Cyber wars

CIA conducted aggressive covert cyber operations against Iran, China, as Trump gave it more power: report

The Central Intelligence Agency, using new powers, carried out aggressive covert cyber operations against countries including Iran, North Korea, China and Russia, a new report says.

The operations came after President Trump gave the CIA “sweeping authorization” in 2018 by signing a "presidential finding," according to Yahoo News, citing U.S. officials with knowledge of the matter.

With a presidential finding, the president authorizes covert action necessary to support “identifiable foreign policy objectives" that are deemed "important to the national security of the United States,” according to a U.S. government document.

The authorization undoes “many restrictions that had been in place under prior administrations,” and gives the CIA more leeway in authorizing its own covert cyber operations, the Yahoo News report said.

Cyber wars

The Emerging Risk of Virtual Societal Warfare

The evolution of advanced information environments is rapidly creating a new category of possible cyberaggression that involves efforts to manipulate or disrupt the information foundations of the effective functioning of economic and social systems. RAND researchers are calling this growing threat virtual societal warfare in an analysis of its characteristics and implications for the future.

To understand the risk of virtual societal warfare, the authors surveyed evidence in a range of categories to sketch out some initial contours of how these techniques might evolve in the future. They grounded the assessment in (1) detailed research on trends in the changing character of the information environment in the United States and other advanced democracies; (2) the insights of social science research on attitudes and beliefs; and (3) developments in relevant emerging technologies that bear on the practices of hostile social manipulation and its more elaborate and dangerous cousin, virtual societal warfare. The authors then provide three scenarios for how social manipulation could affect advanced societies over the next decade.

The analysis suggests an initial set of characteristics that can help define the emerging challenge of virtual societal warfare, including that national security will increasingly rely on a resilient information environment and a strong social topography, and that conflict will increasingly be waged between and among networks.

Cyber wars

Can NSA Stop China Copying Its Cyber Weapons?

Adversaries have been copying and stealing each others’ weaponsever since Ape A threw a rock at Ape B and Ape B got the bright idea to throw it back. But recent revelations from Symantec and The New York Times suggest this problem is much bigger with cyber weapons. Why? In order to attack an enemy’s computer, they have to copy their code onto it. It’s like bombing an enemy with munitions that scatter their own blueprints around the blast site.

US hacking tools have gone astray before, most notoriously when a mysterious group called Shadow Brokers repeatedly released National Security Agency code for hackers around the globe to use in attacks like WannaCry. But cybersecurity analysts at Symantec have found evidence that hackers working for China’s Ministry of State Security were using NSA-built cyber weapons “at least a year prior to the Shadow Brokers leak.” (To avoid offending nation-states, the Symantec report only IDs the Chinese as “Buckeye” and NSA as “Equation Group”). Symantec’s suggested explanation: “one possibility is that Buckeye may have engineered its own version of the tools from artifacts found in captured network traffic, possibly from observing an Equation Group attack.”

Cyber wars

Preparing for Computer Network Operations: USCYBERCOM Documents Trace Path to Operational Cyber Force

Our present understanding of how USCYBERCOM conducts operations in cyberspace comes either through anecdotal examples such as JTF-ARES/OPERATION GLOWING SYMPHONY or through broad doctrine as communicated in publications like JP 3-12 Cyberspace Operations. Little has been revealed about processes linking broad doctrine and strategy to tactical operations. Today the National Security Archive publishes a collection of documents obtained via FOIA declassification regarding the process of building the Cyber Mission Force and Joint Force Headquarters – Cyber under USCYBERCOM. These documents trace the development of the US military’s first acknowledged offensive cyber force, outline the mission's essential tasks and key operational processes USCYBERCOM elements are required to master, discuss the impact of US government shutdowns on the USCYBERCOM training process, and demonstrate the doctrinal roots of cyberspace tasking and targeting in fire support and airpower doctrine.

In May of 2018 USCYBERCOM announced that all 133 Cyber Mission Force (CMF) teams had reached Full Operational Capability (FOC), a major milestone in the history of the combatant command, after two years earlier announcing Initial Operational Capability (IOC).

The CMF consists of three types of teams. The defensive component of USCYBERCOM’s mission is performed by the Cyber National Mission Force, tasked with protecting civilian networks and infrastructure, and the Cyber Protection Force which defends Department of Defense networks. Offensive operations, under the direction of a service-specific Joint Force Headquarters – Cyberspace (JFHQ-C) in support of combatant commanders, are conducted by the Cyber Combat Mission Force.

Cyber wars

Hacker Group Exposes Iranian APT Operations and Members

Hackers have revealed details about the inner workings of a cyber-espionage group mostly known in the security community as OilRig, APT34, and HelixKitten, linked to the Iranian government.

Using the online name Lab Dookhtegan, the hackers used a Telegram channel to dump information about APT34's infrastructure, hacking tools, members, and victims.

The data dump is no hoax. We received confirmation from Chronicle, Alphabet's cybersecurity company, that the leaked information is associated with the APT34/OilRig group.

One theory is that behind the leak are opponents of the Iranian regime involved in the government's cyber operations. If more than one individual did this, it is not a large group, someone familiar with the situation in Iran told us.

Brandon Levene, Head of Applied Intelligence at Chronicle, believes that one reason behind the leak would be to put Iranian cyber capabilities in the limelight; another would be to disrupt future operation by forcing APT34 to retool.

Dookhtegan did not hide their feelings toward the government's cyber activity, expressing hope that other Iranians will do something to fight the regime.

Cyber wars

Obama reportedly directed the NSA to infect Russia with cyber weapons to cause ‘pain’

The Post report, which focuses on Moscow's interference in the 2016 presidential election and the Obama administration's response, said the program was a covert action that would allow the US to retaliate if Russia carries out similar behavior in the future.

"Implants are a term used by the intelligence community for malicious code and backdoors," David Kennedy, a former Marine intelligence specialist and founder of TrustedSec and Binary Defense Systems, told Business Insider. "Essentially [it is] the ability to implant code that goes undetected."

Though the report says Russia would feel "pain" if the infected networks were "disrupted," it's not clear whether the implants were designed to affect infrastructure, similar to how the NSA carried out a successful operation called "Olympic Games" (more commonly referred to as the Stuxnet attack) that set back Iran's nuclear program.

Cyber wars

The Secret Pentagon Push for Lethal Cyber Weapons

Under a forthcoming nearly half-billion-dollar military contract, computer code capable of killing adversaries is expected to be developed and deployed if necessary, according to contractors vying for the work and former Pentagon officials.U.S. troops would have the power to launch logic bombs, instead of traditional explosive projectiles, which essentially would direct an enemy’s critical infrastructure to self-destruct.
Lethal cyber weapons have arrived.
As previously reported, an upcoming $460 million U.S. Cyber Command project will outsource to industry all command mission support activities, including “cyber fires” planning, as well as “cyberspace joint munitions” assessments.