(Greek: κρυπτεία / krupteía, from κρυπτός / kruptós, “hidden, secret things”)

Archive for the ‘FUD’ Category

Post Hoc Ergo Propter Hoc Poop: Recorded Future and the Jihadi FUD-O-Sphere

with 4 comments


Jihadi Crypto

Recently Recorded Future caused a stir in the media over what they gathered through OSINT on Jihadi crypto since the Snowden revelations. This report nearly made me have an aneurysm from it’s simplistic approach to the problem and it’s deep lack of knowledge on the subjects of crypto and jihadism.This report though made the rounds and ended up on places like NPR (which RF cited on their report LA DE DA) adding cache to it all.

The realities though are that RF has in fact only seen one small slice of a larger issue concerning crypto, propaganda, jihad, and the GWOT in general and it makes me mental when I see shit like this. So this post is to set some things straight and I will be furthering this out with a guest appearance on The Loopcast to discuss all of this in a longer forum. For now though, let me splain some things.

Jihadi Crypto AFTER Snowden

Before Snowden the crypto choices for the jihadi’s online pretty much broke down to a couple choices. The Mujahideen Secrets, a couple other crappy ones, and PGP. I will tell you now that the Mujahideen Secrets was the “gold” standard for these guys and it was the suck to start. So really, pre Snowden there were more limited options sure, but the reality is that Mujahideen Secrets was only really used for low level talk between guys on jihobbyist boards and for emailing the brothers at Inspire their derpy ass questions about jihad.

The cryptography was standard in Mujahideen Secrets and the programming of the application itself was so so. I have looked at this before and didn’t think much of it back then. Today I think even less of the whole prospect of the great cryptojihad being an actual “thing” at all. Now though, since Snowden sure, there are more options out there and some may actually be well programmed and using cryptography that is solid. However, that does not mean that the real players are using them post Snowden. Nor does it mean that the players who ARE using the crypto are a serious threat at all to begin with.

Crypto is a Red Herring

Cryptography is only as good as it’s user in many cases. In the case of the jihadi’s out there on the net they are mostly luddites when it comes to tech. Tell me RF, who do you have on your list of great Jihadi hackers today? No, really, who do you have on that list? Don’t throw TH3PR0 at me either because he is not a Muslim extremist as far as I have seen in his traffic. So who do you see as the great threat technically today? If a lot of these guys were adept at tech then most certainly their shitty site’s wouldn’t be getting PWN3D all the time right?

So there is that. Now look at the user base of the jihad. If you are not in country then you are elsewhere and on the Shamikh site spouting shit and throwing as much puffery as possible out there to look good for all the girls right? On the whole, after watching these guys I have to say that the majority aren’t the swiftest boats in the river nor the sharpest blades in the drawer if you catch my drift. So how many of these guys you figure are gonna be able to handle a two key system effectively and not fuck up the key exchange right off the bat?

*Let me give you a hint.. I have seen these idiots place their PRIVATE keys on the Shamikh site**

These guys are like any other users in the base of common people who have trouble comprehending how crypto works never mind how to send a PUBLIC key to the person they want to talk to! So I say to you all here and now, the issue of crypto with these guys on the net is a complete red herring and just a means to an end for RF to get clicks and revenue.


So let’s get past all the crap about “ZOMG SNOWDEN GAVE THE JIHADI’S INTEL!!” and speak about the realities. Sure, the jiahdi’s saw what was being dropped and they learned from it. They immediately went out to create a new means to have encrypted traffic sure. However, ask yourselves how many of these guys using this stuff are really hard core AQ/ISIS/ISIL/AQAP etc guys? The truth of the matter is that the core AQ types are not even using the net because of fears that anything they do will be compromised.

A for instance is this; Post 9/11 UBL started using a sneakernet approach with REAL TRADECRAFT to carry his messages to his commanders. They carried messages by hand and if they used the net they did so sparingly for key comms. They did this because they knew that the net was PWN3D (more assumed) and they already knew communications like SATPHONE was already tagged. After all UBL’s SATPHONE had already been compromised and he found out after an attack.

My point here is that OPSEC and TRADECRAFT are important. If you have good crypto but you fail at OPSEC and TRADECRAFT then you lose. An example of this is that the Inspire accounts that they published in their so called magazine were Gmail and Hotmail accounts. That’s right kids, the jihadi’s were emailing their super secret questions and other things right to the NSA!

…But you think.. THEY USED CRYPTO! HA HA!

No, you see they have the account.. Then when YOU email them they have YOUR account too. See where I am going? Relational databases and bad OPSEC puts the jihadi on the list for flights to GITMO. On average these guys were not carrying out proficient OPSEC tactics and thus were likely to give up their private information along with the accounts and thus you have a black van or a drone showing up in the current GWOT. Crypto is not the answer nor is it the rubric to hang your hat on as to how a leak has compromised operations for the US.

Recorded Future has just taken a slice of the problem and blown it out of proportion for attention and that is a disservice. So please mass media ask some more questions on this. Don’t run with the Snowman OMG story because that is bogus. I know you won’t listen to me but hey a man’s gotta try right? The rest of you out there who read this blog likely already understand this and I am preaching to the choir.

I will look at the varying crypto programs soon and critique them as well as use the data to track some of these idiots just to show the MSM how easy it can be to track them. I have done it before and man sometimes these guys just make it too easy. Like that Jihadi who thought he was l337 by putting up YOUTUBE’s of himself hacking… With his own IP…

SUPER DERP.. But now he has CRYPTO post SNOWDEN OMG!



PS.. Look for the Loopcast podcast on all this coming soon.

Written by Krypt3ia

2014/08/09 at 13:38

Posted in FUD, jihad

ASSESSMENT: Mujahideen Secrets and the Snowden Affair

leave a comment »

Screenshot from 2014-05-15 05:58:04



Mujahideen Secrets:


The Mujahideen Secrets program for crypto has been around for a long time for those who wanted to connect in the jihad online. I looked at it a long time ago and didn’t think much of it to begin with but it has been around a while and in use by some. Recently there has been some tongue wagging that the Snowden Effect has deeply scarred the GWOT because actors (aka the jihadi’s) are not changing their patterns of behaviour and creating new crypto and comms. While this program was out there for use to say communicate with AQAP on their Inspire gmail account it wasn’t as far as I have seen over the years the go to for securing communications for the jihobbyists. In fact, I would preface that people are people and crypto is hard so not many really adopted the technology in the first place.

Since the program had been kicking around the internet so long my assumption was that it was broken already or tampered with more likely to allow for easier reading by security services. So with that said and I think some others within the jihad actually thinking the same it became just another not often used tool in the arsenal for communication between the jiahdi’s on the internet boards. Of course one must also take into account just how many of these people on the boards are “active” in the jihad and not just “jihobbyists” who want to blow smoke online but would never actuate themselves into real terroristic actions.

Pre and Post Snowden:

Screenshot from 2014-05-15 06:14:01

So the articles out there from Recorded Future   which is pretty much a theft of a MEMRI document by the way, purport that since Snowden dropped all his data online people are changing their operational patterns. I say that they perhaps are just seeing the crust of the data and not the innards of the problem statement. There may be a lot of chatter about not using Mujahideen Secrets anymore or of using other technologies but one has to look at the problem from the social/networking standpoint of a fractured AQ/Global jihad now as well. This is where I think they are failing.

GIMF is back and the groups are scrabbling for purchase in the jihad because of things like ISIS causing a stir, Boko Haram as well, and other players out there looking to be the big boss of jihad. Online the boards have been rife with hack attacks, paranoia, and a general malaise of people not actually doing anything but the usual spewing of dogma and posturing. So really, when one starts talking about the online jihad and the use of crypto the reality is on the whole that the online jihad is just a side show to the real deal that happens off the net. Communications are being handled offline now altogether with couriers and paper or USB drives and phones. It has been that way for a long time actually and the general public just doesn’t get this from the press.


The final analysis of this story is pretty simple and it is this; Mujahideen secrets and the other new technologies being offered by GIMF are just fluff. The changing of tactics is only natural post any kind of leak that the nation states are watching and frankly since Snowden this should be a global reality and thus no surprise really. All of the people bemoaning it are just doing so in my mind to tow the party line and aren’t really facing the reality that the game is up. Secondarily, in the case of the jihad the game was pretty much a kids game to boot so please don’t moan about it in the press to make the general populace feel the fear again so you can go on about your business of “surveilling all the things”

This is much more a political power play than it is anything else and reading this tripe in the news makes me gag.


Written by Krypt3ia

2014/05/15 at 10:53

Posted in .gov, .mil, FUD

ASSESSMENT: Corporate Threat Intelligence Versus Actual Intelligence Products

with 5 comments

Screenshot from 2014-02-25 11:12:19

Threat Intelligence:

Threat intelligence is the new hotness in the field of information security and there are many players who want your money to give you their interpretation of it. Crowdstrike, Mandiant, and a host of others all offer what they call threat intelligence but what is it really in the end that the customer gets when they receive a report? Too often what I am seeing is reports based on suppositions and little critical thinking rather than the traditional raison dartre of a threat intelligence report on actors that may have an interest in your environment. A case in point is the report from HP that was conveniently released right in time for this years RSA conference in San Francisco.

This report on the Iranian cyber threat was hard to read due to the lack of real product or knowledge thereof that would have made this report useful to anyone seeking true threat intelligence on an actor that may have interests in them. With a long winded assortment of Googling as Open Source Intelligence, this report makes assumptions on state actors motivations as well as non state actors who may, or may not, be acting on behalf of the Basij or the Iranian government altogether. While the use of Google and OSINT is indeed a valid way of gathering said intelligence, intelligence is not “intelligence” until proper analysis is carried out on it. This was one of the primary problems with the HP report, the analysis was lacking as was the use of an intelligence analyst who knew what they were doing.

Clients and Products:

When carrying out any kind of intelligence gathering and analysis you must first have a client for the product. In the intelligence game you have “products” that “clients” consume and in the case of the HP report on Iranian actors it is unclear as to whom the client is to be here. There are no direct ties to any one sector or actor for the intelligence to have any true “threat matrix” meaning and thus this report is of no real use. These are fairly important factors when generating an analysis of a threat actor and the threat vectors that may affect them when creating a report that should be tailored to the client paying for it. Of course the factors of threat actors and vectors of attack can be general at times and I assume that the HP analyst was trying to use this rather wide open interpretation to sell a report as a means to an end to sell HP services in the near future. I am also willing to bet that this report was a deliberate drop for RSAC and they had a kiosk somewhere where they were hawking their new “Threat Intelligence” services to anyone who might want to pay for them.

In the case of this threat intelligence report ask yourself just who the client is here. Who is indeed really under threat by the alleged Iranian hackers that are listed. What sectors of industry are we talking about and who are their primary targets of choice thus far? In the case of Iran there has been also a great deal of supposition as to these actors and their motives. The report makes allusions to state actor intentions but only lists known Iranian hacker groups that may or may not have affiliations with the government. The same can be said for their TTP’s and other alleged data within the report. The important bit about threat intelligence in the world of information security is that you need hard data to model the threats and the actors for your specific company and this report generates none of this. This fact makes the report not really threat intelligence at all, not in the aspect of either true intelligence nor corporate intelligence.

Intelligence Collection:

The collection of intelligence is an arduous process that should be carried out by trained individuals. There are so many pitfalls that can happen to an untrained analyst that could make the product of the report bias or useless in the end and these things should be avoided. In the case of corporate intelligence reporting and threat intelligence the same is true. Just carrying out some OSINT on some individuals and outputting what you find by stringing together assumptions is not a valid way of carrying out intelligence reporting nor is it the correct way to gather intelligence. The collection of intelligence in the information security spectrum should also include direct data on telemetry and known instances of attack against the organization in question to determine if they are in fact subject to the interests of the threat actor such as Iran or SEA. The HP report lacks this context and thus is not much more than some suppositions about how you might be under threat from an amorphous threat actor, and thus is little more than FUD.

If you are going to collect intelligence I suggest that you get trained individuals to start or if you are interested in the subject yourself you can easily locate materials online to read on how to do so properly and avoid the common pitfalls like bias and group think. Intelligence collection is comprised of many facets. You need to be collecting information from a vast array of sources and methods before you attempt to analyze it and create any kind of cogent reporting for a client. In the case of the HP report you only have histrionic data from news reports and light analysis of websites owned by alleged hackers or state actors. True collection though for a client would also include detailed data or knowledge of their business, their technical measures, and their history to create a cogent picture of their business and the threats that they may face from the actors out there who may have interest in them. The HP report lacks this and that is unfortunate.

Intelligence Analysis:

The analysis of intelligence is as I said above, a learned skill that must be honed in order to perform it correctly. Analysis in and of itself takes all of the data out there and generates a report on the entirety of the data for an against, positive and negative. Anything short of this kind of holistic analysis of information in a report of this kind only serves to mislead the client and usually be quite incorrect. An example of this would be the White House Iraq Group’s (WHIG) assessment of Iraq’s WMD’s and intentions pre Gulf War II. In this case however it was even worse because the intelligence was fit to the political desire of the administration and thus was not really analysis nor intelligence product. In the case of the HP report there is a narrow swath of data that was alleged to be collected (presented in footnotes or screen shots) in addition to snippets of news media as intelligence.

To analyze intelligence one must first have proficiency in the disciplines of intelligence gathering, analysis, and the particular subject matter. In the case of the HP report, there is a lack of comprehension of the politics of Iran which might be drivers for the alleged hackers or state actors. There is also a lack of rigorous interrogation of the data presented as intelligence to test whether or not there may be a disinformation campaign or deception operations at play as well. Put simply, the analyst for HP did not take into account that this is in fact a nation state and that they may in fact be leading such analysts down the primrose path to obfuscate the real actors. This was not even considered in the report and just paints the alleged hacker groups as more than likely linked to nation state activities. This is poor analysis even if there may be some truth to it, but without a rigorous investigation and questioning there can be no real solid assumptions made. The net net here is that analysis of intelligence is not just looking at websites and making assumptions.

Intelligence Reports:

Reporting intelligence is a key part to the overall process within all types of intelligence activities. A report as stated above, must have a client and in the case of the HP report I would once again ask who is the client here? What type of business should be worried that they may fall into the targeting of the nation state of Iran or these Iranian hackers? What sectors of business should be more worried than others here? In the case of the HP report I suspect there was no real client here but it should never be forgotten why one is carrying out the intelligence cycle and just who your client is in order to tailor the report so they can use the information in a productive way. Form and formats change but the aegis of the report is to apprise your client of the five W’s (Who, What, Why, Where, and When) and should be paramount in your efforts at collection and reporting of any kind of intelligence.


My analysis here is this; “Buyer beware” Threat Intelligence may be all the rage out there as services go but really think about what you are getting as product. Ask yourselves just what you are looking for when you consider buying into threat intelligence services and how you may be getting it. If you are looking to see what your current threats are your analyst should be asking you to provide intelligence on you first in order to see who might be attacking you. The technical means of log analysis and telemetry is an integral part of the process here for threat intel for corporate bodies and should never not be a part of the process. Any other reporting on threat actors without defined and direct matrices to your org is nothing more than news reports on possible terrorists who may or may not be attacking in the near future somewhere near you. This is not threat intelligence nor is it giving you a true picture of the threats you may face.


Written by Krypt3ia

2014/03/09 at 11:01

So here’s my thing….

with 3 comments



Face it.. We are all PWND six ways to Sunday

Every frigging day we hear more and more about how the NSA has been emptying our lives of privacy and subverting the laws of this land and others with their machinations. It’s true, and I have been saying as much since the day Mr. Klein came out of his telco closet and talked about how the NARUS system had been plugged into the MAE West back in the day. We are all well and truly fucked if we want any kind of privacy today kids and we all need to just sit back and think about that.

*ponder ponder ponder*

Ok, I have thought about it and I have tried to think of any way to protect myself from the encroachment of the NSA and all the big and little sisters out there. I am absolutely flummoxed to come up with any cogent means to really and truly protect my communications. Short of having access to the NSA supercloud and some cryptographers I don’t think that we will not truly have any privacy anymore. If you place it on the net, or in the air. We have reached in my opinion the very real possibility of the N-Dystopia I have talked about before in the Great Cyber Game post.

As the pundits like Schneier and others groan on and on about how the NSA is doing all of this to us all I have increasingly felt  the 5 stages of grief. I had the disbelief (ok not completely as you all know but the scope was incredible at each revelation) Then the anger came and washed over me, waves and waves of it as I saw the breadth and scope of the abuse. Soon though that anger went away and I was then feeling the bargaining phase begin. I started to bargain in my head with ideas that I could in fact create my own privacy with crypto and other OPSEC means. I thought I could just deny the government the data. I soon though began to understand that no matter what I did with the tools out there that it was likely they had already been back door’d. This came to be more than the case once the stories came out around how the NSA had been pressuring all kinds of tech companies to weaken standards or even build full back doors into their products under the guise of “National Security”

Over time the revelations have all lead to the inescapable truth that there is nothing really anyone can do to stop the nation state from mining our communications on a technological level. Once that had fully set in my mind the depression kicked in. Of late I have been more quiet online and more depressed about our current state as well as our future state with regard to surveillance and the cyberwarz. I came to the conclusion that no matter the railing and screaming I might do it would mean nothing to the rapidly approaching cyberpocalypse of our own creation arriving. ….In short, we can’t stop it and thus the last of the five stages for me has set in. I accept that there is nothing I can do, nay, nothing “we” can do to stop this short of a bloody coup on the government at large.

I now luxuriate in my apathy and were I to really care any more I would lose my fucking mind.


Speaking of losing one’s mind.. Lately people all have been yelling that OPSEC is the only way! One (the gruqq) has been touting this and all kinds of counterintelligence as the panacea for the masses on these issues. Well, why? Why should we all have to be spies to just have a little privacy in our lives huh? I mean it’s one thing to be a shithead and just share every fucking stupid idea you have on FriendFace and Tweeter but really, if you can’t shut yourself up that is your problem right? No, I speak of the every day email to your mom telling her about your health status or maybe your decision to come out etc. Why should the government have the eminent domain digitally to look at all that shit now or later?

If you take measures to protect these transactions and those measures are already compromised by the government why then should you even attempt to protect them with overburdened measures such as OPSEC huh? I mean, really if you are that worried about that shit then go talk to someone personally huh? I know, quite the defeatist attitude I have there huh? The reality is that even though I claim not to be caring about it (re: apathy above) I actually do but I realize that we no longer have privacy even if we try to create it for ourselves with technical means. If the gov wants to see your shit they will make a way to do so without your knowing about it. I fully expect someday that they will just claim eminent domain over the internet completely.

Fuck OPSEC.. I want my government to do the right thing and not try to hide all their skirting of the law by making it classified and sending me an NSL that threatens to put me in jail for breaking the law.

Fuck this shit.


Then we have the CYBERWARZ!! Oh yeah, the gubment, the military, and the private sector all have the CYBERWARZ fever. I cannot tell you how sick of that bullshit I am really. I am tired of all the hype and misdirection. Let me clear this up for you all right here and right now. THERE IS NO CYBERWAR! There is only snake oil and espionage. UNTIL such time as there is a full out kinetic war going on where systems have been destroyed or compromised just before tanks roll in or nukes hit us there is no cyberwar to speak of. There is only TALK OF cyber war.. Well more like masturbatory fantasies by the likes of Beitlich et al in reality. So back the fuck off of this shit mmkay? We do not live in the world of William Gibson and NO you are not Johnny Mnemonic ok!

Sick. And. Tired.

I really feel like that Shatner skit where he tells the Trekkies to get a life…


All that is left for us all now is the DERPOCALYPSE. This is the end state of INFOSEC to me. We are all going to be co-opted into the cyberwarz and the privacy wars and none of us have a snowball’s chance in hell of doing anything productive with our lives. Some of us are breaking things because we love it. Others are trying to protect “ALL THE THINGS” from the breakers and the people who take their ideas and technologies and begin breaking all those things. It’s a vicious cycle of derp that really has no end. It’s an ouroboros of fail.

RAGE! RAGE! AGAINST THE DYING OF THE PRIVACY! is a nice sentiment but in reality we have no way to completely stop the juggernaut of the NSA and the government kids. We are all just pawns in a larger geopolitical game and we have to accept this. If we choose not to, and many have, then I suggest you gird your loins for the inevitable kick in the balls that you will receive from the government eventually. The same applies for all those companies out there aiding the government in their quest for the panopticon or the cyberwarz. Money talks and there is so much of it in this industry now that there is little to stop it’s abuse as well.

We are well and truly fucked.

So, if you too are feeling burned out by all of this take heart gentle reader. All you need do is just not care anymore. Come, join me in the pool of acceptance. Would you care for a lotus blossom perhaps? It’s all good once you have accepted the truth that there is nothing you can do and that if you do things that might secure you then you are now more of a target. So, do nothing…




with 4 comments



There are known knowns; there are things we know we know.
We also know there are known unknowns; that is to say, we know there are some things we do not know.
But there are also unknown unknowns – the ones we don’t know we don’t know.


“Mankdrake, come over here, the Redcoats are coming!”


The hue and cry over the DDoS that has been taking place since the summer on certain banks has been increasing over the last week and of course the secret squirrels and the hangers on who want to sell their wares and stories have been rife on the mainstream media. Of course the likes of Droopy Dawg (former Senator Lieberman) have also been making the rounds at podiums near you droning their dire warnings that Iran is double secretly “out to get us with cyber attacks”

Several of my contemporaries have posted articles this week pointing out that emperors all, have have no clothes on and yet, only within this small verse known as the INFOSEC community am I seeing this fact being leveled at all. It’s sad really that we the community in the know should be so marginalized by the media because we do not take the party line. Thusly the truth of the matter never reaches the unwashed masses and they live on in mortal fear and loathing over the great Muslim Shaitan that is Iran.

For us in the know though, we can only continue to say “No, that’s not what’s happening” to those who will listen or yell it out as I am here once again on my screed… Uhh.. I mean blog. Sad but true as well as for me at least cathartic to at least yell in ALL CAPS for a while. I feel better usually after a good screed here…

But I digress…

“What difference does it make if it’s true? If it’s a story and it breaks, they’re gonna run with it.”

Truth is something that media outlets and the government tell you they are giving you but really are they? In the case of the DDoS attacks on the banks there is no solid evidence as to any kind of attribution of who is doing it. This however has not stopped “government sources” and certain secret squirrels within the INFOSEC community *cough VENDORS cough* who are more than willing to tell you that it’s GOTTA be Iran. Why? well… Because.. IRAN DAMMIT! That’s about the sum of it right there. It is so because they say it is, we don’t need no stinkin proof or anything do we?

Now, had any of these people made the caveat that there is no real proof of this but my gut say’s it’s Iran that’d be ok but then again really? Really? That’s going to be an answer? If there is no proof then you say that there isn’t any and that you CANNOT say who did it. It’s simple really but instead we get the Iran angle because that is the party line for the saber rattling du jour right? Who am I kidding though right? After all according to Karl “Turdblossom” Rove back in the Bush administration “we make the reality” right? So the reality is, since it’s on the news and the secret squirrels have told us on background, that Iran is HACKING OUR BANKS!


Hacking.. Ugh, that’s another issue altogether. The nomenclature is completely ignored by the media and the masses just eat it up because it has the word “hack” in it and that is god damned scary! Never mind that the DDoS really isn’t that harmful to anyone. Honestly, DDoS of the banks does not mean that they are down for the count. Sure they will lose some revenues while the sites are down but this is no nuclear strike or massive hack on the banking system that siphons trillions of dollars to Swiss accounts ala Dr. No. It’s all really much ado about nothing yet it is being flogged for the masses in one assumes is a preparatory campaign against Iran and nothing more.

“Can’t have a war without an enemy…You could have one, but it would be a very dull war…”

So yeah Iran is a repressive authoritarian theocratic government that treats its people poorly and seeks to engender itself as powerful to the global scene. They do have some technological know how and they are fixin on getting them some revenge but is a DDoS really going to be their raison d’etre? Think about it isn’t it laughable as a serious attack? Sure Anonymous does it but that isn’t all they have been doing right? THEY have actually been HACKING!

Good lord! I mean c’mon people! If you are gonna frame up Iran for some cyber shit at least do it with some serious hacks against corporations or infrastructure!! Oh, wait, I know, if they were to really do that then there’d be some real reasons for action right? Then perhaps the people might ask if what they are being sold is the truth or not right? Ahh that must be it right there huh? Just some DDoS, pay no attention, it’s not the end of the world.. Oh and IRAN IRAN IRAN CYBER CYBER CYBER!

*subliminal fear images flash across the screen as Anderson Cooper looks sternly into the camera*

Derp derp derp… So yeah, the government needs an enemy and attribution is soooo hard! It’s Iran.. No doubt about it. No, really, it’s a really complex attack! I mean no ordinary group of hackers or security folks could do this kind of thing! Well, except for those guys who have bitcoins and go to the darknet and rent some botnets.. Wait.. SHHHH… It’s IRAN! It HAS TO BE IRAN! IT’S A NATION STATE DDoS!

*takes drag on cig and looks through wayfarers*

You people make my ass twitch…

No no no no no, fuck freedom.

So once again we are left with the media not taking the full measure of things and that even includes NPR which had a report this week that nearly gave me an aneurysm. Brian Krebs told me yesterday in fact that he declined an interview/comment on this because they were not really willing to hear the truth about this. By the way Brian KUDOS to you man. YOU are my new hero! I presume that others who lack a certain moral ethical compass will be blathering every chance they get and those people should be publicly taken to task for their perpetuation of this farce.

Of course others like Jeff Carr have been a voice of sanity on NPR and elsewhere in the past but you know what? Jeff’s logic and truth doesn’t make for bleeding headlines that will draw clicks for ad revenue will it? Marginalize those who tell the truth that is too dull to sell ad space is the way of it today. So on it goes, the media drumbeat will continue saying that Iran is at the heart of every little cyber hiccup that we have from now on. Iran is in good company with China now. Hey, at least China isn’t alone! Now China can just glibly point at Iran and Mahmoud saying “It was them!” and surely many in the government and the media will say AH HA!

My friends we are doomed. The truth no longer matters and I suppose it hasn’t for some time. I am a dinosaur I suppose to believe that there are truths out there that should be told. Could Iran be behind the attacks by using proxy orgs? Sure. Do we have definitive proof? No. That’s all that needs to be said. That is of course not what we are getting from the government and media today though.

Hmm how long til Glenn Beck or O’Rielly are “Cyber Experts” I wonder….


Written by Krypt3ia

2013/01/11 at 20:32

A Few Words On Body Bombs and Security Theater…

with 4 comments



Has AQAP Been Watching “The Dark Knight” Or What?

It seems lately that the officials out there “in the know” have decided to allow a leak about a certain 15 page report alleging that Al-Asiri, the mad bomber/designer and much described “genius” of terror, has been attempting to perfect a design for an internal “body bomb” Now, no one really knows if this is indeed “the truth” or just how far Asiri may have come in his plans to create these surgically implanted bombs. However, what one can extrapolate from the press on this thing and the sources on “background” willing to talk, is that this seems to be more of a propaganda ploy than anything else on the face of it.

While I have no doubt that this vector of attack has been on the minds of AQ for a long time, so too has the use of CBRN, but to date, they have not been able to do anything in those areas and in fact the BIO warfare program they tried to start was a miserable failure. So, do we really see them getting to the point where a convincing as well as operational “body cavity bomb” is actually put to the test? I suspect that it may be some time until such a plan is put together and operational but as the media would have it now, as well as those leaking the “details” here, they seem to be saying FEAR NOW!

The Case for Surgically Implanted Munitions: Possible, Crazy, Exceedingly Hard to Pull Off

Now that we are all abuzz about the “surgically implanted bombs” lets take a look at the actual nitty gritty of how this would have to be conceived and acted on to work.

  1. You have to have a willing shahidi… Well, there are some out there so there you go. One that is willing to have srugery as well as recuperation time, well, ok… Harder but possible
  2. You have to have a sealed, self contained system that will not bleed (inside the device) and make it malfunction
  3. You have to have explosives that are high power and yet only require small amounts to be of use
  4. You have to have no metal parts to pass through the magnetometer
  5. You have to have a surgeon or surgeons willing to do the cutting and sewing (Well Ayman is a Dr. after all too so…)
  6. The device will have to be hidden enough inside the body so as to not alert others and preclude mobility issues (i.e. small, though the BVD bombs seem to be so as well)
  7. Your detonator has to be either chemical or electric/remote (timed or say an RF device) I lean toward chemical for these but who knows
All of these facts are not impossible to overcome, however, they are pretty tough in the long run to get working for you and have a success. Now, with all of this said, I guess the question then becomes are what are the odds that this is going to happen? Maybe even one might beg the question of how soon? You really have to want this and in much of the AQ mind, many things are termed as “aspirational”, a term meaning wild fantasy, much like a lot of their doctrine and hopes. This by no means means that they are in fact going to happen.

The Case for FUDDERY as A Means to an End For BOTH Sides

So, what we have here though seems to be a lot of clucking about bombs inside of people and the fear mongering that goes on with some quarters of the intelligence community feeding this all to the media. SOFREP, a site concerned with SOF (SPECOPS) had this story out there last week and now it seems to be making the rounds with backup data (background from anonymous sources) that the mad bomber is in fact working on this with a cadre of doctors. Of course one can only assume that this “data” is perhaps coming from the recent mole that got into AQAP posing as a suicide bomber and stole their new prototype BVD bomb.

If true, then yes, sure, they had plans and were trying to make a bomb system that would be hard to detect, I mean, how many MRI’s are at the airports now huh? If this data did not come from the mole though (and there is data that this has been floating around now since at least last fall, way before mole man) then why now is this being thrust upon the media? Or, now that I think about it, there was that arrest of the guy with the pr0n that had the stegged “future work” file in there.


I am willing to bet that is the provenance of the file in question. Ok, so, there you have it. We have the plans and.. What.. Why release this to the public? I mean, what real purpose does it serve other than to scare the populace into submission? In the SOFREP report there is mention of something along the lines of “So how do you feel about your L3 machine now?”Uhhh, just fine really, I mean, it won’t help me if there is a surgically implanted bomb, but it gets much of the rest of the stuff when used properly. I am guessing that the impetus here was to make the TSA look good, by saying “you think you are hassled now, but look at what the jihadi’s are planning!”

Honestly, sure, it could happen, but the odds are slimmer than one might think I think and this seems to be a play here to manipulate the public mindset. Others have called the same foul on the play here but I just wanted to put it down here and sort through all the issues to ascertain where the truth might lie. In this case, for me, it seems like this story serves the purposes of both sides. For one, the security services here and the politicians both get a win by leaking data to sow fear, a fear that was ever so well used in the past (like G’Dub’s admin) and others to sway thought and perhaps lessen resistance to certain things. On the other side, this also works for AQAP because even if they are planning it, they are causing us to create even more elaborate Rube Goldberg devices to stop them, costing us more money and time.

It’s a win win for all of them.. FUD it seems is a booming business.

So, IF They Make These Bombs Happen Then What?

In the end, it comes down to this; “What are we going to do?” Do we really expect that we will now install MRI’s and X-Ray machines in the TSA lines to scan our internal organs as well as the sniffer/blower/wand/m-wave that we already have? This is a means of bombing that would be hard to detect if done well and certainly would not easily be seen under clothes or even with an M-Wave scan if it is not protruding/bulging the persons body in some way. Hell, for that matter, AQAP should just be looking for morbidly obese shahidi candidates huh?

Certainly, leaking this data to the news serves little purpose than to perhaps get people (including those on the hill) to buy into new measures and monies to appropriate them? It would not make one whit of difference in the current protection scheme now would it? Frankly, if AQAP and A-Asiri have been working on this, and it were a major threat, I personally would not have been dropping this to the media. Keep the intel secret (as the report is alleged to be) and keep it out of the public eye…

Unless you all think that by leaking this data you are retarding the chances that AQAP will try this method? I really don’t think that will be the outcome here.

In the end.. I call shenanigans.




Written by Krypt3ia

2012/05/14 at 19:34

Posted in AQAP, FUD, Propaganda

The F.U.D. Files: CASE 010110101 Cyber Attacks On Our Water!

with 6 comments

OMG! The Russians Are Attacking Illinois Water!

This last week we heard that a pump in a water system in Illinois ate itself and fried up. The reason for the pump doing so was soon discovered to be that someone from a Russian IP address had been messing with it remotely. Something that should not be readily possible,  but it was available online remotely. Yes, that’s right, the vulnerable system was online for anyone with an IP address to hit up AND it was in such an un-secured state that pretty much anyone with a pulse could have messed with it. However, this isn’t the story that you get from the press and the talking heads in infosec. Instead you get…

The SCADA boogey man was out and had attacked our vital infrastructure!


PC Mag


Robert M. Lee



Terrorism? Really? Messing about a podunk water system is now terrorism? Seems to me that this system was already having problems since it was put in by the Curran-Gardner people (Problems with the Curran-Gardener SCADA systems can be found here) from their own accounts of what they had to fix since 2008 or so including the wiring being set up wrong to start with on the system in one case as noted.

It turns out that the supervisory passwords were alleged to have come from a password database from the maker of the supervisory system that the Curran people decided to use. Now, given the poor system setup and all of the issues here so far seen in their own documents, I am hopeful that this was not a main supplier of systems to major corporations and governments.

Once again, this all seems rather opportunity based than targeted to me. Someone popped a dbase at a maker who likely had their systems hanging in the lowest of the low hanging fruit state and the skiddies went on to locate another low hanging fruit target.. You guessed it… Curran-Gardner. The fact that they used a Russian IP address is as telling as a Don Rumsfeld news conference on “known unknowns” as well. So all this hand wringing by DHS and others over this little flap need to just calm down and speak to the country soothingly…

Instead we get OMFG RUSSIA IS ATTACKING THE ILLINOIS WATER SYSTEMS! and the papers run with it.


How did the pump finally eat itself? Someone basically was flipping the digital light switch on and off.. That’s how. It could not take being turned on and off.

Wow, what resiliency!

OMG! Some Kid Learned How To Use Shodan!

I have news for you… This is no big secret. In fact, I was talking about these systems a while back after my fracas with Ol’ Craig “The END IS NIGH” Wright. A simple Shodan search turned up many a water system online and open to being poked at. In fact, as I remember it, the other system that has been talked about lately in Nevada, yeah, that one too was online and found on Shodan. Their systems were so horrid in fact that you could easily make a reservation to show up at Hoover dam as a VIP/Government visitor!

So, what’s the takeaway here? Well, that someone was messing around with SCADA because of two factors:

  1. It’s been in the news hyped ad nauseum as the panacea of the modern world and its final inescapable doom
  2. It’s been shown to be easy and the fools running these systems have made them even more insecure by putting the ICS online!

What have you all been thinking? Yes, you guys putting this shit online AND all of you out there SHOCKED that someone started messing with these systems that are so easily found and exploited online in bugsville Idaho!

Come on people wake up! This is just the start here.. Expect more… AND NO, THEY WILL NOT BE ATTACKS COMING FROM AL-QAEDA There’s just no real interest there on their part, these types of attacks on small water systems will not sow the mayhem and fear that they desire.

Get over it.. Deal with the real problems please.


Next, let me step into the wayback machine and once again talk about the SCADA systems being online. I had an.. “argument” with Dr. wright about the dire circumstances of SCADA systems being online. I had said that not all of them were online and Wright pretty much said;


To which I had a small aneurysm and went off on him.. Lets just say that the whole thing got out of hand and Dr. Wright was shown by his own hand to be a chicken little with a tendency to spill secrets about previous engagements he had had. The net net here is this;

“Yes Mr. Wright, there are SCADA/ICS systems online, I have seen them.. BUT not ALL systems are and the important ones that I dealt with, were at least nominally protected behind firewalls and v-lans”

Hey, at least they tried huh? Unlike our water works friends in the news of late right? What’s more, I actually saw one system that was air gapped from the network proper. You would have to actually be on site to get at it.


So, yes, we are learning through Shodan searches as well as unfortunately, in the news, that there are many stupid people running those systems. However, in all the searches of ICS/SCADA systems I did on Shodan, I really only found a couple places that made me say “crap” The others were places like the podunk water supply..

And I am not worried that these will cause mass casualty events.. What it said to me is if stuff went down, some people would be buying bottled water for a while.

SCARY!… not.

If They Attack Our Pumps They Will Then Escalate To Our Nuclear Missiles!

Moving on, one of the things that really peeved me off here about this little story on Illinois was that some were alluding that this could be the clarion bell that the end is nigh. The thought process goes something like this;

“If they can hack this place, then they can escalate through their network to uber important systems!”

Uhh what?

Ok, yes, the Curran-Gardner systems were located within a company that covered both water and power, so yes, they could have jumped to the local grid for the area. They could have hopped over (mostly because these guys have already proven themselves to be clueless about security) and messed maybe with some power regulation to home customers in the area.

No big explosions.. No watershed event.. Other than once again pointing out that the emperor has no clothes and is functionally retarded really. This is an object lesson and one hopes that the local nuclear plant is not online for the Joey Pardell’s of the world to access via the internet. However, such systems that could cause mass casualties may also be in the same state, and this is worrisome.

So far though, I haven’t seen them.

Make No Mistakes.. There Will Be Deaths…

Once again, there is always the possibility that there could be a mass casualty event with regard to SCADA systems controlling pipelines etc. However, I do not see this as a prelude to war nor really an effective means of terrorism just yet. IF someone does exploit a system to cause a pipeline explosion it would be just to sow fear, and that is pretty much it. Sure, you take out a big enough system such as the ones in the Gulf, you “could” have a cascade effect on the supply chain as well as roll over to the financial base of the country.

C’mon, you have all seen this in the movies right? You know what I am talking about.

However, we have not seen this yet and if these systems are so piss poor, then why haven’t we? I mean SCADA issues have been around for a long time now. Why haven’t our enemies used this yet to their advantage? No, I say that the likelihood is that someone will be messing around and accidentally cause an explosion or cascade failure.

The FUD response from this by the government and the media will be the real disaster that will cause the most damage.

Nope, I place the probability of the dark nightmares that the Dick Clarkes of the world are predicting up there with the probability that Bigfoot will walk up to my door, ring the bell, and offer to sell me “Bigfoot Cookies”

Yeah, really…

Sanity Anyone?

So, whatever happened to sanity? I surely think our collective sanity has been eroded by the likes of the media and our overly risk averse government. Since 9/11 they have been hyping (press) and pussyfooting (gov) around the problems we have. In the case of the digital landscape of hacking and security, neither has a solid grip on reality. This is really disappointing as they are the ones feeding the fear to the masses. Never mind those in the security industry who seek to make money as well as those who have no qualifications to speak on subjects but feel they must to get the headlines.

It’s a Mobius loop of stupidity and fear mongering.

We need to get our collective heads out of our collective asses here…

  • Yes, there are SCADA systems online and yes, they can be made to eat themselves
  • Yes, this is a problem, but it is NOT the end of the world
  • No, the terrorists are not using this as a vector of attack.. trust me.
  • NO, the Russians and the Chinese are not attacking here.. Those guys have been in and out of our systems without us knowing (ni hao!)
  • NO, no one will be launching nukes from SCADA/ICS attacks
  • NO, no one will be causing a China Syndrome from SCADA
  • Yes, you may see more pumps eating themselves and you may have to buy some potable water
  • Yes, once the smart *giggle* grid is online you might find yourself without power or unexpected large bills (bad hackers!)
  • Yes, this is all a problem… But more a nuisance than the apocalypse

So, lets all sit back and breathe a bit ok? Yes, there are problems here, but, in the scheme of things, this is not worth all of the attention it is getting from everyone. Never mind the worries that many seem to have.. and are using to their advantage perhaps to sell you services?

Yeah, I went there…. Better watch out, LIGATT soon will have offerings in SCADA security I am sure.

The Teachable Moment

This is all what they call a “Teachable Moment” as someone on my Twitter F-list said the other day. The lessons to be learned are simple ones and you have to step back, take a breath, and think a bit here.

  1. Don’t place inherently insecure systems (as we know SCADA to be) online for access to the internet and anyone on the globe
  2. Don’t believe everything you read in the news.. Often times the reporters have no clue
  3. Don’t listen to every doomsayer or alleged “expert” online or on the media as to the dire straights we are in due to this
  4. Research the problems… compare and contrast.. Use your brains people!
  5. Ok, so we found this one out there and it failed because it was messed with… Now take it and every other one offline (connectivity to the net)
  6. Force the SCADA manufacturers to securely code their systems
  7. Force the government to perform DUE DILIGENCE on critical infrastructure (i.e. audit them all for this and other security problems)

This is my take away from this little incident. Like I said, there are problems, but we know they are out there now..



Written by Krypt3ia

2011/11/20 at 13:04

Posted in .gov, Cyber, CyberPocalypse, FUD

Handwringing, Moralizing, Anonymous, Paedophilia, and Digital Vigilantism

with 2 comments


I recently posted about the Hidden Wiki and its prevalence in hosting paedophilia content. This post may or may not have left an impression on some of the  anonymous collective to take action and perhaps sow good will for their group by hacking into the “Lolita City” site within the DarkNet and releasing thousands of users email addresses and personal data (such as it is on such a site) for the Internet to feast upon. The Anon’s are doing this for their own reasons, but the upshot of it all is that they are causing the paedophiles pain in making it hard for them to get their content as well as potentially outing them online as purveyors and consumers of this wretched content.

Since my post applauding them and giving them some direction as to how to become more of an intelligence gathering apparatus for the LEO community, some in the infosec world have come forward and voiced concerns about this line of thought. All of the talk about the morals, legalities, and philosophical aspects of Anonymous undertaking such actions has gotten me thinking quite a bit.It all raises some interesting questions and philosophical challenges.

Anonymous and Digital Vigilantism:

What I think that most people with reservations about Anonymous taking up such operations as the DarkNet op have are that these people are for the most part kids without training and without any kind of oversight. Oversight in that they could get too big for their britches (one could say that many already have) and think that they are invulnerable to attack never mind the respective laws of our society. That said, it would seem that Anonymous, Antisec, and LulzSec have already decided to take up the mantle of vigilante’s already. However, the targets have been, for the most part, varied parties that could be seen as hapless victims or as malefactors, it all depends on the point of view really.

In the case of Scientology, well, aside from religious freedoms (trust me, they are not a religion) generally the Scientologists have been pretty much seen as getting what they deserved. Today though, years later, Anonymous has begun to take on the governments of the world as well as the likes of Paedophiles online. Once again, generally, people see what they want to concerning whether governments are good or bad. Paedophiles though, pretty much are outlawed universally. So, when Anonymous decided to attack, I could not fault them one bit. However, I could perhaps fault their methods.. Only in that they were bound to only let the paedo’s get away in the end.

I have said it before and I will say it again.. “One man’s freedom fighter is another man’s terrorist” It all depends upon your perspective really. While I do not think all of their targets have been chosen wisely, I cannot fault the true believers out th4ere that they are doing something out of conscience and good. This is not to say that a certain element of the movement is in fact just in it for the lulz (i.e. Antisec and LulzSec) There certainly are factions at play who just want to see the world burn as well as garner themselves digital street cred.

Overall though, the term Vigilante denotes a person or persons (committee’s) who dole out justice summarily when the law is seen as ineffective by them. In this case, the Anon’s have taken up the mantle of vigilante in order to rid the DarkNet of paedophile content because law enforcement seems unable to effectively. Now this is also the crux of the issue in another way, as the police generally are not allowed to hack into sites and dump the dirt so to speak.. The Anon’s are unhindered here. Just as they have felt the same way about other operations where they have denied service to corporations (likening it to a digital sit in) they have crossed the line of the law, but, their methods and motivations are free of it… Until they get caught that is.

The essence of the thing is this.. “Don’t do the crime unless you can do the time” If they believe in it strongly and act upon it, then they must accept the risks of being caught and incarcerated. So far, much of the motivation I have seen by a good deal of anon’s has been motivated by convictions and beliefs. All others have been for Lulz, which is what made LulzSec even more of a problem as they just did not care. The current Antisec movement that LulzSec begat also seems to lack the conviction of their beliefs and seems more driven by ego than anything else by their writings.

And this is the difference between the chaotic Joker like actors and the Batman types.

Anonymous vs. PLA, vs. Patriot Hackers:

Pulling back a bit now, I would like to look at the macroscopic view of Vigilante behaviour versus nation state sanctioned or perhaps, a better word for it would be “condoned” actions and groups. I have written in the past about groups like the Honker Union in China as well as the colourful character known as th3j35t3r. both of these entities have had an effect on the collective consciousness concerning digital vigilante justice and I think it important that they form the contextual base for Anonymous’ actions in Operation DarkNet.

First off, ALL of these entities have been doing what they do (Jester DDOS of Jihadi sites and Anonymous, Honker, hacking against the enemies of China, and Anonymous, attacking sceintology, the gov, and paedo’s) with a mind toward doing “good” In the case of Jester, he thinks DDoS-ing jihadi sites out of a patriotic bent that will stop them from communicating. In the case of the Honker Union, they are patriots to their homeland and attack others who would do their country slight or harm. Anonymous though, started out of /b/ … Which really is a band of miscreants for the most part. However, a core group decided to take on the mantle of doing right somewhere down the line and we find swaths of them today supporting Occupy Wall Street and other political agenda’s.

The basic idea here is that they are all motivated by a belief in some greater good.. Mostly. I am sure there are on individual levels, many more motives (ego, greed, ego… the list goes on) but I will just put it to a gross generality that these people want to effect some kind of change.

At least I hope that this is the case…

What is really different though is that in the case of Jester and the Honker Union, they both are condoned if not outright supported efforts by the countries they reside in. In the case of the PLA and the Honker, there is clear connection between the state and their actions. In the case of Jester, there are allegations (made by him) that his is state sponsored.. But, I think more to the point he is condoned. Either way, the Anon’s may indeed be getting some support (moral or other) from state sponsors and not even know it. In the case of Anon, they could just become the tool of another nation state and not know any better.

Which is pretty scary.

All of these entities though, have had a greater or less effect upon the internet these last few years through their online shenanigans via hacking. The secret is this, they are just the first. There will be others to be sure.. The genie is out of the bottle on this one.

Anonymous vs. LulzSec & Antisec:

Conversely, we have LulzSec and Antisec, who both wreaked havoc on the corporations and the police of the world lately. Their reasons for doing so pretty much have been stated as “because we are bored” At the core though, there seems to be a couple of motives here from postings online. One is the afore mentioned Lulz, the other, seems to be a kind of abject hatred of authority and police. In recent hacks on the police though, there seems to be a bent toward supporting the Occupy movement as the police have had some transgressions against them. So.. They hacked the police and dumped all their data to spite them. Frankly, I see no value to this and once again, even if motivated by supporting the movement, it has no real effect on the police other than to make them more angry and reactive against the protesters.

Basically, I still see Antisec as the Penguin & Joker while Lulz as The Riddler though while Anonymous has become more like The Batman in certain quarters

Anonymous on the other hand has had its lulz, but seems to be growing up a bit and maturing. The social conscience of anon has begun to take shape and within it (movement wise) may well be the lasting component that will be its Raison d’être in the end. Time will tell though, and I hope that this is the case more so than just a bunch of malcontent’s seeking attention and excitement.

The Hand Wringing by The Infosec Community At Large:

Alright, back to the hand wringing and the moralizing post the Op DarkNet…

Certain people in the community wrote that while the empathised with what Anon was trying to do with Op DarkNet, they felt that these people were not the folks they would have doing this to start. Most of this comes from the fact that many of the players are not trained investigators and not LEO’s. I can agree with this from the perspective of legal proceedings later on. If Anonymous hacks a server and then dumps data, it could have an effect on the court case from a few perspectives;

  1. Contamination: The defense could claim that the server was hacked and the data planted
  2. The data could have indeed been tampered with by anon’s
  3. The backend of the server/dbase could in fact be shared and all those who share could be swept up in the legalities/implications
  4. The hack is enough to raise reasonable doubt

So, yes, it could be counter productive to have a vigilante force actually hack a system and report it to law enforcement. However, I would advocate that in the case of Anonymous and the paedo’s at the least, they not just hack and dump data, but instead give that data to law enforcement to start an investigation. For that matter, if Anonymous just located the servers and authenticated (sans hacking) that the content was there, they could in fact just tip off the police.

And this is at least part of what they did with Lolita City in the DarkNet. They tried to locate the server location and this alone could be a great boon for the authorities.

On the other hand, there are moral/ethical objections on the parts of some who think that perhaps letting Anonymous do this type of thing, or even encourage it is setting a bad precedent. To them, Vigilante’s are outside the scope of good behaviour and the law.. They cannot be tolerated. Personally, I think that that is a sanctimonious load of crap, but, that’s just me.

Sometimes when the system cannot function other means need to be taken to effect change. In this case, within a network that is anonymized and the authorities have had little success in catching anyone trading in paedophilia, I see no harm in Anonymous outing them.. Though, I would rather they just passed the intelligence to the LEO’s instead. It is my opinion, that if done correctly, intelligence gathering of this type with a tip off to the police has a better chance at actual arrests and convictions than to just let them go on about their peddling of child pornography.

Just one man’s opinion…

Philosophical and Ethical Stands On Being The Digital Batman:


This is the philosophical and ethical standpoint I take in being the digital Batman. Strict utilitarianism dictates that maximizing overall good is key. In this case and perhaps others, the taking down of the paedophile’s content and capturing their login credentials is enough “good” to allow for the action to be seen as acceptable. This is really the basis of The Batman’s ethics in the comics and ideally, for me on this particular incident with Anonymous.

Now, this does not mean I agree with all of their operations as well as certainly not agreeing with the bulk of the actions carried out by the Antisec movement. However, the perspective is the key I suppose. It’s a slippery slope I admit, but, in this case of OpDarkNet, I agree with the greater good being served in this case.


Here we have the Deontologists like Sam Bowne. Deontology is a nice thing to cling to the ethical rules of a governing system of laws. However, it seems to me, and others here, that this system of laws is not working against these offenders in the hidden wiki. Sure, you could say that the LEO’s have ongoing investigations, but, just how many busts have there been as opposed to the massive amount of content located on the hidden wiki and within i2p, Freenet, and TOR?

So far, I have not seen law enforcement really winning this battle.

Oh well, the Deontologists have their point of view and others have theirs. The key here is that Sammy and others like Packetknife are entitled to their point of view. They are right for themselves, and that is the issue with all philosophy and ethics arguments. Like I said, it’s all about your world view. However, I do not ascribe to a moral absolute unlike someone like Sammy.

There are no right answers. There is only what you are willing to accept for yourself.

Legal Aspects of Digital Vigilantism:

Now, on to the legal aspects here.

18 U.S.C. § 2252 : US Code – Section 2252: Certain activities relating to material involving the sexual exploitation of minors 

The US code on activities related to sexual exploitation of minors alludes to the fact that one has to “knowingly” access such content and to have more than 3 pieces of “content” to be considered guilty of child exploitation/pornography. This of course also alludes to the trafficking thereof etc etc in legalese. Where this is important for the digital Batman is where there are caveats.

(c) Affirmative Defense. - It shall be an affirmative defense to
a charge of violating paragraph (4) of subsection (a) that the
defendant -
(1) possessed less than three matters containing any visual
depiction proscribed by that paragraph; and
(2) promptly and in good faith, and without retaining or
allowing any person, other than a law enforcement agency, to
access any visual depiction or copy thereof -
(A) took reasonable steps to destroy each such visual
depiction; or
(B) reported the matter to a law enforcement agency and
afforded that agency access to each such visual depiction.

So, as I said before, if you are trying to take one of these sites down, then do turn off your browser’s images capabilities.. Hell, why not just use Lynx for that matter so as to negate the issue. However, there is a key point here that you all should take into account. It’s the bit about making the LEO’s aware of the content. This is what I was trying to get at before. If Anonymous or anyone is going to go after this content, then it would be best if you tipped off the LEO’s to the site and the content. Now, the above statement implies that if you make the tip, then you are going to let the police have your system to look at… And we all know Anonymous is not going to do that. So, just be judicious about your tip off’s to the authorities. Do your homework and dump the data to them directly, not on Pastebin.

Of course, then there are the issues of hacking a system in the first place… Well, in the DarkNet, the only thing as I see it that is key would be not leaving a trace that you were there. You know, kinda like the whole hiking ethos of only leaving footprints.. But in this case I would suggest not even a footprint should be left behind. It seems to me, that if you hack a paedo site, even with good intentions, you could get the double whammy from the authorities of hacking as well as accessing child porn…

And that could really be problematic.

So, in the end, I circle back to recommending that you become intelligence gatherers and locate the sources to report. If you locate them, and you get some good details for the authorities without having to SQLi them, all the better. You will be doing a good thing AND you will be satisfying the Deontologists in the room.

Keep your wits about you kids.


The Son of Stuxnet… Methinks The Cart Be Before Ye Horse

with 2 comments

My dear dear lord,
The purest treasure mortal times afford
Is spotless reputation—that away,
Men are but gilded loam, or painted clay.
A jewel in a ten-times barr’d-up chest
Is a bold spirit in a loyal breast.

Mowbray, Richard II Act 1 Scene 1



As fate would have it, today I saw a tweet that said Symantec had a paper coming out on “Stuxnet II” I surfed on over and read the document and what I was left with was this;

“We rushed to judgement here and wanted to get this out to get attention before anyone else did.. Here’s STUXNET REDUX!”

Now, sure, the code base appears to be Stuxnet’s and yes, there are similarities because of this, however, calling this Stuxnet Redux or “Son of Stuxnet” is just a way of patently seeking attention through tabloid style assumptions put on the Internet. Let me pick this apart a bit and you decide…

Code Bases and Re-Tasking

So ok, the coders seemed to have access to the FULL source of Stuxnet. It has been out there a while and surely some people in the world of “APT” have had access to this. It’s not like it was some modified version of Ebola kept at Sverdlosk at Biopreparate. Had you even considered that it was released on purpose as chaff to get others to tinker with it and thus middy the waters?

I’m guessing not from the report that I read, hurried as it was and full of conclusions being jumped to. In fact, Symantec even said that they had not fully audited the code! C’mon…

Alrighty then, we have a newly released and re-tasked version of Stuxnet that turns out to be just a recon tool to steal data. I find it interesting that they make so much of this and intone that the coders of the original are up to shenanigans again but fail to even beg the question that it could be anyone with the requisite skills to cut into the original code (after it had been laid out for everyone to look at) and re-task it with a new time frame. Please note that there are not the original 0day attacks and multiplicity factors of infection vectors as well as exfiltration schemes.

So, not really so complicated as I see it.. You?

The original code/malware was very targeted and this, well this is really just like any other APT attack that I have seen out there.. In fact, in some ways its less clever than the APT attacks out there from the past.

So, really Symantec, take a step back and mull this all over again before you release.. Say.. Just who else had the code and you were worried about that would steal your thunder here?


RATS, RECON, & Targets

Speaking of the infiltration/ex-filtration picture, I see from the report that they are linking the RAT to the original worm but have not real proof that it came from DUQU! It was found in situ on the box that they analyzed and make the assumed statement that it was “likely” downloaded by the malware via its comms to the C&C.

Once again I say “Evidence Much?”

You have no basis other than assumption but you make no real clarification on this. Though there is mention of a DQ.tmp file which I assume means that it came from the RAT.. But.. Proof again please? It’s the little things that count here and I see a great failure in your haste Symantec.

Another thing that is bugging me now is that the news cycle is making connections to DUQU with attacks on power grids.


Symantec, DO YOU HAVE EVIDENCE of what companies were “Targeted” by this malware re-hash? If so, you should come out of the closet here a bit because this is BS unless you have proof. I of course understand that you cannot name the companies, but CONFIRM OR DENY that they were all Power companies before making claims and allusions that the media will just shriek at the top of their lungs placing more FUD on the headlines.

Or… Wait.. Now that might be an advantage to you guys huh?

Ponder.. Ponder…Ponder…

Well played….

What it all boils down to for me is this:

Someone re-tasked the malware and stuck a common RAT in it. Until you (Symantec) come up with more solid evidence of more interesting and technical attacks, then I call bullshit on you.

What? No Mention Of APT Here?

Meanwhile, I see that people are assiduously avoiding the APT word… Hmmmm What does this attack really remind one of… APT!

There, I said it.

APT attacks:

  • Infiltrate
  • Seek data
  • Exfiltrate data
  • Keep access

And therein lies the rub. DUQU has a 36 day shelf life. Now, this is good from a foot-printing level AND could be excellent for setting up the next attack vector that could include the component of sustained access. So, the reality here for me is that this was a foot print attempt on whatever companies it was set upon. It was a recon mission and that was all.


Had you called it a Stuxnet like attack re-purposing code then I would have had less problems with your document Symantec. Instead we got FUD in a hurry.

Baseless Claims: Pictures Or It Never Happened!

Finally, I would like to see Symantec spend some more time here as well as see others pull this all apart. I want to see more proof before you all go off half cocked and get the straights all upset over an attack that may have nothing to do with the original.

Frankly, I find your faith in rationality disturbing… Symantec…


Anonymous, SCADA, LULZ, DHS, and Motivations

with 2 comments

Anonymous Is Interested In PLC’s & SCADA?

A recent .pdf bulletin put out by Homeland Security (i.e. DHS) claims that certain actors within Anonymous (and by that they mean “anonymous”, I added the distinction) have shown interest in at least Siemens SIMATIC PLC’s and how to locate them online for exploitation. It seems that DHS though warning about this threat, is not too concerned about its actually being exploited by the group because they lack the expertise to attack them. So, why the BOLO on this at all? If the collective cannot do the damage to the infrastructure that you are entrusted in keeping safe, then why report on it at all as credible intelligence? It would seem to some, myself included, that Anonymous is not the problem that they are really worried about on the macro scale, but instead, those who may claim to be Anonymous hitting small scale facilities or pockets of targets for their own purposes.

And therein lies the difference.

If indeed Anonymous the collective is looking at attacking SCADA, one has to wonder at their reasons to target such systems. After all, if Anonymous takes out the power or poisons the water, it will not look good for them PR wise. In fact, were such things to happen in the name of Anonymous, I can pretty much guarantee you all that they would be enemy #1 pretty darned quick post an attack. However, if they were to target a company such as a car maker that pollutes, then, you have a real agenda (per their social agenda of late) So, the targeting is really key here and I will cover that later on.

DHS Jumping The Shark?

The motivations of the release by DHS have also  been called into question by some as to why they chose to talk about this at all. This is especially prescient since they take pains to say that the Anonymous movement “most likely” does not have the technical means and motive to really pull of these types of attacks on the infrastructure. So why even bother? Perhaps they are just covering their bases (or asses) just in case the Anon’s actually attack? Or perhaps, they too are clued in on the fact that even if claimed to be anonymous, it could be others working against the US (Nation State Actors) who have chosen to attack and use Anonymous as a cover so as to throw off attribution.

Either way, as some look at it, it is almost like they are daring Anonymous to do it out of spite because they are calling Anonymous’  factions and actors “inept” or “unskilled” which, might get their dander up a bit. All of these scenarios pretty much do not preclude someone hitting SCADA systems in the future and it being blamed on Anonymous, which will bring on a new wave of efforts by the government to stamp them out. Reciprocity being what it is, this too will mean that Anonymous might in fact gain strength and sympathy from such actions and fallout as well.

For me though, I just see DHS covering the bases so as to not be blamed later on should something happen. Not so much am I of the opinion that they are in some kind of propaganda war here with this little missive.

Motives, Means, Technical Abilities

So lets go with the theory that certain elements of the Anonymous collective want to mess with the infrastructure. Who would they target and why? More to the point, what companies would they target that fits their agenda?

  • Telco?
  • Power?
  • Manufacturing?

Those are the three areas that I could see as potential attack vectors. Though, once again I have to say that the only two that I see as real possible would be the telco and manufacturing and even the telco would be dangerous for them to try as well. I mean, if you start messing with Ebay or Paypal that’s one thing, its quite another to mess with national infrastructure, as these two would be considered. If indeed Anonymous hit them and took them down for whatever reason, they would then be directly considered terrorists… And that would be seriously bad for their movement and its legitimacy.

Now, we do know that the  Anon’s hit the BART system but as I remember it, it was BART that took out the communications infrastructure themselves so as to prevent communication between anon’s. So, this just doesn’t seem to fit for me either. Manufacturing though, as I made the case above, could be something they would try. It’s not national infrastructure and it will not take the country down if they stop something like cars  being made.

Is it just me? Or does anyone else just see this as a non starter for Anonymous central? What I do see is the threat of other actors using the nomme de guerre of Anonymous as cover for their actions to mess with the national infrastructure. Perhaps some of these people might in fact be motivated by anonymous, but, my guess that if there were to happen, it would be nation state driven… And something I have been warning about for some time.

Anonymous, as an idea, as a movement, will be subverted by those looking to fulfil their own ends and justify their means. All the while, they will let the Anon’s take the fall for it.



Nation States

… AND.. Corporations.

You know, those with the money and the people who could pull off the technical hacks required to carry these capers off.. Not a bunch of rag tag hacktivists and hangers on.


In the end, what I fear is that there will be a great deal of blowback on Anonymous even talking about hacking and messing with infrastructure. The same can be said for their attempts on taking down Wall Street or the NYSE with their DD0S. If they had succeeded, they would have been an annoyance really, but that would not have caused any great fluctuation in the markets I think. No, unless they hacked into NYSE itself and exposed the fact that they had root in there, I think that it would have a very minimal effect on Wall Street and the economy at large.

Not to say that everything is going ever so well now…

DHS seems to have jumped the shark a bit for me on their BOLO and the coverage of this just tends to add to the FUD concerning SCADA and PLC code. Hell, for that matter we have the new Symantec report on DUQU that yells out about it being the “Son of Stuxnet” but in reality, it is more like a clone of Stuxnet used for APT style attacks by persons uknown..

Get yer FUD here!

Same goes for this DHS warning.

Your results may vary…