News you may have missed #620 (cyberespionage edition)

GCHQ

GCHQ

►►Canada government ‘warned prior to cyberattack’. Canada’s spy agency, CSIS, warned the government that federal departments were under assault from rogue hackers just weeks before an attack crippled key computers. A newly released intelligence assessment, prepared last November, sounded a security alarm about malicious, targeted emails disguised as legitimate messages —the very kind that shut down networks two months later.
►►GCHQ warns cyber crime reaches ‘disturbing’ levels. Cyber attacks on the British government, the public and industry have reached “disturbing” levels, according to the director of Britain’s biggest intelligence agency. Iain Lobban, who runs the British government’s listening centre, GCHQ, has warned that the “UK’s continued economic wellbeing” is under threat.
►►Japanese parliament hit by cyber-attack. Alleged Chinese hackers were able to snoop upon emails and steal passwords from computers belonging to lawmakers at the Japanese parliament for over a month, according to Japanese daily Asahi Shimbun. The paper claims that computers and servers were infected after a Trojan virus was emailed to a Lower House member in July. The Trojan then allegedly downloaded malware from a server allegedly based in China —allowing remote hackers to secretly spy on email communications and steal usernames and passwords from Japanese lawmakers.

News you may have missed #617

Ilan Grapel

Ilan Grapel

►►Analysis: Is the CIA Still an Intelligence Agency? Early September 2011, a former intelligence official commented to The Washington Post that, “The CIA has become one hell of a killing machine”. He then attempted to retract, but his words were on record. But is that really what it should be: a hell of a killing machine?
►►US National Security Agency helps Wall Street battle hackers. The National Security Agency, a secretive arm of the US military, has begun providing Wall Street banks with intelligence on foreign hackers, a sign of growing US fears of financial sabotage. While government and private sector security sources are reluctant to discuss specific lines of investigations, they paint worst-case scenarios of hackers ensconcing themselves inside a bank’s network to disable trading systems for stocks, bonds and currencies, trigger flash crashes, initiate large transfers of funds or turn off all ATM machines.
►►Israel okays deal with Egypt to free alleged spy. Israel’s security cabinet unanimously approved an agreement Tuesday for the release of Israeli-American law student Ilan Grapel (pictured), who has been in jail in Egypt since June 12 on spying allegations that were later reduced to incitement. In exchange, Israel will release 22 Egyptian prisoners, most of them Bedouin from the Sinai jailed for smuggling drugs or weapons.

Computer virus found on CIA’s Predator drone remote-control system

Predator drone

Predator drone

By JOSEPH FITSANAKIS | intelNews.org |
The remote control cockpits of the US Central Intelligence Agency’s Predator drones have been infected by a potentially disastrous computer virus, which surreptitiously records every keystroke made by the pilots. Wired magazine’s Danger Room blog, which aired the exclusive report, said that the virus was discovered by the US Pentagon’s network security specialists less than two weeks ago. It also said that the virus has successfully resisted “multiple efforts” to remove it from the computers that guide the remote-controlled missions of the Agency’s unmanned drones. The blog cited a Pentagon computer specialist, who claims that he and his network security team “keep wiping it off and it keeps coming back”. The specialist also said that it is unclear at the present stage whether the computer virus is malicious or benign, in terms of its security implications. It also remains unknown whether the virus was introduced to the system intentionally or by accident, and how far it has spread into the system. It has been confirmed that the primary task of the virus is keylogging —recording all keystrokes made by users. But nobody at the Pentagon seems to know what happens to the keylogged data —that is, whether it remains within the Predator drone computer system, or whether it is clandestinely transmitted to individuals located outside the US military’s chain of command. The Wired report notes that there have been no reports of incidents relating to compromised information as a result of the keylogging virus. Read more of this post

News you may have missed #570

Nassr al-Mabrouk Abdullah

Abdullah Nassr

►►Libya internal security chief defects. Egyptian airport officials said Nassr al-Mabrouk Abdullah, Muammar al-Gaddafi’s interior minister, landed in a private plane in Cairo with nine family members traveling on tourist visas. Nassr was the minister responsible for police, civil defense, domestic intelligence, and some border security units.
►►S. Korea admits 1962 death occurred in spy training camp. A special committee is reviewing whether the family of a South Korean man who died half a century ago while being trained as a spy for elite missions into North Korea is eligible for compensation. South Korea’s military intelligence command admitted in a July 14 letter that “Mr. Jeon Gwang-su died during training on Sept. 30 of 1962 ahead of being dispatched for a mission in the North”.
►►NSA announces ‘hiring blitz’. The National Security Agency, America’s largest cryptologic intelligence agency, has announced its intention to hire as many as 3,000 people over the next two years, many of them cybersecurity experts. In fact, NSA recruiters even took a trip to Las Vegas in the last few weeks to look for potential hires at DefCon, a high-profile hacker conference there.

Ex-CIA counterterrorist chief says al-Qaeda to turn to computer hacking

Cofer Black

Cofer Black

By JOSEPH FITSANAKIS | intelNews.org |
The strategic retreat currently being experienced by al-Qaeda will force the group to concentrate on inflicting damage on its enemies through the Internet. This is the opinion of Cofer Black, the straight-talking CIA veteran who retired in 2002 as Director of the Agency’s Counterterrorism Center. Black, who is known for his hawkish views on Washington’s ‘war on terrorism’, gave the keynote speech on Wednesday at the Black Hat Technical Security Conference in Las Vegas, Nevada. He told an audience of nearly 7,000 conference participants that “the natural thing” would be for al-Qaeda in the post-bin-Laden age to continue to engage in terrorism by “fall[ing] back to things that are small and agile”, with computer hacking being an ideal candidate. Black, who since 2002 has worked for private contractors, including Blackwater/Xe, illustrated his point by referring to Stuxnet, the elaborately programmed computer virus that targeted electronic hardware in Iran’s nuclear energy program in July of 2010. “The Stuxnet attack is the Rubicon of our future”, said the former CIA official, adding that it was the computer virus designed to cause “physical destruction of a national resource”. Black is rightly revered by intelligence observers for having warned US government officials of a large-scale terrorist attack in August of 2001, one month prior to the September 11 hijackings. Having said this, it is not exactly prophetic to state, as he did, that “cyber will be a key component of any future conflict”. Read more of this post

News you may have missed #548 (China edition)

NIS HQ

By IAN ALLEN | intelNews.org |
►►China detains Korean spy officers. It emerged last week that Chinese authorities have kept in detention for nearly a year two South Korean NIS intelligence officers, who were caught collecting information about North Korea on Chinese soil. It appears that the Chinese did share the information with the North Koreans, because usually the North Korean news agency would have announced this when the officers were first arrested. Of course, NIS denied the Chinese report. ►►US intelligence on China declassified. George Washington University’s National Security Archive has published a series of declassified US intelligence reports on China, spanning the period from 1955 until 2010. In one report authored in 2005, US intelligence analysts speculate that Beijing might be trying to develop a capability to incapacitate Taiwan through high-power microwave and electromagnetic radiation, so as not to trigger a nuclear retaliation from the US. ►►IMF investigators see China behind computer hacking. Back in June, intelNews reported on a massive and sophisticated cyberattack on the computer systems of the International Monetary Fund, which experts claimed was “linked to a foreign government”. Read more of this post

News you may have missed #544

Google

Google

By IAN ALLEN | intelNews.org |
►►Russia a ‘leading suspect’ in cyberespionage attack on US. I wrote on Monday about the cyberespionage operation that targeted a leading US defense contractor last March, and resulted in the loss of tens of thousands of classified documents. US Deputy Defense Secretary William J. Lynn III, who disclosed the operation, said only that it was conducted by “a foreign intelligence service”. According to the last sentence of this NBC report, US officials see Russian intelligence as “one of the leading suspects” in the attack. ►►Al-Qaeda acquires Pakistani spy service manuals. Jamestown Foundation researcher Abdul Hameed Bakier reports that al-Qaeda operatives have managed to get access to espionage training manuals used by Pakistan’s Inter-Services Intelligence directorate (ISI). Copies of the documents have apparently been posted on Internet forums that are sympathetic to al-Qaeda, and bear the mark of the As-Sahab Foundation, al-Qaeda’s media wing. ►►Google-NSA collaboration documents to remain secret —for now. Even before Google shut down its operations in China, following a massive cyberattack against its servers in early 2010, the company has maintained close contact with American intelligence agencies. But after the 2010 cyberattack, some believe that Google’s relationship with the US intelligence community has become too cozy. In February of 2010, the ACLU said it was concerned about Google’s contacts with the US National Security Agency (NSA). Other groups, including the Electronic Privacy Information Center (EPIC), have filed Freedom of Information Act (FOIA) requests seeking access to the inner workings of Google’s relationship with NSA. Read more of this post

News you may have missed #542

Sir John Chilcot

Sir John Chilcot

By IAN ALLEN | intelNews.org |
►►Ex-spy says MI6 cut corners to back Blair’s Iraq war case. Britain’s ongoing Iraq Inquiry headed by Sir John Chilcot, heard last week from a former spy, identified in documents only as “SIS2”. The witness said that MI6 was “probably too eager to please” the government and was guilty of “flying a bit too close to the sun”. He was referring to the intelligence support provided by MI6 in support of the case for entering the Iraq War, made by the Labour government of Prime Minister Tony blair in 2003. He also told the committee that “the pressure to generate results, I fear, did lead to the cutting of corners”. ►►Medical group criticizes CIA’s vaccination scheme. A whimiscal tone prevails in most articles on the recent revelation that the CIA tried to collect DNA evidence on Osama bin Laden by running a phony vaccination program in Abbottabad, Pakistan. But medical groups engaged in organizing vaccination schemes are not amused. French-based international medical aid charity Médecins Sans Frontières has lashed out at the CIA because, it said, by using a medical cover for its assassination scheme, the Agency endangered those who conduct life-saving immunization work around the world. Read more of this post

News you may have missed #532

Viru Hotel

Viru Hotel

By IAN ALLEN | intelNews.org |
A new exhibition in Tallinn, called The Viru Hotel and the KGB, showcases the Soviet KGB operations in the Estonian capital’s most prestigious Soviet-era hotel. According to the curators, the 23rd floor of the hotel served as the KGB’s operational center in the city. The exhibition focuses specifically on KGB bugging technology during the last stages of the Cold War. Speaking of the Cold War, The Oak Ridger hosts an interesting interview with Francis Gary Powers Jr., son of the CIA pilot who was shot down over the USSR and later captured by the Soviets in 1960. Powers insists his father “never divulged America’s secrets” during his two-year imprisonment in Moscow. Interestingly, declassified documents from that time show that the CIA doubted Powers’ plane had been shot down by the Soviets, and believed the pilot had willingly defected to the USSR. In Canada, meanwhile, a new report to parliament by the Canadian Security Intelligence Service’s (CSIS), claims that cyber-spying is fastest growing form of espionage in the country. The report also states that, as a matter of policy, CSIS views some private-sector cyberattacks as a national security issue.

News you may have missed #530

  • Another spy ring reportedly busted in Kuwait. Kuwait has allegedly busted another spy ring, working for the intelligence services “of an Arab country [that] is currently embroiled in political turmoil”, reports Al-Jaridah daily. The paper also said that information gathered by the spy ring was sent to a liaison officer in the embassy of that country. Last April, two Iranians and a Kuwaiti national, all serving in Kuwait’s army, were sentenced to death for belonging to an Iranian spy ring.
  • How defectors come in from the cold. Interesting historical account of how defectors adjust to their new lives, from the BBC’s News Magazine. Sadly, much of the article is about –you guessed it– the Cambridge Five, which the British seem unable to get over, half a century later.
  • UK report says hackers should fight cyber spies. Britain faces losing its position at the leading edge of technology unless new ideas are developed to fight cyber attacks, including recruiting computer hackers to help fight organized cyber crime and espionage by foreign powers. This is the conclusion of a new report by the University College London’s Institute for Security and Resilience Studies.

Massive IMF cyberattack ‘was state-backed’, say sources

International Monetary Fund seal

IMF seal

By JOSEPH FITSANAKIS | intelNews.org
A massive and sophisticated cyberattack that targeted the computer systems of the International Monetary Fund last month was “linked to a foreign government”, according to sources familiar with the incident. The IMF, an international institution which oversees financial crises around the world, revealed the security breach in an internal email sent last week, but has yet to make a public announcement about the incident. Although the cyberattack was not publicly announced, it was revealed last weekend by The New York Times, which cited a “security expert […] familiar with the incident”. The paper notes that IMF’s computer databases function as “a repository of highly confidential information about the fiscal condition of many nations”, and that they contain “potentially market-moving information”. British daily The Independent adds that “internal political opponents and foreign intelligence services could […] find [in the IMF databases] explosive information about government dealings with the fund”. Intriguingly, the attack occurred in the weeks prior to the arrest of the Fund’s Director, Dominique Strauss-Kahn, who was detained on American soil on charges of sexually assaulting a female worker at his luxury New York hotel. Read more of this post

News you may have missed #517

  • New Zealand to launch new cybersecurity agency. The new National Cyber Security Centre will protect high-risk government agencies from attacks by cyber spies and criminals. It will also take on the functions of the Centre for Critical Infrastructure Protection, which helps protect critical national infrastructure such as the computer networks of banks and power companies.
  • New book on China-US spy wars. An extensive review by Joseph Goulden (author of SpySpeak: The Dictionary of Intelligence) of David Wise‘s new book, Tiger Trap: America’s Secret Spy War with China, which has been published by Houghton Mifflin Harcourt.
  • Over 1,000 cyber attacks against UK MoD last year. Criminals and foreign spy agencies launched more than 1,000 cyber attacks on Britain’s Ministry of Defence last year in an effort to steal secrets and disrupt services, Britain’s Defence Secretary Liam Fox has revealed.

News you may have missed #483

  • Ex-CIA chief criticizes ‘too much cybersecurity secrecy’. In an article published in the new issue of the US Air Force’s Strategic Studies Quarterly, former CIA and NSA Director, General Michael “I-want-to-shut-down-the-Internet” Hayden, argues that the US government classifies too much information on cybersecurity vulnerabilities.
  • Renault arrests security chief over spy hoax. Dominique Gevrey, a ex-military intelligence agent, who is French car maker Renault’s chief of security, has been arrested in Paris, just before boarding a flight to Guinea in West Africa. He is accused of concocting the spying allegations which shook the French car giant –-and the entire motoring world-– last January. Meanwhile, Renault has apologized to the three senior executives who were fired after being accused of selling secrets about the company’s electric car strategy to “foreign interests”.
  • Analysis: Gadhafi’s spies keep watch in Libyan rebel capital. “Pro-Gaddafi spies are blamed for assassinations, grenade attacks, and sending rebels threatening text messages. Rebels believe that Gaddafi’s forces are all around them. They lurk outside the Benghazi courthouse that serves as the Capitol for the liberated east, sometimes armed with cameras. They sit in vans outside hotels that house journalists and aid workers, and silently watch who comes and goes”.

Experts see nation-state behind sophisticated computer virus attack

Ahmadinejad

By IAN ALLEN | intelNews.org |
Computer forensics specialists are split as to the purpose and initial target of a sophisticated computer virus that infected computers used in the Iranian government’s nuclear energy program. The virus, named Stuxnet, was discovered in Iran in June by a Belarusian computer security firm doing business in the Islamic Republic. It has since infected at least 100,000 computer systems in countries such as Brazil, India, Russia and the United States. But the primary target of the virus appears to have been the Iranian nuclear energy program, specifically computers located at the Islamic Republic’s nuclear reactor facility in Bushehr and the uranium enrichment plant in Natanz. Several commentators, including Wired magazine, dispute the existence of any evidence pointing to a clear target inside Iran.  But Israeli media maintain that computers at Natanz were the primary target of Stuxnet, and that subsequent infections at computer labs at Bushehr were in fact an unintended side effect. Read more of this post

Police see ‘professional job’ in British spy’s death

Gareth Williams

Gareth Williams

By JOSEPH FITSANAKIS | intelNews.org |
As authorities investigate the recent death of British spy Dr. Gareth Williams, the country’s notorious tabloid media industry is having a field day disorienting interested observers. It is thus easy to miss important news breakthroughs in the cacophony of sensationalized headlines about Williams, whose body was discovered a week ago, stuffed in a sports duffle bag in the bath of his London apartment. One such breakthrough was yesterday’s report by Britain’s widely respected Channel 4, which said that law enforcement investigators described Williams’ death as “a neat job”, a term used to refer to professional killings. The Channel 4 report was preceded by strong official denials by police that Williams’ murder was sex-related, as had been previously reported. Some investigators now believe that Williams was killed by a foreign agent, who then deliberately “planted a trail of clues” pointing to a homosexual link to the death. Read more of this post