Showing posts with label cyberwar. Show all posts
Showing posts with label cyberwar. Show all posts

North Korean Internet Outage Probably Caused By Hackers, Not US (Updated)

December 23, 2014 - North Korea's internet was disrupted over the weekend, and finally went down completely on Monday. It came back online, but then it went down two more times. And tonight, reports Yonhap News Agency, "some major North Korean websites remained blocked Wednesday [Korea time] for the second straight day amid growing speculation over cyber warfare between Washington and Pyongyang. Since going down Monday evening, the website of the North's main propaganda organ, Uriminzokkiri, remained inaccessible as of early Wednesday."

North Korea's Kim Jong-un, digital dictator
Reuters/KCNA
UPDATE, 27 Dec 2014 - North Korea's Internet and 3G mobile network 'paralyzed,' according to Reuters: "Internet connectivity had not returned to normal as of 21:30 local time [Saturday night], Xinhua reported, citing reporters in the country that had confirmed the situation over fixed telephone systems. The report comes after the North Korean government called Obama a 'monkey' and blamed the United States for enduring instability in the country's internet infrastructure, after the U.S. blamed North Korea for hacking attack on Sony Studios."

But was it the work of the U.S. seeking revenge for the cyber attack on Sony Pictures? Some security experts "say the attack that temporarily knocked the isolated nation offline looks more like the work of hacker pranksters than a vengeful U.S. government," says Fusion.net.

The network was not down very long (about 10 hours), which indicates that the outages were probably not the retaliation promised by President Obama as for the devastating cyber attack on Sony Pictures on November 24.  Sure, it seems the outages are continuing, and it seems impressive that an entire nation's internet access was taken down. Right? Well, no, not really. Read on to find out why that's not true in the strange case of North Korea.

The FBI and Obama have blamed North Korea for penetrating Sony's computer system, stealing massive amounts of information, and then rendering the computers useless. Many in the info security business are skeptical of the accusations against North Korea, however, and some even say it might have been in inside job.

The mainstream assumption is that a film called "The Interview" pissed off North Korea's leader, Kim Jong-un by - among other things - depicting him as a douchebag and dying in a fiery explosion. Some say that the depiction of Kim in the film could have caused damage to his prestige if any of his generals or other privileged persons were able to access it, say on a black market DVD or even on the Internet.

On December 19, Obama vowed that the U.S. would "respond proportionally" against North Korea. If the most recent outage/s was caused by an Obama-authorized cyber attack on North Korea's interwebs, then it's a lame response. It certainly was not a proportionate response, considering the enormous, yet to be fully determined, financial losses of Sony Pictures. After all, to simply cause a disruption of less than 24 hours to a very few elite North Koreans probably did not cause any great hardships or damage.

Poster for "The Interview"
I think most of us are wishing for Obama to order up the crippling of Pyongyang's power grid. That would not only deny the North Koreans access to the Internet (no power, no computers), it would also force the artificially privileged of the capital city to live in the same desperate poverty that the rest of the country suffers. A simple EMP blast in the sky over Pyongyang ought to do the trick. Of course, that would cause more public relations problems than it's probably worth.

"North Korea's circle of internet users is so small that the country has only 1,024 IP addresses for 25 million people," reports Vox, "whereas the US has billions of IP addresses for 316 million people. While it's impossible to infer a specific number of internet-connected devices from this, it is safe to say that the number is very, very small." Kim Jong-un's regime has turned Internet access into "something that exists almost purely to cement his government's rule and to reward himself."

"The internet in North Korea is not a public good, nor even a good that the public is aware of," notes Vox. " It is purely and solely used as a government tool, for serving such ends as propaganda and hacking, and as a luxury good for the elites who run the government." The biggest inconvenience that an Internet outage might cause for North Korea would be the inability of their professional hackers and propagandists to operate.

This could pose a threat to Kim Jong-un's prestige. Who cares if the peasants never hear of "The Interview?" Theoretically, the elites could stream the film via their unfiltered Internet access or obtain the film on DVD.

If the elite watch "The Interview," it could hurt Kim's prestige and damage respect for the little dictator. It wouldn't change things immediately, says Rand Corporation senior defense analyst Bruce Bennett, "but the elite in North Korea aren’t happy with Kim Jong Un." Bennett says Kim is "purging people right and left, in far extreme of what his father did. He’s inducing instability in the country…You never know what’s going to change things."

Dyn Research in March 2013 that "the four networks of North Korea are routed by a single Internet service provider, Star JV (AS 131279), which has two international Internet service providers: China Unicom (AS 4837) and Intelsat (AS 22351)."

Taking down North Korea's access to the Internet for a few hours would be an inconvenience for Pyongyang and Kim Jong-un. But it would not impart any proportional damage (relative to the Sony losses) unless it also fried all of the computers connected to it. (There are other computers in North Korea, such as in schools, but they are connected to the state-run intranet, not to the internet. And so headlines referring to "Massive North Korea Internet Outages" are amusing because there is nothing "massive" about Internet access in North Korea.)

Then again, taking it down for a prolonged period of time (a very, very long time measured in years) would cripple North Korea's hacking program, which they use as a substitute for their weak military. A 62-year old defector from North Korea told Aljazeera that there are five reasons why Pyongyang loves cyber warfare, which can all be summed up briefly this way: Cyber warfare can be highly effective, low risk and relatively inexpensive.

While this recent outage might be an attack [by the U.S.], Dyn Research notes that "it’s also consistent with more common causes, such as power problems. Point causes such as breaks in fiberoptic cables, or deliberate upstream provider disconnections, seem less likely because they don’t generate prolonged instability before a total failure. We can only guess. The data themselves don’t speak to motivations, or distinguish human factors from physical infrastructure problems."

It shouldn't be surprising to learn that North Korea has had Internet outages in the past, and they've been on the receiving end of cyber attacks too: Uriminzokkiri, for example, was hacked back in April, 2013. North Korea has blamed those past outages and attacks on the U.S. But they were more likely the symptoms of a lousy infrastructure. Or the actions of playful hackers.

Also See:
Did North Korea Hack Sony? Bruce W. Bennett, Rand
The Sony saga: 10 reasons why the FBI is wrong IT Pro Portal
Obama Vows a Response to Cyberattack on Sony New York Times
Were hackers behind North Korea outage? Politico
North Korea’s Internet Outage Is Probably Due To Pranksters,Not U.S. ‘Cyberwar’ Fusion
It's Alarmingly Easy To Take North Korea's Internet Offline Business Insider UK
How to bring North Korea to its cyber-knees Matthew Gault
How North Korea, one of the world's poorest countries, got so good at hacking Vox

FBI Still Blames North Korea for Sony Hack (Updated)

December 19, 2014 - The FBI blamed North Korea today for the unprecedented computer hacking attack of Sony Pictures Entertainment (SPE) in late November. It is widely believed that the cyber attack was North Korea's retaliation for Sony's film "The Interview." The film depicts a fictional CIA-sponsored assassination of N. Korea's young dictator Kim Jong-unUPDATED, 30 December: New Evidence.....

Kim Jong Un 'death scene' from The Interview
- MirrorNinja (watch video)
The Interview was released to theaters on Christmas Day, despite earlier threats of terrorism that caused Sony to pull the film's release.

The attack on Sony was devastating. In it's statement, the FBI said that "the destructive nature of this attack, coupled with its coercive nature, sets it apart." The statement said that the FBI is confident that the North Korean government "is responsible for these actions."

Experts Doubt North Korea's Role:
Was North Korea really behind the attack on Sony Picture's computers? Or was is one or more former Sony employees, possibly working as a paid contractor for North Korea?

On Dec. 29, Hollywood Reporter: "Security firm Norse claims it has evidence that shows the Sony hack was perpetrated by six individuals, including two based in the U.S., one in Canada, one in Singapore and one in Thailand. Norse senior vp Kurt Stammberger told the Ledger, a security industry news website, that among the six was one former Sony Pictures employee, a 10-year veteran of the company with a very technical background who was laid off in May following restructuring. Norse used human resources documents that were leaked as part of the hack to first identify and then track the former Sony employee's online activity at least since May, when the person left the company."

Dec. 27, CNN: "It's clear to us, based on both forensic and other evidence we've collected, that unequivocally they are not responsible for orchestrating or initiating the attack on Sony," said Sam Glines, who runs the cybersecurity company Norse.

Dec. 29, Dark Matters: "Norse Investigation Focusing on a Small Group, Including Sony Ex-Employees"

Dec. 30, Daily Beast: "Stammberger said that Norse’s analysis is now pointing toward an attack against Sony by disgruntled employees that was conducted in stages and over the course of several months, beginning as early as July, and that North Korea opportunistically praised the attack only after it was discovered."

From the FBI's December 19 press release:

Today, the FBI would like to provide an update on the status of our investigation into the cyber attack targeting Sony Pictures Entertainment (SPE). In late November, SPE confirmed that it was the victim of a cyber attack that destroyed systems and stole large quantities of personal and commercial data. A group calling itself the “Guardians of Peace” claimed responsibility for the attack and subsequently issued threats against SPE, its employees, and theaters that distribute its movies.

....The attacks also rendered thousands of SPE’s computers inoperable, forced SPE to take its entire computer network offline, and significantly disrupted the company’s business operations.
....Sony’s quick reporting facilitated the investigators’ ability to do their jobs, and ultimately to identify the source of these attacks.
....the FBI now has enough information to conclude that the North Korean government is responsible for these actions. While the need to protect sensitive sources and methods precludes us from sharing all of this information, our conclusion is based, in part, on the following:

- Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.

- The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.
- Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.

....the destructive nature of this attack, coupled with its coercive nature, sets it apart. North Korea’s actions were intended to inflict significant harm on a U.S. business and suppress the right of American citizens to express themselves. Such acts of intimidation fall outside the bounds of acceptable state behavior.... (read the full press release here.)

Also See:
U.S. suspects North Korea had help attacking Sony Pictures Reuters (29 Dec)
New Evidence Points to Inside Job, Security Experts Say Hollywood Reporter (Dec 29)
No, North Korea Didn’t Hack Sony Daily Beast (30 Dec)
FBI Fixated on North Korea for Sony Hack Despite New Evidence Daily Beast (30 Dec)
Hackers Make New Demands On Sony Pictures TMZ
Obama pledges proportional response to Sony hack AP/Watertown Public Opinion
Hack Attack Spurs Call For More North Korea Sanctions AP/Atlanta Daily World
Watch the Kim Jong-un Death Scene from The Interview MirrorNinja
Sony Pictures hack: Timeline of revelations from unprecedented cyber-attack IBTimes
Sony Pictures proves Hollywood is a land of cowards New York Post
George Clooney: Hollywood must push for release of The Interview  The Telegraph (UK)
North Korea’s Secret Movie Bootleggers Daily Beast

Hacked AP Twitter Account Tweets 'Two Explosions in the White House' - Syrian Electronic Army Strikes Again

White House bombed - Olympus Has Fallen
This is did not really happen.
April 23, 2013 - "Breaking: Two Explosions in the White House and Barack Obama is Injured," said the ominous tweet from Associated Press's Twitter account.

The tweet was not true, however. AP's Twitter account (@AP) was hacked, and the culprits posted the bogus headline without AP's consent.

"Moments later," reports NBC News, "the @AP Twitter account — with nearly 2 million followers — was suspended. Immediately following the false tweet, the Dow Industrial Average lost about 140 points. These losses were immediately recovered."

Who did the hack job on AP? There is speculation now that it was the pro-Assad Syrian Electronic Army, according to the Quartz website.

Blog Attacked Via Facebook Group For Posting 'Blow Up The Koran'

"Leisture Man Ops" Facebook profile picture
March 12, 2012 - The counterjihad website Infidels United was temporarily brought down today by a mysterious group on Facebook. 

That group orchestrated a dedicated denial of of service (DDOS) attack by inviting others to a Facebook event called "DDOS http://www.infidelsunited.com."  The site was brought back online this evening just past 9:00 PM CDT, but the attacks continue.

A DDOS is "is an attempt to make a computer or network resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted efforts of a person, or multiple people to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely." (source: Wikipedia)

Click image to enlarge it
"Leisture Man Ops" is the group or individual responsible for the DDOS. (No, that's not my mispelling: The fool can't even spell "Leisure" correctly.)

The reason for the attack is not clear, but is probably connected to the fact that Infidels United posted "Blow Up The Koran" on March 5.

Infidels United tells Chicago News Bench that the DDOS attacks have been "unceasing" since the FB event "DDOS http://www.infidelsunited.com" was posted on March 6th.

"Leisture Man Ops" seems to be Malaysian. Many of the phrases uses at their Facebook pages are in the Malay language.
Click image to enlarge it
The phrase "teruskan attack" is used a number of times, and "teruskan" means, roughly, "keep trying" or "don't stop" in Malay, which makes sense in this context for a persistent denial of service attack on a website.

"I have reported it to Facebook and the FBI via http://ic3.gov," said the owner of Infidels United, "and nobody seems to give a crap!"

He wonders, as do we all, why Facebook does not police this kind of activity more closely.
Enhanced by Zemanta

LulzSec Hacker Group Disbands, Runs Away

26 June 2011 - It was probably getting a bit too hot for LulzSec, a group of hackers that have caused a lot of sleepless nights for data security experts in recent weeks. LulzSec said late Saturday it would break up, reports PC World, but they planned to go out with a bang. "In what it said was its final act of mayhem," wrote PC World, "it publicly unloaded a trove of documents containing a significant amount of compressed data." The group's farewell came via Twitter. PC World quoted LulzSec communique as saying, "Our planned 50-day cruise has expired, and we must now sail into the distance...our crew of six wishes you a happy 2011." The FBI, as well as investigative agencies from the U.S. and other nations, have been in hot pursuit of the LulzSec internet criminals. British authorities arrested a suspected member of LulzSec near London recently. Even other hackers were trying to uncover the identities and whereabouts of LulzSec's members. The Telegraph UK says that LulzSec claimed to have "accomplished its mission to disrupt corporate and government bodies" and "has claimed responsibility for security breaches at targets including the CIA, Sony and the US Senate. Before disbanding it issued one last batch of data which included internal documents from internet giant AOL and the US phone company AT&T." More about LulzSec at The Telegraph... Why has LulzSec been wreaking havoc on the Internet? LulzSec claims they did it "just because we could." I get this uneasy feeling that we have not heard the last of LulzSec. Even if the group never operates under that name again, some of it members could continue the misdeeds. Worse, copycat digital criminals around the world will undoubtedly be inspired by LulzSec.

Cyberwar! Hackers Hit Lockheed Martin, Other U.S. Defense Companies

May 28, 2011 - A major breach of security has hit major U.S. weapons makers, including Lockheed Martin - and may still be occurring. According to a Reuters report, hackers penetrated the computer systems of Lockheed Martin and other weapons manufacturers, and it is feared that they could have stolen information about future weapons programs. Also at risk is information about existing military technology already in use. The Wall Street Journal reports that a "person familiar with the situation" said that many employees were required to change their "SecurID" passwords. This, says WSJ, was probably done because of the hacker attack, which may have been accomplished by a person or persons using "duplicate SecurID electronic keys made by EMC Corp.'s RSA security division." More about the defense industry cyber attack at WSJ.com... The problems seem to stem from a hacker attack against RSA back in March. Photo: Lockheed Martin

Climate Research Fraud and Fakery Revealed by Computer Hacker (Updated)

Update, Nov. 30: Whistleblower Got Climategate Emails, Not Hacker Note/Update: Many people still do not understand how huge this story is. It is, pardon the expression, earth shattering for many, and many are having a hard time coming to grips with it. It's as though the curtain has been ripped away, revealing the man who pretended to be the Wizard of Oz. A reader who is having a hard time facing the harsh reality of disillusionment wrote a comment, reproduced at the bottom of this post. 

Falsified climate "data" and strong indications of outright fraud have been revealed by the hacking of a computer at the Hadley Climatic Research Centre (UK), an influential research facility. That's right, fraud. Here's an example, brought to us by Chicago Bungalow (CB), who notes that emails were among the files accessed by the hacking operation. "The emails include one purportedly from Philip Jones, Director of the CRU (Climate Research Unit)," writes CB, "referring to the now well-known 'hockey stick' graph in Michael Mann's article in Nature." Read more at Chicago Bungalow... 

We've been saying for years that the gurus of climate change fall into one of two categories: (1) Frauds who deliberately fudge the data (e.g., Al Gore), and (2) Incompetent science quacks who parrot the global warming/climate change mumbo-jumbo in a pitiful attempt to be in with the in crowd. In addition to those false priests of the Church of Climate Change, of course, are the billions of morons who have swallowed whole the wafers of global warming. Perhaps some will be swayed by this revelation, but not many will be. It takes a lot to sway somebody away from their religion, which is exactly what the belief in Global Warming has become. 

Comment left by "Juicyfruit" on 11/20/2009: "So lets say someone breaks into Tea Party Headquarters and hacks into their computer and then pronounces to the world that what the Tea Party folk believe in is a fraud. I think one should question the definately question the source of information that comes from people who break into other peoples computers. Im still out on the whole global warming thing. But I do have morals." 

My Response to "Juicyfruit": Whenever you write to me you give a fake email address and use fake names like Wierdo, Taxman, Sam and now Juicyfruit. So, how much credence should we give to YOU? Now, I agree with you that the hacking was unethical. However, your comparison of that to a hypothetical hacking of the "Tea Party Headquarters" is seriously flawed for several reasons: 

1) There is no "Tea Party Headquarters," per se. The movement is made up of hundreds of loosely cooperating groups, none of which is beholden to a national organization. 

2) We are not talking about opinion or "belief," as you put it. We are talking about the numbers, the mathematics and hard data that were fudged by the people at the Hadley Climatic Research Centre. 

3) The Hadley people were screwing the data, as demonstrated with notes such as this: "I've just completed Mike's Nature trick of adding in the real temps to each series for the last 20 years (ie from 1981 onwards) amd from 1961 for Keith's to hide the decline." That's not political opinion or difference in philosophy, JF, it's outright fraud with numbers. This has nothing to do with Tea Parties, JF. As for the source of the information, it's the Hadley Climatic Research Centre, with a middle man in Russia who hacked into their computer/s. 

Obama's Smart Grid Will Weaken US Electric Grid Security

Have foreign spies hacked into the US electrical grid? Could they disable large portions of it, or even all of it, if they wanted to? Seems likely according to recent reports, and the Obama Administration will only make it worse with the proposed "Smart Grid." "China has denied a report issued yesterday stating that it had penetrated the U.S. electrical grid," according to the International Business Times. IBT also reported this (emphasis added): The report issued by the Wall Street Journal on Wednesday [April 8] said Chinese, Russian and other cyber spies had intruded into the electrical grid, leaving behind software programs which could cause damage to the network if activated. This story has a huge "Duh" factor built into it. Just as nobody should have been surprised by the events of September 11, 2001, there should be no surprise that our poorly guarded electrical grid could have been (probably has been) compromised by hostile interests. A professor at Indiana University feels the same way. Fred H. Cate, director of the Center for Applied Cybersecurity Research and distinguished professor at the Maurer School of Law (Indiana University), said foreign entities have been attempting to tap into such networks for years, and succeeded on multiple occasions: "The most surprising aspect of recent disclosures about cyberspies having penetrated the U.S. electrical grid is how much the disclosure seems to have surprised policymakers and the press," Cate said. "We have known for years both that foreign governments were attacking the U.S. cyberinfrastructure and that those attacks extended to power and other utilities." (Source) China's government has been busy issuing denials since WSJ ran the story: "The intrusion doesn't exist at all,” said Chinese Foreign Ministry spokeswoman Jiang Yu at a press conference Wednesday, according to China’s state media Xinhua. "We hope that the concerned media will prudently deal with some groundless remarks, especially those concerning accusations against China." China, you may recall, is governed by a bunch of sadistic, sociopathic liars who habitually disable YouTube, Google and other sources of freely flowing information. They still hold Tibet and consider the Dalai Lama to be a top enemy of the state. Although China is a major trading partner of ours, they are sworn to destroy the United States. China's denial rings hollow, as does the Russian denial reported by the April 8 Wall Street Journal article: Russian and Chinese officials have denied any wrongdoing. "These are pure speculations," said Yevgeniy Khorishko, a spokesman at the Russian Embassy. "Russia has nothing to do with the cyberattacks on the U.S. infrastructure, or on any infrastructure in any other country in the world." You may recall that Russia is governed by a bunch of sadistic, sociopathic liars who habitually disable sources of freely flowing information and imprison opposition leaders. They would still hold eastern Europe as slave states if they were able to. Although Russia is a major trading partner of ours, they would love to destroy us. So what is our highly inefficient federal government doing about this? Virtually nothing, really. Barack Obama has already has "committed billions of dollars to grid-related projects, including research, development and assessment. The mission is to create efficiencies to lower costs, create savings and allow for better adoption of alternative energy sources." That's according to a report by Thomas Kostigen at Marketwatch.com. But, as Kostigen points out, Obama's "Smart Grid" does not address security issues (emphasis added): Joshua Pennell is chief executive of IOActive, a security services and software assurance firm in Seattle. In a presentation to the Department of Homeland Security, Pennell says the Smart Grid has "inherent security flaws" and could further expose the country to attacks on our critical power infrastructure. His firm conducted industry research and claims that a smart grid could "expose utility companies to possible fraud, extortion attempts, lawsuits or widespread system interruption." In other words, Obama's "Smart Grid" is downright stupid. It will not only not solve current and inherent security problems, it could actually create more. Kostigen continues: Indeed, The Wall Street Journal reported this week that cyber spies already have penetrated the U.S. electrical grid and left behind software programs that could help disrupt the system. The paper alleges these spies operate from Russia and China. It quotes one U.S. official as saying, "If we go to war with them, they will try to turn them on." Then again, if they do turn it on in a pre-emptive move, we would not be able to go to war with them. The bastards could walk right in. Environmentalists would welcome the invaders with chopsticks and open arms. RELATED: China denies hacking America's electrical grid Oncor says its grid is well protected from hackers IU law professor: Power breach troubling, not unexpected Before Grid Hack Reports, NERC Advises Industry on Cyber Assets Chicago News Bench RSS Feed CommieBama Hats and More