Krypt3ia

(Greek: κρυπτεία / krupteía, from κρυπτός / kruptós, “hidden, secret things”)

Archive for the ‘Economic Warfare’ Category

Operation: NIGHT DRAGON Nothing New, but It Bears Some Repeating

with one comment

Night Dragon Chinese hackers go after energy firms

Latest revelations from McAfee highlight large scale covert attacks emanating from the region
Phil Muncaster, V3.co.uk 10 Feb 2011

Just over a year after the Operation Aurora Chinese hacking revelations shook the world, security vendor McAfee has uncovered another large-scale, covert and targeted attack likely to have originated in the region, dubbed Night Dragon.

Dating possibly as far back as four years ago, Night Dragon attacks are aimed specifically at global oil, energy and petrochemical companies with the aim of harvesting intelligence on new opportunities and sensitive operational data which would give a competitive advantage to another party.

The attacks use methodical but far from sophisticated hacking techniques, according to McAfee’s European director of security strategy, Greg Day.

First the hackers compromise extranet web servers using a common SQL injection attack, allowing remote command execution.

Commonly available hacking tools are then uploaded to the compromised web servers, allowing access to the intranet and therefore sensitive desktop and internal servers.

Password cracking tools then allow the hackers to access further desktops and servers, while disabling Internet Explorer proxy settings allows direct communication from infected machines to the internet, said McAfee.

The hackers then use the specific Remote Access Trojan or Remote Administration Tool (RAT) program to browse through email archives and other sensitive documents on various desktops, specifically targeting executives.

Night Dragon hackers also tried spear phishing techniques on mobile worker laptops and compromising corporate VPN accounts in order to get past the corporate firewall and conduct reconnaissance of specific computers.

Although there is no clear evidence that the attacks were carried out by the state, individuals or corporations, there are clear links to China, said McAfee.

For example, it was from several locations in China that individuals ” leveraged command-and-control servers on purchased hosted services in the US and compromised servers in the Netherlands”, said the security vendor in a white paper entitled Global Energy Cyberattacks: Night Dragon (PDF).

In addition, many of the tools used in the attacks, such as WebShell and ASPXSpy, are commonplace on Chinese hacker sites, while the RAT malware was found to communicate to its operator only during the nine to five working hours of Chinese local time.

McAfee said that researchers had seen evidence of Night Dragon attacks going back at least two years.

“Why is it only now coming to light? Well, the environments and security controls these days are so complex it is very easy for them to slip under the radar of visibility,” Day explained.

“Only really in the last few weeks have we been able to get enough intelligence together to join the dots up, so our goal now is to make the public aware.”

Day advised any company which suspects it may have been targeted to go back and look through anti-virus and network traffic logs to see whether systems have been compromised.

Low level day-to-day problems can often be tell-tale signs of a larger, more concerted attack, he added.

William Beer, a director in PricewaterhouseCooper’s OneSecurity practice argued that the revelations show that traditional defences just don’t work.

“The cost to oil, gas and petrochemical companies of this size could be huge, but important lessons can be learned to fend off further attacks,” he added.

“More investment and focus, as well as support and awareness of the security function, is required from business leaders. Across companies of any size and industry, investment in security measures pays for itself many times over.”

Lately there has been a bit of a hullabaloo about Night Dragon. Frankly, coming from where I do having been in the defense contracting sector, this is nothing new at all. In fact, this is just a logical progression in the “Thousand Grains of Sand” approach that the Chinese have regarding espionage, including the industrial variety. They are patient and they are persistent which makes their operations all the more successful against us.

The article above also has a pdf file from Mcaffee that is a watered down explanation of the modus operandi as well as unfortunately, comes off as a sales document for their AV products. Aside from this, the article and pdf make a few interesting points that are not really expanded upon.

1) The attacks are using the hacked systems/networks own admin access means to exfiltrate the data and escalate access into the core network. This has effectively bypassed the AV and other means of detection that might put a stop to a hack via malware.

2)  The data that the Chinese have exfiltrated was not elaborated on. Much of the data concerns future gas/oil discovery. This gives the Chinese a leg up on how to manipulate the markets as well as get their own foot in the door in places where new sources of energy are being mined for.

All in all, a pretty standard operation for the Chinese. The use of the low tek hacking to evade the tripwire of AV is rather clever, but then again many of us in the industry really don’t feel that AV is worth the coding cycles put into it. Nothing too special here really. Mostly though, this gives more insight into a couple of things;

1) The APT wasn’t just a Google thing

2) Energy is a top of the list thing, and given the state of affairs today with the Middle East and the domino effect going on with regime change, we should pay more attention.

Now, let me give you a hint at who is next… Can you say wheat? Yep, take a look at this last year’s wheat issues.. Wouldn’t be surprised if some of the larger combines didn’t have the same discoveries of malware and exfiltration going on.

K

FUD! GET YER FUD HERE! : AP Exclusive: Report warns of Iran nuke disaster

leave a comment »

VIENNA – The control systems of Iran’s Bushehr nuclear plant have been penetrated by a computer worm unleashed last year, according to a foreign intelligence report that warns of a possible Chernobyl-like disaster once the site becomes fully operational.

Russia’s envoy to NATO, Dmitry Rogozin, also has raised the specter of the 1986 reactor explosion in Ukraine, but suggested last week that the danger had passed.

The report, drawn up by a nation closely monitoring Iran’s nuclear program and obtained by The Associated Press, said such conclusions were premature and based on the “casual assessment” of Russian and Iranian scientists at Bushehr.

With control systems disabled by the virus, the reactor would have the force of a “small nuclear bomb,” it said.

“The minimum possible damage would be a meltdown of the reactor,” it says. “However, external damage and massive environmental destruction could also occur … similar to the Chernobyl disaster.”

Full article HERE

Alright enough already with this talk about Stuxnet causing an Iranian Chernobyl! Look, Stuxnet was programmed in a VERY specific way to work its voodoo on the processing of Uranium, NOT on the management of the rods being excited within a reactor! The program attacked the PLC’s for specified Siemens controllers that worked with the centrifuges that spun the Uranium into fissile material.

So, who now is thinking that perhaps this little piece of reporting might be a red herring huh?

Yep…

Of course the Iranians at this time are so freaked out that they will not patch the systems that have been infected with patches from Siemens because they are too paranoid! God, I love that! Well played USA/UK/Israel for even after Stuxnet has been outed and much research has gone into it, Iran still is totally fucked! Well done! The Iranians have been a paranoid group for a long time, now they are just totally unhinged I suspect with all of the Stuxnet hype and their own brand of internal denial and heads in the sand.

Psssst hey Iran… Jester also infected your LOIC too!

Hey.. Hey now don’t cry…

Krypt0s

Top Secret America: The Fifth Column, Uncontrolled and Unaccounted For

with 2 comments

The top-secret world the government created in response to the terrorist attacks of Sept. 11, 2001, has become so large, so unwieldy and so secretive that no one knows how much money it costs, how many people it employs, how many programs exist within it or exactly how many agencies do the same work.

These are some of the findings of a two-year investigation by The Washington Post that discovered what amounts to an alternative geography of the United States, a Top Secret America hidden from public view and lacking in thorough oversight. After nine years of unprecedented spending and growth, the result is that the system put in place to keep the United States safe is so massive that its effectiveness is impossible to determine.

The investigation’s other findings include:

* Some 1,271 government organizations and 1,931 private companies work on programs related to counterterrorism, homeland security and intelligence in about 10,000 locations across the United States.

* An estimated 854,000 people, nearly 1.5 times as many people as live in Washington, D.C., hold top-secret security clearances.

* In Washington and the surrounding area, 33 building complexes for top-secret intelligence work are under construction or have been built since September 2001. Together they occupy the equivalent of almost three Pentagons or 22 U.S. Capitol buildings – about 17 million square feet of space.

From Secret America in the Washington Post

PBS Frontline report coming this fall

When this article came out there seemed to be just a collective murmur as a response by the masses. I figured that either people just didn’t care, didn’t get it, or were just too stunned to comment about it. Upon reading up some more and seeing the Frontline piece, I have decided that most people just can’t grasp the sheer import of this report. What this all says to me is that the government has no idea of just who is doing what and how much money is being spent. What’s more, the people certainly have no idea (the people as in the voting public) whats really going on either.

Another factor here I think is that many people just have too much faith in the government and in the corporations. When you really look at it though, once you have worked in the sausage factory and have seen how its made, you really never want to eat sausage again. Its like that with working for the government and or corporations really. Having spent all these years in the information security business working for fortune 500 companies as well as the government, I can say I do not want to “Eat the sausage” Of course perhaps the better thing to say is that I do not trust the government nor corporations because they both are comprised of inept people and red tape.

By far though, the concerns that I have are something a bit more ominous in nature. I fear that these machinations will only lead to greater abuses of power by not only the government but also the corporate entities that they have tasked with performing all this secret work. It used to be that there was government oversight on the intelligence community, but you knew that there was some off books things happening. Now, we have post Iraq and still ongoing in Afghanistan, a contractor proxy war that now includes a civilian intelligence element. An element that now seems to be even more “civilian” because it is being operated by corporations and not wings of the government. It gives a new meaning to “black ops”

Another interesting turn in this “secretification” to steal a Bush-ism is the whole issue of just how far the pendulum has swung from the nations not caring so much about HUMINT and intelligence to suddenly being even more fervent about it it seems than they were during the cold war years. I might also hazard a statement to say that since 9/11 it has generally felt more and more like the 50’s again where paranoia is concerned about the “enemy threat to the homeland”

Are we in danger? Yes. Do we need to have to go back to the 50’s mentality of us and them with a McCarthy-esque twist? No.

Of course all or most of this is aimed at Jihadi terrorists and not a governmental body like the Soviet bloc and this is where the disconnect seems to be the largest for me. It’s rather ironic actually that all this effort is being predicated on fighting a group of people who are not generally known for being easily infiltrated nor as easy to get a grasp on as the Sov’s were. People just knee jerked after 9/11 and really, they have only created even more bureaucracy in which the real INTEL will get lost and another attack likely happen because of it.

Welcome to Washington’s dementia…

The Consultant Was a Spy

leave a comment »

Heathfield was also pitching a software program he claimed to have developed, called FutureMap. He described it to sources and in writing as a program that would reside on a company’s internal computer network. Users could plug in variables such as election results and technological breakthroughs to see how events might affect their businesses and future strategies. A screen capture of FutureMap shows a timeline tracking events over the course of many years in a variety of categories, including “Energy and Environment” and “Medicine & Biogenetics.”

Sources who met with Heathfield about FutureMap now believe the software could have been used to steal corporate information and send it back to Russian intelligence officials without the companies’ knowledge. . . . . . Sources were unnerved by how sophisticated and polished Heathfield’s pitch was. If not for the FBI’s intervention, one source speculated, Heathfield could have made a successful sale, installed the software, and started sending information home. “If he had a few more customers and better marketing, he could have really pulled off something tremendous.” . . . .

Full article here:

Back when I was a road warrior for IBM, many people who knew me (friends and family) actually half thought that I was not an IBM employee, but some kind of spook. I have to admit that due to the nature of what I was doing I couldn’t really talk about exactly what I was doing, but I could tell them I was here or there etc.. Unlike real spooks. In the case of Heathfield, well, he turned out to be a real spook and gee, look at that, he was a self branded “consultant” whod’a thunk it huh?

The fact is that the CIA often uses NOC agents in the role of consultants or reps for “front companies” or even legit companies as a cover for their NOC (Non Operational Cover) identities or “legends” They go into places under the guise of business like an Oil company that may in fact be the target of their collection activities. It’s an old trick and it always will be the case, there is nothing new here save that this guy was in fact perhaps peddling software that was pre-pwn3d and could tunnel the “clients” data out to mother Russia. A rather nifty idea really but again, nothing new.

So, won’t you now look on the new consultant as not only perhaps a Bob (oblique Office Space reference) but also maybe the next corporate spy?

THIS is what should happen but I am sure will not. You see, the vetting process for employing people oftentimes is too weak if at all in place at companies. All too many times people do not check references nor do they do the criminal background checks on new hires or prospectives. Never mind the fact that most of the time its easy enough to get onto a corporate facility with faked credentials or none at all and gain access to data, terminals, hardware etc. Hell, just how many places have a separate vlan or drop for internet access for visiting consultants or perspective clients?

Put it this way.. Can anyone just plug in and get a DHCP address on your network? If they can, well game over man.. Even more so if you have a weak AP system for wireless (can you saw WEP?) So that “consultant” whether or not they are meant to be there or have just socially engineered their way into the building may already be on your network and tunneling out gigs of data as you read this…

So one of them turned out to be a real bona fide Russian illegal WOOO HOOO! Worry about all the others out there from ever other land as well as corporate entity looking to steal your shit.

Pay attention! So can the DHL Guy, the I.T. Guy, The Mail Man, The Temp, The Plumber, Janitor, etc etc etc…

CoB

Talk on Chinese Cyber Army Pulled From Black Hat: Nothing To See Here… Move Along…

with one comment

“Operation Aurora, GhostNet, Titan Rain. Reactions were totally different in the US and in Asia. While the US media gave huge attention, Asia find it unbelievable and interesting, that cyber warfare and government-backed commercial espionage efforts that have been well established and conduced since 2002, and have almost become a part of people’s lives in Asia, caused so much “surprise” in the US.

Here we’ll call this organization as how they’ve been properly known for the past eight years as the “Cyber Army,” or “Wang Jun” in Mandarin. This is a study of Cyber Army based on incidences, forensics, and investigation data since 2001. Using facts, we will reconstruct the face of Cyber Army (CA), including who they are, where they are, who they target, what they want, what they do, their funding, objectives, organization, processes, active hours, tools, and techniques.”

Full article Here:

“We’ve been hacked! Oh wait, you’re in Paris… You can’t help us.. CLICK”

Color me not surprised to see that this talk was yanked off of the BlackHat schedule. This is specifically in light of the fact that the presenter is from Taiwan, a protectorate of China and likely if the talk went ahead, then the speaker and his company would have been sanctioned by the Chinese government. Though, it could be that there are other players here that may not want some bits of information out in the open but who’s to say at this juncture? Suffice to say that something in this iteration (and there have been others of this same talk given) got them spooked.

The other comment that struck me was the red text above that mirrors what I have been saying all along since the whole Google APT thing erupted onto the media stage here in the states.

This is nothing new.

The Chinese have been at this for some time just as other countries had been doing the same thing. It is just perhaps the scale and the persistence that has been the key to the difference here. The Chinese have the 1000 grains of sand approach that is culturally specific to them. They took that notion, the game of “Go” and and what they learned from Sun Tzu then applied it to their cyber warfare/inforwar stratagem. Its only a natural progression really given their culture and history. What really takes me aback is just how little the West (ala the US) seems to be so ignorant of this that it has me wondering just what navel they have been gazing at all of this time while the Chinese ate our collective lunches.

So here we are, months later after the Google revelations and years after the successful attacks that no one dare name for fear of national security or perhaps national egg on the collective national face with regard to incursions in the past on sensitive networks. You see, yes Virginia, there have been other incursions and much more has been stolen via networking infrastructure as well as HUMINT by the likes of China in the past. Its just that its either classified, hush hush, or, more likely, the targets have no idea that they had been compromised and their data stolen. It’s all just a matter of the security awareness that we have had.. Well, where that has been nationally has been in the toilet really, so extrapolate from that the amount of data that has been stolen ok? Lets use the JSF as an example of this as its been in the news.

Trending Lately.. APT+JSF = Chinese Love

Now, given that this type of talk has been the “du jour” lately on the security and government circuit, lets move the target further out and to the left a bit ok? I have been noticing something in the news that has direct connection to my last employer, so I will be judicious with my speech here.. How shall I start….

Ok… Lets name the players…

Lockheed Martin: Hacked and about 2TB of data taken out of the systems… Inclusive on the JSF project

(Undisclosed company that makes hot object integral to flight) : Nothing in the news…. wink wink nudge nudge..

The FAA: Hacked and back channeled through trusted networks into Lockheed and ostensibly other companies

The JSF itself.. Well the congress wants to keep the program afloat while the main military brass want to kill it. You see, its been compromised already and I suspect well enough, that the technical advantages that it was supposed to have, are pretty much gone now. You see, all those hacked systems and terabytes of data exfiltrated out were enough to compromise the security of the ship herself and give the enemy all they needed to defeat her “stealth” systems.

Somewhere in China there’s a hangar, a runway, and a Chinese version of the JSF sitting on the tarmac doing pre-flight I think.

So the latest scuttlebut out there with regard to the cost overruns and the problems with the JSF are just one part of the picture I think. Sure, there is political intrigue and backstabbing going on too, but, were I the military and my new uber plane was no longer uber, nor cost efficient, I would be killing it too and looking for something else to use in theater.

So how did this happen?

Causality: Trusted Networks, Poor Planning, Poor Technical and Procedural Security, and The Human Equation

The method of attack that compromised the networks in question involved a multi-layer strategy of social hacks as well as technical ones. The Chinese used the best of social engineering attacks with technical precision to compromise not only the more secured networks, but also to use trust relationships between companies working on the JSF to get the data they wanted. You see, all of these companies have to talk to each other to make this plane. This means that they will have networked connections either via VPN or directly within their infrastructures to pass data. By hitting the lesser secured network/company/individuals they can eventually escalate privilege or just hop right onto the networks that they want in a back door manner.

Hit the weakest point and leverage it.

In the case of the JSF, the terabytes of data were never really elaborated on but I can guess that not only was it flight traffic data, but integrally, the flight recording data concerning all of the systems on board as the plane was tested. Inclusive to this, if the APT got further into Lockheed and other companies that make the plane, they might have data on the level of actual CAD drawings of parts, chemical analysis and composition details, as well as the actual code written to operate the systems on board the plane for it to function.

In short, all of the pieces of the puzzle on how to make one.

Sure, there must be gaps, I am sure that they did not gain access to some ITAR/EAR data but, given the nature of the beast, they can infer on some things and in other areas perhaps get analogous or dual use technologies to fill in the gaps. The two terabytes are the only terabytes that we “know of” or shall I say allowed to be known of. It is highly likely that that data is not the only stuff to be taken. Its just a matter of finding out if it has.. And in some cases, they can’t even tell because of the poor security postures of those companies involved.

The reasons for these companies (with the exception of Lockheeds) lack of insight into their security is simply because they have not been corporately aware enough to care about it… Yet. Perhaps now they are getting better post the hacks on Lockheed and others, but it has been my experience that even after a big hack is exposed in the news, many corporate entities take a “it can’t happen to me” attitude and go on about BAU until they get popped and put on the news. What’s more, the Chinese know this and use it to their advantage utterly.

You see, its not just all about super technical networking. It’s also because they don’t even have solid policies, procedures, response plans, and other BASIC security measures in place or being tested and vetted regularly. This negates the super cool technical measures that they might have bought from the likes of IBM and CISCO because Johnny Bonehead C level exec says he MUST have a 4 character password and ADMIN access to his machine.

All against policy… If they do indeed have one on that…

Failure is imminent unless the sum of the parts are in working order. This means the dogma of policy, security education, incident response, RBAC, etc, the CIA triad are in place and have acceptance from the upper echelon of the company. All too often this is not the case and thus easy compromise occurs.

Circling Back To The BlackHat Talk:

Ok, circling back now after my diatribe… My bet is that both parties (China and US) did not want this talk to go on depending on the data that was within. Some red faces would likely have ensued and or would have given people ideas on where to attack in future also. It’s a win win for all concerned if the talk was made to go away and well, it did didn’t it? Unless this guy says he quits his job, moves away from Taiwan and then gives the talk anyway. I doubt that is going to happen though.

In the end, the cyber “war” has been going on for years… Well more like cyber “espionage” but in todays long view I see them as the same thing. After all, a good cyber warfare strategem includes compromise of key systems and data in order to make them useless at the right time.

The Cyber War has been raging since the 90’s. It’s just that the American people and media have only recently heard of the “internents” being vulnerable.

Wakey wakey…

CoB

FOCA: A New Recon Tool

with 3 comments

I recently got a text from a former co-worker saying that I should take a look at FOCA, a tool that I had not heard of before. The text said that this tool had a good deal of forensics potential in that it would search a group of documents and extract the metadata from them. My friend got it half right from what I have experienced so far.

The tool does indeed cull metadata, but, it is from directed web searches with engines like Google and Bing that it does so. This however is a fantastic thing! Even if you cannot just point it at a directory on a hard drive locally, this tool is a great resource for OSINT/RECON online. I decided to give it a try first on some Jihadist sites *post to follow* but then decided to use it against a “known domain” NYSE.com

The tool gives you a simple front end that allows you to search a domain/website and saves the whole process in a proprietary project based format. So, you can go looking for a specific domain and create a whole project to save all the collected data. The only flaw I have seen so far is that this tool does not output your search/project into any kind of use able report format.

The tool goes out to Google, begins searching for numerous filetypes such as .doc or .pdf. Once located, the URL’s show up in the tools window to show you if you do indeed have good hits. After the initial search, you can then download all of the documents for the next step of pulling the metadata. This is where it gets interesting…

Once the docs are downloaded, you can analyze the metadata and then FOCA gives you a series of pull downs that show you all of the user data that the docs offer up… And boy can it provide a plethora of data! From the NYSE searches I was able to not only see the user names, email addresses, software being used to create the documents, but also folders that they were stored in!

Then you can move on to more obscure searches using the metadata. FOCA has a feature to search those same engines that it just pulled the files from to go further and look into the domain structures, server names, users, printers, suffice to say it pretty much will map out a whole infrastructure for you using Google/Bing and the metadata you already have.

Now, depending on the security levels that the systems being searched against have, it is possible to cull quite a bit of intel on your target. So much data that in fact one could make a real network map as well as a full plan of attack on users, networks, file systems, etc.

It’s kinda scary really as you may be able to see from the pictures here….

All in all, this tool is quite the find. I would only like to ask the creator to allow for a local feature to just access metadata for files that have been downloaded already… But that’s for another post to follow on those whacky jihadist sites…

FOCA

CoB

The SKYNET of Wall Street… How About CyberWar by Russia or Joe the Hacker?

leave a comment »

Given the recent events with the stock markets sudden and sharp dip, many people have been pondering whether or not there was some computer trickery involved. One might even dare to say “hack” or, unfortunately, the moniker of “CyberWar” has been thrown out there about the incident.

From what I have heard on the news, the systems just seemed to go off on their own, the words used were “took off” and there were even references in the news to “Skynet” Oh my… Now that is scary, these people are looking at this as the next SkyNet out to whack us with giant Schwarzenegger’s!  I think though, that the reality lies more along the lines of perhaps a test. Perhaps a pre-test to something more akin to the cyberwar scenarios.

What’s bothering me though is the eerie silence on the part of the government, the police/feds, and Wall Street itself on this. Of course I am sure they would all love to minimize any fears that the public may have here because surely, if the word went out that this was an attack or a hack, then the market would crash further and for longer than it did last week. People would just not have any faith in the system and there would be the equivalent of a bank run on Wall Street.

So the news media and the talking heads tried to pawn this off to a “fat finger” trade, but then, as time went on, it came to light that it couldn’t be that. So, what was it then? Are they investigating? Are there Secret Service folks on site performing forensics on digital assets?

Like I said.. “eerie silence”

This all got me thinking about the potential for a hack on the NYSE and the stock markets in general. My first task as any good security specialist was to footprint the target. So, I went to “The Google” and did some foot printing at www.nyse.com what I found rather flabbergasted me. If you look in the right way, you can gather a LOT of intel on the network makeup, protocols, processes, clients, and vendors for the stock market. All of this just coming from one domain mind you…

I was able to not only obtain documents marked “CONFIDENTIAL” but those same documents described networks, processes for DR, Backup, and daily operations. I was also able to get manuals on their systems that interface to make trades from both inside and from outside of the exchange. Some of these documents actually described actions that the network operations folks are yet to actually carry out for 2010.

Oh yes, our theoretical money on Wall Street is safe… Not.

In one case, I actually was able to gather IP addresses for failover in NJ and Chicago as well as when they were planning on running a failover test. So, yeah, these documents are all, as a whole, a hell of a start to begin planning for an attack on the monetary engine of our country. Many of these documents I assume have just been put in the wrong directories on the web facing servers even with the markings on them, but, really, c’mon guys where’s your OPSEC?

Even better, the uber document with much data on how the systems work and includes network diagrams goes further to show you cabinet details in collocation areas as well as has actual blueprints to the trading floor in NYC.

DOH!

So, perhaps there is a reason for the quiet huh? Imagine the panic that would ensue if indeed the market was attacked by someone with a computer and a set of pdf’s on how to operate trading software? Imagine the fear right now to those of you in the security field who are about to learn that in one case, a system used to trade carries out its actions on a TELNET session over the internet…

No… Really… I saw it. Perhaps they have a VPN or maybe I misread it but….

Check whether you can telnet://XXX.XXX.XXX.224:1723. If not, try to telnet://XXX.XXX.XXX.224:1838. If you can reach 1838 but not 1723, you must create a new line in the [TALIPC] section of the TAL.INI. The line reads: UseNewPort=

Oh yeah.. there you have it… Needless to say, I stopped there. Google had given me enough to really mount a plan…

Its time to start hiding your money in mattresses folks… Or maybe just buy all the gold jewelery you can and head to “Good ol’ Tom” when the shit hits the fan. So Wall Street, What’s the story here?

K

William Gibson’s Future is Here: Keiretsu’s, Phramacom’s, Kombinats, and Private Intelligence

with one comment

World View Change:

I just finished reading “Broker, Trader, Lawyer, Spy” by Eamon Javers moments ago and it has had me thinking for some time now about the private intelligence business. Of course I believe that in many ways, the last 10 years or so of my career has been in an analogous business, that of “Information Security”, a euphemism that covers a portion of what I do on a regular basis for clients by checking their security and trying to circumvent it to steal their data.

Of course in my case and others, we are asked to do so by the targets themselves and to recommend fixes for anything that we find.

However, it seems that since at least the 2000’s a boutique business model for “Private Intelligence” has burgeoned around the globe and now it seems to be at its height in this current economic climate. After all, if you as company A can get an edge on company B by hiring some old intelligence warhorses to spy on B, then all the better eh? I mean, in today’s ethically “gray” world, what’s to stop you? Governmental regulation? HA!

Once, long ago, I was an altruistic sort and believed not only in my government but also in business’ and people’s desire to do the “right thing” Now, 13 years later, I have come to the conclusion that there are no companies, nor people out there who are genuinely looking to do the right thing. After working for fortune 500 companies as well as smaller ones, I am now aware that the only motivation that they all have is to “get ahead” or to “have a good day and not rock the boat” as my last employer proved out in spades.

In short, I have come to the conclusion that there is no black and white.. Only gray areas in which we can choose to hide and learn to live with ourselves.

In the business of “Corporate or Private Intelligence” one can make a good living as long as they don’t suddenly grow a conscience about exactly who they are surveilling or gathering intel on as well as to whom they are providing it to. Though, often these entities who are paying the bill have a middle man (aka a law firm) hiring you out to do the work so as to have a blind spot vis a vis “confidentiality” agreements. So you may never really know what you are up to in the grand scheme. However, in my new world view, I should feel indifferent I think about the whole thing because the base truth is that each of the parties involved (being watched and paying for the service) both likely subscribe to the morays of our current corporate and governmental environment…

“What’s in it for me?”

Stepping Into the Forest of Mirrors:

So it has come that in today’s world, the intelligence agents MUST be technically savvy in order to work. I have seen the articles online about how the CIA and MI5/MI6 have begun large recruitment drives for individuals with technical backgrounds in computing. The problem though that they have is this, their pay grades suck and in today’s world too few are true believers in God and Country. So the private sector seems to be the most logical choice for anyone who wants to make a living and have enough to actually retire when they are too old to work any more.

Of course in the book a chapter is devoted to the idea that many of the agents out there today at the CIA are now “allowed” to moonlight as long as they tell the agency and get approval to do so. I guess in order to keep talent, the CIA decided it was best to allow these activities as long as they were not compromising any operations… Makes sense, after all the largest GS salary one can really get tops out at just over $100,000.00… Not much in today’s salary base huh? So it would seem that many are getting the training from the CIA and other agencies then moving on to the private sector.

Meanwhile, that private sector is not sipping at the private intelligence spigot, they are gulping it down. It seems that not only nation states are the main recipient of corporate intelligence any more. Instead, its the idea of conglomerates and corporations practicing business as war in the best of traditions that harken back to the “Keiretsu” and Sun Tzu. Perhaps my assessment of American business was slightly off in one of my last posts?

Nah, I think instead that they are all practicing this means of corporate warfare, but lack the stability nor forward thinking of the Japanese Keiretsu model. It’s corporate spy vs. spy and the only ones to really profit are the spies themselves. In this I find a certain comfort really, because frankly, the corporations that I have been inside of, do not deserve to get ahead due to their sloth and lack of forward thinking. A certain intransigence and laziness pervades most companies where it comes to being able to fend off such attacks as those used in corporate digital warfare and frankly, its their own fault.

So, where does that leave me? It leaves me thinking that to really make a living and to maximize my talent use, it would be better to walk away from trying to teach these companies anything about securing their data and instead use their weaknesses against them working for such a firm as the Trident Group or any number of others out there. Perhaps to even just start my own agency. After all, who’s job in corporate America is safe today? By being a good soldier and doing your all do you really get any consideration from the company you work for?

Think about it.

Final Analysis:

In the end, I found this book to be quite enlightening. I was rather surprised by the last pages where the author tried to put forth the idea that all corporate intelligence firms should register with the government (ala the SEC) to work. I think he was smoking the proverbial crack pipe when he put that to paper, but I understand his altruistic thrust there. Eamon, that will never happen and it won’t because if you register these places their cover is blown. How would an agency of that type ever really work if the government has them and their employees registered in an ever so safe SQL database on an insecure server somewhere huh?

*Snort*

If you get the chance, read the book. You too will be enlightened as to what is going on out there in the world today. You will not see things in black and white any more, that’s for sure. Oh, and if you are a William Gibson fan, you will undoubtedly have to stop yourselves and think “Shit, he predicted things to the T again!”

CoB

Losing the War with Japan… Or was it Losing The War With China…Maybe Ourselves…

leave a comment »

A keiretsu (系列?, lit. system, series, grouping of enterprises, order of succession) is a set of companies with interlocking business relationships and shareholdings. It is a type of business group.

Recently, I came across an old episode of PBS’ Frontline that was titled “Losing The War With Japan” (click link to see it on YouTube) In this 1991 report we see how the country was concerned with the rise of Japanese business and their “unfair” practices of Keiretsu and Zaibatsu. Of course the report calls it “Predatory Capitalism” but I would just say that they were being smart. I guess one man’s smart is another losers 1-800-WAAA, but we are a country of laws are we not? So sure, I can see my way clear on some of the charges in unfair practices. However, now that nearly twenty years have passed what have we learned?

Obviously not much…

Lets run down whats happened since the Frontline piece.

1) Japan took over the car market and the US Auto industry learned nothing. They remained bloated and making poorly thought out, bloated, gas guzzlers and are now in bankruptcy or near to it.

2) Japan got too close to America and took on too many of her ways. Soon there was a meltdown in their economy and a slew of admissions of malfeasance by corporate entities.

3) America had a boom and bust over “internet stocks” basically vaporware Greed was indeed good and the Ivan Boesky set began to plan for even bigger schemes that would come to roost in our current “credit default swaps” fiasco and near depression. The net effect, we began to not make anything here except maybe “intellectual capital” that is currently being stolen and reverse engineered in China.

4) America began the great outsourcing of all the things we no longer “make” in order to have better bottom lines on balance sheets from cheaper labor in third world countries.

5) China buys great quantities of our debt.. They now effectively “own” us.

6) The “Great Recession” comes post 3 front wars for many years and an abdication of any kind of regulation on business, banking, stocks, etc. Even though, we were warned that the big banks were playing fast and loose with our money and selling us magic beans.

7) Now China looms as a new kind of super power that deems to attack us on cyber and economic fronts in order to become the pre-eminent super power. Basically, they have us by the short and curlies economically as well as technically (e.g. cyber warfare)

So, how did we not learn from history? How is it that this country just went on its merry way and learned not one thing from its near miss with Japan? Did greed and self absorption just blind us to it all?

In a word.. Yes.

We have failed ourselves by not paying attention and our government has failed us for not being able to comprehend what was going on. We elected the morons in office and they let go of the tiller that controlled the business world’s ethical rudder. Of course, we the people didn’t help either as we were rolling in the new money that was rolling in from tech stocks, or ponzi schemes that had been all the rage.

There’s a line from “Rising Sun” that always struck me as true and now that I look back it is absolutely so.

John Connor: We’re playing that most American of games.
Web Smith: Which is what?
John Connor: Catch-up.

Lets face it, we are playing catch up because we have been too intellectually incurious to see what has been happening all these years. Can we catch up now I wonder? Or will we continue down the same path of blind faith in the system and personal greed?

Of course one would have to also hope that the “system” i.e. our government would not let themselves be led down the primrose path again like they have with all of this credit default swaps and “too big to fail” banks falderall… I hold out little hope.

Take as look at the Frontline stories and ponder…

CoB