Project Viglio: There Will Be CyberDouchery!

ecyenixsoyokdbnjwinbgy

Once Upon A Time….

Once upon a time, not too long ago, at Defcon, a guy no one really heard of stepped up and claimed he was starting a new “group“ and needed volunteers and money. This was Chet Uber, and after some time, and some posts, we all thought this little group with the misspelled logo (viglio is not vigilant wink wink nudge nudge) but it seems that they just fell off the radar instead of imploding. I had previously written about the whole debacle in the making a bit ago and gave it no more thought, that is until today when someone passed me the article linked above. It seems that they have been slinking around doing.. “something” and gaining alleged members like Vint Cerf? Really Vint? You’re gonna hang your hat with Uber?

*blink blink*

*Que Swordfish Soundtrack*

Wow, stellar… Ok, so, back to the show here. This article out today seems like a bit of a play for money to me. After all, there’s the “We’re secret and we do secret attribution things but, we are running in the red” *pulls pockets out and shows the lint* So, why allow an article to be written by a second rate blog cum news source online? Allowing super secret access to all their super secret bits to do a tell nothing piece?

*sniff sniff* Smell that? It’s “CyberDouchery”

Oh, There WILL be Douchery

So, who do we have listed in the super secret organization according to what “could be told” by Chet and his crack team?

The group’s membership involves people from a wide range of disciplines and backgrounds. The current leaders who are willing to be publicly identified (other than Uber) include Mark Rasch, (General Counsel, Director of Cybersecurity for CSC), A.J. Fardella, (Director of Intelligence and Analysis, Director of Black Diamond Data and a planning commissioner for the city of Pittsburg, California), and Michael Tomasiewicz (Deputy Director and second in command to Uber, Network Specialist with ConAgra Foods). Others include Adrian Lamo who is the Assistant Director for Adversary Characterization, Doug Jacobsen (Director of Science & Technology, Professor of Electronics at Iowa State University), and Jeff Bardin (Assistant Director, Intelligence and Analysis – Middle East Desk, Chief Intelligence Officer for Treadstone 71).

Hmmm some names are familiar, and some have the patina of being legit.. Perhaps they are just idealists. All in all though, the same problems around this “organization” still apply. What are they really doing? Who are they reporting to if anyone? What support are they to LEO’s and why, if they have such luminaries in the biz like “Treadstone” *snort* are they not in fact funded by the government in some way? Also, if they are all doing this kind of work, what is the clearance level like here? Is the government in fact sharing data with these folks to bird dog things?

I somehow find this unlikely.

Also, the bulk of the people listed are not really overly technical so where are all the real technicians here? There are just a plethora of questions that come to mind with this feeble article on examiner.com and frankly, they open a real can of worms I think for anyone really paying attention to what’s going on with regard to attribution and general buggery that’s been going on since Stuxnet appeared. PSYOPS, Jester, Anon bullshit, it’s just been a festival of stupid out there and this just adds a fouler odor to the whole thing.  The worst part about it though is that the government may in fact be paying attention to these people and taking data from them as gospel.

*baleful stare*

Really USGOV?

So yeah, the government is not saying much here but we have Uber saying that they are doing all this work and passing all this data.. I really don’t see the government responding here or talking about “Project Vigilant” do you?

*Cough.. Anyone?*

So, once again, I ask you, if Viglio is not getting INTEL from the government and the military, then who might their targets be? Ya know, who’d be out in the open and available to the spooky eyeball in their cheesy logo?

*squints*

Hmmm say Anonymous? Or maybe anyone on the internet who might not share their opinion? See, this would be the optimum target for a group like this. A group of non condoned individuals not cleared for national security cases but wanting to help… Or am I just a paranoid old man?

Oh shut up! I know I am!

Anyway, I certainly hope the US Government takes all this with a grain of salt, that is, if they are taking this at all. Since Viglio is not telling exactly what they do, it is highly likely that they are just trawling the IRC channels looking for unsuspecting n00bs to capture with their wiles and then write nifty reports on them and pass them to their local field office… Which in fact might just throw them in the circular file… If they were smart. Unfortunately though, I suspect that there are customers for their data and in that, the fear of what they could be up to wells inside me, as it should all of you.

Given The Known Known’s… Shit, Should We Even Worry?

Ok, now that we know they are out there and we pretty much can surmise that they are not working super secret cases for the NSA, just what are they up to? As I alluded to above, I personally think they are just trolling the internet looking for hacker n00bs to turn in as would be APT.

But, that’s just me huh?

What? Others think so too?

Yep, they do.. On background I have talked to a couple of people in the know and they have the same opinions generally. Basically everyone feels that this is some sort of charlatan-esque effort on the part of a few who may in fact think they are doing the right thing. Others may be more motivated by ego and perhaps money (if there is any to be had) but generally, the feeling is that this is a pile of bad mojo. One source that I talked to said this (paraphrasing here)

“Ok, so we have a small community here and no one we know has been tapped for this duty or been asked about it? No one we know actually works with them? The odds of that within the INFOEC community are pretty that we would know several somebody’s who were actively working on it. The fact that we don’t bespeaks a problem with this organization”

There seem to be a lot more questions about this group than there are answers and no matter how many names with brand recognition you throw out there (mind you many of them thrown out there now are once again, non technical people or charlatans) you are kinda left with a sense of feeling dirty for having thought about them.

I Hope Our National Security Doesn’t Depend On These Quacks…

*hangs head*

Once again I come to you with a rant and a peek under the incestuous blanket of INFOSEC and CYBERDOUCHERY. I am sorry for those of you with delicate dispositions, but the tales must be told for all our own good. A group such as this, extra legal as they seem to be and rather deliberately evasive using the rubric of “secrecy” as their cloak should set all of your spidey senses off. At best they are a group of people seeking to do good but in fact may be doing ill by carrying out poor OSINT. At worst, they are a group  of people trying to boost their ego’s by thinking that they are secret squirrels and in the know.

Either way, I would hazard a bet that nothing good is coming of their machinations and anyone out there on IRC may find their names in files that they can FOIA request that came from tips by “Project Viglio”

This shit is just out of hand…

I suggest people look into their background and decide for themselves…

K.