U-2 to spy on North Korea. For more than 35 years, the U-2 has been one of Washington’s most reliable windows into military movements inside North Korea. Unlike satellites, U-2s can be redirected at short notice to loiter over target areas. Last month, the US Air Force postponed at least until 2020 any plans to replace them with costlier, unmanned Global Hawks. Now, as the world watches for signs of instability during North Korea’s transition to a new leadership, the U-2 operations are as important ―or more so― than ever.
►►Thin line separates cyberspies from cybercriminals. New research appears to raise questions over the conventional wisdom that pure nation-state cyberspies rarely dabble in traditional financial cybercrime. Dell SecureWorks Wednesday shared details of a complex study it conducted of two families of espionage malware that have infected government ministry computers in Vietnam, Brunei, Myanmar, Europe, and at an embassy in China.

US expels Venezuelan diplomat over cyberespionage allegations

Livia Acosta NogueraBy JOSEPH FITSANAKIS | intelNews.org |
The United States has ordered the immediate expulsion of the head of the Venezuelan consulate in Miami, over allegations that she helped coordinate a cyberattack against US government targets in 2008. The diplomat, Livia Acosta Noguera, was declared “persona non grata” (an unwelcome person) by the US Department of State last Friday, and was given 72 hours to leave the country. State Department officials refused to discuss the reasons for Acosta’s expulsion. But the BBC said that the expulsion order was prompted by a letter sent last month to US Secretary of State Hillary Clinton by four members of the US Congress. The letter’s authors reportedly raised concerns about a documentary aired in December by Univision, a US-based Spanish-language broadcaster, titled “The Iranian Threat”. According to reports, the documentary alleged that Acosta was part of a multinational team of diplomats from Venezuela, Iran and Cuba, who, while stationed in Mexico in 2008, helped orchestrate a cyberespionage operation against US targets. The alleged operation was aimed at computer servers belonging to the US government computer, including some at the Department of Defense, the National Security Agency, the Central Intelligence Agency, and the White House. Computer servers at several nuclear power plants across the US were also reportedly targeted. The documentary exposé, which later appeared in print in US-based Spanish-language newspaper El Nuevo Herald, included allegations that Acosta is in fact a member of the Bolivarian Intelligence Service, Venezuela’s foremost external intelligence agency. Read more of this post

Analysis: The strange world of cyberspy vendor conferences

ISS WorldBy JOSEPH FITSANAKIS | intelNews.org |
It is common knowledge among intelligence observers that espionage activity around the world is on the increase, having in some cases surpassed Cold-War levels. The main facilitator of this phenomenon is technological, namely the ease of access to classified information afforded by relatively safe cyberespionage techniques. In our 21st-century, therefore, the spy v. spy game takes place largely online. Ironically, however, many of the government agencies engaged in offensive cyberintelligence operations against each other buy the required software and hardware from the same vendors. The latter are private companies, headquartered in Milan, London, Johannesburg, Montreal, and other cities around the world, which periodically participate in industry trade shows. These gatherings are eerie, secretive meetings, frequented by international spies representing various governments, and are strictly closed to outsiders. Vernon Silver, of Bloomberg, which has done an admirable job lately tracking the operations of these secretive vendors, has penned a fascinating exposé of one such bizarre trade show, called ISS World. Known informally as ‘Wiretappers Ball’, ISS (short for Intelligence Support Systems) World convenes several times a year in various cities around the world. One recent show, which took place in Malaysia, hosted nearly 1,000 attendees from 56 countries, writes Silver: “unlike trade shows, this one had no social events [and] no corporate-sponsored cocktail parties”. Instead, merchants of communications interception technologies offered demonstrations to agents of various governments, of what is called “offensive IT intelligence”. These demonstrations, conducted by appointment only in darkened conference rooms, center on technologies that can hack cell phones, break into email accounts, unscramble encrypted Skype calls, and surreptitiously access targeted web cams. Read more of this post

Comment: Is China the New Spy Superpower?

US and China

US and China

By JOSEPH FITSANAKIS* | intelNews.org |
In fifteen years of monitoring intelligence-related developments, I have rarely seen so many news items about China appear simultaneously in the Western press, as I did during the past fortnight. On December 5, financial news network Bloomberg reported that the United States government invoked “Cold War-era national security powers” to compel telecommunications companies operating on American soil to disclose confidential data about their networks. The plan, spearheaded by the US Department of Commerce, but undoubtedly prompted and monitored by the National Security Agency, features a detailed survey distributed to dozens of telecommunications service providers, as well as hardware and software developers. The latter are reportedly required to supply “a detailed accounting” of every piece of “foreign-made hardware and software” installed on their networks, in a move that Bloomberg interprets as “a hunt for Chinese cyber-spying”. A few days later, intelligence researcher and author David Wise opined in The New York Times that the West had better recognize that China “has developed a world-class espionage service —one that rivals the CIA”. He qualified his statement by providing several examples of major espionage triumphs achieved by the Chinese intelligence services in the last decade, such as the acquisition of design blueprints for the US-built B-1 bomber and Northrop Grumman’s B-2 stealth bomber. Other examples given by Wise include China’s attainment of the design specifications for the US Navy’s Quiet Electric Drive system, aimed at enhancing the stealth abilities of submarines, as well as the remains of the modified Black Hawk helicopter that crashed in Abbottabad, Pakistan, during the CIA-led operation to assassinate al-Qaeda founder Osama bin Laden last May. Most of all, Wise laments the acquisition by the Chinese of the design specifications for the W-88 warhead, the symbol of America’s next-generation of mini-nuke weapons. Read more of this post