A Few Words On Body Bombs and Security Theater…

//BEGIN

//UNCLASS

Has AQAP Been Watching “The Dark Knight” Or What?

It seems lately that the officials out there “in the know” have decided to allow a leak about a certain 15 page report alleging that Al-Asiri, the mad bomber/designer and much described “genius” of terror, has been attempting to perfect a design for an internal “body bomb” Now, no one really knows if this is indeed “the truth” or just how far Asiri may have come in his plans to create these surgically implanted bombs. However, what one can extrapolate from the press on this thing and the sources on “background” willing to talk, is that this seems to be more of a propaganda ploy than anything else on the face of it.

While I have no doubt that this vector of attack has been on the minds of AQ for a long time, so too has the use of CBRN, but to date, they have not been able to do anything in those areas and in fact the BIO warfare program they tried to start was a miserable failure. So, do we really see them getting to the point where a convincing as well as operational “body cavity bomb” is actually put to the test? I suspect that it may be some time until such a plan is put together and operational but as the media would have it now, as well as those leaking the “details” here, they seem to be saying FEAR NOW!

The Case for Surgically Implanted Munitions: Possible, Crazy, Exceedingly Hard to Pull Off

Now that we are all abuzz about the “surgically implanted bombs” lets take a look at the actual nitty gritty of how this would have to be conceived and acted on to work.

  1. You have to have a willing shahidi… Well, there are some out there so there you go. One that is willing to have srugery as well as recuperation time, well, ok… Harder but possible
  2. You have to have a sealed, self contained system that will not bleed (inside the device) and make it malfunction
  3. You have to have explosives that are high power and yet only require small amounts to be of use
  4. You have to have no metal parts to pass through the magnetometer
  5. You have to have a surgeon or surgeons willing to do the cutting and sewing (Well Ayman is a Dr. after all too so…)
  6. The device will have to be hidden enough inside the body so as to not alert others and preclude mobility issues (i.e. small, though the BVD bombs seem to be so as well)
  7. Your detonator has to be either chemical or electric/remote (timed or say an RF device) I lean toward chemical for these but who knows
All of these facts are not impossible to overcome, however, they are pretty tough in the long run to get working for you and have a success. Now, with all of this said, I guess the question then becomes are what are the odds that this is going to happen? Maybe even one might beg the question of how soon? You really have to want this and in much of the AQ mind, many things are termed as “aspirational”, a term meaning wild fantasy, much like a lot of their doctrine and hopes. This by no means means that they are in fact going to happen.

The Case for FUDDERY as A Means to an End For BOTH Sides

So, what we have here though seems to be a lot of clucking about bombs inside of people and the fear mongering that goes on with some quarters of the intelligence community feeding this all to the media. SOFREP, a site concerned with SOF (SPECOPS) had this story out there last week and now it seems to be making the rounds with backup data (background from anonymous sources) that the mad bomber is in fact working on this with a cadre of doctors. Of course one can only assume that this “data” is perhaps coming from the recent mole that got into AQAP posing as a suicide bomber and stole their new prototype BVD bomb.

If true, then yes, sure, they had plans and were trying to make a bomb system that would be hard to detect, I mean, how many MRI’s are at the airports now huh? If this data did not come from the mole though (and there is data that this has been floating around now since at least last fall, way before mole man) then why now is this being thrust upon the media? Or, now that I think about it, there was that arrest of the guy with the pr0n that had the stegged “future work” file in there.

AH HA!

I am willing to bet that is the provenance of the file in question. Ok, so, there you have it. We have the plans and.. What.. Why release this to the public? I mean, what real purpose does it serve other than to scare the populace into submission? In the SOFREP report there is mention of something along the lines of “So how do you feel about your L3 machine now?”Uhhh, just fine really, I mean, it won’t help me if there is a surgically implanted bomb, but it gets much of the rest of the stuff when used properly. I am guessing that the impetus here was to make the TSA look good, by saying “you think you are hassled now, but look at what the jihadi’s are planning!”

Honestly, sure, it could happen, but the odds are slimmer than one might think I think and this seems to be a play here to manipulate the public mindset. Others have called the same foul on the play here but I just wanted to put it down here and sort through all the issues to ascertain where the truth might lie. In this case, for me, it seems like this story serves the purposes of both sides. For one, the security services here and the politicians both get a win by leaking data to sow fear, a fear that was ever so well used in the past (like G’Dub’s admin) and others to sway thought and perhaps lessen resistance to certain things. On the other side, this also works for AQAP because even if they are planning it, they are causing us to create even more elaborate Rube Goldberg devices to stop them, costing us more money and time.

It’s a win win for all of them.. FUD it seems is a booming business.

So, IF They Make These Bombs Happen Then What?

In the end, it comes down to this; “What are we going to do?” Do we really expect that we will now install MRI’s and X-Ray machines in the TSA lines to scan our internal organs as well as the sniffer/blower/wand/m-wave that we already have? This is a means of bombing that would be hard to detect if done well and certainly would not easily be seen under clothes or even with an M-Wave scan if it is not protruding/bulging the persons body in some way. Hell, for that matter, AQAP should just be looking for morbidly obese shahidi candidates huh?

Certainly, leaking this data to the news serves little purpose than to perhaps get people (including those on the hill) to buy into new measures and monies to appropriate them? It would not make one whit of difference in the current protection scheme now would it? Frankly, if AQAP and A-Asiri have been working on this, and it were a major threat, I personally would not have been dropping this to the media. Keep the intel secret (as the report is alleged to be) and keep it out of the public eye…

Unless you all think that by leaking this data you are retarding the chances that AQAP will try this method? I really don’t think that will be the outcome here.

In the end.. I call shenanigans.

K.

//END

//UNCLASS

Anonymous, SCADA, LULZ, DHS, and Motivations

Anonymous Is Interested In PLC’s & SCADA?

A recent .pdf bulletin put out by Homeland Security (i.e. DHS) claims that certain actors within Anonymous (and by that they mean “anonymous”, I added the distinction) have shown interest in at least Siemens SIMATIC PLC’s and how to locate them online for exploitation. It seems that DHS though warning about this threat, is not too concerned about its actually being exploited by the group because they lack the expertise to attack them. So, why the BOLO on this at all? If the collective cannot do the damage to the infrastructure that you are entrusted in keeping safe, then why report on it at all as credible intelligence? It would seem to some, myself included, that Anonymous is not the problem that they are really worried about on the macro scale, but instead, those who may claim to be Anonymous hitting small scale facilities or pockets of targets for their own purposes.

And therein lies the difference.

If indeed Anonymous the collective is looking at attacking SCADA, one has to wonder at their reasons to target such systems. After all, if Anonymous takes out the power or poisons the water, it will not look good for them PR wise. In fact, were such things to happen in the name of Anonymous, I can pretty much guarantee you all that they would be enemy #1 pretty darned quick post an attack. However, if they were to target a company such as a car maker that pollutes, then, you have a real agenda (per their social agenda of late) So, the targeting is really key here and I will cover that later on.

DHS Jumping The Shark?

The motivations of the release by DHS have also  been called into question by some as to why they chose to talk about this at all. This is especially prescient since they take pains to say that the Anonymous movement “most likely” does not have the technical means and motive to really pull of these types of attacks on the infrastructure. So why even bother? Perhaps they are just covering their bases (or asses) just in case the Anon’s actually attack? Or perhaps, they too are clued in on the fact that even if claimed to be anonymous, it could be others working against the US (Nation State Actors) who have chosen to attack and use Anonymous as a cover so as to throw off attribution.

Either way, as some look at it, it is almost like they are daring Anonymous to do it out of spite because they are calling Anonymous’  factions and actors “inept” or “unskilled” which, might get their dander up a bit. All of these scenarios pretty much do not preclude someone hitting SCADA systems in the future and it being blamed on Anonymous, which will bring on a new wave of efforts by the government to stamp them out. Reciprocity being what it is, this too will mean that Anonymous might in fact gain strength and sympathy from such actions and fallout as well.

For me though, I just see DHS covering the bases so as to not be blamed later on should something happen. Not so much am I of the opinion that they are in some kind of propaganda war here with this little missive.

Motives, Means, Technical Abilities

So lets go with the theory that certain elements of the Anonymous collective want to mess with the infrastructure. Who would they target and why? More to the point, what companies would they target that fits their agenda?

  • Telco?
  • Power?
  • Manufacturing?

Those are the three areas that I could see as potential attack vectors. Though, once again I have to say that the only two that I see as real possible would be the telco and manufacturing and even the telco would be dangerous for them to try as well. I mean, if you start messing with Ebay or Paypal that’s one thing, its quite another to mess with national infrastructure, as these two would be considered. If indeed Anonymous hit them and took them down for whatever reason, they would then be directly considered terrorists… And that would be seriously bad for their movement and its legitimacy.

Now, we do know that the  Anon’s hit the BART system but as I remember it, it was BART that took out the communications infrastructure themselves so as to prevent communication between anon’s. So, this just doesn’t seem to fit for me either. Manufacturing though, as I made the case above, could be something they would try. It’s not national infrastructure and it will not take the country down if they stop something like cars  being made.

Is it just me? Or does anyone else just see this as a non starter for Anonymous central? What I do see is the threat of other actors using the nomme de guerre of Anonymous as cover for their actions to mess with the national infrastructure. Perhaps some of these people might in fact be motivated by anonymous, but, my guess that if there were to happen, it would be nation state driven… And something I have been warning about for some time.

Anonymous, as an idea, as a movement, will be subverted by those looking to fulfil their own ends and justify their means. All the while, they will let the Anon’s take the fall for it.

Governments

Nations

Nation States

… AND.. Corporations.

You know, those with the money and the people who could pull off the technical hacks required to carry these capers off.. Not a bunch of rag tag hacktivists and hangers on.

Blowback

In the end, what I fear is that there will be a great deal of blowback on Anonymous even talking about hacking and messing with infrastructure. The same can be said for their attempts on taking down Wall Street or the NYSE with their DD0S. If they had succeeded, they would have been an annoyance really, but that would not have caused any great fluctuation in the markets I think. No, unless they hacked into NYSE itself and exposed the fact that they had root in there, I think that it would have a very minimal effect on Wall Street and the economy at large.

Not to say that everything is going ever so well now…

DHS seems to have jumped the shark a bit for me on their BOLO and the coverage of this just tends to add to the FUD concerning SCADA and PLC code. Hell, for that matter we have the new Symantec report on DUQU that yells out about it being the “Son of Stuxnet” but in reality, it is more like a clone of Stuxnet used for APT style attacks by persons uknown..

Get yer FUD here!

Same goes for this DHS warning.

Your results may vary…

K.

Anon Analytics: Stock Manipulation Through Information Release & The Slippery Slope

It's all about the information Maaahhty

Cosmo: Posit: People think a bank might be financially shaky.
Martin Bishop: Consequence: People start to withdraw their money.
Cosmo: Result: Pretty soon it is financially shaky.
Martin Bishop: Conclusion: You can make banks fail.
Cosmo: Bzzt. I’ve already done that. Maybe you’ve heard about a few? Think bigger.
Martin Bishop: Stock market?
Cosmo: Yes.
Martin Bishop: Currency market?
Cosmo: Yes.
Martin Bishop: Commodities market?
Cosmo: Yes.
Martin Bishop: Small countries?

In a previous post I wrote about the nascent “Anon Analytics” group that had popped up claiming that they were going to out corruption in corporations by using OSINT and inside leaks/whistle-blowers. On the face of it, I thought this was a good idea and said as much in the post. I had caveats though that they confirm their information and that they be above board. I received a response from Anon Analytics thanking me for the article and that they had found it interesting.  I however, had failed to read the disclaimer on the first report by Anon Analytics and as such, this is my mea culpa as well as another warning to Anon that they need to keep things above board here.. Lest they become just as bad as those who they are claiming they are outing for misdeeds.

I was alerted to an article from Finance Asia that called them on the fact that within this disclaimer, they are making the statement that the assumption must be made that the “Partners, Affiliates, Consultants, Clients, and other related parties” hold “short” positions in the securities profiled in the report. Which means that all of the parties named there will profit from shorts due to the data being released and potentially causing the stock to plummet and fail.

Say.. Isn’t that what got us all into this fix today with the markets and the banks in general?

Yes, indeed, that is the case and this statement within their disclaimer alone causes me to pretty much rescind my previous statements about any kind of approval for these efforts by Anon Analytics. Really, this is the pot calling the kettle black and then throwing feces to boot. This is not how you rectify malfeasance! Frankly, this could just then be considered only a machination to make money off of the use of information warfare (disinformation as well) to profit and manipulate the markets.

.. And as far as I know, this is rather illegal…

Look, what I said before about being above board with this effort still stands. If you want to right wrongs then you cannot use this effort as a potential piggy bank as well. At the present time, I cannot confirm all of your data from Chaoda however, if you look at the news following the reports release, you can see how you affected the market and the stock. The cause and effect may or may not have anything to do with your report in fact, but, time will tell if there are any real arrests in the whole affair concerning Chaoda. If there aren’t and nothing can be conclusively proven, then what has really been done to the company? Some losses yes, and, by your statement, those around you will profit.. Potentially.

If you want to make a difference, you cannot be a party to profit from information warfare that you are generating.

K.

Inspire 7: The 9/11 Anniversary Edition

Well, it seems that the Khan media wing of AQAP/Al-Malahem finally got around to releasing the latest version of “Inspire Magazine” with some rather uninspiring content yesterday. Though the core sites of Shamukh and Ansar were under assault from DDoS attacks by persons unknown (Jokey’s pals?) the Malahem guys managed to disseminate the file and it went large on numerous file share areas on the Internet. Which just goes to show you how effective those DoS attacks are eh?

*wink wink nudge nudge kids*

The magazine this time around was the 10 year anniversary issue, which was over a week late to start and then had slim content. This makes me wonder just why it was so thin as well as why they even really bothered at all. The 20 pages consist of mostly uninteresting statements and pictures from jihadi leaders past and present about how they had struck a great blow for Islam and jihad 10 years ago. Reminiscences aside, not much there to really inspire I think. However, there is a core piece by Samir Khan (founder of the magazine and former US citizen turned jihadi media mogul.. *not*) that is somewhat interesting and germane to recent events.

The Wired articles about FBI training manuals and programs on Islam were not necessarily out there when this magazine was put to bed, but, it seems like perhaps Khan and the others at Malahem were already responding to them.

 

As we pointed out, this media
conflict between the West and the
mujahidin quickly became a war
of Western secular ideology and
Islam. Shaykh Usama intended
to attack the West to point out to
the world America’s police-state
foreign policy upon the Muslim
world and not the West’s corrupt
secular principles. But because the
West was ardent to point out the
mujahidin’s attachment to Islam as
extreme, portraying them as “fun-
damentalists,” Muslims throughout
the world asked: “Wait, are they
not then concluding that a good
practicing Muslim is their funda-
mentalist enemy?” Zakir Naik, the
popular television personality who
is known for his religious debates
and runs the PeaceTV network, has
repeatedly echoed, “Every Muslim
should be a fundamentalist as a
fundamentalist is one who sticks
to the fundamentals of Islam.” This
attack led by America on the muja-
hidin’s adherence to Islam was one
of the main reasons that led to the
defacement of their legitimacy in
the eyes of millions of Muslims. To
this day, America has still failed to
realize that.

This one passage covers a lot of what the Mujahid propaganda campaign by Al Malahem and AQ have really been trying to get across to promulgate a reaction within the ummah  globally to come to their way of thinking. By instantiating the idea that every Muslim should be “fundamental” to be Muslim to begin with, they are making a play at every single Muslim, no matter what part of the spectrum, to become fundamentalist. By using even a popular TV personality to make this point, they are trying to slip this into the collective mindset. Where this meets the Wired article and the training debacle is quite obvious though, those tutorials all portrayed the idea that the problem isn’t the Muslim, its in fact Islam itself.. And of course Shari’a law as well.

Its this argument that perhaps Spencer Ackerman should be enlightened about.. I find it funny as well that he took little time to really read the magazine before writing his piece on it at Wired. The article lacks complete understanding and in fact comes off as jingoistic propaganda itself, which is even more ironic given the nugget here by Khan about the media war that AQ and AQAP are trying to wage huh?

Hey Spencer, how about spending more time cogitating than being dismissive. I am sure it would be a much more interesting article had you taken the time to really read it.

This is not to say that the “Media War” as Khan puts it, is really working. In fact, I would say that it is not as a larger effort, working the way they would like. We have not seen in influx of jihobbyists or new suicide bombers here in the West, where this magazine is aimed at. Instead, those few who may be on the path to radicalization will only likely use this as another piece of their collective echo chamber. However, the core idea of what Khan is saying about the position of the West and our misunderstanding is pretty much on the money. Khan also likes to cite Michael Scheuer much of the time and I can understand why. It was Scheuer who was first on at Alec Station and has a pretty good grasp of Bin Laden, Jihad, and the AQ mindset. It was Scheuer in fact who has been saying all along that the US government and people were playing right into the hands of AQ by doing what we did in Iraq etc. I would suggest anyone wishing to get a better grasp of all of this read his books.

What Khan fails to understand is that this is not the first “propaganda war” that the US has waged. Sure, its the first one really online per se, but, it’s certainly not completely new. It’s just new to Khan and the AQ set is all. So, they have set up for a slick magazine that they can try to grab the kiddies with interspersed with some more cerebral content. In this edition, its more about the cerebral areas that are more telling than all of the claptrap propaganda around the big win of 9/11. This part of Spencer’s piece is right, its really mostly piffle, but, it is key not to ignore the rest of the content.

Meanwhile, there are oddities like the article on how Iran’s belief in conspiracies riles up the AQ set. Really? You guys are so miffed about Mahmoud that you had to write about it? Frankly we all know he’s a nutbg, but really, there is no need to go into this. I really have to wonder why this came up at all. It would seem that perhaps maybe the “Truther” movement is gaining so much potential that Khan and company feel they need to say “HEY we did that!” Whatever the motivation, it was an odd trek off the beaten path there.

Overall, there are some interesting intimations within the contents of this magazine as well as from the point of view that the content is skimpy and not the norm. No how to build bombs, no AK-47 schematics and tutorials. Why? Why too the seemed rush to this then the falling off by letting it out way after the actual anniversary of their “great blow against us” ? Could it be that the drone strikes are getting a bit close to them? Did we perhaps hit a main facility for production and they had to go from a backup that wasn’t finished?

Have they run out of ideas?

One wonders..

Oh well, this magazine may actually be in decline.. and you know what.. That’d be ok with me.

K.

The Psychology of “Neo Jihad” Radicalization

The Paradigm Pivot:

Soon after the attacks on 9/11 the US and other countries began a “War On Terror” that attempted to disrupt and destroy the Al Qaeda networks. The military and intelligence wars on AQ have been very successful in that they have splintered the group, cut its main lines of C&C, and forced them to scatter into the hills of Waziristan and other places. The intelligence war began with stepped up surveillance technically as well as, after much spin up, getting physical assets on the ground and inserted into the intelligence gathering apparatus. Once the networks were set up, and the AQ infrastructure fractured, it became apparent to the leaders of AQ that they needed to proselytize in a different way to get more “recruits” for the global jihad that they wanted.

Once the realization set in, the AQ leadership began to move online to communicate, radicalize, and recruit new jihadi’s to the cause. As time went by and more of the networks were broken, the ranks of jihad began to thin out. This became a real problem for Al Qaeda and it realized that it needed a new paradigm to reach the “Western” ummah that they could try to sway to jihad. With the creation of GIMF, and AQAP later on, the footprint of jihadi propaganda and radicalization took shape online. Since 2001, we have seen AQ and affiliates grapple with how to get their message across as well as create channels for those who are not in the 2 lands, to radicalize, and then come to jihad.

This post is about not only the means that AQ, AQAP, and others have come up with as a response to the problem, but also a profile of the GEN2 jihadi’s online that are being radicalized and who have acted in the past as well as those who may in the future.

Online Jihad: 10 Years of Internet Jihad

A plethora of sites on the internet have been set up over the years by AQ and its affiliates to propagandize and communicate. many of these sites at first were just simple file upload areas and small bulletin boards. Today we have many mass media style sites including videos, tutorials, online chat areas, and private messaging. The PHP bulletin boards set up on domain named sites or on servers (stealth) that have been hacked, have been the most popular of all. With these sites, the jihad radicalization goes on with postings within pass-worded group sites like Shamukh (AQ) or Ansar.com.

For the most part, these sites have only been partially successful in being a command and control mechanism for AQ. They have failed to gather the swelling support that they would have liked on the part of the Western ummah and it is this lack of fervor that has them vexed. I have personally seen this vexation in AQAP’s “Inspire Magazine” as they have been trying to become more “Hip and Western” to get a new audience. All of their efforts though, have had lackluster returns. This lack of response on the part of the young westernized groups that they are targeting is likely to a few factors;

  1. The radicalization process is not in person
  2. The western mindset of the targets is more secular in nature and separate from the core AQ groups experiences
  3. These youths are not living in lands where war is ongoing
So, the target populations that they are aiming at are hard to reach and likely not predisposed to radicalization online easily. However, there are others who they do reach. These are a smaller group of individuals who are outlined below in the GEN2.0 section of this post. First though, there needs to be an explanation of the psychology of radicalization that will backstop the three points above on why the jihad is missing the mark with the western youth.

The Psychology of Radicalization:

Radicalization: The process in which an individual changes from passiveness or activism to become more revolutionarymilitant or extremist. Radicalization is often associated with youthadversityalienationsocial exclusionpoverty, or the perception of injustice to self or others.

Much of the classic radicalizing that happens within movements such as Al Qaeda happens when the like minded get together under the penumbra of a stronger personality that leads them. In the case of Islamic Jihad, there have been many Imam’s and leaders who preach this type of thought within their right wing versions of Islam. This is the core of the idea behind raising the ummah army to fight a jihad, the radicalization of the parishioners through direct proselytizing. Since 9/11 though, much of the Muslim community has come under scrutiny from intelligence gathering groups seeking to find the next cell of terrorists being exhorted to jihad by an imam or another leader.

In other cases secular leaders may arise, this may take shape in the form of someone like Mohammad Atta, or the like who are within a circle of like minded people (What Dr. Marc Sageman calls “a group of guys” theory) who “self radicalize” and either make contact with core AQ, or, they decide to act on their own, using the internet as their guide to jihad techniques and ideals. This may happen with two or more individuals seeking like minded people, or, a leader may inculcate them into their particular brand of thought.

A third and seemingly rising type of radicalization seems to be the Lone Wolf or Loner. This is a person either seeking to belong to something greater than they are, or, someone mentally unbalanced and moving along the lines of their own particular mental illness. The Lone Wolves and the Loner’s are dangerous in that they are now one of the primary targets of AQ and their propaganda/radicalization drive other than the “group of guys” The reason for this is that all of these groups can “self radicalize” without having to step into a mosque by reading online and digitally relating with other like minded jihadi’s online. The major difference being that there is no direct contact and, for most, this method of contact and radicalizing lacks the added social element of being in person as a part of a group.

This is a key feature of radicalization that needs to be understood. Since we are social animals, we need to feel that kinship and the only real way to do this primarily is to be within a social dynamic structure that includes physically being there. Online it seems, just does not cut it for most. However, there are others, the mentally ill, and those who are so socially awkward, that online seems to be the only way that they can relate, that have become the next generation of jihobbyists. This in tandem with the fact that now it is rather hard to make contact with, and access the core AQ group physically (i.e. going to a training camp in Waziristan) has made the online radicalization process the pre-eminent way for the jihadi process to carry on.

Jihad GEN 2.0: Lone Wolves, Wolf Packs, & Loners

  • Lone Wolves: Single actors who radicalize either by self or online groups but act alone
  • Wolf Packs: “The Group of Guys” Who radicalize together as a unit and attempt jihad
  • Loners: The single player who radicalizes online and may have contacts with some but is not a team player
These terms above have been bandied about for a while now in the CT arena. The reason for this is two fold. One, we have been seeing these types radicalizing and acting out. Two, AQ has also seen this trend and they are trying to leverage these small groups or single individuals to action. As stated at the top of this post, the lines of communication and radicalization have had to change since the war on terror began. It is because we have so cornered AQ and their afiliates in the 2 lands, that they have resorted to these tactics, and, they are finding it hard to have any good results. This however, has not stopped them from trying and also trying to innovate new ways to radicalize the Western ummah.

Lone Wolves, or the “Lone Wolf” The most likely candidate for the lone wolf is a second generation immigrant who feels some sort of synergy with their parents homeland. There have been a spate of cases where Al Shebaab had converts sneak off from the US to Somalia to train with them. The majority of these lone wolves in this case, were kids in their teens or early twenties that took off to join the jihad there. The premise though, is that these are people who are not necessarily part of any one group but seek out the jihad on their own. They often connect with the core jihadi groups in some way (Malik Hassan and Anwar Al Awlaki) and then act on their own in a more constructed and supported way from the core AQ groups.

A number of these “lone wolves” were caught here in the US when they were intercepted by the FBI in sting operations. These operations mostly consisted of assets talking to the lone wolf and asking them what they would do for jihad. What operations would they like to pull off, and offer that wolf the means to carry out their intentions. This for some, treads the line of entrapment, but for me, I think it is fair game because either way, the individual, unless being held captive and tortured etc, is not suffering from “Stockholm Syndrome” and thus acting under their own will. Social dynamics aside, these actors sought out the jihad, and in my mind, already have instabilities and predispositions that will inevitably lead them to do something with or without the help of an agent provocateur.

Wolf Packs are groups of like minded individuals who have either come together and then radicalized, or, have formed due to a strong leader. These are the most dangerous of the groups because they tend to be groomed by core AQ and, as a group, not only self radicalize, but they re-enforce their belief and action as a social dynamic. Wolf packs have been seen as the more organized and thus more dangerous element in this behavior model. An example of the wolf pack would be the Lackawana 6 or others who banded together and eventually went to an AQ training camp. Though, in the case of the Lackawanna 6, it seems as though they came back from the trip decidedly lacking the motivation to carry out a mission. This is likely because of their Westernized mind set. They did however provide material support to the jihad, and were convicted of this.

Another wolf pack though are the 19 who carried out the attacks on 9/11. The Hamburg Cell, as they were called, came together in Germany where they self radicalized at a local mosque and eventually made contact with the core AQ group. This group would be considered the progenitor of the wolf pack jihad itself and are lauded by AQ for their success. They are the model for AQ’s blueprint originally on reaching a western audience.

Loners are the last type of jihadi that the AQ core are seeking to incite. The loner tends to be an individual who is socially inept to the degree that some have actually been diagnosed with Aspergers Syndrome. Still others have proven to be mentally ill individuals who latch onto the jihad for whatever reasons are driving their psyche. On average, the loner can be seen as the spree killer of the group that feeds the need of the jihad in that they sow fear and confusion while potentially taking out numbers of people. An example of a loner would be Nidal Malik Hassan (Ft. Hood Shooter) who clearly was mentally unstable and went on a shooting rampage injuring 30 and killing 13.

Loners tend to be more the spree killers with guns than they are bomb makers. Another loner type would be Faisal Shahzad, who attempted to make a propane bomb alone. His training was incomplete or he was inept, because the device failed to go off. In the case of Shahzad, he also spent time in Pakistan (from where he emigrated to the US) with the Pakistani Taliban. His radicalization went on unseen by others around him and his actions became more erratic as time went on. I have not seen a psych evaluation of him, but from all that I have seen, it may well be that he too is mentally unstable.

Another couple of reasons to worry more about the “loner” type of jihadi are these:

  • They are loners, thus unless someone in the family see’s whats going on, it will likely go unseen until its too late
  • They are often here in the US and with guns easily available, make their spree killing scenarios most likely to work
In all, these three types of jihadi’s are the main targets now for the AQ and other core groups to radicalize and energize. The jihad needs recruits to carry out their war and the Qaeda have learned that they need not be the devout and pious to do so. The weak minded and the socially inept will do just fine.

Online Radicalization: Propaganda, Congregation, Synergy & The Online Shadow War

As mentioned above, the radicalization process online has mainly consisted of websites that cater to the newbie to the jihad up to the hard core members. Primarily though, these sites have been a means to gain new recruits for the holy war. These sites had been for a long time, rather blatantly operating online because the governments had not caught up with the technology. Recently though, there has been a change going on within the online jihad. Due to many factors including actions on the part of the hacker community, the propaganda machine that has been the jihadi bulletin board system online has begun to go underground as well as redouble its propaganda efforts.

AQAP’s “Inspire Magazine” releases also have been slowed down and the core’s processes for distribution tightened because of tampering with the files in the past and the worries that they have been compromised as a network online. Spooks and hackers have been infiltrating their networks and websites for a while now and they have caught on. Of course in some ways, the assumption should always have been so. However, attacks on the AQ propaganda sites have increased over the last couple of years to include complete take downs of certain sites through DD0S as well as compromise and destruction of their back ends. Since these occurrences, the smarter of the group have decided that it was time to create a new propaganda jihad.

Abu Hafs al-Sunni al-Sunni, is an exemplar of this mindset. He espouses that the propaganda jihad needs to be more layered and secret. His proposal is to hide the online jihad in plain sight, by making pages that have stealth links (gateway sites) that will lead the knowing, to the real sites where content can be obtained and ideas shared. His ideas were a bit ahead of the curve for most on the boards, but now, post 2011, the administrators and the core AQ I think, are taking a closer look at this model. As online sites that are non secret become more and more targeted, it is only natural that they jihad would eventually have to go underground to continue and flourish from a command and control as well as radicalization standpoint. By locking down the content with gateways to it, those who are serious could congregate behind the digital curtain and carry on, while the digital bill boards call to all those thinking about joining the fray.

As the online jihad progresses technically, so too will their followers and this is a concern. With technologies such as TOR (The Onion Router) and their “Hidden Services“ one can now easily hide all content behind a network that cannot be tracked or traced. Online chats can be had in total anonymity as well as files can be left within the confines of such networks for only those who have the right address to get them (net/net meet the new digital anonymous dead drops) and it is here that once again the pivot happens within the dynamic of online jihad. Once the technological skills of the jihadi’s come online, so too will the types of attacks online that could be carried out by them as well as the success rates of kinetic attacks because they are using solid methods to transmit and connect with each other to plan operations.

Already we have seen this movement happening on the forums and it really is only a matter of time until some of these guys read the man page on how to configure their own TOR node with hidden services turned on. It is clear that the technologies are making it easier for them to hide in plain site as well as behind the technical curtain, so, it is my proposition that the next iteration of the GWOT have a component of psychological operations more involved. Just as I have said about the Anonymous situation ongoing, the greater successes are likely to come about because we better understand the players motivations and psyche’s.

Countering The Threat:

In conclusion, I see a two pronged method of attack to fight the online jihad:

  1. Psyops: The idea that psychological operations has always been a part of the counter insurgency effort. However, in the digital world this has been more the spooks territory than the digital warfighter. Of course the digital war is new as is the online jihad so it is a natural progression to see this type of warfare as well as detective process being implemented.
  2. Technical Counter-Insurgency Operations: As the technological adroitness grows on the part of the jihadi’s so should the capabilities on the counter insurgency online. It is understood that the US has quite a bit of technical know how online so it is an easier supposition to make that we will be able to step up quickly. However, it is the melding of the two (psyops/pscyhology and technical ops) that must happen to wage this battle well.
We are going to have to step up our online activities to meet the challenge and as far as I have knowledge of, certain areas of law enforcement need to play catch up. The AQ core will continue to reach out to the lonely and dispossessed to radicalize the newcomers as well as use the technologies we have created (privacy/hacking utilities included) to effect the outcomes they desire and we need to be able to counter them.

APPENDIX A:US Cases of Terrorism since 9/11

2002

• José Padilla. José Padilla (32), a native U.S. citizen, convert to Islam, and al Qaeda

operative, was arrested upon his return from the Middle East to the United States.

Although there is no question of his al Qaeda connection, his mission remains unclear.

He was convicted for providing material support to al Qaeda and sentenced in 2008.

A co-defendant, Kifah Wael Jayyousi (40), a naturalized U.S. citizen from Jordan, was

also convicted.

• The Lackawanna Six. Six Yemeni-Americans—Sahim Alwar (26), Yahya Goba (25),

Yasein Taher (24), Faysal Galab (25), Shafal Mosed (23), all born in the United States,

and Muktar al-Bakri (21), a naturalized citizen—were arrested for training at an

al Qaeda camp in Afghanistan.

• The Portland Seven. Seven individuals—Patrice Lumumba Ford (31), Jeffrey Leon

Battle (31), October Martinique Laris (25), Muhammad Ibrahim Bilal (22), Ahmed

Ibrahim Bilal (24), all native U.S. citizens; Habis Abdulla al Saoub (37), a U.S. perma-

nent resident from Jordan; and Maher Hawash (38), a naturalized U.S. citizen from

Jordan—were arrested for attempting to join al Qaeda and the Taliban.

• Earnest James Ujaama. Earnest James Ujaama (36), a native U.S. citizen, was arrested

for providing support to the Taliban.

• Imran Mandhai. Imran Mandhai (20), a U.S. permanent resident from Pakistan, told

an FBI informant that he wanted to wage war against the United States. He planned

to assemble an al Qaeda cell and attack various targets in Florida, including electrical

substations, Jewish businesses, a National Guard armory, and also, improbably, Mount

Rushmore. Under surveillance for a long time, Mandhai was arrested and subsequently

convicted of conspiracy to destroy property.

• Anwar al-Awlaki. Anwar al-Awlaki (31), a U.S. citizen born in New Mexico, studied

engineering in college and motivation in graduate school, then became an increasingly

radical imam. After being questioned by the FBI several times, he left the United States

in 2002 and went to Yemen, where he is now a leading spokesperson for al Qaeda.

2003

• Adnan Gulshair el Shukrijumah. A provisional arrest warrant was issued for Adnan

Gulshair el Shukrijumah (27), a Saudi national and legal permanent resident, who grew

up and worked in the United States. Shukrijumah was suspected of involvement in a

number of terrorist plots. In 2010, he was indicted for his involvement in the 2009 Zazi

plot to blow up New York subways.

• Iyman Faris. Iyman Faris (34), a naturalized U.S. citizen from Pakistan, was arrested

for reconnoitering the Brooklyn Bridge for a possible al Qaeda attack.

• The Northern Virginia Cluster. Eleven men were arrested in June 2003 for training

at a jihadist training camp abroad, intending to join Lashkar-e-Toiba, and planning

terrorist attacks: Caliph Basha Ibn Abdur Raheem (28), a native U.S. citizen; Sabri

Benkhala (27), a native U.S. citizen; Randoll Todd Royer (39), a native U.S. citizen;

Ibrahim al-Hamdi (25), a Yemeni national; Khwaja Mahmood Hasan (27), a natural-

ized U.S. citizen from Pakistan; Muhammed Aatique (30), a legal permanent resident

from Pakistan; Donald T. Surratt (30), a native U.S. citizen; Masoud Ahmad Khan

(33), a naturalized U.S. citizen from Pakistan; Seifullah Chapman (31), a native U.S.

citizen; Hammad Abdur-Raheem (34), a U.S.-born citizen and Army veteran of the

first Gulf War; and Yong Ki Kwon (27), a naturalized U.S. citizen from Korea. Two

other individuals were also arrested in connection with the group: Ali al-Timimi (40), a

U.S.-born citizen, and Ali Asad Chandia (26), a citizen of Pakistan. Six of the accused

pleaded guilty, and another three were convicted. Benkhala was acquitted but was later

charged and convicted of making false statements to the FBI. Al-Timimi was convicted

in 2005. The case against Caliph Basha Ibn Abdur Raheem was dismissed.

• Uzair Paracha. Uzair Paracha (23), a legal permanent resident from Pakistan, was

indicted for attempting to help an al Qaeda operative enter the United States in order

to attack gas stations. He was convicted in 2005.

• Abdurahman Alamoudi. Abdurahman Alamoudi (51), a naturalized U.S. citizen from

Eritrea, was indicted in the United States for plotting to assassinate Saudi Arabia’s

Prince Abdullah.

• Ahmed Omar Abu Ali. Ahmed Omar Abu Ali (22), a native U.S. citizen, was arrested

by Saudi authorities and later extradited to the United States for providing support to

a terrorist organization and plotting to assassinate the president of the United States.

2004

• Mohammed Abdullah Warsame. Mohammed Abdullah Warsame (31), a legal perma-

nent resident from Somalia, was arrested for conspiring to support al Qaeda. He was

found guilty and sentenced in 2009.

Chronology of the Cases

• Ilyas Ali. Ilyas Ali (55), a naturalized U.S. citizen from India, pleaded guilty to provid-

ing material support to the Taliban and al Qaeda. He attempted to sell hashish and

heroin in return for Stinger missiles, which he then planned to sell to the Taliban. Two

other defendants, Muhammed Abid Afridi and Syed Mustajab Shah, both Pakistani

nationals, were also convicted in the case.

• Amir Abdul Rashid. Ryan Gibson Anderson (26)—a native U.S. citizen and convert to

Islam who called himself Amir Abdul Rashid—was a soldier in the U.S. Army at Fort

Lewis, Washington, when he was arrested in February 2004 for contacting Islamic

websites related to al Qaeda and offering information about the U.S. Army.

• Mark Robert Walker. A Wyoming Technical Institute student, Mark Robert Walker

(19), a native U.S. citizen who, according to reports, became obsessed with jihad, was

charged with attempting to assist the Somali-based group, Al-Ittihad al Islami. He

planned to provide the group with night-vision devices and bulletproof vests.

• Mohammed Junaid Babar. Mohammed Junaid Babar (31), a naturalized U.S. citizen

from Pakistan, was arrested in New York for providing material support to al Qaeda.

• The Herald Square Plotters. Shahawar Martin Siraj (22), a Pakistani national, and

James Elshafy (19), a U.S.-born citizen, were arrested for plotting to carry out a terrorist

attack on New York City’s Herald Square subway station.

• The Albany Plotters. Yassin Aref (34), an Iraqi refugee in the United States, and

Mohammad Hossain (49), a naturalized U.S. citizen from Bangladesh, two leaders of a

mosque in Albany, New York, were arrested for attempting to acquire weapons in order

to assassinate a Pakistani diplomat.

• Adam Yahiye Gadahn. Adam Yahiye Gadahn (26), a native U.S. citizen and convert to

Islam, moved to Pakistan in 1998. By 2004, he was identified as a member of al Qaeda

planning terrorist attacks in the United States, and he subsequently became one of

al Qaeda’s principal spokesmen. He was formally indicted in 2006.

• The Abdi Case. Nuradin Abdi (32), a Somali national granted asylum in the United

States, was indicted in June 2004 for plotting with Iyman Faris to blow up a Colum-

bus, Ohio, shopping mall. (He was arrested in November 2003.)

• Gale Nettles. Gale Nettles (66), a native U.S. citizen and ex-convict, was arrested in

August in an FBI sting for plotting to bomb the Dirksen Federal Building in Chi-

cago and for attempting to provide al Qaeda with explosive material. His motive was

revenge for his conviction as a counterfeiter, but he wanted to connect with al Qaeda,

which he figured would pay him for his excess explosive materials. He was convicted

on the terrorist charge in 2005.

• Carpenter and Ransom. Two New Orleans men, Cedric Carpenter (31), a convicted

felon, and Lamont Ransom (31), both native U.S. citizens, intended to sell fraudulent

identity documents to the Philippine jihadist terrorist group Abu Sayyaf in return for

cash and heroin. Ransom, who had previously served in the U.S. Navy, was familiar

with the group. Both were convicted and sentenced in 2005.

2005

• The New York Defendants. Three defendants—Mahmud Faruq Brent (32), a U.S.-

born citizen who had attended a training camp in Pakistan run by Lashkar-e-Toiba;

Rafiq Abdus Sabir (50), a U.S.-born citizen and medical doctor who volunteered to pro-

vide medical treatment to al Qaeda terrorists; and Abdulrahman Farhane (52), a natu-

ralized U.S. citizen from Morocco who agreed to assist in fundraising for the purchase

of weapons for insurgents in Chechnya and Afghanistan—were linked to defendant-

turned-informant Tarik Shah (42), a U.S.-born citizen who was arrested in May 2005

for offering to provide training to insurgents in Iraq. Shah identified his co-defendants,

and all four were convicted.

• The Lodi Case. Hamid Hayat (22), a native-born U.S. citizen, and his father, Umar

Hayat, a naturalized U.S. citizen from Pakistan, were arrested in June 2005 for secretly

attending a terrorist training camp in Pakistan. Umar Hayat ultimately pleaded guilty

of lying to federal authorities.

• The Torrance Plotters. Kevin James (29), Levar Washington (21), and Gregory

Patterson (25), all native U.S. citizens and converts to Islam, and Hammad Riaz Samana

(21), a permanent resident from Pakistan, were charged in August 2005 with planning

to carry out terrorist attacks on National Guard armories, a U.S. military recruiting

center, the Israeli consulate, and Los Angeles International airport. (This case is some-

times referred to as the Sacramento Plot.)

• Michael Reynolds. Michael Reynolds (47), a native U.S. citizen, acquired explosives

and offered them to an informant whom he believed was an al Qaeda official to blow

up the Alaska Pipeline in return for $40,000.

• Ronald Grecula. Ronald Grecula (70), a native U.S. citizen, was arrested in Texas in

May 2005 for offering to build an explosive device for informants he believed to be

al Qaeda agents. He pleaded guilty to the charge in 2006.

2006

• The Liberty City Seven. Seven men—Narseal Batiste (32), a native U.S. citizen;

Patrick Abraham (39), a Haitian national illegally in the United States after over-

staying his visa; Stanley Grunt Phanor (31), a naturalized U.S. citizen; Naudimar

Herrera (22), a native U.S. citizen; Burson Augustin (21), a native U.S. citizen; Rothschild

Augustin (26), a native U.S. citizen; and Lyglenson Lemorin (31), a legal permanent resi-

dent from Haiti—were charged in June 2006 with plotting to blow up the FBI build-

ing in Miami and the Sears Tower in Chicago. Herrera and Lemorin were acquitted.

Chronology of the Cases

• Syed Hashmi. Syed “Fahad” Hashmi (30), a Pakistani-born U.S. citizen, was arrested

in London on charges of providing material support to al Qaeda.

• Derrick Shareef. Derrick Shareef (22), a native U.S. citizen and convert to Islam, was

arrested for planning a suicide attack on an Illinois shopping mall. He intended to

place hand grenades in garbage cans, but the plot also involved handguns.

• The Fort Dix Plotters. Six men—Mohammad Ibrahim Shnewer (22), a naturalized

U.S. citizen from Jordan; Serdar Tatar (23), a legal permanent resident from Turkey;

Agron Abdullahu (24), a U.S. permanent resident from Kosovo; and Dritan Duka (28),

Shain Duka (26), and Elljvir Duka (23), three brothers from Albania living in the

United States illegally—were charged with plotting to carry out an armed attack on

soldiers at Fort Dix, New Jersey.

• The Toledo Cluster. Mohammad Zaki Amawi (26) and Marwan El-Hindi (43), both

naturalized U.S. citizens from Jordan, and Wassim Mazloum (25), a legal permanent

resident from Lebanon, were arrested in Toledo, Ohio, for plotting to build bombs to

use against American forces in Iraq. Two additional persons were also charged in this

case: Zubair Ahmed (26), a U.S.-born citizen, and his cousin Khaleel Ahmed (25), a

naturalized U.S. citizen from India.

• The Georgia Plotters. Syed Harris Ahmed (21), a naturalized U.S. citizen, and Ehsanul

Islam Sadequee (20), a U.S.-born citizen from Atlanta, Georgia, were arrested in April

2006 for discussing potential targets with terrorist organizations and receiving instruc-

tion in reconnaissance.

• Daniel Maldonado. Daniel Maldonado (27), a native U.S. citizen and convert to

Islam, was arrested for joining a jihadist training camp in Somalia. He was captured

by the Kenyan armed forces and returned to the United States.

• Williams and Mirza. Federal authorities charged two students at Houston Commu-

nity College—Kobie Diallo Williams (33), a native U.S. citizen and convert to Islam,

and Adnan Babar Mirza (29), a Pakistani national who had overstayed his student

visa—with aiding the Taliban. According to the indictment, the two planned to join

and train with the Taliban in order to fight U.S. forces in the Middle East.

• Ruben Shumpert. Ruben Shumpert (26), also known as Amir Abdul Muhaimin, a

native U.S. citizen who had been convicted for drug trafficking, converted to Islam

shortly after his release from prison. When the FBI came looking for him in 2006, he

fled to Somalia and joined al-Shabaab. He was reportedly killed in Somalia in Decem-

ber 2008.

2007

• Hassan Abujihaad. Hassan Abujihaad (31), formerly known as Paul R. Hall, a native

U.S. citizen and convert to Islam who had served in the U.S. Navy, was arrested in

April 2007 for giving the locations of U.S. naval vessels to an organization accused of

supporting terrorists.

• The JFK Airport Plotters. Russell Defreitas (63), a naturalized U.S. citizen from

Guyana; Abdul Kadir (55) a Guyanese citizen; Kareem Ibrahim (56), a Trinidadian;

and Abdal Nur (57), another Guyanese citizen, were charged in June 2007 with plot-

ting to blow up aviation fuel tanks at John F. Kennedy Airport in New York. Defreitas

was arrested in Brooklyn. The other three plotters were arrested in Trinidad and extra-

dited to the United States.

• Ahmed Abdellatif Sherif Mohamed. Ahmed Abdellatif Sherif Mohamed (26), a U.S.

permanent resident from Egypt, was arrested for providing material support to terror-

ists by disseminating bomb-making instructions on YouTube. He pleaded guilty to the

charge.

• Omar Hammami. Now known as Abu Mansour al-Amriki, Omar Hammami

(23), a native-born U.S. citizen, left Alabama some time not later than 2007 to join

al-Shabaab in Somalia. He later appeared in the group’s recruiting videos. Hammami

was indicted in 2010 for providing support to al-Shabaab.

• Jaber Elbaneh. Jaber Elbaneh (41), a naturalized U.S. citizen from Yemen, was con-

victed in absentia by a Yemeni court for plotting to attack oil and gas installations in

Yemen. He had previously been charged in the United States with conspiring with the

Lackawanna Six. He was one of a number of al Qaeda suspects who escaped from a

Yemeni prison in 2006. He subsequently turned himself in to Yemeni authorities.

• The Hamza Case. Federal authorities charged the owner and several officials of Hamza,

Inc., a financial institution, for money laundering and secretly providing money to

al Qaeda. Those charged included Saifullah Anjum Ranjha (43), a legal permanent U.S.

resident from Pakistan; Imdad Ullah Ranjha (32), also a legal permanent resident from

Pakistan; and Muhammed Riaz Saqi, a Pakistani national living in Washington, D.C.

Also charged in the case were three Pakistani nationals living in Canada and Spain.

2008

• Christopher Paul. Christopher “Kenyatta” Paul (43), a native U.S. citizen and convert

to Islam living overseas, was arrested upon his return to the United States in April 2008

for having plotted terrorist attacks on various U.S. targets. He later pleaded guilty.

• Bryant Vinas. Bryant Vinas (26), a native U.S. citizen and convert to Islam, was

arrested in Pakistan and extradited to the United States for having joined al Qaeda in

Pakistan. He also provided al Qaeda with information to help plan a bombing attack

on the Long Island Rail Road.

• Somali Recruiting Case I. As many as a dozen Somalis may have been recruited in

the Minneapolis, Minnesota, area by Shirwa Ahmed (26), a naturalized U.S. citizen

Chronology of the Cases from Somalia, to fight in Somalia. Ahmed subsequently was

killed in a suicide bomb- ing in Somalia.

• Sharif Mobley. Sharif Mobley (26), a native U.S. citizen of Somali descent, moved

to Yemen in 2008, ostensibly to study Arabic and religion, but in reality, authorities

believe, to join a terrorist organization. He was later arrested by Yemeni authorities in

a roundup of al Qaeda and al-Shabaab militants. In March 2010, he killed one guard

and wounded another in an attempt to escape.

2009

• The Riverdale Synagogue Plot. Native U.S. citizens James Cromite (55), David

Williams (28), Onta Williams (32), and Laguerre Payen (27), a Haitian national, all con-

verts to Islam, were arrested in an FBI sting in New York in May 2009 for planning to

blow up synagogues.

• Abdulhakim Mujahid Muhammad. In June 2009, Abdulhakim Mujahid

Muhammad (23), also known as Carlos Bledsoe, a native U.S. citizen and Muslim con-

vert, killed one soldier and wounded another at an Army recruiting station in Arkansas.

• The North Carolina Cluster. Daniel Boyd (39), a native U.S. citizen and convert to

Islam who fought against the Soviets in Afghanistan in the late 1980s, was arrested

in July 2009 along with his two sons, Zakarlya Boyd (20) and Dylan Boyd (22), also

converts to Islam, and four others, including three U.S. citizens—Anes Subasic (33), a

naturalized U.S. citizen from Bosnia; Mohammad Omar Aly Hassan (22), a U.S.-born

citizen; and Ziyad Yaghi (21), a naturalized U.S. citizen—and Hysen Sherifi (24), a

legal U.S. resident from Kosovo, for plotting terrorist attacks in the United States and

abroad. Jude Kenan Mohammad (20), a U.S.-born citizen, was also a member of the

group. He was arrested by Pakistani authorities in 2008. Boyd reportedly reconnoi-

tered the Marine Corps base at Quantico, Virginia.

• Betim Kaziu. Betim Kaziu (21), a native U.S. citizen, was arrested in September

2009 for traveling overseas to join al-Shabaab or to attend a terrorist training camp in

Somalia.

• Ali Saleh Kahlah al-Marri. Ali Saleh Kahlah al-Marri (38), a U.S. permanent resi-

dent and dual national of Qatar and Saudi Arabia, was charged with attending an

al Qaeda training camp in Pakistan. He pleaded guilty to providing material support

to a terrorist group.

• Michael Finton. Michael Finton (29), a native U.S. citizen and convert to Islam, was

arrested in September 2009 in an FBI sting for planning to blow up a federal court-

house in Springfield, Illinois.

• Hosam Maher Smadi. Hosam Maher Smadi (19), a Jordanian citizen living in the

United States, was arrested in September 2009 in an FBI sting for planning to blow up

an office building in Dallas, Texas.

• Najibullah Zazi. Najibullah Zazi (25), a permanent U.S. resident from Afghanistan,

was arrested in September 2009 for receiving training in explosives at a terrorist train-

ing camp in Pakistan and buying ingredients for explosives in preparation for a ter-

rorist attack in the United States. Indicted with Zazi were his father, Mohammed Zazi

(53), a naturalized U.S. citizen from Afghanistan, and Ahmad Afzali (38), a U.S. per-

manent resident from Afghanistan, both for making false statements to federal inves-

tigators; neither was involved in the terrorist plot. In January 2010, authorities arrested

Adis Medunjanin (24), a naturalized U.S. citizen from Bosnia, and Zarein Ahmedzay

(25), a naturalized U.S. citizen from Afghanistan, and charged them with participat-

ing in the plot.

• Tarek Mehana. In October 2009, federal authorities in Massachusetts arrested Tarek

Mehana (27), a dual citizen of the United States and Egypt, for conspiring over a seven-

year period to kill U.S. politicians, attack American troops in Iraq, and target shopping

malls in the United States. Two other individuals, including Ahmad Abousamra (27), a

U.S. citizen, were allegedly part of the conspiracy. Abousamra remains at large.

• David Headley. In an increasingly complicated case, David Headley (49), a U.S.-born

citizen of Pakistani descent and resident of Chicago, was arrested in October 2009

along with Tahawar Rana (48), a native of Pakistan and a Canadian citizen, for plan-

ning terrorist attacks abroad. Headley was subsequently discovered to have partici-

pated in the reconnaissance of Mumbai prior to the November 2008 attack by the ter-

rorist group Lashkar-e-Toiba. He pleaded guilty in March 2010.

• Colleen Renee LaRose. Calling herself “Jihad Jane” on the Internet, Colleen Renee

LaRose (46), a native U.S. citizen and convert to Islam, was arrested in October 2009

for plotting to kill a Swedish artist whose drawings of Muhammad had enraged Mus-

lims and for attempting to recruit others to terrorism. Her arrest was concealed until

March 2010. LaRose pleaded guilty to the charges.

• Nidal Hasan. In November 2009, Nidal Hasan (38), a native U.S. citizen and Army

major, opened fire on fellow soldiers at Fort Hood, Texas, killing 13 and wounding 31.

• The Pakistan Five. In November 2009, five Muslim Americans from Virginia—

Umar Farooq (25), a naturalized U.S. citizen from Pakistan; Ramy Zamzam (22), who

was born in Egypt, immigrated to the United States at the age of two, and became a

citizen by virtue of his parents becoming citizens; Waqar Hassan Khan (22), a natu-

ralized U.S. citizen from Pakistan; Ahmad Abdullah Mimi (20), a naturalized U.S.

citizen from Eritrea; and Aman Hassan Yemer (18), a naturalized U.S. citizen from

Ethiopia—were arrested in Pakistan for attempting to obtain training as jihadist guer-

rillas. Khalid Farooq, Umar Farooq’s father, was also taken into custody but was later

released. The five were charged by Pakistani authorities with planning terrorist attacks.

• Somali Recruiting Case II. In November 2009, federal authorities indicted eight

men for recruiting at least 20 young men in Minnesota for jihad in Somalia and rais-

ing funds on behalf of al-Shabaab. By the end of 2009, a total of 14 indictments had

been handed down as a result of the ongoing investigation. Those indicted, all but

one of whom are Somalis, were Abdow Munye Abdow, a naturalized U.S. citizen from

Somalia; Khalid Abshir; Salah Osman Ahmad; Adarus Abdulle Ali; Cabdulaahi Ahmed

Faarax; Kamal Hassan; Mohamed Hassan; Abdifatah Yusef Isse; Abdiweli Yassin Isse;

Zakaria Maruf; Omer Abdi Mohamed, a legal permanent resident from Somalia; Ahmed

Ali Omar; Mahanud Said Omar; and Mustafa Salat. No age information is available.

• Abdul Tawala Ibn Ali Alishtari. Abdul Tawala Ibn Ali Alishtari (53), also known as

Michael Mixon, a native U.S. citizen, was indicted and pleaded guilty to attempting to

provide financing for terrorist training in Afghanistan.

2010

• Raja Lahrasib Khan. Raja Lahrasib Khan (57), a naturalized U.S. citizen from Paki-

stan, was charged with sending money to Ilyas Kashmiri, an al Qaeda operative in

Pakistan, and for discussing blowing up an unidentified stadium in the United States.

• Times Square Bomber. Faisal Shazad (30), a naturalized U.S. citizen from Pakistan,

had studied and worked in the United States since 1999. In 2009, he traveled to Paki-

stan and contacted the TTP (Pakistan Taliban), who gave him instruction in bomb-

building. Upon his return to the United States, he built a large incendiary device

in a sport utility vehicle (SUV) and attempted unsuccessfully to detonate it in New

York City’s Times Square. He was arrested in May 2010. Three other individuals were

arrested in the investigation but were never charged with criminal involvement in the

case.

• Jamie Paulin-Ramirez. The arrest of Colleen R. LaRose (“Jihad Jane”) in 2009 led to

further investigations and the indictment of Jamie Paulin-Ramirez (31), also known as

“Jihad Jamie.” Paulin-Ramirez, a native-born U.S. citizen and convert to Islam, alleg-

edly accepted an invitation from LaRose to join her in Europe in order to attend a

training camp there. According to the indictment, she flew to Europe with “the intent

to live and train with jihadists.” She was detained in Ireland and subsequently returned

to the United States, where she was arraigned in April 2010.

Wesam el-Hanafi and Sabirhan Hasanoff. Wesam el-Hanafi (33), also known

as “Khaled,” a native-born U.S. citizen, and Sabirhan Hasanoff (34), also known as

“Tareq,” a dual U.S.-Australian citizen, were indicted for allegedly providing material

In September 2010, Sami Samir Hassoun (22), was arrested in an FBI sting in Chicago

for attempting to carry out a ter-rorist bombing. Hassoun expressed anger at Chicago

Mayor Richard Daley. It is not clear that the case is jihadist-related.

In December 2010, Awais Younis (26), a naturalized U.S. citizen from Afghanistan, was

arrested for threatening to bomb the Washington, D.C., Metro system. He made the threat on

Facebook, and it was reported to the authorities. Neither of these cases is included in the chronology.

support to a terrorist group. The two men, one of whom traveled to Yemen in 2008,

provided al Qaeda with computer advice and assistance, along with other forms of aid.

• Khalid Ouazzani. Khalid Ouazzani (32) pleaded guilty in May to providing material

support to a terrorist group. Ouazzani, a Moroccan-born U.S. citizen, admitted to rais-

ing money for al Qaeda through fraudulent loans, as well as performing other tasks at

the request of the terrorist organization between 2007 and 2008.

• Mohamed Mahmood Alessa and Carlos Eduardo Almonte. Two New Jersey men,

Mohamed Mahmood Alessa (20), a native U.S. citizen, and Carlos Eduardo Almonte

(24), a naturalized citizen from the Dominican Republic and convert to Islam, were

arrested in June at New York’s JFK Airport for conspiring to kill persons outside the

United States. The two were on their way to join al-Shabaab in Somalia.

• Barry Walter Bujol, Jr. Barry Walter Bujol, Jr. (29), a native U.S. citizen and convert

to Islam, was arrested as he attempted to leave the United States to join al Qaeda in

Yemen. He had been under investigation for two years and was in contact with an

undercover agent he believed to be an al Qaeda operative.

• Samir Khan. In June 2010, the Yemen-based affiliate of al Qaeda began publishing

Inspire, a slick, English-language online magazine devoted to recruiting Western youth

to violent jihad. The man behind the new publication was Samir Khan (24), a Saudi-

born naturalized U.S. citizen who moved to the United States with his parents when

he was seven years old. He began his own journey to violent jihad when he was 15. He

reportedly left the United States in late 2009, resurfacing in Yemen in 2010.

• Rockwood’s Hitlist. Paul Rockwood (35), a U.S. citizen who served in the U.S. Navy

and converted to Islam while living in Alaska, was convicted in July 2010 for lying

to federal authorities about drawing up a list of 15 targets for assassination; they were

targeted because, in his view, they offended Islam. He was also accused of research-

ing how to build the explosive devices that would be used in the killings. His wife,

Nadia Rockwood (36), who has dual UK-U.S. citizenship, was convicted of lying to

authorities.

• Zachary Chesser. Zachary Chesser (20), a native U.S. citizen and convert to Islam, was

arrested for supporting a terrorist group in July as he attempted to board an airplane to

fly to Somalia and join al-Shabaab. Chesser had earlier threatened the creators of the

television show South Park for insulting Islam in one of its episodes.

• Shaker Masri. A U.S. citizen by birth, Shaker Masri (26) was arrested in August 2010,

allegedly just before he planned to depart for Afghanistan to join al Qaeda or Somalia

to join al-Shabaab.

• Somali Recruiting Case III. As part of a continuing investigation of recruiting and

funding for al Qaeda ally al-Shabaab, the U.S. Department of Justice announced four

indictments charging 14 persons with providing money, personnel, and services to the

terrorist organization. In Minnesota, 10 men were charged with terrorism offenses for

leaving the United States to join al-Shabaab: Ahmed Ali Omar (27), a legal permanent

resident; Khalid Mohamud Abshir (27); Zakaria Maruf (31), a legal permanent resident;

Mohamed Abdullahi Hassan (22), a legal permanent resident; Mustafa Ali Salat (20), a

legal permanent resident; Cabdulaahi Ahmed Faarax (33), a U.S. citizen; and Abdiweli

Yassin Isse (26). Three were new on the list and had been the subject of previous indict-

ments: Abdikadir Ali Abdi (19), a U.S. citizen; Abdisalan Hussein Ali (21), a U.S. citi-

zen; and Farah Mohamed Beledi (26). A separate indictment named Amina Farah Ali

(33) and Hawo Mohamed Hassan (63), both naturalized U.S. citizens, for fundraising

on behalf of al-Shabaab. A fourth indictment charged Omar Shafik Hammami (26),

a U.S. citizen from Alabama, and Jehad Sherwan Mostafa (28) of San Diego, Califor-

nia, with providing material support to al-Shabaab. (Hammami’s involvement is listed

in this chronology under the year 2007, when he first left the United States to join

al-Shabaab; Mostafa is listed separately in the next entry.)

• Jehad Serwan Mostafa. In August 2010, Jehad Serwan Mostafa (28), a native U.S.

citizen, was indicted for allegedly joining al-Shabaab in Somalia. He reportedly left

the United States in December 2005 and was with al-Shabaab between March 2008

and June 2009.

• Abdel Hameed Shehadeh. Abdel Hameed Shehadeh (21), a U.S.-born citizen of Pal-

estinian origin, was arrested in October for traveling to Pakistan to join the Taliban

or another group to wage jihad against U.S. forces. Denied entry to Pakistan, then

Jordan, Shehadeh returned to the United States and subsequently attempted to join

the U.S. Army. He allegedly hoped to deploy to Iraq, where he planned to desert and

join the insurgents. When that did not work out, he tried again to leave the country

to join the Taliban.

• Farooque Ahmed. Farooque Ahmed (34), a naturalized U.S. citizen from Pakistan, was

arrested in October for allegedly plotting to bomb Metro stations in Washington, D.C.

FBI undercover agents learned of Ahmed’s intentions by posing as al Qaeda operatives.

• Shabaab Support Network in San Diego. Saeed Moalin (33), a naturalized U.S. cit-

izen from Somalia, Mohamed Mohamed Mohamud (38), born in Somalia, and Issa

Doreh (54), a naturalized U.S. citizen from Somalia, all residents of San Diego, were

arrested for allegedly providing material support to al-Shabaab. The investigation of

this network is continuing, and a fourth man from Southern California, Ahmed Nasir

Taalil Mohamud (35), was subsequently indicted.

• Al-Shabaab Fundraising II. In November, federal authorities arrested Mohamud

Abdi Yusuf (24), a St. Louis resident, and Abdi Mahdi Hussein (35) of Minneapolis,

both immigrants from Somalia. The two are accused of sending money to al-Shabaab

in Somalia. A third person, Duane Mohamed Diriye, believed to be in Africa, was also

indicted.

• Nima Ali Yusuf. Nima Ali Yusuf (24), a legal permanent resident originally from Soma-

lia, was arrested in November for allegedly providing material support to a terrorist

group. She was accused of attempting to recruit fighters and raise funds for al-Shabaab.

• Mohamed Osman Mohamud. Mohamed Osman Mohamud (19), a naturalized U.S.

citizen originally from Somalia, was arrested in December for attempting to detonate

what he believed to be a truck bomb at an outdoor Christmas-tree-lighting ceremony

in Portland, Oregon. He reportedly had wanted to carry out some act of violent jihad

since the age of 15. His bomb was, in fact, an inert device given to him by the FBI,

which set up the sting after it became aware of his extremism through a tip and subse-

quent monitoring of his correspondence on the Internet.

• Antonio Martinez. Antonio Martinez (21), also known as Muhaamed Hussain, a nat-

uralized U.S. citizen and convert to Islam, was arrested in December for allegedly plot-

ting to blow up the Armed Forces Career Center in Catonsville, Maryland. The car

bomb he used to carry out the attack was a fake device provided to him by the FBI,

which had been communicating with him for two months.

APPENDIX B: Research Materials

1302002992ICSRPaper_ATypologyofLoneWolves_Pantucci

12Sageman

Wk 6-3 Terrorism background psychology Sageman

20091007.Sageman.ConfrontingalQaeda

208551

Yes Virginia, There Are Hackers and Spooks On Militant Boards…

A prominent poster on the elite password-protected jihadi web site Shumukh has told fellow forum members his account on the site has been hacked to send spyware to fellow forum participants.

The user, who goes by the handle “Yaman Mukhadab,” posted on August 28 that “it seems that someone is using my account and is somehow sending messages with my name to the members,” according to Flashpoint Partners, which translated the discussion for Danger Room. Shumukh uses software from vBulletin, which allows members to send private messages to each other.

Mukhadab’s handiwork has attracted attention beyond the forum. He was one of the contributors to the site’s lame recent attempt at creating a fantasy target wishlist comprised of American security industry leaders, defense officials and other public figures.

From Wired

Yeah, yeah, yeah, once again Wired got a little tidbit from Evan Kohlmann to keep his Flashpoint company relevant and in the news. Blah blah blah. Look, Adam is it? Yeah, Adam, there is much more that goes on on this site and the myriad others that Evan isn’t telling you. Sure, this guy Yaman got a little twitchy and he is right to be so lately. There has been A LOT of other things going on on both sides of the fence lately that ol’ Evan hasn’t let you in on, or more likely, has no clue of.

  • There are hackers, both at the behest of the government and those not avowed going at these sites. Some are just knocking them down for periods of time (Jester etc)  Some who are auditing the sites and actually interacting at times with the players after owning them, and SOME who are just hacking the shit out of the sites and wreaking havoc. The latter was seen back a month or two ago with the take down of Ansar. They just RM’d that sucker, but, the jihadi’s had a backup and they were online within days. (which you mentioned.. good)
  • Most of these sites have sections where the the newbies are being taught hacking skills. Some of these tutorials are low level (like the lulz types we saw not too long ago *protect your MACIP’s) Others are quite well versed in hacking and have tutorials on the level of something to worry about. In fact, some of these sites contain the works of friends of mine in the security community that they have posted as research. Within these sections we have areas where the jihadi’s have an assortment of upload/download sites for malware (mostly these are older packages) but some of the newer posts have malware and creation kits that are up to today’s standards (which you failed to mention)
  • The version of AQAP’s “Inspire you talk about was tampered with *cupcakes* as well as one version did in fact have a trojan. (which you failed to mention)
  • The list of targets wasn’t so much lame as it was a new call to the “lone wolves” on these boards to act on it. There is a change in the way these guys are waging jihad that is not really covered by Evan and you. Did you know for instance that there is a Facebook Jihad (propaganda war) that is ongoing? As well as guys like Abu Hafs Al Suni Al Suni are advocating for a ‘stealth jihad’ ? Yeah, they are, and they have been busy trying to propagandise and get the word out to those lone nutjobs that might in fact try something like say, pick a name off of that ‘lame’ list as you called it. It wouldn’t be so lame after they actually whacked someone would it?

Sure, a good deal of this and the other jihobbyist sites are full of dreck, but, there are pockets of true believers, and your little piece in Wired downplays it all.

For more:

GCHQ/SIS AQ Media PSY-OP: Messin With Jihobbyists

Also try this little Google Search for spyware posts on the board. They have been busy.

As a side note, the Jihadi’s also went further and opted to go after the MEMRI organization as well. In a later post by Yaman, they list out the leaders of the org as targets as well. What makes me wonder is which one of them has a log and pass for MEMRI (hint hint MEMRI check your logs)

 

 

 

All in all, another bang up job Wired… *sarcasm implied*

K.

ウェブ忍者が失敗する : Dox-ing, Disinformation, and The Fifth Battlespace

Digital Ninja Fail: ウェブ忍者が失敗する

The recent arrests of alleged key members of LulzSec and Anonymous have been called into question by the ‘Web Ninja’s‘, a group of would be hackers who have been ‘DOX-ing” the anonymous hierarchy for some time now. Yesterday, they posted the following on their page concerning the arrest of a man from the Shetland Islands who is purported to be ‘Topiary‘ by the Met and SOCA.

Now, this is a bold statement for anyone who really knows what they are doing in the intelligence analysis field. So, it is my supposition that these guys have no clue about what they are doing by making bold assertions like this. The data they have is tenuous at best and by making such bold statements, I have to wonder if indeed the so called ‘Ninja’s” themselves might not be a tool of anonymous to in fact sow that disinformation.

Here are the facts as I see them;

  • To date, the federal authorities have not questioned anyone who was DOX’d by the Ninja’s that I am aware of
  • The individuals who were DOX’d that were investigated by the authorities were in fact outed by LulzSec/Anonymous themselves
  • Adrian Chen has spoken to the person that the Ninja’s have fingered and claims that he (said person) went to the authorities himself. So far he is still not a suspect.

So, taking into account these facts, I would have to say that the Ninja’s have failed in their stated mission so far and I would suffice to say that if they are indeed a part of a disinformation campaign, then that too has failed. After all, the police seem to be ignoring the data put on the interent by the likes of the Ninja’s in favour of other tried and true tactics. The primary tactic as I see it, is grab one individual and then get them to roll over on their compatriots in the face of massive jail time.

This pretty much works all the time as we, as human beings, are most willing to sacrifice others for the self. In the case of the likes of LulzSec skiddies, I would have to say that the ages of the players, and their generational tendencies will allow them to cut deals pretty quickly. It’s my assessment that they are in it for the self gratification and lulz, not for the altruism that the LulzSec and Anonymous press releases have been trying to have one believe. My assumption is that if indeed the 19 year old guy they popped in Scotland is involved with LulzSec, and is in fact Topiary, he will roll over soon enough.

I also believe that these are all untrained operatives and they have made and will make more mistakes. I am pretty sure that the alleged “leaderless” group has leaders AND that unlike a true guerrilla warfare cell, will know the other players personal details. Essentially, they have had no compartmentalisation and they will all fall eventually though interrogation and deal making. As I said before, the insider threat to the organisation is key here, and it was this idea I think the Ninja’s had.. Well, at least that was the original idea of the Ninja Warrior. They were spies who infiltrated the ranks and destroyed from within.

So far with these guys.. Not so much.

Welcome To Spook World: Disinformation Campaigns and Intelligence Analysis

Now, on the whole disinformation thing, I know that the Lulz and Anonymous have said that they are using disinformation as well to try and create a smoke screen. Frankly, all of the intelligence out there that is open source is suspect. Maltego map’s of end user names as I have shown in the past can be useful in gathering intelligence… Sometimes. For the most part, if a user keeps using a screen name in many places and ties that name to real data, then they can be tracked, but, it takes a lot of analysis and data gathering to do it. Though, many of the foot soldiers within the Anon movement are young and foolish enough to just keep using the same screen names for everything so there is a higher likelihood that the data being pulled up on Maltego and with Google searches is solid enough to make some justified conclusions.

With the more experienced people though, there has been some forethought and they have protected their identities as best they could. What became their real downfall was that they could not rise above petty infighting and dox-ing each other. Thus you have the start of the potential domino effect on the core group as well as anyone who has any peripheral affiliation with the Lulz. Be assured, those who have been pinched are giving up as many names as possible as well as whatever is on their hard drives, Anon hacker manuals or not. All of these scenarios lead to the conclusion of more arrests by the authorities and even more skiddies getting into legal trouble around the globe. Meanwhile though, if the core group has been smart, then perhaps the leaders will skate for a time, using the masses as canon fodder.

Gee kids.. Did you know that you were all expendable?

On another tac, I would like to speak about the potential of the disinformation campaigns being perpetrated by the authorities as well. Consider that the trained professionals out there who are hunting these characters (Topiary, Sabu, et al.) are also adept at using not only the technologies of the fifth battlespace, but also the training afforded them in ‘spook world’ This means disinformation campaigns, mole hunts, and insurgencies of their own, getting to the inner core of Anonymous and Lulz. Now, that there were six (alleged) lulzer’s it would be more difficult to do, especially if those LulzSec folks really do know one another (as they claim they do not, which, I just don’t buy.. Remember the compartmentalisation issue) The agent provocateur’s are out there I am sure and with each rung of the ladder, they get closer to the core group.

That is unless the core group falls apart on their own and DOX’s each other out. In the end, I am going to suggest that the authorities will use all of the tricks of the trade on the Anon/Lulz folks to bag them… And with concerted effort by government resources, they will get their men/women.

Untrained, Unruly, and Unprofessional Operators:

“Discretion is the better part of valour” as they say, and in the case of the Lulz and Anon crews, they seem to not have a clue. Perhaps the Lulz think that by being unruly and unpredictable to a certain amount, will be just the cover they need, but, I think that their lack of discretion will be their undoing as well as their hubris. Had many of these folks had some real training, they might have just stood down for a while (not just a week or so) after setting sail into the sunset.

As I have said before, it was a bad idea to recruit and have comm’s out in the open on IRC servers even if they had ‘invite only’ channels. As is being seen now, someone (jester perhaps) has taken down their servers again after other outages due to Ryan Cleary’s attack and pressure from the government on those connection sources that the Anon’s were using. I am sure the idea was to have a movement that could also serve as diversion for the core users as well as to LOIC, but this all failed in the end didn’t it? The LOIC is what has given the FBI the 1,000 IP addresses as a hit list, so to speak, that they are now using to collect people and charge them for the DD0S attacks.

Had these people been trained or not been so compulsive, they might have had more of a chance to keep this up for a much much longer time. As I write, the Lulz do continue, but they have slowed quite a bit since the arrests started again. This I think is because the cages are starting to get rattled and people are finally coming to the conclusion that some discretion is needed to not end up Bubba’s play pal in prison. It’s a learning curve, and likely going to be a painful one for the kiddies.

Unprofessional actions within this area of battle will end up with your being put in jail kids.

To end this section I would also like to add this thought. My assessment of the Lulz core group is this;

  • They were drunk on the power of their escapades
  • The more followers they had and more attention, the less risk averse they became
  • They seem to have compulsion disorders (don’t say it.. Aspergers!) that seem to not allow them to lay low (until now it seems)
  • The ego has eaten their id altogether
  • Base ages are within the teens with a couple over 20

Technical Issues Within The Fifth Battlespace:

Another BIG issue within this battlespace is the technology. The Anon’s and Lulz have been ascribing to the idea of “Proxies, we haz them! So we’re secure!” and to a certain extent they are right. There are always ways around that though and certainly leaks in data (such as the TOR leaks that have happened) that could lead someone to locate the end user behind the proxy, so they are not fool proof. Certainly not if the fool in question is some skiddie 12 year old using LOIC un-proxied and not obfuscated while they D0S Paypal.

The problem is that the technology could fail you as well as the untrained operative could make small and large mistakes that could lead authorities right back to their IP and home accts. On the other side of that equation is that when properly done, it is damn hard to prove a lot in hacking cases because of obfuscation, as well as mis-configured end systems that have been hit. I cannot tell you how many times I have seen incidents play out where the target systems had no logging on as well as being completely un-secured, thus leaving practically nothing for a forensics team to find and use.

Once again, this brings us back to the insider threat, whether they be the insider who decides to go turncoat, or, the agent provocateur (i.e. Jester and the Ninja’s as well as others from the authorities) who infiltrate the Lulz and then gut them from the inside. What it really boils all down to is that in the end, it will be the foibles of the Lulz core and the actions of spooks that will bring them down.. And I think they are learning that very fact now.

JIN; One Must Know The Enemies Mind To Be Victorious:

As a last note, I would like to say to the Ninja’s, you need to learn and practice your Kuji-in. It is obvious to me that you have failed on the ‘Jin’ (knowing the opponents mind) with your dox attempts. Until such time as I see people being hauled in that directly relate to your documents posted, then I am going to consider the following to be the case:

  1. DOX-ing is mostly useless and takes quite a bit of analysis before just releasing names
  2. The Feds are not taking your data as gospel, nor should the general public or media
  3. You yourselves may in fact be a tool of Anonymous/Lulz and as such, spewing disinformation
  4. You could be right, but by releasing it to the public at large, you are letting the Lulz know to destroy evidence and create obfuscation that will hinder arrests later.

Ninja’s got results.. Not so much for ‘Web’ Ninjas. At least Jester, if his claims are true, is breaking their C&C channels lately.. Which has its own problematic issues.. Just like his meddling in the Jihadi area, but, that’s a story for another time.

K.

The Lulzboat Sailed The Internets and All I Got Was This Stupid Garbage File!

That’s it? All we get is this stinkin garbage file?

Well, it seems that the Lulz are over for now as last night saw the Lulzboat sail into the sunset. In a post on twitter and a rapidly seeded file dump on Pirate Bay, the LulzSec collective decided to hang up their tophat claiming that they were basically going to pull a Costanza at the top of their game.

Within the torrent file the following parting words were sent:

Friends around the globe,

We are Lulz Security, and this is our final release, as today marks something meaningful to us. 50 days ago, we set sail with our humble ship on an uneasy and brutal ocean: the Internet. The hate machine, the love machine, the machine powered by many machines. We are all part of it, helping it grow, and helping it grow on us.

For the past 50 days we’ve been disrupting and exposing corporations, governments, often the general population itself, and quite possibly everything in between, just because we could. All to selflessly entertain others – vanity, fame, recognition, all of these things are shadowed by our desire for that which we all love. The raw, uninterrupted, chaotic thrill of entertainment and anarchy. It’s what we all crave, even the seemingly lifeless politicians and emotionless, middle-aged self-titled failures. You are not failures. You have not blown away. You can get what you want and you are worth having it, believe in yourself.

While we are responsible for everything that The Lulz Boat is, we are not tied to this identity permanently. Behind this jolly visage of rainbows and top hats, we are people. People with a preference for music, a preference for food; we have varying taste in clothes and television, we are just like you. Even Hitler and Osama Bin Laden had these unique variations and style, and isn’t that interesting to know? The mediocre painter turned supervillain liked cats more than we did.

Again, behind the mask, behind the insanity and mayhem, we truly believe in the AntiSec movement. We believe in it so strongly that we brought it back, much to the dismay of those looking for more anarchic lulz. We hope, wish, even beg, that the movement manifests itself into a revolution that can continue on without us. The support we’ve gathered for it in such a short space of time is truly overwhelming, and not to mention humbling. Please don’t stop. Together, united, we can stomp down our common oppressors and imbue ourselves with the power and freedom we deserve.

So with those last thoughts, it’s time to say bon voyage. Our planned 50 day cruise has expired, and we must now sail into the distance, leaving behind – we hope – inspiration, fear, denial, happiness, approval, disapproval, mockery, embarrassment, thoughtfulness, jealousy, hate, even love. If anything, we hope we had a microscopic impact on someone, somewhere. Anywhere.

Thank you for sailing with us. The breeze is fresh and the sun is setting, so now we head for the horizon.

Let it flow…

Hrmmm.. 50 days? Is there any real significance to this other than perhaps the party van was pulling up outside your doors and you had to dump the garbage file quick like? Honestly, the files that you dumped, while in sheer numbers of passwords and logon’s to a few sites is well, kinda weak. In short, there is nothing revelatory here. I mean, jeez at LEAST the garbage file in the movie had some interesting malware shit in it right?

The Files:

So, we have some AT&T data from inside that cover some frequency ranges, and some manuals, minutes from meetings etc that are kind of interesting. There is a scan of the FBI.gov site that shows a vuln, and they managed to add Pablo Escobar to the Navy jobs database.

Whoopee.

All in all I have to give the Lulzsec crew a big “MEH” on this as well as their other dumps really. Sure, they have pointed out that low hanging fruit is abundant on the internet, but, really, who in the security or hacking world did not know this? Further more, what does the average everyday end user care? I mean, if their passwords are stolen, they will reset them. If their money is stolen they are insured by the Fed… Is there a great hue and cry from the masses because Lulz were had by the general populace to have the Lulzboat crew hoisted on the yard arm?

Not that I have seen.

In short kidz, you have only served to amuse yourselves and others out there but if you had anything else in mind about bringing change to the scene, I don’t think you have succeeded. People are creatures of habit and sloth. Short of taking the whole system down for the count, nothing will be so epic as to make corporations secure their networks and perform due diligence. Those who have done so out of worry because of your antics will go back to their peaceful Luddite slumber.

Leaving So Soon?

So, on to your sudden departure from the scene. I have the feeling that as I had written about before, you were coming to realize that perhaps you could never be as clever or wily to evade detection and prosecution given your penchant for the dramatic you all seem to have. Your propaganda machine and communication channels were leaking, this you could see from the A-Team dumps.

You guys have tried variations of your names, you have attempted obfuscate as much as you could, but, in the end, your re-use of favored screen names was your undoing. You see, the jester has been scouring the internet (I am sure with help from others) looking for any connections to those screen names or iterations thereof. I myself have done this and came up with analogous data to what jester and others have posted. With each successive day, your true identities are being uncovered if they have not fully been as of now.

However, this re-use of nick names and ties to email addresses aside, you guys just were immature enough to do yourselves in with petty disputes and the use of non trustworthy assets. This whole outing of each other thing was one of the most stupid things I have seen. Sure, some of it could be digital chaff, with you trying to set out disinformation, but I think that is not the case. Your own hubris shall be the thing that ends up placing the party vans on your collective front steps.

Lets face it, you played the game of spooks and I think in the end, you will lose. In fact, I think that you should probably have been better off had you just gone off seeking some sharks with frikkin lazers on their heads in your volcano lair instead of playing with the fire that you have been. Once they do pop you, you all are going to see some very interesting things inside jail as the governments kluge together terrorism charges on you.

Your Legacy:

Well, I guess we will have to see if anyone decides to take up the Lulzsec mantle. For now, we all await the party van posse to pick you all up sooner or later. You have spawned some more fools though like Team Poison who want to up the ante with releases of data like old Tony Blair stuff… That was kinda lame too frankly and made so sense when they claimed to still have access.. Why dump what you have and then claim to still have access? If it was current, I am pretty sure they have yanked the plug on that mail server and ‘five’ has it.

Oh, did you take that into account? I mean, he is Tony Blair after all… They are MI5… ‘Expect them’

So where was I?… Oh yeah..

In all of your dumps you delivered nothing worth your or our time. You proved a point that SQLi is prevalent but who didn’t know this? You have proved that you were pretty immature and likely suffer from Asperger’s yourselves… Well that will be the claim that your lawyers make to the judge won’t it huh? I mean that is the mental illness du jour as excuses go for immature hacking antics today isn’t it? I don’t think that will work though, the government just doesn’t care, they will medicate you and then put you on trial. You see Asperger’s is not a form of insanity, and the insanity plea, as some of us know, is NOTORIOUSLY hard to use as a defense in court. Nope, you guys really actually suffer from inflated ego’s and too much jolt cola.. That’s my diagnosis, for what its worth.

So, yeah, legacy… Well, you certainly have tried to do your best imitation of SPECTRE, but instead you came off as Bighead. I am sure there will be others following in your footsteps, but, in the end I don’t think you have launched a new SPECTRE.

Nope, I expect your real legacy will be the creation of more draconian laws by the government as a backlash to your antics. Laws that will make all our lives a bit more less private and a lot more prone to being misused. I also expect that the lulz will continue, though at your expense once you are all caught and put into the pokey.

… And those lulz will also be epic fail.

K.

IMPORTANT SECURITY TIPS: Security Tips for Jihobbyists At Majahden

Security Tips for Majahden2 Users and Jihobbyists

Important Security Tips from Majahden:

The boys at Majahden have been learning lately about how psyops, hacking, disinformation, and being pwn3d works. I suppose since Osama went to live in a pineapple under the sea, they have been taking stock of just how much information they are leaking on the boards out there on the internets. There have been a spate of timely deaths in the AQ camp of late as well as a few arrests, but really, the intelligence coup of finding OBL and whacking him has all the jihobbyists worried that they will be next.

Of course they should be worried, but not only because OBL was popped. You see, we have been inside their shit for some time now and they just did not know it I guess. I have written in the past about sites that I have been poking at and digging through and I know in the case of Al-faloja (may it rest un-peacefully) I was able to get quite a bit of data from them. Since Al-Faloja fell down and went boom, there have been many site re-vamps by many a phpBB admin but they still seem to be on the whole, lacking the skills to really secure their shit.

Oopsies!

So, from their sooper sekret squirrel lair we have the following text from the above screen shot on majahden entitled “Important Security Tips” From this post I can say that they have been learning though. The tips are good and if followed it will make it just a teensy bit harder to track them and eventually have them picked up. Here are some good ones:

  • Trust no one: See a new member asking all kinds of questions about going to jihad? Be wary of them they may be spies
  • Use internet cafe’s to log in and post to the boards because they can track your IP address
  • DO NOT use just one internet cafe! Move around and make sure that you go outside your usual area (where you live)
  • Use a PROXY at the cafe!
  • Be careful though at the cafe because they are on the lookout for swarthy types like us!
  • NEVER give out your real information to ANY forum! (i.e. Bday, phone, etc)
  • Beware of files published to the forums! They could be malware!
  • Beware of popup installs like Java on the boards, they are not proper and likely a means to compromise you!
  • Beware people asking you to email them from the forum (use the message program on the board)
  • DO NOT RE-USE PASSWORDS!
  • Be careful what information (personal) you put on the site
  • Be careful about posting anecdotes about seeing this or that imam speak (places you in a place and a time)

AND Finally, in the FUNNIEST note of the list;

  • This is not a dating site! You want to make friends do that separately from the jihadi forums.

*snort*

In all, these warnings are good solid rules of the road for anyone going anywhere on the internet never mind on a jihadi board being audited by the likes of moi. Just from a privacy standpoint these types of suggestions are valid as well and should be the standard for anyone not wanting their identity stolen or their stuff hacked easily. This however, is pretty new to all of these guys and are the rudiments of SECOPS for them. Up til now, they have been not following any of these precepts, and to have to say this is not a dating site? Well, that kinda says it all to me hehe.

Meanwhile another tasty tidbit came up from the same site and this one is a little more interesting. The above screen cap is for a posting called “Deceptive methods to extract information” and it covers primarily the idea of snitches being placed in cells at camps to elicit information from jihadi’s. Now, this is nothing new to anyone who has had a diet of movies or TV here in the US, but perhaps it is a new one for these guys. Informants in the form of turncoat prisoners or actual agents from the likes of the CIA etc, have been standard operations to get information without the enemy knowing it.

This post is written by someone though who has had first hand experience with being detained. They go on to describe very specific scenarios and methods to evade giving up information to the “birds” as they are calling them.  (I think they mean stool pigeons) The writer gives suggestions on how to detect the turncoats and or to deal with the interrogators methods in trying to cajole information from them. All in all, this is an interesting read that comes across as someone who has had direct experience and understands PSYOPS.

The Take Away:

These posts and others within the site have me thinking that they are starting to become a bit more sophisticated in their efforts online. There are numerous tutorials now on chaining Tor and proxy-ing as well as the use of crypto and other security oriented programs. TNT_ON has been busy posting more tutorials as well as lauding Younis Tsouli (aka irhabi007, now in jail) as the progenitor of the jihadi hacking scene. All I can really say is that it is maturing and we need to step up our efforts with regard to them.

With the new invigoration within the cyber-jihadi community since OBL’s great pineapple adventure, they have taken up the gauntlet not only to hack but to wage a cyber-propaganda campaign like never before. Presently, the jihadi’s on Majahden and other sites have been spinning up and creating numerous Facebook sites that conform to standards that will fly under the FB radar (FB has been pulling sites down just about as fast as they could put them up) this has become the new “stealth jihad” They are making the effort now to have innocent front pages that lead to many other more hidden pages containing hardcore jihadi content. This is something that was being espoused last year on the boards and is now coming into acceptance as the main modus operandi. This way they can have their content and not get it 0wned or taken down by the likes of Facebook or Blogspot.

Since the advent of the LulzSec crew, it just seems that we all have been focused elsewhere.. Time to wake up and go back to working these fools. I say it is time to start a program of 0day infected dox that will be downloaded from all those sharing sites that these guys love. Remember the whole cupcake thing with Inspire? I say we do it en masse for as many sites as we can. Added to this, we should also be using many more approaches such as PSYOPS, Disinformation, and all out penetration of their servers… No matter where they sit.

But that’s just me… I also think that perhaps the NSA might have that already covered… One wonders…

At the very least, we should keep an eye on these sites.. If not for the lulz, then for taking them down once and for all.

K.

The Dragon and Eagle: China’s Rise from Hacking To Digital Espionage

黑客 Transliteration into English ‘Dark Visitor’, more specifically in our colloquial language ‘Hacker’ The Dark Visitor movement of the 1990′s has morphed into a more sophisticated and government connected espionage wing today. What was once a loosely affiliated group of patriotic hackers, has been honed by the PLA (Peoples Liberation Army) into a force to be reckoned with on the stage of digital espionage and data theft.

Beginnings:

Back in the latter 1990′s the Internet made its way to China and soon hackers began to see how the system worked. These hackers were curious about systems to start, but soon the motives changed in the Chinese hacker community due to patriotism and the inherent nature of the Chinese culture, to feel that they could avenge their country for perceived sleights by hacking web pages and defacing them. It was in 1997 that the first hacker collective was formed and named the “Green Army” and in 1998, the “Red Hacker Alliance” was formed after an Indonesian incident involving riots against the Chinese caused them to band together.

Over time, many groups would form and dissipate only to re-form. The groups would have various reasons to go on campaigns of hacking against other countries like Taiwan over political issues and the like, but it seemed for the most part the general aegis was just to hack. A change though came in the 2000′s when commercialism started to come to play. It seems that as in the West, the hackers began to see that their skills could be put to use to make money, and many of them began working as security consultants. As with the country itself, commercialisation that Deng Xiaoping had put into play with his ‘market economy’ afforded them the idea of not just being politic but also in some ways, Capitalist.

From the “Dark Visitor” by Scott Henderson its a good albeit short read on the subject. You can buy it on his site I think..

The paradigm however has changed a bit since 2005 and since, more of the hacking and the groups doing it have dual motives. Due to the PLA co-opting the hacker groups, a healthy dose of patriotism, and the general socio-political environment that the Chinese live in today, we now have both forces at work. The political and the market driven.

Motivations for APT Attacks:

Since the market economy’s beginning with Deng, China has brought itself up out of the depths that the Mao government dragged them into a burgeoning super power. Most of this economic feat has been driven by the sheer ability of the Chinese to throw immense amounts of workforce at problems. While producing cheaper and perhaps lower quality goods, they have plaid upon the capitalist nature of the west to pivot themselves into the controlling seat economically and production wise. America and other countries have locked on to the idea that hiring out to foreign workers (outsourcing) they are saving a lot on their bottom line. As well, the consumer, be they American or other, have enjoyed the advantages of cheaper products, thus they save more money on their purchases, and thus have more disposable income.

This model however has one flaw for the Chinese. While the Chinese have great skill in replicating technologies, and have created clever contracts that in the end, garner them all of the specs on how to make just about everything, they lack in the area of generating new technologies. This is the basis for their efforts within the industrial espionage area that make up quite a great number of the persistent attacks on companies in the West that have succeeded in stealing IP. It seems that the Chinese need for political status as well as economic status have created the perfect incubator for the likes of the Honker Union or the Green Army, to turn their efforts toward making China a complete superpower.

State vs. Non State Actors:

The lines between the state actor and the non state are very much blurred in China. Due to the culture, many of the hackers work together for the common goal of the state. Since 2001 though, the notion of the state actor has been more common since the PLA began to incorporate the hackers into their ranks as well as to begin training programs at universities like the Chengdu University of Technology, which, just happens to be situated within the province where the first directorate of cyber intelligence resides.

There are certainly likely to be other hackers or groups also working for themselves selling 0day and the like, but I can also envision that certain state actors might also want in on that action as well. How better to control some of the malware out there than to actually create it and sell it? Either way, the notion of separating state and non state actors in China has pretty much been a non starter for me when looking into this issue.

In the end, they all are state actors I think just by the nature of the regime.

Techniques:

In the beginning, the Chinese hackers were just defacing pages, but after Cult of the Dead Cow created Back Orifice, the face of hacking changed. Huang Xin
took note and created the first Chinese trojan ‘glacier‘ since then, it’s been an ever increasing world of trojans and means to get the users of systems to install them. As time progressed, and hackers had to deal with more security measures (i.e. firewalls) they all began to use guile to get the end user to do the work for them. Over the years the Chinese have gotten much better at crafting decent emails that will not ring alarm bells in users heads. These emails and exploits are what we now call ‘phishing

Additionally, the Chinese have honed the attacks to not only be sly but also they have added a very regimented structure of keeping access to the networks they have compromised. Through thorough placement of further back doors as well as creating custom code to apply to applications inside of their target infrastructures, they have managed to keep the access that they desire to exfiltrate data at their own pace. Using multiple nodes within a compromised network, they will just shrug and move on to another compromised node once they have been discovered and stopped on the original. THIS is the true meaning of “Advanced Persistent Threat” and for me it’s mostly on the persistence that the emphasis should be kept.

Moving Forward:

Recent events with Lockheed have moved me to write this blog post as well as begin a series of them on the Chinese hacking community today. My initial searches online have provided all too much data and it admittedly has me overwhelmed. This I decided to parse this all out. I wanted to cover the history, motivations, and means today. Soon I will be writing more about infrastructure and methodologies to try and give a map so to speak, of what we are dealing with as the Chinese continue to use those ‘Thousand Grains of Sand‘ against us.

But, just to give you a taste of what I am seeing… Here is just one site that I did a relational link search on:

More to come…

K.