Exposed – Intel Paper: Common Cyber Threats to Universities

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

MS-ISAC Intel Paper: Common Cyber Threats to Universities

The following document was obtained from the website of the Missouri Department of Higher Education.

Common Cyber Threats to Universities

Page Count: 10 pages
Date: February 23, 2016
Restriction: For Official Use Only
Originating Organization: Multi-State Information Sharing and Analysis Center
File Type: pdf
File Size: 773,757 bytes
File Hash (SHA-256): 638A6DB7C124E3424BCD2627D2212274029FFAFBE9D93D82FC8BCA4B5676CC89

Download File

(U//FOUO) TLP: AMBER The Risk: The Multi-State Information Sharing and Analysis Center (MS-ISAC) assesses with high confidence that cyber threat actors routinely target universities, for the purposes of financial gain, notoriety, or entertainment, and often to gain access to personally identifiable information (PII) and/or sensitive research. MS-ISAC believes universities are inherently more vulnerable to cyber targeting than other state, local, tribal, and territorial (SLTT) government entities, due to the non-restrictive research environment with less compartmentalization and less access restriction, which results in more opportunity for infection, and when infection occurs, easier transmission through a network.

• Incident frequency remained relatively consistent in 2015 compared to 2014, but incidents spiked in July and August 2015 as seen in Figure 1. The August spike may be partially caused by the return of students to campus and increased traffic on university networks.
• Nation-‐state actors pose the gravest threat to universities systems and the greater national security interest. This is due to nation-‐state actor’s more advanced skill sets and tendency to strategically target universities with developed research programs, or those that are Cleared Defense Contractors (CDC) or Centers for Academic Excellence (CAE), which may contain engineering, health, science or defense research, crucial to the U.S. National Security interest.
• Based on MS-‐ISAC data, universities are most likely to be targeted via a phishing email, and malware infection is the most likely tactic, technique or procedure (TTP) a university will experience.

Cyber Monday 2017, Cyber Bullying, Cyber Security, Cyber Security Jobs, Cyber High, Cyber Monday 3s, Cyber Security Salary, Cyberpower, Cyber Goth, Cyber Security Degree, Cyber Attack, Cyber Awareness, Cyber Acoustics, Cyber Academy, Cyber Attack Map, Cyber Attack 2017, Cyberark, Cyber Attack On Electrical Grid, Cyber Angel, Cyber Awareness Army, Cyber Bullying, Cyber Bullying Statistics, Cyber Bullying Facts, Cyberbully, Cyber Bullying Stories, Cyber Bullying Quotes, Cyber Bullying Articles, Cyber Bullying Laws Michigan, Cyber Bites, Cyber Bullying Essay, Cyber Chase, Cybercoders, Cyber Chip, Cyber Crime, Cyber Check, Cyber Cafe, Cyber City Oedo 808, Cyber Cafe Near Me, Cyber Command, Cyber Currency, Cyber Dust, Cyber Dragon Infinity, Cyber Dragon, Cyber Dragon Deck, Cyberduck, Cyber Definition, Cyber Dragon Nova, Cyber Dojo, Cyber Dragon Deck 2017, Cyber Defense Jobs, Cyber End Dragon, Cyber Education Center, Cyber Education, Cyber Espionage, Cyber Education Center Lansing Mi, Cyber Ethics, Cyber Extortion, Cyber Eltanin, Cyber Engineering, Cyber Etymology, Cyber Forensics, Cyber Five, Cyber Force, Cyber Forensics Jobs, Cyber Formula, Cyber Font, Cyber Frauds, Cyber Forensics Degree, Cyberfair, Cyber Footprint, Cyber Goth, Cyberghost, Cyber Goth Dance, Cyber Ghetto, Cybergrants, Cyber Gadget, Cyber Goth Girl, Cyber Gadget Retro Freak, Cyber Goth Clothing, Cyber Gears, Cyber Hymnal, Cyber Harassment, Cyber High, Cyber Hacking, Cyber Hug, Cyber Harpie Lady, Cyber Hygiene, Cyber Helmet, Cyber Harassment Laws, Cyber Harassment Michigan, Cyber Insurance, Cyber Inc, Cyber Intelligence, Cyber Insurance Policy, Cyber Investigation, Cyber Intelligence Analyst, Cyber Illinois, Cyber Intelligence Degree, Cyber Insurance Providers, Cyber Infrastructure, Cyber Jar, Cyber Jobs, Cyberjapan Dancers, Cyber Junkie, Cyber Jack, Cyber Jihad, Cyber Jesus, Cyberjudas, Cyber Jar Banned, Cyber Jason, Cyber Kill Chain, Cyberknife, Cyber Knight, Cyber Kotori, Cyber Key, Cyber Kill Chain Model, Cyber King, Cyber Kidnapping, Cyber Kong, Cyber Kitty, Cyber Liability Insurance, Cyber Law, Cyberlink, Cyber Liquids, Cyber Love Live, Cyber Laser Dragon, Cyberlock, Cyber Liability Insurance Cost, Cyber Lawyer, Cyberlink Powerdirector, Cyber Monday 2017, Cyber Monday 3s, Cyber Monday, Cyber Monday 1s, Cyber Monday 2016, Cyber Meaning, Cyber Michigan, Cyber Marvel, Cyberman, Cybermen, Cyber News, Cyber Nico, Cyber Ninja, Cyber Nations, Cyber Ninja Hanzo, Cyber Nuke, Cyber Network, Cyber Nozomi, Cyber Net, Cyber Nanny, Cyber Operations, Cyber Optics Detroit, Cyber Operations Officer, Cyber Optics, Cyber Ops, Cyber Operations Specialist, Cyber Outlet, Cyber Ogre, Cyber Operations Specialist Salary, Cyber Officer Air Force, Cyberpower, Cyberpunk, Cyber Police, Cyber Physical Systems, Cyberpatriot, Cyber Pegasus, Cyberpunk 2077, Cyber Playground, Cyberpower Ups, Cyber Pink, Cyber Quest, Cyberq, Cyber Quest Soaring Eagle, Cyber Quotes, Cyber Queen, Cyberquery, Cybex Q Cloud, Cyber Questions, Cyber Quest Fort Gordon, Cyberq Manual, Cyber Research, Cyber Risk, Cyber Resilience, Cyber Range, Cyber Risk Management, Cyber Rain, Cyber Recruiter, Cyber Risk Insurance, Cyber Repair Plant, Cyber Rider Turbo, Cyber Security, Cyber Security Jobs, Cyber Security Salary, Cyber Security Degree, Cyber Security Training, Cyber Security News, Cyber Stalking, Cyber Security Certifications, Cyber Security Companies, Cyber Safety, Cyber Terrorism, Cyber Tech, Cyber Threat, Cyber Transport Systems, Cyber Terrorism Definition, Cyber Terminators, Cyber Threat Intelligence, Cyber Technology, Cyber Theft, Cyber Threat Alliance, Cyber Umi, Cyber University, Cyber U, Cyber Ups, Cyber Bullying, Cyber Umi Cosplay, Cyber Underground, Cyber Unit, Cyber Usa, Cyber Underwriter Salary, Cyber Valley, Cyber Vandalism, Cyber Violence, Cyber Vpn, Cyber Vulnerability, Cyber Victimization, Cyber Village Academy, Cyber Virus, Cyber Vision, Cyber Vulnerability Assessment, Cyber Warfare, Cyberweld, Cyber Woman With Corn, Cyber World, Cyber Warfare Definition, Cyber World Institute, Cyber Warrior, Cyber Weapons, Cyber Wars, Cyber Wallpaper, Cyber X, Cyber Xmen, Cyber X Games, Cyber X Link, Cyber X Designs, Cyber X 3d, Cyborg X Trailer, Cyber X Internet Cafe, Cyber X Games 2017, Cyber Xl, Cyber Yugioh, Cyber Yellow, Cyber Yog, Cyber Yugioh Cards, Cyber Yankee, Cyber Yankee 2017, Cyber Yellow Vans, Cyber Youtube, Cyber Youcam, Cyber You, Cyber Zilla, Cyber Zone, Cyber Zarya, Cyber Zombie, Cyber Z, Cyber Zoom, Cyberzone Internet Cafe, Cyber Zone Hours, Cyber Zilla Toy, Cyber Zone Opelika, Threat Definition, Threat Level Midnight, Threat Synonym, Threat In Spanish, Threat Modeling, Threat Stack, Threat Meaning, Threat Dynamics, Threat Intelligence, Threat Assessment, Threat Assessment, Threat Analysis, Threat Awareness And Reporting Program, Threat Antonym, Threat Actor, Threat Agent, Threat Assessment Model, Threat Assessment Training, Threat And Error Management, Threat Advice, Threat Based Threads, Threat Beast, Threat Brief, Threat Bias, Threat Basketball, Threat Board, Threat Blocked Avast, Threat Behavior, Threat Based Risk Assessment, Threat Blog, Threatconnect, Threatcrowd, Threat Charges, Threat Cloud, Threat Crime Cause Death\/gbi, Threat Ck2, Threat Control Override, Threatcon, Threatcon Delta, Threat Crime, Threat Definition, Threat Dynamics, Threat Detection, Threat Define, Threat Def, Threat Defense, Threat Display, Threat Detection And Response, Threat Disposal Nier, Threat Dynamics Hours, Threat En Espanol, Threat Expert, Threat Exchange, Threat Emulation, Threat Examples, Threat Error Management, Threat Environment, Threat Ender Crossword Clue, Threat Encyclopedia, Threat Emitter, Threat From North Korea, Threat Feeds, Threat From Xor, Threat Finance, Threat Fire, Threat From Russia, Threat From Above, Threat From The Thicket, Threat Finance Jobs, Threat From The Sea, Threat Grid, Threat Gif, Threat Group, Threat Generator, Threat Geek, Threat Graph, Threatguard, Threat Grid Login, Threat Group-4127, Threat Grid Api, Threat Hunting, Threathoops, Threat Hunting Tools, Threat Hunting With Splunk, Threat Hunting Training, Threat Hunting Techniques, Threat Hypothesis, Threat Has Been Detected, Threat Hunting Definition, Threat Hunting Summit, Threat In Spanish, Threat Intelligence, Threat Intelligence Feeds, Threat Intelligence Platform, Threat Intel, Threat In French, Threat Icon, Threat Intelligence Analyst, Threat Identification, Threat Intelligence Definition, Threat Jay Z Mp3, Threat Jay, Threat Journal, Threat Jokes, Threat Jail Time, Threat Jay Z Genius, Thread Java, Threat Jay Z Instrumental, Threat Jay Z Listen, Threat Jewellery, Threat Knowledge Group, Threat Kill Chain, Threat Level Midnight, Threat Knowledge, Threat Knowledge Group Isis, Threat Knights Of Pen And Paper, Threat Level Midnight Full Movie, Threat Level, Threat Level Midnight Episode, Threat Level Midnight Quotes, Threat Level Midnight, Threat Level Midnight Full Movie, Threat Level, Threat Level Midnight Episode, Threat Level Midnight Quotes, Threat Level Midnight Song, Threat Landscape, Threat Level Delta, Threat Level Midnight Poster, Threat Level Orange, Threat Modeling, Threat Meaning, Threat Matrix, Threat Map, Threat Management, Threat Management Group, Threat Modeling Tool, Threat Meme, Threat Modeling Designing For Security, Threat Management Gateway, Threat Note, Threat Neutralized, Threat North Korea, Threat Net, Threat Null, Threat News, Threat Narrative, Threat Neverwinter, Threat Networks, Threat Name Ws.reputation.1, Threat Of New Entrants, Threat Of Substitutes, Threat Of Joy Lyrics, Threat Of Nuclear War, Threat Of Joy, Threat Of War, Threat Of North Korea, Threat Of Substitute Products, Threat Of Terrorism, Threat Of Joy Chords, Threat Post, Threat Payday 2, Threat Pattern, Threat Prevention, Threat Perception, Threat Protection, Threat Profile, Threat Past Tense, Threat Point, Threat Plates, Threat Quotes, Threatquotient, Threat Questionnaire, Thread Queue, Threat Quotes And Sayings, Threat Quarantine, Threat Quotes In Hindi, Threat Quotes From Movies, Threat Response Solutions, Threat Response, Threat Report, Threat Rapper, Threat Range Pathfinder, Threat Rhyme, Threat Rigidity, Threat Research, Threat Radar, Threat Risk Assessment, Threat Synonym, Threat Stack, Threat Signal, Threat Simulation Theory, Threatstream, Threat Stack Careers, Threat Spanish, Threat Scan, Threat Scenarios, Threat Suppression, Threat To Survival, Threat To Internal Validity, Threat Thesaurus, Threat Tec, Threattrack, Threat To Biodiversity, Threat To Society, Threat To Validity, Threat To National Security, Threat To Us, Thread Up, Threat Update, Threat Us, Threat Used In A Sentence, Threat Uk, Threat Urban Dictionary, Thread Up Mens, Thread Up Review, Thread Up Maternity, Thread Up Sell, Threat Vector, Threat Vs Vulnerability, Threat Vulnerability Risk, Threat Vector Definition, Threat Vulnerability Assessment, Threat Verb, Threat Vs Warning, Threat Vault, Threat Vs Consequence, Threat Vs Challenge, Threat Wire, Threat With A Deadly Weapon, Threat Watch, Threat Wiki, Threat Warning, Thread Wallets, Threat Words, Threat Working Group, Threat Wow, Threat With A Gun, Threat X, Threat X Vulnerability = Risk, Threat And Risk, Threat X Impact, Threat Exchange, Threat Xword, X Factor Threat, Threat X3, X2 Threat, Xml Threat Protection In Datapower, Treat You Better Lyrics, Treat Yo Self, Treat You Better, Treat Yo Self Gif, Treat Your Feet, Treat You Better Chords, Treat Yo Self Meme, Treat Yo Self Episode, Treat Yo Self Day, Treat Yourself Meme, Threat Zero, Threat T\u0142umaczenie, Threat Zone, Thread Zigbee, Thread Zap, Zika Threat, Zp Theart, Zonealarm Threat Emulation, Zombie Threat, Zombie Threat Level, University Of Phoenix, University Of Washington, University Of Michigan, University Of Maryland, University Of Florida, University Of Chicago, University Of Texas, University Of Arizona, University Of South Carolina, University Of Alabama, University At Buffalo, University At Albany, University Apartments, University Athlete, University Academy, University Art, University Avenue, University At Buffalo Address, University Audi, University Accounting Services, University Bookstore, University Bowl, University Blue 12s, University Baptist Church, University Blue, University Bookstore Purdue, University Bookstore Hours, University Blue 11, University Boulevard, University Bikes, University Credit Union, University Club, University College London, University City, University College Dublin, University Commons, University Center, University Club Chicago, University City High School, University Co Op, University Definition, University Dodge, University Dental, University Drive, University District Seattle, University Downs, University Dermatology, University District, University Delaware, University Denver, University Edge, University Estates, University Electric, University Eye Center, University Endowments, University Edge Kent, University Eye Care, University Extension, University Enterprises, University Eye Associates, University Federal Credit Union, University Ford, University Florida, University Family Care, University Frames, University Falls, University Font, University Federal Credit Union Utah, University Foods, University Florist, University Gardens, University Grill, University Gateway, University Group, University Green, University Guest House, University Games, University Green Apartments, University Gastroenterology, University Georgia, University Hospital, University High School, University Heights, University Health, University House, University Health System, University Health Services, University Hospitals Jobs, University Hospital Cleveland, University Honda, University Inn, University In California, University In Melbourne, University In Texas, University In New York, University Inn Washington Dc, University In Florida, University In Spanish, University In Chicago, University In Boston, University Jobs, University Jewelry, University Jeep, University Jobs Usa, University Jordan 11, University Job Boards, University Jacksonville, University Jobs Nyc, University Jobs Chicago, University Jamestown, University Kia, University Kitchen, University Kentucky, University Kansas, University Kia Durham, University Kentucky Baseball, University Of, University K9, University Kia Huntsville Alabama, University Kansas City, University Library, University Lofts, University Logos, University Lanes, University Liquor, University Lake School, University Liggett, University Lutheran Church, University Lands, University Laundry, University Mall, University Medical Center, University Mall Hours, University Motors, University Mazda, University Mall Tampa, University Mall Theatres, University Mall Stores, University Michigan, University Medicine, University Near Me, University North Carolina, University Nevada Reno, University North Texas, University Notre Dame, University North Dakota, University Nails, University Northern Colorado, University North Florida, University New Mexico, University Of Phoenix, University Of Washington, University Of Michigan, University Of Maryland, University Of Florida, University Of Chicago, University Of Texas, University Of Arizona, University Of South Carolina, University Of Alabama, University Park, University Park Mall, University Place, University Park Apartments, University Park Pa, University Park Il, University Place Wa, University Pointe, University Plaza, University Prep, University Quotes, University Quiz, University Queensland, University Quarters, University Quarter System, University Quality Inn Lansing Mi, University Quad, University Quality Inn Lansing, University Quebec, University Quick Care, University Rankings, University Radiology, University Rankings 2017, University Ridge, University Realty, University Red 5s, University Roadhouse, University Rentals, University Reformed Church, University Registrar, University School, University South Carolina, University System Of Georgia, University San Diego, University School Of Milwaukee, University Southern California, University Square, University Settlement, University South Florida, University Suites, University Tees, University Towers, University Trails, University Town Center, University Tire, University Toyota, University Theater, University Terrace, University Texas Austin, University Tennessee, University United Methodist Church, University Urology, University Urgent Care, University Utah, University Union, University Unitarian Church, University Utah Credit Union, University Umc, University Utah Hospital, University Urbana Champaign, University Village, University Village Theatre, University Vs College, University View, University Village Stores, University Village Austin, University View Academy, University Vw, University Village Clemson, University Village Chicago, University Washington, University Wisconsin Madison, University Wafer, University West, University Walk, University Woods, University West Florida, University Writing Center, University West Georgia, University World Rankings, University Xavier, University X, University Xfinity, University Xamarin, University Credit Union, University Club, University College London, University City, University College Dublin, University Commons, University Ymca, University Yard Sale, University Yes Academy, University Ymca Seattle, University Ymca Charlotte Nc, University Yacht Club, University Ymca Hours, University Y, University Yale, University Yoga, University Zip Code, University Zurich, University Zagreb, University Zoka, University Zaragoza, University Zimbabwe, University Zipcar Rates, University Zambia, University Zurich Jobs, University Zaxby’s

Public Intelligence – Nation-State Cyber Actors Focused on “Maintaining Persistent Access” to U.S. Energy Infrastructure

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

Damaging cyber attacks against the U.S. energy infrastructure do not currently pose a significant threat according to an intelligence assessment released by the Department of Homeland Security and Industrial Control Systems Computer Emergency Response Team (ICS-CERT) in January. While cyber actors backed by a number of nation-states are actively “targeting US energy sector enterprise networks,” these activities are focused primarily on supporting cyber espionage activities to acquire and maintain “persistent access to facilitate the introduction of malware” in the event of “hostilities with the United States.”

The restricted DHS assessment titled “Damaging Cyber Attacks Possible but Not Likely Against the US Energy Sector” was obtained by Public Intelligence and reveals that at least seventeen intrusions against the U.S. energy sector were traced back to APT actors in FY 2014. The attacks never resulted in damage or disruption, but were instead focused on “data theft from enterprise networks” and “accessing and maintaining presence on ICS” networks and systems. One example cited in the assessment is a piece of malware called Havex that was “likely developed by Russian state-sponsored cyber actors.” The existence of the malware was first disclosed in a June 2014 blog post by Finnish security firm F-Secure which described how the remote access tool (RAT) was being used as part of an industrial espionage campaign. DHS states that this campaign dates back to 2011 and that while the “main function is to gather information,” Havex can also run “specialized plug-ins for additional capabilities.”

The assessment also mentions an attack on the Ukrainian energy sector in December 2015 that resulted in at least 80,000 customers losing power for up to six hours. At the time the assessment was written, ICS-CERT stated that they were “unable to confirm” the event was triggered by cyber means, but that a sample of the malware provided by the Ukranian Government had the capability to “enable remote access and delete computer content, including system drives.” While DHS does not attribute the attack to any specific cyber actor, the assessment states that the attack is “consistent with our understanding of Moscow’s capability and intent, including observations of cyber operations during regional tensions.”

A month after the DHS assessment was published, ICS-CERT released an alert describing the attack in much greater detail and relaying the findings of a team that included representatives of the U.S. Computer Emergency Readiness Team (US-CERT), Department of Energy, FBI and North American Electric Reliability Corporation. The alert increased the number of those affected by the attack to more than 225,000 customers, noting that the attack was “reportedly synchronized and coordinated, probably following extensive reconnaissance of the victim networks.” The attackers reportedly “acquired legitimate credentials and leveraged valid remote access pathways” to cause 50 regional substations to experience “malicious remote operation of their breakers conducted by multiple external humans.”

ICS-CERT also released a restricted version of the alert marked For Official Use Only that included non-public details and analysis of the vulnerabilities exposed by the attack. An updated version of the restricted alert from March was also obtained by Public Intelligence and states that “critical infrastructure [industrial control system or ICS] networks, across multiple sectors, are vulnerable to similar attacks.” ICS-CERT argues that the “incident highlights the urgent need for critical infrastructure owners and operators across all sectors to implement enhanced cyber measures that reduce risks” that could result from the use of a number of different techniques that were employed by the attackers, including:

• Theft of legitimate user credentials to enable access masquerading as approved users,
• Leveraging legitimate remote access pathways (VPNs),
• The remote operation of human-machine interface (HMI) via company installed remote access software (such as RDP, TeamViewer or rlogin)
• The use of destructive malware such as KillDisk to disable industrial control systems (ICSs) and corporate network systems
• Firmware overwrites that disable/destroy field equipment
• Unauthorized scheduled disconnects of uninterruptable power supplies (UPS) to devices to deny their availability
• The delivery of malware via spear-phishing emails and the use of malicious Microsoft Office attachments
• Use of Telephone Denial of Service (TDoS) to disrupt operations and restoration.

During the attacks, “remote human operators” accessed the workstations of dispatchers at the facilities using legitimately installed tools for remote access. They used this access to trip the breakers, change the passwords for key systems, corrupt firmware of serial-to-ethernet converters used for substation communication and leverage backup battery systems to trigger shutdowns of connected servers and devices. In one instance, the attackers used an uninterruptible power supply (UPS) to target an internal telecommunications server which cut off “all internal communications with regional offices and distribution substations.”

Despite the risks demonstrated in the Ukrainian attack, the DHS assessment from January tries to downplay the threat posed by state actors, noting that 63 percent of malicious cyber activity in FY 2014 was “unattributed, low-level activity” related to cybercrime using methods such as ransomware and denial-of-service attacks. The assessment’s authors also include a section criticizing the media’s over-hyping of cyber attacks and cyber warfare as leading to “misperceptions about the cyber threat to the US energy sector.” The term “cyber attack” is often used by the media and private sector to refer to incidents and activities that are not necessarily intended to “cause denial, disruption, destruction, or other negative effects” which would better be described as “cyber espionage, and even low-level, untargeted incidents of cybercrime.” The assessment even speculates that overuse of the term could lead to “alarm fatigue” which could lead to less reporting of incidents and longer response times.

Public Intelligence Blog, Public Intelligence Technology Associates, Public Intelligence Inc, Public Intelligence Technology Associates Kk, Public Intelligence Website, Public Intelligence Report, Public Intelligence Denmark, Public Intelligence Tool, Public Intelligence Analyst, Public Intelligence Twitter, Public Intelligence Analyst, Public Intelligence Agency, Public Intelligence Assessment, Public Artificial Intelligence Companies, Public Security Intelligence Agency, Public Health Intelligence Analyst, Public Health Intelligence Analyst Job Description, Public Safety Intelligence Analyst Ohio, Public Safety Intelligence Analyst, Public Health Intelligence Analysis, Public Intelligence Blog, Public Intelligence Blog Podcast, Public Business Intelligence, Public Sector Business Intelligence, Public Sector Business Intelligence Strategy, Public Transport Business Intelligence, Public Health Business Intelligence, British Public Intelligence Agency, Intelligence Public Affairs Bilbao, Public Intelligence.com, Public Artificial Intelligence Companies, Public Health Intelligence Course, Business Intelligence Public Companies, Public Health Intelligence Training Course, Public Affairs And Competitive Intelligence, Public Intelligence Denmark, Public Disorder Intelligence Division, Public Domain Intelligence Test, Intelligence Public Discussion, Public Health Intelligence Definition, Public Health Intelligence Data, Public Health Intelligence Job Description, Public Disorder Intelligence Unit, Public Health England Intelligence Networks, Public Speaking Emotional Intelligence, Public Health Intelligence North East, Public Sector And Emotional Intelligence, Public Threat Intelligence Feeds, Public Health Intelligence Function, Public Health Intelligence Learning From The Ebola Crisis, Public Service Commission’s General Intelligence Test, Global Public Intelligence, Institute Of Public Intelligence Gmbh, Public Health Intelligence, Public Health Intelligence Analyst, Public Health Intelligence Jobs, Public Health Intelligence Definition, Public Health Intelligence Scotland, Public Health Intelligence Officer, Public Health Intelligence Analyst Job Description, Public Health Intelligence Training, Public Health Intelligence Manager, Public Health Intelligence Specialist, Public Intelligence Inc, Public Intelligence Inspire, Public Interest Intelligence, Public Speaking Intelligence Is Not Enough, Public Interest Immunity Intelligence, Intelligence In Public Speaking, Info Public Intelligence, Intelligence In Public Literature, Intelligence In Public Sector, Public Relations In Intelligence, Public Health Intelligence Jobs, Public Health Intelligence Job Description, Public Security Intelligence Agency Japan, Public Health Intelligence Analyst Job Description, Public Health Intelligence Analyst Jobs, Public Intelligence Peter Julius, Public Health Intelligence Learning From The Ebola Crisis, Public Health Intelligence Local Authority, Public Sector Intelligence Ltd, Boston Public Library Intelligence Bobblehead, Intelligence Led Public Safety, Lowdown Public Intelligence, Public Health Intelligence Analyst Linkedin, Public Intelligence Mexican Mafia, Public Health Intelligence Manager, Public Health Intelligence Manager Walsall, Public Sector Market Intelligence, Public Intelligence Net, Public Health Intelligence North East, Public Health Intelligence Network, Public Health England Intelligence Networks, Global Public Health Intelligence Network, Canadian Public Health Intelligence Network, Public Speaking Intelligence Is Not Enough, Public Intelligence Odense, Public Intelligence.org, Public Order Intelligence Unit, Public Order Intelligence, Public Health Intelligence Officer, National Public Order Intelligence Unit (Npoiu), Public Speaking On Intelligence Is Not Enough, Public Perception Of Intelligence, Artificial Intelligence Public Opinion, Public Opinion On Intelligence, Public Intelligence Project, Public Intelligence Pdf, Public Intelligence Peter Julius, Public Policy Intelligence, Public Intelligence Blog Podcast, Artificial Intelligence Public Policy, Dental Public Health Intelligence Programme, Public Procurement Intelligence, Public Intelligence Prezi, Public Intelligence Report, National Public Radio Intelligence Squared, Business Intelligence Public Relations, Public Relations Intelligence, Public Security Intelligence Agency, Public Service Intelligence, Public Safety Intelligence, Public Safety Intelligence Analyst Ohio, Public Safety Intelligence Analyst, Public Speaking Intelligence Is Not Enough, Public Sector Intelligence, Public Source Intelligence, Public Sector Intelligence Ltd, Public Health Intelligence Scotland, Public Intelligence Technology Associates, Public Intelligence Technology Associates Kk, Public Intelligence Tool, Public Intelligence Twitter, Public Threat Intelligence Feeds, Public Health Intelligence Training, Public Health Intelligence Training Course, Public Health Intelligence Team, Public Domain Intelligence Test, Public Health Intelligence Tools And Techniques, Public Health Intelligence Uk, Public Order Intelligence Unit, Public Health Intelligence Unit, American Public University Intelligence Studies, National Public Order Intelligence Unit (Npoiu), Doncaster Public Health Intelligence Unit, Public Disorder Intelligence Unit, Public Intelligence Website, Public Intelligence Wiki, Public Health Intelligence Manager Walsall, Cyber Monday 2017, Cyber Bullying, Cyber Security, Cyber Security Jobs, Cyber High, Cyber Monday 3s, Cyber Security Salary, Cyberpower, Cyber Goth, Cyber Security Degree, Cyber Attack, Cyber Awareness, Cyber Acoustics, Cyber Academy, Cyber Attack Map, Cyber Attack 2017, Cyberark, Cyber Attack On Electrical Grid, Cyber Angel, Cyber Awareness Army, Cyber Bullying, Cyber Bullying Statistics, Cyber Bullying Facts, Cyberbully, Cyber Bullying Stories, Cyber Bullying Quotes, Cyber Bullying Articles, Cyber Bullying Laws Michigan, Cyber Bites, Cyber Bullying Essay, Cyber Chase, Cybercoders, Cyber Chip, Cyber Crime, Cyber Check, Cyber Cafe, Cyber City Oedo 808, Cyber Cafe Near Me, Cyber Command, Cyber Currency, Cyber Dust, Cyber Dragon Infinity, Cyber Dragon, Cyber Dragon Deck, Cyberduck, Cyber Definition, Cyber Dragon Nova, Cyber Dojo, Cyber Dragon Deck 2017, Cyber Defense Jobs, Cyber End Dragon, Cyber Education Center, Cyber Education, Cyber Espionage, Cyber Education Center Lansing Mi, Cyber Ethics, Cyber Extortion, Cyber Eltanin, Cyber Engineering, Cyber Etymology, Cyber Forensics, Cyber Five, Cyber Force, Cyber Forensics Jobs, Cyber Formula, Cyber Font, Cyber Frauds, Cyber Forensics Degree, Cyberfair, Cyber Footprint, Cyber Goth, Cyberghost, Cyber Goth Dance, Cyber Ghetto, Cybergrants, Cyber Gadget, Cyber Goth Girl, Cyber Gadget Retro Freak, Cyber Goth Clothing, Cyber Gears, Cyber Hymnal, Cyber Harassment, Cyber High, Cyber Hacking, Cyber Hug, Cyber Harpie Lady, Cyber Hygiene, Cyber Helmet, Cyber Harassment Laws, Cyber Harassment Michigan, Cyber Insurance, Cyber Inc, Cyber Intelligence, Cyber Insurance Policy, Cyber Investigation, Cyber Intelligence Analyst, Cyber Illinois, Cyber Intelligence Degree, Cyber Insurance Providers, Cyber Infrastructure, Cyber Jar, Cyber Jobs, Cyberjapan Dancers, Cyber Junkie, Cyber Jack, Cyber Jihad, Cyber Jesus, Cyberjudas, Cyber Jar Banned, Cyber Jason, Cyber Kill Chain, Cyberknife, Cyber Knight, Cyber Kotori, Cyber Key, Cyber Kill Chain Model, Cyber King, Cyber Kidnapping, Cyber Kong, Cyber Kitty, Cyber Liability Insurance, Cyber Law, Cyberlink, Cyber Liquids, Cyber Love Live, Cyber Laser Dragon, Cyberlock, Cyber Liability Insurance Cost, Cyber Lawyer, Cyberlink Powerdirector, Cyber Monday 2017, Cyber Monday 3s, Cyber Monday, Cyber Monday 1s, Cyber Monday 2016, Cyber Meaning, Cyber Michigan, Cyber Marvel, Cyberman, Cybermen, Cyber News, Cyber Nico, Cyber Ninja, Cyber Nations, Cyber Ninja Hanzo, Cyber Nuke, Cyber Network, Cyber Nozomi, Cyber Net, Cyber Nanny, Cyber Operations, Cyber Optics Detroit, Cyber Operations Officer, Cyber Optics, Cyber Ops, Cyber Operations Specialist, Cyber Outlet, Cyber Ogre, Cyber Operations Specialist Salary, Cyber Officer Air Force, Cyberpower, Cyberpunk, Cyber Police, Cyber Physical Systems, Cyberpatriot, Cyber Pegasus, Cyberpunk 2077, Cyber Playground, Cyberpower Ups, Cyber Pink, Cyber Quest, Cyberq, Cyber Quest Soaring Eagle, Cyber Quotes, Cyber Queen, Cyberquery, Cybex Q Cloud, Cyber Questions, Cyber Quest Fort Gordon, Cyberq Manual, Cyber Research, Cyber Risk, Cyber Resilience, Cyber Range, Cyber Risk Management, Cyber Rain, Cyber Recruiter, Cyber Risk Insurance, Cyber Repair Plant, Cyber Rider Turbo, Cyber Security, Cyber Security Jobs, Cyber Security Salary, Cyber Security Degree, Cyber Security Training, Cyber Security News, Cyber Stalking, Cyber Security Certifications, Cyber Security Companies, Cyber Safety, Cyber Terrorism, Cyber Tech, Cyber Threat, Cyber Transport Systems, Cyber Terrorism Definition, Cyber Terminators, Cyber Threat Intelligence, Cyber Technology, Cyber Theft, Cyber Threat Alliance, Cyber Umi, Cyber University, Cyber U, Cyber Ups, Cyber Bullying, Cyber Umi Cosplay, Cyber Underground, Cyber Unit, Cyber Usa, Cyber Underwriter Salary, Cyber Valley, Cyber Vandalism, Cyber Violence, Cyber Vpn, Cyber Vulnerability, Cyber Victimization, Cyber Village Academy, Cyber Virus, Cyber Vision, Cyber Vulnerability Assessment, Cyber Warfare, Cyberweld, Cyber Woman With Corn, Cyber World, Cyber Warfare Definition, Cyber World Institute, Cyber Warrior, Cyber Weapons, Cyber Wars, Cyber Wallpaper, Cyber X, Cyber Xmen, Cyber X Games, Cyber X Link, Cyber X Designs, Cyber X 3d, Cyborg X Trailer, Cyber X Internet Cafe, Cyber X Games 2017, Cyber Xl, Cyber Yugioh, Cyber Yellow, Cyber Yog, Cyber Yugioh Cards, Cyber Yankee, Cyber Yankee 2017, Cyber Yellow Vans, Cyber Youtube, Cyber Youcam, Cyber You, Cyber Zilla, Cyber Zone, Cyber Zarya, Cyber Zombie, Cyber Z, Cyber Zoom, Cyberzone Internet Cafe, Cyber Zone Hours, Cyber Zilla Toy, Cyber Zone Opelika, Us Energy Information Administration, Us Energy Consumption, Us Energy Sources, Us Energy Independence, Us Energy Policy, Us Energy Corp, Us Energy Revolution, Us Energy Development Corporation, Us Energy Crisis, Us Energy Department, Us Energy Administration, Us Energy Association, Us Energy Advisors, Us Energy And Employment Report, Us Energy Assets, Us Energy And Commerce Committee, Us Energy And Employment Report 2016, Us Energy And Environment, Us Energy Agencies, Us Energy Arlington Tx, Us Energy By Source, Us Energy Budget, Us Energy Bill, Us Energy Boom, Us Energy Buffalo Ny, Us Energy Brokers, Us Energy By Type, Us Energy Board, Us Energy Balance, Us Energy Consumption, Us Energy Corp, Us Energy Crisis, Us Energy Consumption 2016, Us Energy Consumption By Sector, Us Energy Company, Us Energy Consumption Per Capita, Us Energy Consumption Per Year, Us Energy Crisis 1970s, Us Energy Corporation, Us Energy Development Corporation, Us Energy Department, Us Energy Demand, Us Energy Distribution, Us Energy Dependence, Us Energy Development, Us Energy Drink Market, Us Energy Demand Projections, Us Energy Data, Us Energy Drilling, Us Energy Exports, Us Energy Etf, Us Energy Efficiency, Us Energy Employment, Us Energy Exploration, Us Energy Efficiency Statistics, Us Energy Efficiency Market Size, Us Energy Engineers, Us Energy Employment Report, Us Energy Expenditures, Us Energy From Coal, Us Energy Facts, Us Energy From Renewable Sources, Us Energy Flow, Us Energy Future, Us Energy Flow 2016, Us Energy From Solar, Us Energy From Wind, Us Energy Forms, Us Energy Flow 2015, Us Energy Grid, Us Energy Generation, Us Energy Group, Us Energy Generation By Source, Us Energy Generation 2016, Us Energy Graph, Us Energy Genesis, Us Energy Generation Capacity, Us Energy Guide, Us Energy Gov, Us Energy History, Us Energy Holdings Llc, Us Energy Holdings, Us Energy High Yield, Us Energy High Yield Bond, Us Energy High Yield Index, Us Energy Heat Controls, Us Energy History Timeline, Us Energy High Yield Etf, Us Energy Hedge Funds, Us Energy Information Administration, Us Energy Independence, Us Energy Imports, Us Energy Industry, Us Energy Infrastructure, Us Energy Intensity, Us Energy Independence 2016, Us Energy Index, Us Energy Independence 2017, Us Energy Imports By Country, Us Energy Jobs, Us Energy Junk Bonds, Us Energy Junk Debt Sell-off Spreads, Us Energy Job Creation, Us Energy Jayson, Us Energy Job Losses, Us Japan Energy Cooperation, Us Renewable Energy Jobs, Us Wind Energy Jobs, Us Energy Association Jobs, Us Energy K1, Us Kinetic Energy Weapons, Us Kwh Energy Consumption, Us Kazakhstan Energy Partnership, Us Energy Louisville Ky, Us Energy Russell Ks, Us Energy Management Keswick, What Is Kinetic Energy, Us Energy Partners Russell Ks, Us Energy Cost Per Kwh, Us Energy Lighting, Us Energy Llc, Us Energy Laws, Us Energy Loan Program, Us Energy Login, Us Energy Logistics, Us Energy Lighting Inc, Us Energy Label, Us Energy Legislation, Us Energy Lp, Us Energy Mix, Us Energy Map, Us Energy Market, Us Energy Mix 2016, Us Energy Management, Us Energy Market Size, Us Energy Management Inc, Us Energy Minneapolis, Us Energy Market Share, Us Energy Mix 2017, Us Energy News, Us Energy Needs, Us Energy News Daily Digest, Us Energy New York, Us Energy Ny, Us Energy Natural Gas, Us Energy News Today, Us Energy News Articles, Us Energy Net Exporter, Us Energy Needs Per Year, Us Energy Oil And Gas, Us Energy Outlook, Us Energy Output, Us Energy Outlook 2016, Us Energy Organization, Us Energy Off The Grid, Us Energy Oil, Us Energy Overview, Us Energy Overview And Key Statistics, Us Energy Of Department, Us Energy Production, Us Energy Policy, Us Energy Production 2016, Us Energy Production By Source 2016, Us Energy Pie Chart, Us Energy Policy 2017, Us Energy Policy Timeline, Us Energy Partners, Us Energy Profile, Us Energy Plan, Us Energy Quads, Us Quadrennial Energy Review, Us Quadrennial Energy Review 2015, Us Energy Consumption Quadrillion Btu, Us Energy Stock Quote, Us Department Of Energy Q Clearance, Us Doe Quadrennial Energy Review, Energy Quest Usa, Us Energy Revolution, Us Energy Recovery, Us Energy Resources, Us Energy Reserves, Us Energy Report, Us Energy Renewable Percentage, Us Energy Regulations, Us Energy Recovery Glassdoor, Us Energy Rural Valley Pa, Us Energy Resources Llc, Us Energy Sources, Us Energy Subsidies 2016, Us Energy Secretary, Us Energy Sciences, Us Energy Subsidies, Us Energy Services, Us Energy Statistics, Us Energy Sources Over Time, Us Energy Sector, Us Energy Sources 2016, Us Energy Tax Credit, Us Energy Trends, Us Energy Tour, Us Energy Types, Us Energy Trade Balance, Us Energy Transition, Us Energy Technologies, Us Energy Tour Greeley, Us Energy Trump, Us Energy Use, Us Energy Use Per Capita, Us Energy Use By Sector, Us Energy Usage Per Year, Us Energy Use By Type, Us Energy Use Compared To World, Us Energy Use 2016, Us Energy Use Chart, Us Energy Use Pie Chart, Us Energy Use Vs World, Us Energy Vidalia Ga, Us Energy Vortex Locations, Us Energy Vct, Us Energy Vortex Map, Us Venture Energy, Us Energy Consumption Vs World, Us Energy Rural Valley Pa, Us Energy Solutions Virginia Beach, Us Energy Production Vs Consumption, Us Energy Genesis Vi, Us Energy Waste, Us Energy Wiki, Us Energy Weapons, Us Energy Windows & Doors Inc, Us Energy Waste Statistics, Us Energy Windows And Doors, Us Energy Windows Las Vegas, Us Energy Website, Us Energy Windows, Bold Like Us Energy X Plus, Us Figure Skating Xcel Energy, Blu Bold Like Us Energy X, Us Energy Yatesboro Pa, Us Yearly Energy Consumption, Us Energy New York, Us Energy High Yield, Us Energy High Yield Bond, Us Energy High Yield Index, Us Energy High Yield Etf, Us Energy High Yield Spread, Us Energy High Yield Bond Index, Us Energy Imports By Year, Us Energy Zones, Us Energy Zone Map, Us Energy Climate Zones, Us Solar Energy Zones, Us Energy Star Zones, Us Department Of Energy’s Zip-code Insulation Program, Us Doe Zero Energy, Us Department Of Energy Zip Code, Infrastructure Definition, Infrastructure As A Service, Infrastructure Synonym, Infrastructure As Code, Infrastructure Stocks, Infrastructure Meaning, Infrastructure Etf, Infrastructure Week, Infrastructure Engineer, Infrastructure Examples, Infrastructure As A Service, Infrastructure As Code, Infrastructure Architect, Infrastructure And Private Equity, Infrastructure Alternatives, Infrastructure Automation, Infrastructure Architecture, Infrastructure Abbreviation, Infrastructure Architect Salary, Infrastructure As A Service Definition, Infrastructure Bill, Infrastructure Bank, Infrastructure Bill Trump, Infrastructure Bonds, Infrastructure Budget, Infrastructure Building, Infrastructure Budget 2017, Infrastructure Business Analyst, Infrastructure Business, Infrastructure Business Definition, Infrastructure Canvas, Infrastructure Companies, Infrastructure Corporation Of America, Infrastructure Construction, Infrastructure Consulting, Infrastructure Costs, Infrastructure Canada, Infrastructure Companies In Usa, Infrastructure Components, Infrastructure Clipart, Infrastructure Definition, Infrastructure Development, Infrastructure Def, Infrastructure Design, Infrastructure Definition Geography, Infrastructure Design Suite Premium, Infrastructure Diagram, Infrastructure Documentary, Infrastructure Definition Ap Human Geography, Infrastructure Debt, Infrastructure Etf, Infrastructure Engineer, Infrastructure Examples, Infrastructure Engineers Inc, Infrastructure Engineer Salary, Infrastructure Economics Definition, Infrastructure Etf Fidelity, Infrastructure Economics, Infrastructure Engineering Corporation, Infrastructure Expansion, Infrastructure Funds, Infrastructure Finance, Infrastructure Failure, Infrastructure For Dummies, Infrastructure Facts, Infrastructure Fee, Infrastructure Funds 2017, Infrastructure Facilities, Infrastructure Funding Trump, Infrastructure Firms, Infrastructure Grade, Infrastructure Grants, Infrastructure Geography Definition, Infrastructure Grants For Nonprofits, Infrastructure Growth, Infrastructure Group, Infrastructure Government, Infrastructure Grade By State, Infrastructure Gap, Infrastructure Graphic, Infrastructure Hoi4, Infrastructure Health And Safety Association, Infrastructure Hardware, Infrastructure Human Geography, Infrastructure Hacking, Infrastructure History, Infrastructure Hardening, Infrastructure Hub Eve, Infrastructure Hosting, Infrastructure Health Sensors, Infrastructure In A Sentence, Infrastructure In Healthcare, Infrastructure In Spanish, Infrastructure Investment, Infrastructure Icon, Infrastructure Improvements, Infrastructure It, Infrastructure In India, Infrastructure In Africa, Infrastructure In America, Infrastructure Jobs, Infrastructure Journal, Infrastructure John Oliver, Infrastructure Job Titles, Infrastructure Job Description, Infrastructure Japan, Infrastructure Jokes, Infrastructure Job Creation, Infrastructure Journal Awards, Infrastructure Jobs In Usa, Infrastructure Kid Definition, Infrastructure Kpi, Infrastructure Kanban, Infrastructure Key Performance Indicators, Infrastructure Kenya, Infrastructure Kannada Meaning, Infrastructure Knowledge, Infrastructure Kpmg, Infrastructure Korea, Infrastructure Kl, Infrastructure Lifecycle Management, Infrastructure Logo, Infrastructure Legislation, Infrastructure Lead, Infrastructure Layer, Infrastructure List, Infrastructure Law, Infrastructure Landscape, Infrastructure Lifecycle, Infrastructure Llc, Infrastructure Meaning, Infrastructure Management, Infrastructure Mode, Infrastructure Michigan, Infrastructure Mutual Funds, Infrastructure Masons, Infrastructure Monitoring, Infrastructure Master, Infrastructure Manager Salary, Infrastructure Management Services, Infrastructure News, Infrastructure Network, Infrastructure Needs, Infrastructure Networks Inc, Infrastructure Navigator, Infrastructure Needs For Multi-agency Preparedness, Infrastructure Nigeria, Infrastructure New York Times, Infrastructure New Zealand, Infrastructure New York, Infrastructure Ontario, Infrastructure Operations, Infrastructure Of India, Infrastructure Of China, Infrastructure Of America, Infrastructure Of A Building, Infrastructure Of The Internet, Infrastructure Of A City, Infrastructure Optimization, Infrastructure Outsourcing, Infrastructure Plan, Infrastructure Projects, Infrastructure Project Manager, Infrastructure Penny Stocks, Infrastructure Problems, Infrastructure Plural, Infrastructure Private Equity, Infrastructure Policy, Infrastructure Projects In Usa, Infrastructure Pictures, Infrastructure Quizlet, Infrastructure Quotes, Infrastructure Quality, Infrastructure Questions, Infrastructure Quality By Country, Infrastructure Qualification, Infrastructure Quebec, Infrastructure Qualification Gamp, Infrastructure Quality And The Subsidy Trap, Infrastructure Quality By State, Infrastructure Report Card, Infrastructure Resources, Infrastructure Reits, Infrastructure Requirements, Infrastructure Resilience, Infrastructure Reform, Infrastructure Repair, Infrastructure Risk, Infrastructure Report Card By State, Infrastructure Resources Llc, Infrastructure Synonym, Infrastructure Stocks, Infrastructure Spending, Infrastructure Services, Infrastructure Sentence, Infrastructure Security, Infrastructure Systems, Infrastructure Solutions, Infrastructure Software, Infrastructure Support, Infrastructure Trump, Infrastructure Technology, Infrastructure That Supports Total Quality Includes, Infrastructure Testing, Infrastructure Thesaurus, Infrastructure Trump Plan, Infrastructure Team, Infrastructure Technician, Infrastructure Topology, Infrastructure Types, Infrastructure Us, Infrastructure Upgrade, Infrastructure Uk, Infrastructure User Stories, Infrastructure Utility Services, Infrastructure Unlimited, Infrastructure University Kuala Lumpur, Infrastructure Used In A Sentence, Infrastructure Ukraine, Infrastructure Ufl, Infrastructure Vs Ad Hoc, Infrastructure Vs Platform, Infrastructure Vs Application, Infrastructure Virtualization, Infrastructure Vs Superstructure, Infrastructure Video, Infrastructure Valuation, Infrastructure Victoria, Infrastructure Vs Network, Infrastructure Vulnerability, Infrastructure Week, Infrastructure Week 2017, Infrastructure Wireless Network, Infrastructure Work, Infrastructure Water, Infrastructure Wiki, Infrastructure Wifi, Infrastructure Week Dc, Infrastructure Week 2018, Infrastructure Week Dc 2017, Infrastructure.xml Spring, Infrastructure X86, Infrastructure Xenapp, Infrastructure Xkcd, Xendesktop Infrastructure Diagram, Xuma Infrastructure Group, Xendesktop Infrastructure, Xenapp Infrastructure Diagram, Xenmobile Infrastructure, Xuma Infrastructure Group Contact Details, Infrastructure Youtube, Infrastructure Yield, Infrastructure Yearbook, Infrastructure Yemen, Infrastructure Yojana, Infrastructure Yahoo Answers, Infrastructure Yieldco, Infrastructure Yield Fund, Infrastructure Yukon, Infrastructure Yorkshire, Infrastructure Zimbabwe, Infrastructure Zambia, Infrastructure Zoning, Infrastructure Zhongwen, Infrastructure Zero, Infrastructure Zara, Infrastructure Zamboanga City, Infrastructure Zurich, Infrastructure Zanzibar, Infrastructure Zimbabwe 2014

PI – FBI Cyber Bulletin: Global Extremists Conducting Cyber Activity in Support of ISIL

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

Global Extremists Conducting Cyber Activity in Support of ISIL

Page Count: 3 pages
Date: February 18, 2016
Restriction: TLP: GREEN
Originating Organization: Federal Bureau of Investigation, Cyber Division
File Type: pdf
File Size: 455,830 bytes
File Hash (SHA-256): 9ED8F8AD7F92E01B31AD756BD939A1A20F9EFCE72105E7D4D908B5902E4FF0B0

Download File

Over the past 18-24 months, an unknown number of online extremists have conducted “hacktivist” cyber operations – primarily Web site defacements, denial-of-service attacks, and release of personally identifiable information (PII) in an effort to spread pro-Islamic State of Iraq and the Levant (ISIL) propaganda and to incite violence against the United States and the West. Recent open source reporting from the Daily Mail India, indicates ISIL is recruiting Indian hackers and offering upwards of $10,000 USD per job to hack government Web sites, steal data, and to build social media databases for recruiting purposes. Indian officials believe as many as 30,000 hackers in India may have been contacted. The FBI cannot confirm the validity of the media reports, and beyond this single article on Indian hackers and ISIL, does not have information indicating any such relationship exists to date. The FBI assesses this activity is most likely independent of ISIL’s leaders located in Syria and Iraq.

Threat The FBI has no information at this time that would identify any specific group or industry sector being targeted by pro-ISIL Web site defacements. We assess Web site vulnerabilities found using automated tools are the primary reason for target selection in past victims. Releases of PII, also known as doxing, by pro-ISIL hacktivists have primarily focused on U.S. and Western government personnel, especially military and law enforcement.

Since at least August 2015, a group of pro-ISIL hackers calling themselves “Elite Islamic State Hackers,” “Islamic Cyber Army,” and “Caliphate Cyber Army” have been associated with multiple Web site defacements and PII releases. In September 2015, group members began posting a series of messages via Twitter stating that they were conducting cyber attacks against the United States in commemoration of the September 11th terrorist attacks using the hash tag #AmericaUnderHacks for their Twitter postings. The postings included screenshots displaying access to several victim Web sites, as well as the posting of PII on President Barack Obama, the First Lady Michelle Obama, Congressional Staff members, government employees, and U.S. military members. Since the #AmericaUnderHacks hacking campaign in September 2015, group members have executed similar campaigns against the United Kingdom (#BritainUnderHacks), Saudi Arabia (#SaudiUnderHacks), Russia (#RussiaUnderHacks), and Israel (#IsraelUnderHacks).

Open source reporting in India has noted the existence of several “hacking groups” within India. Thus far, such reporting has identified group names like “Indian Cyber Army” or “Shakti Campaign” and referenced such groups as having worked on behalf of the Indian government against Pakistan. To date, we have yet to see any validated reporting as to the capabilities of such groups or been able to confirm their existence. It does stand to reason; however, criminal hacking activity, whether by individuals or from organized groups exists in India and could potentially target US companies both for financial gain and for general acclaim.

Technical Details

The FBI assesses most pro-ISIL hacktivist groups use relatively unsophisticated methods and tools to scan for and exploit well-known Web site vulnerabilities. Structured Query Language (SQL) injection, Cross Site Scripting (XSS), and social engineering tactics to obtain account credentials are assessed to be in the capability range of pro-ISIL cyber actors.

The recruited Indian hackers are reportedly communicating on Internet based services like Skype, Silent Circle, Telegram, and WhatsApp. Pro-ISIL hackers use social media platforms like Twitter to make public announcements and release PII. Larger PII releases have been uploaded to online text sharing sites such as Pastebin.com and Justpaste.it.

Defense Precautionary measures to mitigate computer intrusion threats include:

Enable automated patches for common vulnerabilities, and routinely update hardware and software applications, including anti-virus software.
Scrutinize links contained in e-mails, and do not open attachments included in unsolicited e-mails.
Only download software from sites you know and trust.
Disable macros. Be careful of pop-ups from attachments that require you to enable them.
Monitor employee logins that occur outside of normal business hours.
Avoid using the same login and password for multiple platforms, servers, or networks.
Use two-factor authentication for employee logins, especially remote logins.
Create a centralized Information Technology email account for employees to report suspicious emails.
Provide regular training to remind and inform employees about current social engineering threats.
Monitor unusual traffic, especially over non-standard ports; and close unused ports.
Monitor outgoing data, and be willing to block unknown IP addresses.
Utilize a Virtual Private Network (VPN) for remote login capability.

Name

Email

Website

Comment

Δ

Fbi Most Wanted, Fbi Jobs, Fbi Director, Fbi Salary, Fbi Agent, Fbi Background Check, Fbi Agent Salary, Fbi Headquarters, Fbi Special Agent, Fbi Internships, Fbi Agent, Fbi Agent Salary, Fbi Academy, Fbi Application, Fbi Analyst, Fbi Atlanta, Fbi Agent Jobs, Fbi Anon, Fbi Address, Fbi Arrests, Fbi Background Check, Fbi Badge, Fbi Bau, Fbi Building, Fbi Boston, Fbi Bap, Fbi Baltimore, Fbi Benefits, Fbi Budget, Fbi Building Dc, Fbi Careers, Fbi Crime Statistics, Fbi Clearance, Fbi Criminal Background Check, Fbi Chicago, Fbi Citizens Academy, Fbi Crime Statistics By Race, Fbi Contact, Fbi Channeler, Fbi Candidates, Fbi Director, Fbi Director Candidates, Fbi Director James Comey, Fbi Definition, Fbi Director Fired, Fbi Director Salary, Fbi Definition Of Terrorism, Fbi Database, Fbi Dallas, Fbi Drug Policy, Fbi Employment, Fbi Email Address, Fbi Employment Drug Policy, Fbi El Paso, Fbi Employees, Fbi Emblem, Fbi Established, Fbi Education Center, Fbi Education, Fbi Executive Branch, Fbi Fingerprinting, Fbi Files, Fbi Field Offices, Fbi Fingerprint Card, Fbi Fitness Test, Fbi Facebook, Fbi Fingerprint Check, Fbi Forensic Accountant, Fbi Foia, Fbi Founder, Fbi Glock, Fbi Games, Fbi Gov, Fbi Glassdoor, Fbi Guns, Fbi Gang List, Fbi Gun Statistics, Fbi Gif, Fbi Gift Shop, Fbi General Counsel, Fbi Headquarters, Fbi Hrt, Fbi History, Fbi Houston, Fbi Hiring, Fbi Hate Crime Statistics, Fbi Head, Fbi Hat, Fbi Honors Internship, Fbi Hotline, Fbi Internships, Fbi Investigation, Fbi Intelligence Analyst, Fbi Informant, Fbi Irt, Fbi Investigation Trump, Fbi Ic3, Fbi Infragard, Fbi Internet Fraud, Fbi Id, Fbi Jobs, Fbi Jacket, Fbi James Comey, Fbi Jurisdiction, Fbi Job Description, Fbi Jobs Apply, Fbi Jacksonville, Fbi Jade Helm, Fbi Jobs Chicago, Fbi Jackson Ms, Fbi Kansas City, Fbi Kids, Fbi Knoxville, Fbi Kidnapping, Fbi Komi, Fbi Kentucky, Fbi Killed Jfk, Fbi Kkk, Fbi Kodi, Fbi K9 Unit, Fbi Logo, Fbi Leeda, Fbi Los Angeles, Fbi Locations, Fbi Las Vegas, Fbi Leaks, Fbi Leader, Fbi Linguist, Fbi Louisville, Fbi Login, Fbi Most Wanted, Fbi Most Wanted List, Fbi Meaning, Fbi Meme, Fbi Movies, Fbi Museum, Fbi Motto, Fbi Miami, Fbi Mission Statement, Fbi Most Dangerous Cities, Fbi Number, Fbi News, Fbi National Academy, Fbi Nics, Fbi New York, Fbi New Orleans, Fbi Newark, Fbi New York Tv Show, Fbi Near Me, Fbi Nominee, Fbi Offices, Fbi Org Chart, Fbi Omaha, Fbi Operative, Fbi On Trump, Fbi Organizational Chart, Fbi Obama Meme, Fbi Obama, Fbi Oklahoma City, Fbi Office Near Me, Fbi Phone Number, Fbi Profiler, Fbi Pft, Fbi Police, Fbi Pay Scale, Fbi Phoenix, Fbi Pay, Fbi Philadelphia, Fbi Positions, Fbi Pittsburgh, Fbi Quantico, Fbi Qualifications, Fbi Q Target, Fbi Quotes, Fbi Quiz, Fbi Questions, Fbi Qr Code, Fbi Qas, Fbi Quantico Address, Fbi Quantico Tours, Fbi Requirements, Fbi Russia, Fbi Russia Investigation, Fbi Report, Fbi Ranks, Fbi Recruiting, Fbi Raid, Fbi Records, Fbi Rape Statistics, Fbi Russia Trump, Fbi Salary, Fbi Special Agent, Fbi Stands For, Fbi Swat, Fbi Special Agent Salary, Fbi Surveillance, Fbi Statistics, Fbi Sos, Fbi Surveillance Van, Fbi Seal, Fbi Training, Fbi Top Ten, Fbi Trump, Fbi Trump Russia, Fbi Tip Line, Fbi Tv Shows, Fbi Twitter, Fbi Tips, Fbi Teen Academy, Fbi Tours, Fbi Ucr, Fbi Ucr 2016, Fbi Units, Fbi Ucr 2015, Fbi Undercover, Fbi Unsolved Cases, Fbi Upin, Fbi Utah, Fbi Usa, Fbi Uniforms, Fbi Vs Cia, Fbi Vault, Fbi Virus, Fbi Vs Apple, Fbi Virtual Academy, Fbi Vehicles, Fbi Violent Crime Statistics, Fbi Virginia, Fbi Van, Fbi Van Wifi, Fbi Website, Fbi Warning, Fbi Wiki, Fbi Wanted List, Fbi Watch List, Fbi Windbreaker, Fbi Warning Screen, Fbi White Collar Crime, Fbi Warrant Search, Fbi Weapons, Fbi X Files, Fbi Xl2, Fbi Xl31, Fbi Xl4, Fbi Xl2 Programming, Fbi Xl-31 Troubleshooting, Fbi Xl 31 Installation Manual, Fbi X Files Real, Fbi Xl2t Installation Manual, Fbi Xl 1215, Fbi Yearly Salary, Fbi Youtube, Fbi Youth Academy, Fbi Youth Leadership Academy, Fbi Yellow Brick Road, Fbi Youth Programs, Fbi Yearly Budget, Fbi Youth Leadership Academy Portland, Fbi Youngstown Ohio, Fbi Yearly Income, Fbi Zodiac Killer, Fbi Zodiac, Fbi Zip Code, Fbi Zodiac Killer List, Fbi Zero Files, Fbi Zodiac List, Fbi Zodiac Signs Killer, Fbi Zhang Yingying, Fbi Zion, Fbi Zodiac Crimes, Extremist Definition, Extremist Groups, Extremist Meaning, Extremist Synonym, Extremist Demon Hunter, Extremist Ideology, Extremist Group Definition, Extremist Groups In The Us, Extremist Activity, Extremist Religion Definition, Extremist Activity, Extremist Atheist, Extremist Activity In Russia, Extremist Attacks, Extremist Animal Rights Groups, Extremist Attacks In America, Extremist Antonym, Extremist Actions, Extremist Adjective, Extremis Armor, Extremist Band, Extremist Beliefs, Extremist Beer, Extremist Bible Verses, Extremist Books, Extremist Ban In Russia, Extremist Behavior, Extremist Buddhist Cell, Extremist Baptist Church, Extremist Buddhist In Burma, Extremist Crime Database, Extremist Christian Church, Extremist Content, Extremist Catholic, Extremist Conservative, Extremist Countries, Extremist Content On Youtube, Extremist Comic, Extremist Cults, Extremist Catholic Groups, Extremist Definition, Extremist Demon Hunter, Extremist Definition Russia, Extremist Documentary, Extremist Definition In Spanish, Extremist Davey Havok, Extremist Definition Webster, Extremist Documentary Netflix, Extremist Dc, Extremist Deluxe Edition, Extremist Example, Extremist Environmental Groups, Extremism Example, Extremism Experts Left, Extremism Explained, Extremism Experts, Extremism Essay, Extremism Experts Are Starting To Worry About The Left, Extremism Experts Starting To Worry About The Left, Extremist Exclusion Orders, Extremist Feminist, Extremist For Love, Extremist Flags, Extremist Fundamentalist, Extremist Feminist Quotes, Extremis Film, Extremist Fallacy, Extremist Freedom Fighters Of India, Extremism Facts, Extremist Forums, Extremist Groups, Extremist Group Definition, Extremist Groups In The Us, Extremist Groups In Russia, Extremist Groups In Syria, Extremist Groups In Africa, Extremist Groups In History, Extremist Groups In The Middle East, Extremist Groups In Iraq, Extremist Group Meaning, Extremist Hindu, Extremist Hate Groups, Extremist Homicide, Extremist Hindi Meaning, Extremist Hindi, Extremist Hotline, Extremist Hitler, Extremis Hulk, Extremism In History, Extremist Hindu Girl, Extremist Ideology, Extremist In Spanish, Extremist In Tagalog, Extremist Islamist, Extremism Is No Vice, Extremist Ideas, Extremism In America, Extremist Isis, Extremist Islamic Countries, Extremism In A Sentence, Extremist Jihad, Extremist Jihadist, Extremist Jainism, Extremist Jw, Extremist Jw Russia, Extremist Jacobin Group, Extremist Jokes, Extremist Joe Satriani, Extremist Jw.org, Extremist Killings, Extremist Kills Mom, Extremist Kills Mom In Syria, Extremist Karen, Extremist Keywords, King’s College Extremist, Kkk Extremist Group, Known Extremist Groups, Kashmir Extremist Groups, Khalistan Extremist, Extremist Law In Russia, Extremist Liberal, Extremist Literature, Extremist Left Wing Groups, Extremist Left Wing, Extremist Leaders, Extremist Legal Definition, Extremist Literature Meaning, Extremism Law Russia, Extremist Liberal Groups, Extremist Meaning, Extremist Movie, Extremist Movements, Extremist Meme, Extremist Meaning In Russia, Extremist Mosques In Us, Extremist Muslim Meaning, Extremist Mormon, Extremist Meme Armies, Extremist Marvel, Extremist Netflix, Extremist Nationalism, Extremist News, Extremist Next Door, Extremist Narratives, Extremist Northamptonshire, Extremist Ne Demek, Extremist Nationalism In India, Extremist Names, Extremist Nature, Extremist Organizations, Extremist Organization Definition, Extremist Organizations In Russia, Extremist Or Terrorist, Extremist Opposite, Extremist Organisations, Extremist Of Indian National Congress, Extremist Opposite Word, Extremis Outdoor Furniture, Extremist Of Tamilnadu, Extremist Pronunciation, Extremist Parties, Extremist Propaganda, Extremist Political Groups, Extremist Parties In Germany, Extremistpullup, Extremist Publications In Russia, Extremist Preachers, Extremism Project, Extremist Pronounce, Extremist Quotes, Extremist Quizlet, Extremist Quotes From Bible, Extremist Quran Quotes, Extremist Quran, Extremist Quiz, Extremist Qasim, Extremist Quarter Horse, Quizlamic Extremists, Feminist Extremist Quotes, Extremist Religion Definition, Extremist Religion, Extremist Religious Groups, Extremism Russia, Extremist Republicans, Extremist Right Wing, Extremist Rhetoric, Extremist Religious Groups List, Extremist Religions In Russia, Extremist Rabbit, Extremist Synonym, Extremist Sentence, Extremist Symbols, Extremist Suffix Crossword, Extremist Sect, Extremist Suffix, Extremist Sites, Extremist School, Extremist Shia, Extremist Sikh Groups, Extremist Terrorist, Extremist Terrorism, Extremist Tattoos, Extremist Terrorist Groups, Extremist Tv Tropes, Extremist Thinking, Extremist Thesaurus, Extremist Tagalog, Extremist Training Camp England, Extremist Terrorism Definition, Extremist Used In A Sentence, Extremist Urban Dictionary, Extremist Uk, Extremist Uk Parties, Extremist Universities, Extremist Urdu Meaning, Extremist Use Of Social Media, Extremist Urban, Extremist Urges Spill Blood In Australia, Extremist Unity, Extremist Videos, Extremist Views, Extremist Videos On Youtube, Extremist Or Terrorist, Extremist Violence, Extremist Vegans, Extremist Vst, Extremist Villains Wiki, Extremis Virus, Extremist Vs Radical, Extremist Websites, Extremist Webster, Extremist Wiki, Extremist Was Right, Extremist Watch List, Extremist With Hook, Extremist Westboro Baptist Church, Extremist Watch List Uk, Extremist Wing Of Congress, Extremist Youtube, Extremist Youtube Videos, Extremist Youtube Ads, Extremist Youth Recruitment, Extremism Youth Usip, Yemen Extremist Groups, Photo Extremist Youtube, Satriani Extremist Youtube, Extremist Meaning Yahoo, Extremist Video You Tube, Extremist Zionist, Extremist Zealot, Zerohedge Extremist, Jihad Extremist, Demon Hunter Extremist Zip, New Zionist Extremist Group, Demon Hunter Extremist Zip Download, Extremist Manifesto Nick Zedd, Extremist Co Znaczy, Cyber Monday 2017, Cyber Bullying, Cyber Security, Cyber Security Jobs, Cyber High, Cyber Monday 3s, Cyber Security Salary, Cyberpower, Cyber Goth, Cyber Security Degree, Cyber Attack, Cyber Awareness, Cyber Acoustics, Cyber Academy, Cyber Attack Map, Cyber Attack 2017, Cyberark, Cyber Attack On Electrical Grid, Cyber Angel, Cyber Awareness Army, Cyber Bullying, Cyber Bullying Statistics, Cyber Bullying Facts, Cyberbully, Cyber Bullying Stories, Cyber Bullying Quotes, Cyber Bullying Articles, Cyber Bullying Laws Michigan, Cyber Bites, Cyber Bullying Essay, Cyber Chase, Cybercoders, Cyber Chip, Cyber Crime, Cyber Check, Cyber Cafe, Cyber City Oedo 808, Cyber Cafe Near Me, Cyber Command, Cyber Currency, Cyber Dust, Cyber Dragon Infinity, Cyber Dragon, Cyber Dragon Deck, Cyberduck, Cyber Definition, Cyber Dragon Nova, Cyber Dojo, Cyber Dragon Deck 2017, Cyber Defense Jobs, Cyber End Dragon, Cyber Education Center, Cyber Education, Cyber Espionage, Cyber Education Center Lansing Mi, Cyber Ethics, Cyber Extortion, Cyber Eltanin, Cyber Engineering, Cyber Etymology, Cyber Forensics, Cyber Five, Cyber Force, Cyber Forensics Jobs, Cyber Formula, Cyber Font, Cyber Frauds, Cyber Forensics Degree, Cyberfair, Cyber Footprint, Cyber Goth, Cyberghost, Cyber Goth Dance, Cyber Ghetto, Cybergrants, Cyber Gadget, Cyber Goth Girl, Cyber Gadget Retro Freak, Cyber Goth Clothing, Cyber Gears, Cyber Hymnal, Cyber Harassment, Cyber High, Cyber Hacking, Cyber Hug, Cyber Harpie Lady, Cyber Hygiene, Cyber Helmet, Cyber Harassment Laws, Cyber Harassment Michigan, Cyber Insurance, Cyber Inc, Cyber Intelligence, Cyber Insurance Policy, Cyber Investigation, Cyber Intelligence Analyst, Cyber Illinois, Cyber Intelligence Degree, Cyber Insurance Providers, Cyber Infrastructure, Cyber Jar, Cyber Jobs, Cyberjapan Dancers, Cyber Junkie, Cyber Jack, Cyber Jihad, Cyber Jesus, Cyberjudas, Cyber Jar Banned, Cyber Jason, Cyber Kill Chain, Cyberknife, Cyber Knight, Cyber Kotori, Cyber Key, Cyber Kill Chain Model, Cyber King, Cyber Kidnapping, Cyber Kong, Cyber Kitty, Cyber Liability Insurance, Cyber Law, Cyberlink, Cyber Liquids, Cyber Love Live, Cyber Laser Dragon, Cyberlock, Cyber Liability Insurance Cost, Cyber Lawyer, Cyberlink Powerdirector, Cyber Monday 2017, Cyber Monday 3s, Cyber Monday, Cyber Monday 1s, Cyber Monday 2016, Cyber Meaning, Cyber Michigan, Cyber Marvel, Cyberman, Cybermen, Cyber News, Cyber Nico, Cyber Ninja, Cyber Nations, Cyber Ninja Hanzo, Cyber Nuke, Cyber Network, Cyber Nozomi, Cyber Net, Cyber Nanny, Cyber Operations, Cyber Optics Detroit, Cyber Operations Officer, Cyber Optics, Cyber Ops, Cyber Operations Specialist, Cyber Outlet, Cyber Ogre, Cyber Operations Specialist Salary, Cyber Officer Air Force, Cyberpower, Cyberpunk, Cyber Police, Cyber Physical Systems, Cyberpatriot, Cyber Pegasus, Cyberpunk 2077, Cyber Playground, Cyberpower Ups, Cyber Pink, Cyber Quest, Cyberq, Cyber Quest Soaring Eagle, Cyber Quotes, Cyber Queen, Cyberquery, Cybex Q Cloud, Cyber Questions, Cyber Quest Fort Gordon, Cyberq Manual, Cyber Research, Cyber Risk, Cyber Resilience, Cyber Range, Cyber Risk Management, Cyber Rain, Cyber Recruiter, Cyber Risk Insurance, Cyber Repair Plant, Cyber Rider Turbo, Cyber Security, Cyber Security Jobs, Cyber Security Salary, Cyber Security Degree, Cyber Security Training, Cyber Security News, Cyber Stalking, Cyber Security Certifications, Cyber Security Companies, Cyber Safety, Cyber Terrorism, Cyber Tech, Cyber Threat, Cyber Transport Systems, Cyber Terrorism Definition, Cyber Terminators, Cyber Threat Intelligence, Cyber Technology, Cyber Theft, Cyber Threat Alliance, Cyber Umi, Cyber University, Cyber U, Cyber Ups, Cyber Bullying, Cyber Umi Cosplay, Cyber Underground, Cyber Unit, Cyber Usa, Cyber Underwriter Salary, Cyber Valley, Cyber Vandalism, Cyber Violence, Cyber Vpn, Cyber Vulnerability, Cyber Victimization, Cyber Village Academy, Cyber Virus, Cyber Vision, Cyber Vulnerability Assessment, Cyber Warfare, Cyberweld, Cyber Woman With Corn, Cyber World, Cyber Warfare Definition, Cyber World Institute, Cyber Warrior, Cyber Weapons, Cyber Wars, Cyber Wallpaper, Cyber X, Cyber Xmen, Cyber X Games, Cyber X Link, Cyber X Designs, Cyber X 3d, Cyborg X Trailer, Cyber X Internet Cafe, Cyber X Games 2017, Cyber Xl, Cyber Yugioh, Cyber Yellow, Cyber Yog, Cyber Yugioh Cards, Cyber Yankee, Cyber Yankee 2017, Cyber Yellow Vans, Cyber Youtube, Cyber Youcam, Cyber You, Cyber Zilla, Cyber Zone, Cyber Zarya, Cyber Zombie, Cyber Z, Cyber Zoom, Cyberzone Internet Cafe, Cyber Zone Hours, Cyber Zilla Toy, Cyber Zone Opelika, Isil Meaning, Isil Definition, Isil News, Isil Vs Isis, Isil Isis, Isis Map, Isil Akbulut, Isil Leader, Isil Stock, Isis Flag, Isil Akbulut, Isil Acronym, Isil Attacks, Isil Abbreviation, Isil Aktan, Isil Alev, Isil Afghanistan, \U0131\u015f\u0131l Alben, Isis Apush, Isil Aksoy, Isil Bagdadi, Isis Band, Isis Bombing, Isil Bs Isis, Isil Blackboard, Isil Berkun, Isis Build, Isis Beliefs, Isis Button, Isis Beauty, Isil Certification, Isil Chemical Weapons, Isis Coney Island, Isis Cartoon, Isil Conflict, Isis Capital, Isil Capabilities, Isis Control Map, Isis Caliphate, Isis Chan, Isil Definition, Isil Dillig, Isis Definition, Isil Daesh, Isil Define, Isil Dipietro, Isis Dearborn, Isis Damil, Isil Dilek, Isis Drones, Isil Erel, Isil Egypt, \U0131\u015f\u0131l E\u011frikavuk, Isis Egypt, Isis Explained, Isis Exchange, Isis Excussion, Isis Europe, Isis Edc, Isis Events, Isis Flag, Isil Fighters, Isil Funding, Isil Finances, Isil Full Form, Isis Facts, Isil Founder, Isis Fighters, Isis Fails, Isis Founder, Isis Goddess, Isil Group, Isis Goals, Isil Guney, Isis Gallardo, Isis Genocide, Isis Goat Meme, Isis Getting Shot, Isis Getting Bombed, Isis Goat, Isil Halac Md, Isis Harambe, Isis History, Lsil Hpv, Isis Hair, Isis Hit List, Isis Hunting Permit, Isis Heavy, Isil Hamdemir, Isis Hostages, Isil Isis, Isil In Yemen, Isil In Syria, Isil In Afghanistan, Isil In Iraq, Isil In Libya, Isil Ideology, Isil In Mosul, Isil Insurgency In Tunisia, Isil In Egypt, Isil Jordan, Isil Job, Isil Journal, Isil Jesus Maria, Isil Je, Isis Jokes, Isil Japan, Isil Japanese, Isis Jordan Pilot, Isis Japanese Hostage, Isis K, Isis King, Isil Karaca, Isis Kurds, Isis Kids, Isis Kidnapping, Isis Knot, Isis Keyshia, Isis Kneading, Isis King Net Worth, Isil Leader, Isil Libya, Isil Leader Killed, Isil Latest News, Isil Lima Peru, Isil Lima, Isil Lu, Isil Leader Dead, Isis Leader Killed, Isis Logo, Isil Meaning, Isis Memes, Isis Meaning, Isis Map, Isis Mosul, Isil Meaning In English, Isil Meaning Levant, Isis Music, Isis Members, Isis Magazine, Isil News, Isil Name, Isil Numbers, Isil Nal, Isil Not Isis, Isis Names, Isil Name Meaning, Isis Net Worth, Isis Navy, Isil News Now, Isil Origin, Isil Or Isis, Isle Of Man, Isil Or Isis What Is The Difference, Isil Oz, Isis Origin, Isis Osiris, Isis Oceanic, Isis Oil, Isis Oracle, Isil Peru, Isis Propaganda, Isis Papers, Lsil Pap, Isil Photos, Isil Pakistan, Isil Palmyra, Isis Persona 5, Isis Pharmaceuticals, Isis Pictures, Isis Quotes, Isis Queen, Isis Quizlet, Isis Quran, Isis Questions, Isis Quartz, Isis Qaraqosh, Isis Quick Facts, Isis Qatar, Isis Queen Of Heaven, Isil Recber, Isil Russia, Isis Religion, Isis Recruitment, Isis Recruitment Video, Isis Raqqa, Isis Rea Boykin, Isil Stands For, Isil Stock, Isil Stock Price, Isil Sinai Province, Isis Sunni, Isil Saudi Arabia, Isil Symbol, Isis Shia, Isil Size, Isis Social Media, Isis Territory, Isil Terrorism, Isil Target Russia, Isis Tv Show, Isis Twitter, Isil Territorial Claims, Isil Turkish Name, Isil Today, Isis Theme Song, Isil Tunisia, Isil Uzum, Isil Uk, Isis Uf, Isis Unveiled, Isis Update, Isis Using Drones, Isis Uniforms, Isis Uk, Isis Us, Isis Uiowa, Isil Vs Isis, Isil Videos, Isil Vs Isis Wiki, Isil Vs Isis Snopes, Isil Vs Isis Reddit, Isis Violence, Isil Vs Iran, Isil Vs Isis Israel, Isil Videos Of Executions, Isil Vs Isis Meaning, Isil Wiki, Isil War, Isis Website, Isil What Does It Stand For, Isil Waxman, Isis Wigs, Isis War, Isis Wings, Isis Waswas, Isis Women, Isil Xmas, Isil Xi Lu, Isil Xinjiang, Xidigaha Isil, Isil And Isis, Isil X\u30c7\u30fc, Isil Yemen, Isil Yucesoy, Isil Yildiz Yale, Isil Yucesoy Biography, Isil Yucesoy Funeral, Isil Yildiz, Isil Youtube, Isil Yavuz, Isis Yilmaz, Isil Zastava, Isil Zaprijetio Balkanu, Isil Znacenje, Entil’zha, Isil Zorlu, Isil Zionist, Isil Zakat, Isil Zapalio Zarobljenika

How the Cyber-STASI wants to overtake the Internet

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

Since the early days of TCP, port scanning has been used by computer saboteurs to locate vulnerable systems. In a new set of top secret documents seen by Heise, it is revealed that in 2009, the British spy agency GCHQ made port scans a “standard tool” to be applied against entire nations (Figure 1, see the picture gallery). Twenty-seven countries are listed as targets of the HACIENDA program in the presentation (Figure 2), which comes with a promotional offer: readers desiring to do reconnaissance against another country need simply send an e-mail (Figure 3).

Bild 1 von 26

Hacienda, Mugshot, Olympia, ORB – Slides and Graphics

Figure 1

The HACIENDA Programm

The documents do not spell out details for a review process or the need to justify such an action. It should also be noted that the ability to port-scan an entire country is hardly wild fantasy; in 2013, a port scanner called Zmap was implemented that can scan the entire IPv4 address space in less than one hour using a single PC. [3] The massive use of this technology can thus make any server anywhere, large or small, a target for criminal state computer saboteurs.

The list of targeted services includes ubiquitous public services such as HTTP and FTP, as well as common administrative protocols such as SSH (Secure SHell protocol – used for remote access to systems) and SNMP (Simple Network Management Protocol – used for network administration) (Figure 4). Given that in the meantime, port scanning tools like Zmap have been developed which allow anyone to do comprehensive scans, it is not the technology used that is shocking, but rather the gargantuan scale and pervasiveness of the operation. The next section gives background on how port-mapping tools work and what information is gained by using them, making it clear what becomes possible when a state actor uses them at scale.

Background: The TCP Three-Way Handshake

The most commonly-used protocol on the Internet is TCP | the Transmission Control Protocol. Every time an email is sent or a web page is browsed, TCP is the protocol that is used to move data reliably between clients and servers. Port-mapping tools take advantage of a structural problem in TCP in order to determine what services are running on a system. Since the early days of TCP, port scanning has been used by attackers to locate vulnerable systems. Whenever a TCP client wants to communicate with a TCP server, the two parties perform what is called a TCP three-way handshake. The flawed design of this handshake is the foundation for port mapping tools, as during the handshake, the server leaks information about the availability of a service without checking the client’s authorization.

Figure 5 illustrates the sequence of TCP packets which are sent to establish a connection. The establishment of the connection works as follows: the host which wants to initiate a connection first sends out a TCP SYN (“synchronize”) packet. If the destination host accepts the connection request, it sends a SYN/ACK (“synchronize/acknowledge”) packet. After receiving a positive reply, the initiating host sends out an ACK (“acknowledge”) packet, which finalizes the TCP three-way handshake. This TCP three-way handshake allows an adversary to easily determine if some TCP service is offered at a given port by a host on the Internet: if the TCP port is closed, the server reacts differently to the TCP SYN packet (Figure 6), sending a RST (“reset”) packet instead of the SYN/ACK it would send were the port open. Thus, an adversary can easily map Internet services by considering the differences in the server’s replies in the packet flows depicted in Figure 5 and Figure 6 respectively.

The Authors

Julian Kirsch is finishing his Master’s degree at the Technische Universität München, where he will soon join Prof. Eckert’s chair for computer security to pursue a doctorate degree. His research interests include reverse engineering and counter-espionage.
Christian Grothoff is funded by the Deutsche Forschungsgemeinschaft (DFG) under ENP GR 3688/1-1 until the end of August 2014. He is now moving from the Technische Universität at München to Inria Rennes, where he will start a research team in the area of secure decentralized networks. His research interests include compilers, programming languages, software engineering, networking and security.
Monika Ermert is a freelancer for heise online and has written on DNS, DNS security and more issues for a many years.
Jacob Appelbaum is an investigative journalist.
Laura Poitras is a documentary film maker and journalist living in Berlin.
Henrik Moltke is an investigative journalist.

The Enemy Online

In addition to simple port scans, GCHQ also downloads so-called banners and other readily available information (Figure 4). A banner is text sent by some applications when connecting to an associated port; this often indicates system and application information, including version and other information useful when looking for vulnerable services. Doing reconnaissance at the massive scale revealed in the documents demonstrates that the goal is to perform active collection and map vulnerable services ubiquitiously, not to go after specific targets.

By preparing for attacks against services offered via SSH and SNMP, the spy agency targets critical infrastructure such as systems used for network operations. As shown in the past with the penetration of Belgacom and Stellar, when an employee’s computer system or network credentials may be useful, those systems and people are targeted and attacked.
The database resulting from the scans is then shared with other spy agencies of the Five Eyes spying club (Figure 7), which includes the United States, Canada, United Kingdom, Australia and New Zealand. MAILORDER is described in the documents as a secure transport protocol used between the Five Eyes spy agencies to exchange collected data.

Every device a target

The process of scanning entire countries and looking for vulnerable network infrastructure to exploit is consistent with the meta-goal of “Mastering the Internet”, which is also the name of a GCHQ cable-tapping program: these spy agencies try to attack every possible system they can, presumably as it might provide access to further systems. Systems may be attacked simply because they might eventually create a path towards a valuable espionage target, even without actionable information indicating this will ever be the case.

Using this logic, every device is a target for colonization, as each successfully exploited target is theoretically useful as a means to infiltrating another possible target. Port scanning and downloading banners to identify which software is operating on the target system is merely the first step of the attack (Figure 8). Top secret documents from the NSA seen by Heise demonstrate that the involved spy agencies follow the common methodology of online organized crime (Figure 9): reconnaissance (Figure 10) is followed by infection (Figure 11), command and control (Figure 12), and exfiltration (Figure 13). The NSA presentation makes it clear that the agency embraces the mindset of criminals. In the slides, they discuss techniques and then show screenshots of their own tools to support this criminal process (Figure 14, 15 and 16).

Internet Colonization

The NSA is known to be interested in 0-day attacks, which are attacks exploiting largely unknown vulnerabilities for which no patch is available. Once an adversary armed with 0-day attacks has discovered that a vulnerable service is running on a system, defense becomes virtually impossible. Firewalls are unlikely to offer sufficient protection, whether because administrators need remote access or because spy agencies have already infiltrated the local network (siehe: Barton Gellman and Ashkan Soltani. Nsa infiltrates links to yahoo, google data centers worldwide, snowden documents say. The Washington Post, October 2013). Furthermore, adding additional equipment, such as firewalls administered via SNMP, into an internal network may also open up new vulnerabilities.

Figure 8 points to a particular role that HACIENDA plays in the spy club’s infrastructure, namely the expansion of their covert infrastructure. The top secret documents seen by Heise describe the LANDMARK program, a program by the Canadian spy agency CSEC which is used to expand covert infrastructure (Figure 17).

The covert infrastructure includes so-called Operational Relay Boxes (ORBs), which are used to hide the location of the attacker when the Five Eyes launch exploits against targets or steal data (Figure 18). Several times a year, the spy club tries to take control of as many machines as possible, as long as they are abroad. For example, in February 2010 twentyfour spies located over 3000 potential ORBs in a single work day (Figure 19). However, going over the port scan results provided by HACIENDA was considered too laborous (Figure 20), so they programmed their OLYMPIA system to automate the process (Figure 21). As a result, the spies brag that they can now locate vulnerable devices in a subnet in less than five minutes (Figure 22).

The Canadians are not the only ones using HACIENDA to locate machines to compromise and turn into ORBs. At GCHQ, the hunt for ORBs is organized as part of the MUGSHOT program (Figure 23). The GCHQ has also automated the process and claims significant improvements in accuracy due to the automation (Figure 24). Again the information obtained from HACIENDA plays a prominent role (Figure 25). A key point is that with MUGSHOT the GCHQ integrates results from active scans (HACIENDA) as well as passive monitoring (Figure 26), to “understand everything important about all machines on the Internet”.

Thus, system and network administrators now face the threat of industrial espionage, sabotage and human rights violations created by nation-state ad- versaries indiscriminately attacking network infrastructure and breaking into services. Such an adversary needs little reason for an attack beyond gaining access and is supported by a multi-billion dollar budget, immunity from prosecu- tion, and compelled collaboration by companies from Five Eyes countries. As a result, every system or network administrator needs to worry about protecting his system against this unprecedented threat level. In particular, citizens of countries outside of the Five Eyes have, as a result of these programs, greatly reduced security, privacy, integrity and resilience capabilities.

Spy agencies are using their powers to commandeer Internet systems for power projection. Their actions follow the standard template of cyber-criminal behav- ior, using reconnaissance through active and passive port scanning to identify potential victims. Given this serious threat, system administrators need to improve their defensive posture and, in particular, reduce the visibility of non- public services. Patching services does not help against 0-day attacks, and firewalls may not be applicable or suffcient. In the second part of our article, we will introduce another option for system administrators to make non-public system administration services less visible for reconnaissance operations. By standardizing such techniques, the Internet community may be able to dampen the ability of security services to master the Internet.

Knocking down the HACIENDA

In this article, we will describe a new port knocking variant that uses the nation-state adversary model, and thus offers some protections against the HACIENDA program, thereby possibly stopping the spy agencies at the reconnaissance stage.

While defending against undisclosed vulnerabilities in public services is rather difficult, minimizing one’s visible footprint and thus one’s attack surface for administrative services is much easier. Port knocking [9] is a well-known method for making TCP servers less visible on the Internet. The basic idea is to make a TCP server not respond (positively) to a TCP SYN request unless a particular “knock” packet has been received first. This can be helpful for security, as an attacker who cannot establish a TCP connection also cannot really attack the TCP server.

However, traditional port knocking techniques [10] generally do not consider a modern nation-state adversary. Specifically, port scans are not the only method an attacker may use to learn about the existence of a service; if the service is accessed via a network where the adversary is able to sniff the traffic, the adversary may observe the connection and thereby deduce the existence of a service. A nation-state attacker may even be able to observe all traffic from the TCP client and perform man-in-the-middle attacks on traffic originating from the client. In particular, with compromised routers in the infrastructure, it is possible to execute a man-in-the-middle attack to take over a TCP connection just after the initial TCP handshake has been completed. An advanced attacker in control of routers may also try to identify the use of insufficiently stealthy port knocks by detecting unusual patterns in network traffic. However, it may still be safe to assume this adversary does not flag a standard TCP handshake as suspicious, as this is way too common.

TCP Stealth

TCP Stealth is an IETF draft (Julian Kirsch, Christian Grothoff, Jacob Appelbaum, and Holger Kenn: Tcp stealth, August 2014. IETF draft) which describes an easily-deployed and stealthy port knocking variant. TCP Stealth embeds the authorization token in the TCP ISN, and enables applications to add payload protections. As a result, TCP Stealth is hard to detect on the network as the traffic is indistinguishable from an ordinary 3-way TCP handshake, and man-in-the-middle attacks as well as replay attacks are mitigated by the payload protections. TCP Stealth works with IPv4 and IPv6.

TCP Stealth is useful for any service with a user group that is so small that it is practical to share a passphrase with all members. Examples include administrative SSH or FTP access to servers, Tor Bridges, personal POP3/IMAP(S) servers and friend-to-friend Peer-to-Peer overlay networks. The easiest way to use TCP Stealth is with operating system support. TCP Stealth is available for Linux systems using the Knock patch (siehe: Julian Kirsch. Knock, August 2014).. For kernels that include this patch, TCP Stealth support can be added to applications via a simple setsockopt() call, or by pre-loading the libnockify shared library and setting the respective environment variables.

Installation

As the mainline Linux currently does not yet offer support for Knock, the kernel of the machine which should be using Knock needs to be patched. Patching the kernel is straightforward:

1. First, obtain the sources of the desired kernel version from https://www. kernel.org if you intend to use a vanilla running kernel. Note that many distributions make adaptations to the kernel and therefore provide custom kernel sources, so one might want to check for the customized kernel sources.

2. Once the kernel sources are available, download the appropriate Knock patch from https://gnunet.org/knock. Note that if you intend to run a kernel version which is not explicitly listed on the Knock website, the best option is to try out the patches of the closest version provided.

3. Change to the directory where the kernel sources reside (replace the <your-version>-part according to your selection of the kernel- and the patch-version) and apply the patches (you can f ind more information on how to apply and revert patches on the kernel source in the kernel.org archives):

$ cd linux-<your-version>/

~/linux $ patch -p1 < /path/to/knock/patch/tcp_stealth_<your-version>.diff

4. Get the configuration of the currently running kernel. There are two widely used methods which can be used interchangeably:

(a) Debianoids maintain a copy of the kernel configuration parameters in the /boot directory. You can copy the config to your current kernel sources using the following command:

~/linux $ cp /boot/config-$(uname -r) .config

(b) Many other distributions compile the kernel with the possibility to read the running kernel’s configuration from the /proc/ file system:

~/linux $ zcat /proc/config.gz > .config

(c) If none of the cases above applies for your distribution, you can try to use the default kernel configuration by entering

~/linux $ make defconfig

However, do not expect a convincing kernel to result from this in terms of performance and stability.

5. Choose the defaults for all configuration parameters which are not in your current configuration. A different kernel version might introduce new compile configuration options:

~/linux $ yes "" | make oldconfig

6. Enable Knock in your current configuration by selecting Networking Support > Networking Options > TCP/IP networking > TCP: Stealth TCP socket support in the inter-active menu:

~/linux $ make menuconfig

7. The kernel is now ready for compilation. Enter

~/linux $ make bzImage && make modules

to compile the kernel and all additional modules. Be prepared for the fact that this step can take a long time. If you have a machine with more than one processor core, you can adjust the number of build threads using the -j option to both make commands.

8. If compilation succeeds, install the new kernel and all modules. Afterwards, automatically create a new initramdisk for your newly compiled kernel. If you have sudo installed, enter

~/linux $ sudo make modules_install && sudo make install

otherwise enter the these commands into a root prompt leaving out both sudos.

9. Reboot the machine and instruct your boot manager to boot into the new kernel. You now have a Knock aware machine.

Enabling Knock Using LD PRELOAD

Knock can be used without having to modify the source code of the program. This can be useful in cases where the source code is not available or when inserting the needed libc calls is infeasible (for example due to restrictions imposed by the application logic).

In order to use Knock in existing applications, a dynamic library libknockify is provided. The basic usage of the libknockify shared object to enable Knock for program example program is as follows:

KNOCK_SECRET="shared secret"

KNOCK_INTLEN=42

LD_PRELOAD=./libknockify.so

./example_program

Afterwards, if the application example program communicates via TCP, libknockify will set the respective socket options to enable the use of Knock in the kernel. In the example, the shared secret is derived from the text “shared secret”, and the content integrity protection is limited to the first 42 bytes of payload in the TCP stream. If the KNOCK INTLEN variable is not set, content integrity protection is disabled.

Using TCP Stealth via setsockopt()

Application developers can integrate support for TCP Stealth directly into their code. This has the advantage that it is possible to control which TCP connections have TCP Stealth enabled, and it might further improve usability. To enable basic port knocking with a Knock-enabled kernel, the application only needs to perform a single setsockopt() call after creating the TCP socket:

char secret[64] = "This is my magic ID.";

setsockopt (sock, TCP_STEALTH, secret, sizeof (secret));

For content integrity protection, TCP clients need to additionally specify the first bytes of the payload that will be transmitted in a second setsockopt() call before invoking connect():

char payload[4] = "1234";

setsockopt(sock, IPPROTO_TCP, TCP_STEALTH_INTEGRITY, payload, sizeof(payload));

connect (sock, ...);

write (sock, payload, sizeof (payload));

Servers expecting content integrity protection merely need a second setsockopt() call to specify the number of bytes that are expected to be protected by TCP Stealth:

int payload_len = 4;

setsockopt(sock, IPPROTO_TCP, TCP_STEALTH_INTEGRITY_LEN,payload_len, sizeof(payload_len));

Limitations

Nowadays, most end-user devices access the Internet from behind a gateway router which performs network address translation (NAT). While TCP Stealth was designed to avoid the use of information that is commonly altered by NAT devices, some NAT devices modify TCP timestamps and ISNs and may thus interfere with the port knocking mechanism.

Table 1: Changes made to the ISN by middle-boxes dependent on the destination port as measured by Honda et al. (Michio Honda, Yoshifumi Nishida, Costin Raiciu, Adam Greenhalgh, Mark Handley, and Hideyuki Tokuda. Is it still possible to extend tcpß In Procee- dings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference, IMC ’11, pages 181{194, New York, NY, USA, 2011. ACM.)

Table 1 summarizes experiments by Honda et al. showing how common ISN modification by NAT devices is in practice. In terms of security, TCP Stealth is limited to the 32 bits of the TCP ISN field; hence, a persistent adversary may still succeed by luck or brute force. However, we believe that TCP Stealth will provide adequate protections against indiscriminate attackers performing untargeted attacks (such as HACIENDA). Moving administrative services to non-standard ports can further decrease the chance of accidental discovery by active port scanners.

While the use of integrity protection with TCP Stealth is technically optional, port knocking without integrity protections offers little security against an adversary that observes network traffic and hijacks connections after the initial TCP handshake. Thus, future network protocols should be designed to exchange key material at the beginning of the first TCP packet. Sadly, this is not the case for SSH, which instead exposes a banner with version information to an attacker well before the cryptographic handshake. Hence, design flaws in the SSH protocol currently require the use of an additional obfuscation patch [2] to effectively use TCP Stealth integrity protections with SSH.

Summary

Technical solutions such as TCP Stealth are one way for administrators to harden their systems by protecting internal TCP services against the attacks by criminals, be they private, commercially motivated or state parties. However, as Linus Neumann of the CCC recently stated in an OpEd for Heise, it may not be possible to win the race in the long run solely through technical means. Without the necessary political will to legally protect, promote and fund secure communication systems, this one-sided battle will continue | and users will lose. Neumann underlined that secure communication systems were possible, but that governments are much more concerned about loss of control than about hardened (and less controllable) networks. Much more political work lays ahead; however, operating system vendors and administrators can improve the situation today by deploying modern security solutions.

Figures and Graphs at

Permalink: http://heise.de/-2292681

Wie die Cyber-STASI das Internet übernehmen will

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

Das HACIENDA-Programm

Das GCHQ-Programm mit dem Namen HACIENDA bewirbt in einer Präsentation aus dem Jahr 2009 Vollscans für insgesamt 27 Länder, verbunden mit dem Angebot: Wer ein anderes Land aufklären will, braucht nur eine E-Mail zu schicken. (Folie 3). Regeln für die Begutachtung oder notwendige Begründungen für eine solche Aktion finden sich in den Dokumenten nicht. Die Möglichkeit, ganze Länder zu scannen, ist keine wilde Fantasie: Neue Tools wie Zmap erlauben seit 2013 das Ausleuchten des gesamten IPv4-Adressraums weltweit in weniger als einer Stunde. Ein derart gezielter, massiver Einsatz der Scans durch den Staat macht daher jeden einzelnen Server zu einem Ziel staatlicher Computersaboteure.

Auf der Liste der Dienste – und entsprechend Ports – die angegriffen wurden, finden sich allgemeine öffentliche Dienste wie das Webprotokoll (HTTP) oder Dateitransferprotokoll (FTP) ebenso wie Werkzeuge, die üblicherweise von Netzwerkadministratoren eingesetzt werden, etwa das Secure Shell Protokoll (SSH) oder das Simple Network Management Protokoll (SNMP). Da in der Zwischenzeit veröffentlichte Werkzeuge wie Zmap es fast jedermann erlauben, umfangreiche Scans durchzuführen, ist es nicht so sehr die eingesetzte Technik, die schockiert, sondern deren massive, praktisch lückenlose Ausnutzung gegen beliebige Systeme und potentiell alle Nutzer im Netz.

Die Funktionsweise von Portscannern sowie die Erkenntnisse, die durch deren Einsatz gewonnen werden können, führen vor Augen, was der großflächige Einsatz von Portscannern durch Staaten zur Folge hat.

Hintergrund: Der TCP Three-Way Handshake

Die Autoren:

Julian Kirsch schließt gerade seinen Master an der Technischen Universität München ab und wird dort künftig am Lehrstuhl für Computersicherheit von Professor Eckert promovieren. Seine Forschungsinteressen sind unter anderem Reverse Engineering und Spionageabwehr.
Christian Grothoff wird noch bis Ende August von der Deutsche Forschungsgemeinschaft (DFG) im Rahmen des Emmy-Noether Programms unter dem Kennzeichen ENP GR 3688/1-1 gefördert. Er zieht dann von der Technische Universität München nach Inria Rennes, wo er eine Forschungsgruppe im Bereich sicherer dezentralisierter Netzwerke aufbauen wird. Seine Forschungsinteressen beinhalten den Bau von Kompilern, Programmiersprachen, Software Engineering, Netzwerke und Sicherheit.
Monika Ermert ist freie Journalistin und berichtet für heise online seit vielen Jahren über DNS, DNS-Sicherheit und andere Themen.
Jacob Appelbaum arbeitet als investigativer Journalist.
Laura Poitras ist Dokumentarfilmemacherin und Journalistin und lebt in Berlin
Henrik Moltke arbeitet als investigativer Journalist.

TCP, das Transmission Control Protokoll, ist das am weitesten verbreitete Protokoll im Netz. Jedes Mal, wenn eine Mail verschickt oder eine Webseite aufgerufen wird, sorgt TCP für die verlässliche Übertragung der Datenpakete zwischen Clients und Servern. Portscanner machen sich ein strukturelles Problem von TCP zunutze, um zu bestimmen, welche Dienste auf einem System aktiv sind. Seit Urzeiten werden die Scans daher von Angreifern genutzt, um verwundbare Server zu finden. Einer Kommunikation von TCP-Client und -Server geht immer ein so genannter Three-way-handshake voraus. Ein Fehler im Design dieses “Händedrucks” der beiden Server erlaubt das Portscanning überhaupt. Denn der Server gibt dabei immer preis, ob ein bestimmter Dienst verfügbar ist, ohne vorab zu prüfen, ob der anfragende Client überhaupt autorisiert ist, auf den Dienst zuzugreifen.

Die Grafik 5 in der Bilderstrecke illustriert, wie eine TCP-Verbindung zustande kommt. Erst sendet der Host, der eine Verbindung herstellen will, ein TCP SYN Paket. Der Zielserver antwortet mit SYN/ACK, wenn er die Anfrage akzeptiert. Mit einem weiteren ACK-Segment komplettiert der anfragende Host den Three-Way-Handshake, der Verbindungsaufbau ist abgeschlossen. Genau dieser Handshake erlaubt es einem Angreifer festzustellen, ob TCP-Dienste über die jeweiligen Ports angeboten werden: ist der TCP Port geschlossen, reagiert der Server mit einem RST-Paket (“reset”) auf das erste SYN Paket (Grafik 6 in der Bilderstrecke). Für den Angreifer ist es ein Leichtes, die vorhandenen Internetdienste zu kartieren, indem er die unterschiedlichen Serverantworten im Strom der Pakete berücksichtigt. (Vergleiche Grafik 5 und Grafik 6)

Der Feind im Netz

Das GCHQ macht, wie aus ihrer Präsentation von HACIENDA ersichtlich wird, nicht nur einfache Portscans, es greift auch Banner und andere verfügbare Informationen ab (Folie 4). Ein Banner ist dabei eine Nachricht, die von einer Serverapplikation standardmäßig an jeden sich verbindenden Client gesendet wird. Dabei werden oftmals detaillierte Informationen über das System und die an den Port gebundene Applikation (wie zum Beispiel Versionsnummern) übertragen. Dieses Wissen erleichtert anschließend das gezielte Ausnutzen von Schwachstellen.

Das breit angelegte Ausspähen verschiedenster Dienste, samt der verfügbaren Dienstinformationen über das gesamte Netz hinweg, zeigt, dass das Ziel die aktive Kartierung und Sammlung verletzlicher Systeme weltweit ist und nicht etwa Aufklärung zu bestimmten Zielsystemen oder Personen. Mit der Vorbereitung von Attacken auf Dienste, auf die mittels SSH oder SNMP zugegriffen wird, greifen die Spione kritische Infrastrukturen an, wie zum Beispiel die für die Netzwerkbetrieb notwendigen Systeme.

Das Eindringen in das System des belgischen Netzbetreibers Belgacom und das des deutschen Satellitennetzwerkbetreibers Stellar hat in der Vergangenheit gezeigt, dass, wenn Systeme von Mitarbeitern oder deren Zugangsdaten auch nur indirekt nützlich sein könnten, diese Systeme und Menschen Opfer von Angriffen werden.

Die aus den Scans hervorgegangene Datenbank wird dann im Klub der Five- Eyes-Spione verteilt, zu dem das Vereinigte Königreich, die USA, Kanada, Australien und Neuseeland gehören. Das in der Folie erwähnte Programm MAILORDER ist ein internes Transportprotokoll, mit dem der Spionageclub Daten untereinander austauscht. Inwieweit die Five Eyes auch anderen “Partnern” Zugriff auf die HACIENDA-Daten gewährt haben, ist eine noch offene Frage.

Jedes Gerät ein Ziel

Das Scannen der Server ganzer Länder und die Suche nach verwundbaren Stellen in der Infrastruktur der Netze folgt letztlich konsequent dem Ziel der “Beherrschung des Internet”, einem von der GCHQ koordinierten Programm zum Abhören von Netzwerkverbindungen: Die Geheimdienste attackieren jedes nur mögliche System, vermutlich allein deshalb, weil es Zugang zu weiteren Systemen eröffnen kann. Denn möglicherweise öffnet sich ja dabei irgendwo der Pfad zu einem wertvollen Zielobjekt. Nach dieser Logik ist jedes Gerät ein interessantes Ziel für die Aufklärung – und für eine mögliche feindliche Übernahme. Denn jedes kompromittierte Gerät kann ja theoretisch ein Bindeglied in der Kette zum Zielobjekt sein.

Die Portscans und das Herunterladen von Bannern zur Identifizierung, welche Software auf dem ausgespähten System läuft, ist nur der erste Schritt des Angriffs (Folie 8). Eine streng geheime Präsentation der National Security Agency (NSA), die heise online vorliegt, illustriert das Gesamtkonzept (Folie 10). Die Spione folgen dabei den genau so auch vom organisierten Online-Verbrechen angewandten Methoden: der Ausspähung (Folie 10) folgt die Kompromittierung (Folie 11) und Übernahme des Systems (Folie 12) und der Diebstahl von Daten (Folie 13). In der NSA-Darstellung wird klar, dass staatliche Computersaboteure sich dieses kriminelle Vorgehen zu eigen machen: Erst diskutieren sie das Ausspionieren und Einbrechen in die Systeme als “hacking” und dann führen sie ihre eigenen Werkzeuge dafür vor. (Folie 14, 15 und 16).

Die Kolonialisierung des Internet

Es ist mittlerweile bekannt, dass die NSA sich sehr für sogenannte 0-Day-Angriffe interessiert, Schwachstellen in Software, die noch unbekannt sind und für die es daher noch keinen Patch gibt. Sobald ein mit dem Wissen über eine solche 0-Day-Attacke ausgerüsteter Angreifer einen verwundbaren Dienst auf einem Server findet, ist dieser eine leichte Beute. Firewalls bieten kaum ausreichenden Schutz, sei es, weil der Administrator selbst per Fernzugriff wartet, oder weil die staatlichen Schnüffler längst innerhalb des Netzwerkes agieren (siehe: Barton Gellman and Ashkan Soltani. Nsa infiltrates links to yahoo, google data centers worldwide, documents say. The Washington Post, October 2013). Neue Hardware, wie zum Beispiel über SNMP konfigurierte Firewalls, ins eigene Netz zu integrieren, könnte darüber hinaus auch neue Lücken aufreißen.

Folie 8 weist auf eine besondere Rolle hin, die HACIENDA in der Überwachungsinfrastruktur spielt. Die heise online vorliegenden, streng geheimen Dokumente beschreiben das LANDMARK-Programm, welches vom kanadischen Geheimdienst CSEC zur Expansion verdeckter Infrastruktur (Folie 17) betrieben wird. Die verdeckte Infrastruktur besteht aus sogenannten Operational Relay Boxes (ORBs), die verwendet werden, um den tatsächlichen Aufenthaltsort eines Angreifers zu verschleiern, wenn die Five Eyes Exploits gegen Ziele einsetzen oder Daten stehlen (Folie 18).

Mehrmals im Jahr versucht der Spionageclub, Kontrolle über so viele Maschinen wie möglich zu erlangen. Hauptsächliches Entscheidungskriterium ist dabei nur, dass sich das Ziel im Ausland befindet. So waren beispielsweise im Februar 2010 vierundzwanzig Spione an nur einem einzigen Arbeitstag in der Lage, über 3000 potenzielle ORBs zu lokalisieren. Dennoch war die Arbeit, die von HACIENDA gelieferten Ergebnisse manuell auszuwerten, zu mühsam, weshalb das OLYMPIA-System programmiert wurde, das den Prozess automatisiert (Folie 21). Die Spione prahlen damit, dass mithilfe von OLYMPIA verwundbare Geräte innerhalb eines zu spezifizierenden Subnetzes in weniger als fünf Minuten gefunden werden können (Folie 22).

Allerdings sind die Kanadier nicht die Einzigen, die mithilfe von HACIENDA Maschinen suchen, die kompromittiert und in ORBs verwandelt werden können. Beim GCHQ ist die Jagd nach ORBs als Teil des MUGSHOT-Programms organisiert (Folie 23). Dort hat man den Prozess ebenfalls automatisiert und eine signifikante Verbesserung der Genauigkeit erreicht, wie auf den Folien behauptet wird (Folie 24). Abermals spielen dafür die Informationen, welche HACIENDA liefert, eine große Rolle. Ein zentraler Punkt ist, dass das GCHQ mithilfe von MUGSHOT Ergebnisse aktiver Scans (HACIENDA) und passiver Überwachung kombiniert (Folie 26).

Kontrollverlust

Der Angreifer Staat bereitet durch die willkürlichen Attacken der Industriespionage, der Sabotage und auch Menschenrechtsverletzungen den Boden. Ihm reicht die Aussicht auf den Zugriff als Grund für sein Tun. Ein milliardenschweres Budget, Straffreiheit für Agenten und die Rekrutierung von Netzbetreibern, die zur Mitarbeit gezwungen werden, befördern die Entwicklung. Netzwerk- und Systemadministratoren fällt es zu, sich gegen einen nie da gewesenen Grad der Bedrohung abzusichern. Bürger außerhalb der Five-Eye-Länder müssen mit erheblich verringerten Standard an Sicherheit, Vertraulichkeit, Integrität und Robustheit in den Netzen leben.

Geheimdienste nutzen ihre Fähigkeiten Systeme im Internet zu übernehmen um ihre Macht auszudehnen. Ihre Aktivitäten folgen den typischen Mustern von Cyber-Kriminellen, die Portscans nutzen, um potenzielle Opfer zu identifizieren. Für Systemadministratoren heißt es angesichts des Bedrohungsszenarios, dass sie ihre Abwehr stärken und vor allem die Sichtbarkeit nicht-öffentlicher Server verringern müssen. Dienste mit Patches nachzurüsten, schützt nicht gegen die 0-Day-Exploits, und Firewalls sind kein ausreichender Schutz. Wir stellen daher eine Option für Systemadministratoren vor, die nicht-öffentliche Dienste gegen potentielle Ausspähung schützen kann.

Knock: Eine Abrissbirne für HACIENDA

Ein neuer Vorschlag zur Verschleierung von Ports ging an diesem Freitag an die Internet Engineering Task Force (IETF). Mit TCP Stealth (Julian Kirsch, Christian Grothoff, Jacob Appelbaum, and Holger Kenn: Tcp stealth, August 2014. IETF draft) könnten Netzwerkadministratoren dafür sorgen, dass ihre Server gegenüber willkürlichen Portscans abgeschirmt werden. TCP Stealth ist nicht zuletzt als Antwort auf Programme wie HACIENDA entstanden und wird auf dem jährlichen Treffen der GNU Entwickler an der TU München vorgestellt.

Die Abwehr gegen gezielte Angriffe auf ungekannte Schwachstellen – die 0-Day-Exploits – in öffentlichen Diensten ist hart. Einfacher ist es, den sichtbaren “Fußabdruck” und damit die Angriffsfläche von administrativen Diensten zu verkleinern.

Port Knocking ist eine erprobte Methode, um Server im Netz weniger sichtbar zu machen (siehe: Julian Kirsch. Knock, August 2014). Die Grundidee ist schlicht, dass ein TCP-Server nur dann auf eine SYN-Anfrage antwortet, wenn der abfragende Server zuvor ein “knock”-Paket vorausgeschickt hat. Anklopfen mit einem geheimen Klopfzeichen sorgt so für mehr Sicherheit, weil ein Angreifer, der ohne das Klopfzeichen anfragt, keine TCP-Verbindung aufbauen kann, den Dienst dahinter auch nicht attackieren kann.

Traditionelles Port Knocking (siehe: M. Krzywinski. Port knocking: Network authentication across closed ports. SysAdmin Magazine, 12:12{17, 2003) hat den staatlichen Angreifer jedoch nicht mit einkalkuliert. Wird der Service von einen Netz aus angefragt, in dem der Angreifer bereits den Datenverkehr mitliest, kann er die Verbindung belauschen und so auf die Existenz des Dienstes schließen. Ein staatlicher Angreifer kann sogar allen Verkehr des TCP-Clients beobachten und dann eine Man-in-the Mddle-Attacke zum Ausspähen des Client starten. Ein Man-in-the-Middle-Angriff über kompromittierte Router ermöglicht es Angreifern, eine TCP-Verbindung direkt nach dem Handshake zu übernehmen. Ein fortgeschrittener Hacker, der die Router kontrolliert, kann auch schwach verschleierte Port Knocks identifizieren, in dem er ungewöhnliche Routinen im Datenverkehr analysiert. Immerhin kann man wohl möglicherweise noch davon ausgehen, dass ein Angreifer den “normalen” TCP-Verkehr nicht nicht als verdächtig markiert. Denn damit würde er wohl zu viele Treffer generieren.

TCP Stealth

TCP Stealth ist ein bei der IETF eingereichter Request for Comment für eine einfach zu implementierende, stille Port-Knocking-Variante. TCP Stealth verbirgt ein Token zur Autorisierung in der ISN-Sequenz, die zu Beginn des Drei-Wege-Handshakes beim TCP-Verbindungsaufbau gesandt wird, und ermöglicht Schutz durch einen Check der Prüfsumme (payload protection). TCP Stealth ist schwer zu entdecken, weil es im klassischen Drei-Wege-Handshake verborgen ist. Der Datenverkehr beim Verbindungsaufbau ist unverändert. Man-in-the-Middle-Attacken und Wiedereinspielungsangriffe (replay attacks) werden durch den Prüfsummencheck erschwert.

TCP Stealth arbeitet mit IPv4 und IPv6 und ist für jeden Dienst nützlich, dessen Nutzergruppe so klein ist, dass eine Passphrase unter den Nutzern ausgetauscht werden kann. Beispiele sind SSH- oder FTP-Zugriffe auf Server, Tor-Bridges, persönliche POP3- oder IMAP-Server sowie Peer-to-Peer-Overlay- oder Friend-to-Friend-Netze. TCP Stealth ist für den Linux-Kernel in Form des Knock-Patches verfügbar. Ist ein Kernel gepatcht, so kann die Unterstützung für TCP Stealth in bestehenden Applikationen durch einen einfachen Aufruf der setsockopt()-Funktion aktiviert werden. Alternativ können bestehende Programme TCP Stealth nutzen, indem sie mithilfe von LD PRELOAD die dynamische Bibliothek libknockify einbinden.

Die Installation von TCP Stealth

Da der Hauptentwicklungszweig des Linux-Kernels derzeit Knock nicht unterstützt, muss auf dem Rechner, auf dem Knock laufen soll, der Kernel gepatcht werden. Die Distribution Parabola Linux bringt Knock-Unterstützung schon mit, hier kann Knock einfach mit einem Paketmanager installiert werden.

Für alle anderen Distributionen funktioniert der Patch folgendermaßen:

1. Für einen Standard-Kernel die Quellen des gewünschten Kernels von http://www.kernel.org herunterladen. Dabei beachten, dass viele Distributionen den Kernel anpassen und eigene Quellen anbieten. Deshalb ggf. diese angepassten Kernel nehmen.

2. Wenn die Quellen vorliegen, den entsprechenden Knock-Patch von gnunet.org/knock herunterladen. Wenn die Kernelversion nicht ausdrücklich auf der Knock-Website aufgeführt ist, empfiehlt sich ein Versuch mit der am nächsten verwandten Version.

3. In das Verzeichnis der Kernel-Quellen wechseln (“<your-version>” mit der entsprechenden Version des Kernels und des Patches ersetzen) und den Patch ausführen (mehr Informationen über das Einspielen und Zurücknehmen von Patches im Kernel gibt es im Archiv auf kernel.org)

$ cd linux-<your-version>/

~/linux $ patch -p1 < /path/to/knock/patch/tcp_stealth_<your-version>.diff

4. Die Konfiguration des aktuellen Kernels kopieren. Dafür gibt es zwei gängige Methoden:

(a) bei Debian und verwandten Distributionen eine Kopie der Kernelkonfigurationsparameter im Verzeichnis /boot. Die Konfigurationsdatei kann einfach in die Kernel-Quellen kopiert werden:

~/linux $ cp /boot/config-$(uname -r) .config

(b) Bei vielen anderen Distributionen gibt es die Möglichkeit, die Konfiguration des laufenden Kernels über das /proc-Dateisystem auszulesen:

~/linux $ zcat /proc/config.gz > .config

~/linux $ make defconfig

Allerdings sollte man von dieser Methode keinen besonders stabilen und performanten Kernel erwarten.

5. Alle Parameter, die nicht in der aktuellen Konfiguration gesetzt wurden, auf den Standardwert setzen. Eine andere Kernel-Version könnte neue Konfigurationsoptionen zur Kompilierung erfordern.

~/linux $ yes "" | make oldconfig

6. Knock über die Menüauswahl “Networking Support > Networking Options > TCP/IP networking > TCP: Stealth TCP socket support” für die aktuelle Konfiguration aktivieren.

~/linux $ make menuconfig

7. Der Kernel ist jetzt bereit für die Kompilierung. Mit

~/linux $ make bzImage && make modules

den Kernel und alle zusätzlichen Module kompilieren. Dieser Schritt kann ziemlich viel Zeit in Anspruch nehmen. Auf Maschinen mit mehr als einem Prozessorkern kann mit der Option -j bei beiden make-Befehlen die Zahl der Build-Threads angepasst werden.

8. Nach erfolgreicher Kompilierung den Kernel und alle Module installieren. Danach automatisch eine neue initramdisk für den neuen Kernel erstellen lassen:

~/linux $ sudo make modules_install && sudo make install

Wenn sudo nicht installiert ist, beide make-Befehle mit Root-Rechten ausführen.

9. Computer neu starten und den Boot-Manager anweisen, mit dem neuen Kernel zu booten. Die Maschine hat jetzt Knock.

Einschalten von Knock mit LD PRELOAD

Knock kann ohne Ändern des Source Codes des jeweiligen Programms genutzt werden. Das kann sich als nützlich erweisen, wenn der Source Code nicht verfügbar ist oder wenn der Einbau der notwendigen Bibliothek (libc) nicht möglich ist, beispielsweise wegen Beschränkungen in der Logik der Anwendung.

Um Knock in bestehenden Anwendungen zu nutzen, steht eine dynamische Bibliothek libknockify zur Verfügung. Grundsätzlich sieht die Nutzung des mit libknockify gemeinsam genutzten Objekts zum Einsatz von Knock für ein Programm example program folgendermaßen aus:

KNOCK_SECRET="shared secret"

KNOCK_INTLEN=42

LD_PRELOAD=./libknockify.so

./example_program

Wenn die Anwendung “example program” anschließend über TCP kommuniziert, wird libknockify die jeweiligen Socket Options setzen, um den Gebrauch von Knock im Kernel zu aktivieren. Im Beispiel wird die gemeinsame Passphrase aus dem Text “shared secret” gezogen. Die Integrität des Content ist auf die ersten 42 Bytes der Prüfsumme im TCP Datenstrom beschränkt. Wird die Variable KNOCK INTLEN nicht gesetzt, ist die Integritätsprüfung deaktiviert.

Benutzung von TCP Stealth mit setsockopt()

Die Entwickler von Anwendungen können Unterstützung von TCP Stealth direkt in ihren Code integrieren. Das ermöglicht eine Kontrolle, welche TCP-Verbindungen TCP Stealth mitbringen. Es kann die Usability weiter verbessern. Um Port Knocking mit einem Knock-fähigen Kernel grundsätzlich zu aktivieren, muss die Anwendung lediglich einen einzigen setsockopt() Aufruf machen, nachdem das TCP socket generiert wurde:

char secret[64] = "This is my magic ID.";

setsockopt (sock, TCP_STEALTH, secret, sizeof (secret));

Für Content-Integritätssicherung müssen die TCP-Clients zusätzlich die ersten Bytes der Prüfsumme spezifizieren, die in einem zweiten setsockopt()-Aufruf übertragen wird, bevor die Verbindung mit connect() aufgebaut wird:

char payload[4] = "1234";

setsockopt(sock, IPPROTO_TCP, TCP_STEALTH_INTEGRITY, payload, sizeof(payload));

connect (sock, ...);

write (sock, payload, sizeof (payload));

Server, die eine Datenintegritätsprüfung mithilfe von TCP Stealth verwenden wollen, rufen setsockopt() ein zweites Mal auf und geben dabei die Anzahl der Bytes an, die vor Veränderung durch Dritte geschützt werden sollen.

int payload_len = 4;

setsockopt(sock, IPPROTO_TCP, TCP_STEALTH_INTEGRITY_LEN,payload_len, sizeof(payload_len));

Die Grenzen der Technik

Die meisten Endgeräte sitzen mittlerweile hinter Gateway-Routern, die Network Address Translation (NAT) machen. TCP Stealth ist zwar so gestaltet, dass von NAT-Boxen veränderte Informationen nicht genutzt werden. Einige NAT-Boxen ändern aber auch TCP-Timestamps und ISN; sie behindern damit den Port-Knocking-Mechanismus. Tabelle 1 illustriert die Ergebnisse von Experimenten, die zeigen wie verbreitet allgemeine Veränderungen von ISN durch NAT-Boxen in der Praxis sind.

Tabelle 1: Änderungen von ISN, abhängig vom Ziel-Port (Michio Honda, Yoshifumi Nishida, Costin Raiciu, Adam Greenhalgh, Mark Handley, and Hideyuki Tokuda. Is it still possible to extend tcpß In Procee- dings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference, IMC ’11, pages 181{194, New York, NY, USA, 2011. ACM.)

TCP Stealth ist auf die 32 Bit im TCP-ISN-Header-Field beschränkt; ein aggressiver Angreifer kann diese Einschränkung ausnutzen und durch Zufall oder eine Brute-Force-Attacke doch zum Ziel kommen. TCP Stealth wird aber eine angemessene Absicherung gegen Angreifer bieten, die ungezielt scannen (wie z.B. HACIENDA). Netzmanagementdienste auf Nicht-Standard Ports zu migrieren, kann die Gefahr von Zufallserfolgen aktiver Portscanner weiter reduzieren.

Während der Gebrauch von Integritätsschutz mit TCP Stealth eine technische Option ist, bietet Port Knocking ohne einen solchen Schutz wenig Sicherheit gegenüber einem Angreifer, der den Datenverkehr im Netz beobachtet und Verbindungen umleitet, nachdem der TCP-Handshake passiert ist. Künftige Entwicklungen von Transportprotokollen sollten daher einen einen Schlüsselaustausch schon beim Start des Verbindungsaufbaus vorsehen. Leider passiert das auch bei SSH nicht, das sich dem Angreifer stattdessen noch vor dem kryptographischen Handshake mit einem Banner mit Versionsinformationen präsentiert. Dieser Fehler im Design von SSH macht zusätzliche Maßnahmen zur Verschleierung derzeit notwendig, wenn man den Integritätsschutz durch TCP Stealth wirkungsvoll ausnutzen möchte.

Politische Lösungen sind gefragt

Technische Lösungen wie TCP Stealth, die versuchen, mit den hochgerüsteten staatlichen Computersaboteuren Schritt zu halten, bieten einen Weg für Netzbetreiber, ihre Systeme zu härten, indem sie nicht-öffentliche TCP-Dienste gegen den Zugriff durch Angreifer schützen, seien diese nun kommerziell motiviert oder segelten unter dem offenbar alles entschuldigenden Banner der nationalen Sicherheit.

Das Rennen nur durch technische Maßnahmen zu gewinnen, ist langfristig wohl unmöglich, wie auch Linus Neumann vom CCC gerade in einem Kommentar für heise online geschrieben hat. Ohne den notwendigen politischen Willen, die Bürger rechtlich gegen die uferlosen Übergriffe zu schützen und auch in entsprechende Forschung für echte Nutzersicherheit zu investieren, wird der ungleiche Rüstungswettlauf weitergehen – und die Endnutzer, die Bürger werden die Verlierer sein.

Neumann hat nochmal darauf hingewiesen: Eigentlich sind sichere Systeme möglich, doch alle Regierungen fürchten den Kontrollverlust in einem hart gesicherten und weniger kontrollierbaren Kommunkationsnetz. Hier gibt es politisch noch viel Überzeugungsarbeit zu leisten. Vorerst müssen die Entwickler von Betriebssystemen und die Netzadministratoren das Beste aus der Situation machen, indem sie die modernsten und vor allem besten Sicherheitslösungen einsetzen, die sie bekommen können.

Die Folien sind hier:

http://www.heise.de/ct/artikel/NSA-GCHQ-Das-HACIENDA-Programm-zur-Kolonisierung-des-Internet-2292574.html?hg=1&hgi=3&hgf=false

Revealed by Cryptome – Cyber Warriors in the Middle East: Syrian E-Army

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

The Vocabulary of Cyber War by U.S. Strategic Command

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

A restricted document from U.S. Strategic Command provides insight into the underlying philosophy of military efforts to wage cyber warfare.

At the 39th Joint Doctrine Planning Conference, a semiannual meeting on topics related to military doctrine and planning held in May 2007, a contractor for Booz Allan Hamilton named Paul Schuh gave a short presentation discussing doctrinal issues related to “cyberspace” and the military’s increasing effort to define its operations involving computer networks. Schuh, who would later become chief of the Doctrine Branch at U.S. Cyber Command, argued that military terminology related to cyberspace operations was inadequate and failed to address the expansive nature of cyberspace. According to Schuh, the existing definition of cyberspace as “the notional environment in which digitized information is communicated over computer networks” was imprecise. Instead, he proposed that cyberspace be defined as “a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures.”

Amid the disagreements about “notional environments” and “operational domains,” Schuh informed the conference that “experience gleaned from recent cyberspace operations” had revealed “the necessity for development of a lexicon to accommodate cyberspace operations, cyber warfare and various related terms” such as “weapons consequence” or “target vulnerability.” The lexicon needed to explain how the “‘four D’s (deny, degrade, disrupt, destroy)” and other core terms in military terminology could be applied to cyber weapons. The document that would later be produced to fill this void is The Cyber Warfare Lexicon, a relatively short compendium designed to “consolidate the core terminology of cyberspace operations.” Produced by the U.S. Strategic Command’s Joint Functional Command Component – Network Warfare, a predecessor to the current U.S. Cyber Command, the lexicon documents early attempts by the U.S. military to define its own cyber operations and place them within the larger context of traditional warfighting. A version of the lexicon from January 2009 obtained by Public Intelligence includes a complete listing of terms related to the process of creating, classifying and analyzing the effects of cyber weapons. An attachment to the lexicon includes a series of discussions on the evolution of military commanders’ conceptual understanding of cyber warfare and its accompanying terminology, attempting to align the actions of software with the outcomes of traditional weaponry.

Defining Cyber Warfare

One of the primary reasons for creating a lexicon devoted to cyber warfare is that there are “significant underlying differences” between traditional military operations and so-called “non-traditional weapons” such as those employed in cyber warfare. The lexicon was intended to reduce these differences by integrating and standardizing the “use of these non-traditional weapons” while providing “developers, testers, planners, targeteers, decision-makers, and battlefield operators . . . a comprehensive but flexible cyber lexicon that accounts for the unique aspects of cyber warfare while minimizing the requirement to learn new terms for each new technology of the future.” Described as a Language to Support the Development, Testing, Planning, and Employment of Cyber Weapons and Other Modern Warfare Capabilities, the lexicon is designed to facilitate the construction and employment of cyber weapons:

The cyber warfare community needs a precise language that both meets their unique requirements and allows them to interoperate in a world historically dominated by kinetic warfare. Mission planners must be able to discuss cyber weapons with their commanders, the intelligence analysts, the targeteers, and the operators, using terms that will be understood not just because they have been defined somewhere in doctrine, but also because they make sense. Giving the weapons planners a well-founded lexicon enables them to have far-reaching discussions about all manner of weapons and make important decisions with a significantly reduced likelihood of misunderstanding and operational error.

To understand what exactly constitutes a cyber weapon and what makes it so different from the kind of weapons employed in traditional warfare, it is important to understand the objectives of cyber warfare. Cyber warfare is defined in the lexicon as the creation of “effects in and through cyberspace in support of a combatant commander’s military objectives, to ensure friendly forces freedom of action in cyberspace while denying adversaries these same freedoms.” This can be accomplished through cyber attacks, cyber defense as well as cyber exploitation, with each option providing its own unique set of associated capabilities and potential outcomes. Cyber attacks bare the greatest resemblance to popular notions of cyber war, incorporating actions to “deny or manipulate information and/or infrastructure in cyberspace” through methods like a computer network attack (CNA) that are intended to “disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves.” Cyber defense is primarily focused on defending U.S. military networks from similar attacks conducted by other nations or non-state actors and protecting the integrity of the Department of Defense’s Global Information Grid (GIG) which carries military communications worldwide. Cyber exploitation is focused primarily on the collection of intelligence and other useful data from targeted computer systems to enable improved “threat recognition” that can contribute to future operations in cyberspace.

These components of cyber warfare rely on capabilities that are used to construct cyber weapon systems. A cyber warfare capability is a “device, computer program or technique” that includes any combination of “software, firmware, and hardware” that is “designed to create an effect in cyberspace, but has not been weaponized.” Weaponization is a process that takes these capabilities and implements “control methods, test and evaluation, safeguards, security classification guidance, interface/delivery method” and other tactical considerations to ensure that the capability can be properly employed to produce the intended effect. A completed cyber weapon system is a combination of one or more of these capabilities that have been weaponized and are ready for deployment. These weapons can then be categorized based upon specific uses and issues related to their employment, such as who is authorized to use them. One suggested schema in the lexicon provides three categories: the first for weapons that require approval from the combatant commander, a second for weapons that are pre-approved for specific uses and a third that requires the approval of the President or Secretary of Defense before the weapon can be utilized.

One of the “Discussions on Cyberspace Operations” contained in the lexicon follows the military’s historical apprehension toward describing software programs and other cyber capabilities as weapons. Throughout the early 1990s, the term “tool” was widely favored in the initial phases of the military’s cyber warfare mission. One reason for this reluctance was military commanders’ concerns about the lack of authority under Title 10 for conducting cyber operations. However, given that there are six “Joint functions” recognized in military doctrine “C2 [command and control], Intel, Fires, Maneuver, Protection and Sustainment,” the use of any offensive cyber capabilities “unquestionably” is a form of fires, making the cyber capability itself a kind of weapon. The idea that software and computer hardware could be considered a weapon is further complicated by the fact that many offensive cyber capabilities consist of nothing more than “cyber techniques” that involve “keystrokes, but where no hardware or software is introduced into the target system.” When “last minute changes in the target render the approved weapon inert, an operator might need to use cyber techniques to complete an assigned mission, particularly one that has been approved for effect or objective,” making the certification process and training of the “operator” critical to considering cyber capabilities as a “weapon system.” There must be control methods, testing and evaluation, safeguards, certified personnel, mission logs, a concept of operations as well as tactics, techniques and procedures on how to employ the weapon system. This is similar to the situation with conventional weapons as “the very first M-16 rifle ever made, while a ‘weapon’ in the dictionary sense of the word, was not deployed until it was operationally tested, had a training program, spare parts inventory, etc.” It was only after this process that “each new M-16 was part of a ‘weapon system’ and could be crated and shipped to the front lines directly from the assembly line.”

Cyber Weapons and Their Effects

A fundamental distinction discussed in the lexicon, one which separates cyber weapons from those used in conventional warfare, is the distinction between kinetic and non-kinetic weaponry. Kinetic weapons are those that “use forces of dynamic motion and/or energy upon material bodies” whereas non-kinetic weapons are those that “create their effects based upon the laws of logic or principles other than the laws of physics.” Within each of these broad categories, there are further distinctions based upon the lethality of the weapon being described. For example, a Mark-84 bomb is an example of a lethal kinetic weapon capable of inflicting physical damage to material entities based upon the use of motion and force. The Active Denial System, a directed-energy weapon which uses millimeter waves to create a sensation of heat on the skin of human targets, is an example of a non-lethal kinetic weapon. As a non-kinetic weapon creates its effect through the use of logic or other principles, the category necessarily encompasses a much wider array of weapon systems from diverse fields like information warfare and psychological operations. Biological and chemical weapons are examples of lethal non-kinetic weapons that rely upon biological factors rather than physical force to create their effect. Computer network attack (CNA) software, on the other hand, is an example of a non-lethal non-kinetic weapon, creating an effect based solely on the logical operations it performs on a targeted computer system.

While cyber weapons are considered to be non-lethal in their effects, this doesn’t mean that non-lethal weapons are “required to have zero probability of causing fatalities, permanent injuries, or destruction.” To better understand the effects that non-lethal non-kinetic weapons can have, the lexicon attempts to align cyber weapons with the traditional terminology of the “Four D’s” used throughout the information operations community: deny, destroy, degrade and disrupt. One discussion in the lexicon introduces a construct to understand these effects in terms of a scope, level and time of “denial” in a targeted system, causing “reduction, restriction, or refusal of target operations.” Using this framework, “degrade, disrupt, and destroy” would all be considered different forms of denial that have varying scopes. Disrupt introduces a “time aspect of denial” and degrade adds an “amount or level of denial.” The final term “destroy” is saved for the “special case that includes the maximum time and maximum amount of denial.” The lexicon even proposes a function for calculating denial:

Quantitatively, denial (D) can be expressed as a function of scope (s), level (l), and time (t), i.e. D(s,l,t). Defining effects in this manner makes it clear to the planning staff that each of the parameters of the function must be considered and specified as necessary as indicated by, or derived from, commander’s objective. As the level (l) or amount approaches 100% and time (t) approaches infinity, destruction is achieved.

The true effects of a cyber weapon often differ significantly from simply denying or even destroying an enemy system. Every weapon “takes an action” when it is triggered and this action is “intended to have an effect.” For a traditional bomb, that action is a “kinetic explosion and the effect is normally target damage,” whereas a cyber weapon may result in “the execution of some software and the effects, some form of denial or manipulation.” However, weapons also have “outcomes that are not expected and are not required to achieve the objective.” The lexicon describes these as indirect effects that can result in consequences for unintended targets. When these consequences affect unlawful targets or cause “damage to persons or objects that would not be lawful military targets,” they are considered “collateral effects” that are similar to the traditional notion of collateral damage.

Vulnerabilities and Target States

Past worries about collateral damage from cyber weapons have proven to be well founded. In the summer of 2010, copies of an unknown computer worm began replicating throughout the internet using a vulnerability in Microsoft Windows to find its way into the control systems of major corporations like Chevron. However, the malicious program was not the work of Chinese hackers or sophisticated cyber criminals, it was a cyber weapon called Stuxnet created as part of a joint U.S. and Israeli intelligence operation targeting Iran’s nuclear program that was codenamed “Olympic Games.” Stuxnet would later claim other unintended targets, including a Russian nuclear power plant. Unintended effects associated with cyber weapons are dangerous for a number of reasons, including the risk that an adversary might be able to use the weapon, once discovered, against the originator of the attack. According to the lexicon, these vulnerabilities of cyber weapons can be separated into six distinct categories:

(U//FOUO) Detectability risk – The risk that a weapon will be unable to elude discovery or suspicion of its existence. This includes the adverse illumination risk of hardware weapons.

(U//FOUO) Attribution risk – The risk that the discoverer of a weapon or weapon data will be able to identify the source and/or originator of the attack or the source of the weapon used in the attack.

(U//FOUO) Co-optability risk – The risk that, once discovered, the weapon or its fires will be able to be recruited, used, or reused without authorization.

(U//FOUO) Security Vulnerability risk – The risk that, once discovered, an unauthorized user could uncover a security vulnerability in the weapon that allows access to resources of the weapon or its launch platform. This includes the risk of an adversary establishing covert channels over a weapon’s C2 link.

(U//FOUO) Misuse risk – The risk that the weapon can be configured such that an authorized user could unintentionally use it improperly, insecurely, unsafely, etc.

(U//FOUO) Policy, Law, & Regulation (PLR) risk – The risk that the weapon can be configured such that an authorized user could intentionally use it in violation of existing policy, laws, and regulations.

These vulnerabilities are “mostly unfamiliar to the kinetic weapons community, and are due to the complexity of the weapons, the dynamic nature of the ‘atmosphere’ of cyberspace, and the difficulty of gathering detailed intelligence about cyber targets.” A discussion on cyber weapon vulnerabilities in the lexicon argues that “the crowded nature of cyberspace and the proliferation of anonymizing technologies can work to both our advantage and disadvantage, in that attribution can be very difficult for both our adversaries and ourselves.” Once a network target has been “accessed and subverted,” the implanted cyber weapon should be “considered like a mine or an improvised explosive device (lED) where there are no longer any delivery considerations for the weapon, but only survivability and transferring of commands and updates.”

In several portions of the lexicon, attacking unaffiliated infrastructure that happens to be used by an adversary is discussed as a viable means of creating a “second order” effect on the target. For example, if “privileged access in not possible, we may still be able to create our desired effect in the first order by using public access to the target” such as “a distributed denial of service (DDOS) that floods a port on the target.” When the intended target “cannot be directly accessed via either public or privileged means, the desired effect can still be achieved by targeting an intermediating link or node so that the desired effect cascades from the first order effect.” An example of this is “conducting a DDOS attack on a critical link” leading to the target or “degradation through packet flooding” by assuming the “maximum data bus speed and a maximum input/output processor throughput on the target.” A ping flood attack can be “directed at a single IP address or broadcast to a whole Class B IP domain with thousands of recipients.”

The effectiveness of a cyber weapon corresponds to its ability to place a target into a particular state of operation. The target state “corresponds to the condition of the target with respect to a military objective” such as creating a root shell for privileged access. A typical cyberspace target state can typically be considered to operate in one of the following “five states relative to achieving a commander’s primary objective”:

Unconfirmed: Unknown if there is an access path to target.

Confirmed/Nominal: Access path to target established.

Unprivileged access: Unprivileged access to target established.

Privileged access/At risk: Privileged access to target established.

Goal/Other condition: Target has been placed in the desired or other intermediate condition.

Using a real world example, the lexicon asks us to “consider the use of a ‘buffer overflow’ capability to achieve ‘root’ level (privileged) access on a computer operating system in order to disable an adversary’s computer program.” The use of a “buffer overflow creates an initial effect (access to unauthorized portion of memory) and, by including in the buffer overflow capability other carefully crafted code, it can also enable another effect (e.g. gaining root access) and place the target in a different state.” Whereas the previous state of the target was “nominal,” the new state of the target is “compromised.” If the system administrator has implemented “a mechanism to log and report all creations of a root shell,” the outcome can still create unintended consequences because the cyber weapon could be detected and then be susceptible to attribution or manipulation. With certain types of cyber weapons this sort of discovery or attribution could present serious problems, though with others it may prove to be of little use to the weapon’s discoverer. As cyber weapons only “deliver information or some other information-related effect to the target and not high explosive or high energy,” they can be used “as long as we have electrical power.”

Document

Pages

Text

Zoom

U.S. Strategic Command Cyber Warfare Lexicon

Select a term from the following list to read the full definition. All definitions are taken from U.S. Strategic Command (USSTRATCOM) Cyber Warfare Lexicon Version 1.7.6.

cyberspace

cyberspace operations (CO)

cyber warfare (CW)

cyber warfare capability

cyber weapon system

cyber weaponization

cyber weapon characterization

cyber weapon categorization

cyber weapon delivery mode

cyber weapon flexibility

cyber weapon identification

cyber weapon vulnerability

effects assessment (EA)

intended cyber effect

kinetic

probability of effect (PE)

target state

targeted vulnerability

weapon action

weapon effect

cyberspace

(U//FOUO) cyberspace: a global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers. (from 12 May 2008 SECDEF memo)

[(U//FOUO) Previous version – cyberspace: A domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures. (from NMS-CO)]

↑ Return to the top

cyberspace operations (CO)

(U//FOUO) cyberspace operations (CO): All activities conducted in and through cyberspace in support of the military, intelligence, and business operations of the Department. (based on NMS-CO description)

(U//FOUO) cyberspace operations (CO): The employment of cyber capabilities where the primary purpose is to achieve military objectives or effects in or through cyberspace. Such operations include computer network operations and activities to operate and defend the global information grid. (from 29 Sep 2008 VJCS Memo, however it is inconsistent with NMS-CO and improperly limited)

↑ Return to the top

cyber warfare (CW)

(U//FOUO) cyber warfare (CW): Creation of effects in and through cyberspace in support of a combatant commander’s military objectives, to ensure friendly forces freedom of action in cyberspace while denying adversaries these same freedoms. Composed of cyber attack (CA), cyber defense (CD), and cyber exploitation (CE).

↑ Return to the top

cyber attack (CA)

(U//FOUO) cyber attack (CA): Cyber warfare actions intended to deny or manipulate information and/ or infrastructure in cyberspace. Cyber attack is considered a form of fires.

↑ Return to the top

cyber defense (CD)

(U//FOUO) cyber defense (CD): Cyber warfare actions to protect, monitor, detect, analyze, and respond to any uses of cyberspace that deny friendly combat capability and unauthorized activity within the DOD global information grid (GIG).

↑ Return to the top

cyber exploitation (CE)

(U//FOUO) cyber exploitation (CE): Cyber warfare enabling operations and intelligence collection activities to search for, collect data from, identify, and locate targets in cyberspace for threat recognition, targeting, planning, and conduct of future operations.

↑ Return to the top

cyber warfare capability

(U//FOUO) cyber warfare capability: A capability (e.g. device, computer program, or technique), including any combination of software, firmware, and hardware, designed to create an effect in cyberspace, but that has not been weaponized. Not all cyber capabilities are weapons or potential weapons.

↑ Return to the top

cyber weapon system

(U//FOUO) cyber weapon system: A combination of one or more weaponized offensive cyber capabilities with all related equipment, materials, services, personnel, and means of delivery and deployment (if applicable) required for self-sufficiency. (Note: adapted directly from JP 1-02 of weapon system.)

↑ Return to the top

cyber weaponization

(U//FOUO) cyber weaponization: The process of taking an offensive cyber capability from development to operationally ready by incorporating control methods, test and evaluation, safeguards, security classification guidance, interface/ delivery method, certified and trained personnel, employment recorder, CONOP, TIP, life-cycle support, and launch platform.

↑ Return to the top

cyber weapon characterization

(U//FOUO) cyber weapon characterization: The process of determining and documenting the effect producing mechanisms and assurance factors of cyber weapons. Characterization includes aspects of technical assurance evaluation, OT&E, risk/protection assessments, and other screening processes. Answers the question: “What do I need to know about this weapon before I can use it?” [Note: Cyber Weapon Characterization is one step in the Cyber Weaponization process.]

↑ Return to the top

cyber weapon categorization

(U//FOUO) cyber weapon categorization: A binning of cyber weapon capabilities into categories, based on risk assessment and the release authority required for their use. Useful for answering the question: “Who can authorize use of this weapon?” Example categories might be:

• Category I- Combatant commander release

• Category II – Pre-approved for combatant commander use in specific OPLANs

• Category III- President/SECDEF release only

↑ Return to the top

cyber weapon delivery mode

(U//FOUO) cyber weapon delivery mode: The method via which a cyber weapon (or a command to such a weapon) is delivered to the target. Delivery may be via direct implant or remote launch. Hardware cyber weapons often require direct implant. Remote launched cyber weapons and/or commands may be placed via wired and/or wireless paths.

↑ Return to the top

cyber weapon flexibility

(U//FOUO) cyber weapon flexibility: The extent to which the cyber weapon’s design enables operator reconfiguration to account for changes in the target environment.

↑ Return to the top

cyber weapon identification

(U//FOUO) cyber weapon identification: The manner in which a cyber weapon is represented for inventory control purposes, based on the weapon’s forensic attributes (e.g. for software: file name, file size, creation date, hash value, etc., for hardware: serial number, gram weight, stimulus response, x-ray image, unique markings, etc.).

↑ Return to the top

cyber weapon vulnerability

(U//FOUO) cyber weapon vulnerability: An exploitable weakness inherent in the design of a cyber weapon. Weaknesses are often in one of the following risk areas:

detectability risk – The risk that a weapon will be unable to elude discovery or suspicion of its existence. This includes the adverse illumination risk of hardware weapons.
attribution risk – The risk that the discoverer of a weapon or its effect will be able to identify the source and/or originator of the attack or the source of the weapon used in the attack.
co-optability risk – The risk that, once discovered, the weapon or its fires will be able to be recruited, used, or reused without authorization.
security vulnerability risk – The risk that, once discovered, an unauthorized user could uncover a security vulnerability in the weapon that allows access to resources of the weapon or its launch platform. This includes the risk of an adversary establishing covert channels over a weapon’s C2 link.
misuse risk – The risk that the weapon can be configured such that an authorized user could unintentionally use it improperly, insecurely, unsafely, etc.
policy, law, & regulation (PLR) risk – The risk that the weapon could be configured such that an authorized user could intentionally use it in violation of existing policy, laws, and regulations.

↑ Return to the top

access

(U) access: Sufficient level of exposure to or entry into a target to enable the intended effect.

↑ Return to the top

collateral effect

(U) collateral effect: Unintentional or incidental effects, including injury or damage, to persons or objects that would not be lawful military targets in the circumstances ruling at the time.

↑ Return to the top

deny

(U) deny: To attack by degrading, disrupting, or destroying access to or operation of a targeted function by a specified level for a specified time. Denial is concerned with preventing adversary use of resources.

degrade(U) degrade: (a function of amount) To deny access to or operation of a targeted function to a level represented as a percentage of capacity. Desired level of degradation is normally specified.
disrupt(U) disrupt: (a function of time) To completely but temporarily deny access to or operation of a targeted function for a period represented as a function of time. Disruption can be considered a special case of degradation where the degradation level selected is 100%.
destroy(U) destroy: To permanently, completely, and irreparably deny access to, or operation of, a target. Destruction is the denial effect where time and level are both maximized.

↑ Return to the top

dud

(U) dud: A munition that has not been armed or activated as intended or that failed to take an expected action after being armed or activated. (Note: adapted directly from JP 1-02 of dud.)

↑ Return to the top

effects assessment (EA)

(U) effects assessment (EA): The timely and accurate evaluation of effects resulting from the application of lethal or non-lethal force against a military objective. Effect assessment can be applied to the employment of all types of weapon systems (air, ground, naval, special forces, and cyber weapon systems) throughout the range of military operations. Effects assessment is primarily an intelligence responsibility with required inputs and coordination from the operators. Effects assessment is composed of physical effect assessment, functional effect assessment, and target system assessment. Note: Battle Damage Assessment (BDA) is a specific type of effects assessment for damage effects. ” (This is a direct adaptation from the JP 1-02 definition of BDA.)

↑ Return to the top

intended cyber effect

(U//FOUO) intended cyber effect: A sorting of cyber capabilities into broad operational categories based on the outcomes they were designed to create. These categories are used to guide capability selection decisions. Answers the question: “What kind of capability is this?” Specifically:

• denial – degrade, disrupt, or destroy access to, operation, quality of service, or availability of target resources, processes, and/or data.

• manipulation – manipulate, distort, or falsify trusted information on a target.

• command and control – provide operator control of deployed cyber capabilities.

• information/data collection – obtain targeting information about targets or target environments.

• access – establish unauthorized access to a target.

• enabling – provide resources or create conditions that support the use of other capabilities.

↑ Return to the top

kinetic

(U) kinetic: Of or pertaining to a weapon that uses, or effects created by, forces of dynamic motion and/ or energy upon material bodies. Includes traditional explosive weapons/ effects as well as capabilities that can create kinetic RF effects, such as continuous wave jammers, lasers, directed energy, and pulsed RF weapons.

↑ Return to the top

non-kinetic

(U) non-kinetic: Of or pertaining to a weapon that does not use, or effects not created by, forces of dynamic motion and/ or energy upon material bodies.

↑ Return to the top

lethal

(U) lethal: Of or pertaining to a weapon or effect intended to cause death or permanent injuries to personnel.

↑ Return to the top

non-lethal

(U) non-lethal: Of or pertaining to a weapon or effect not intended to cause death or permanent injuries to personnel. Nonlethal effects may be reversible and are not required to have zero probability of causing fatalities, permanent injuries, or destruction of property.

↑ Return to the top

manipulate

(U//FOUO) manipulate: To attack by controlling or changing a target’s functions in a manner that supports the commander’s objectives; includes deception, decoying, conditioning, spoofing, falsification, etc. Manipulation is concerned with using an adversary’s resources for friendly purposes and is distinct from influence operations (e.g. PSYOP, etc.).

↑ Return to the top

misfire

(U) misfire: The failure of a weapon to take its designed action; failure of a primer, propelling charge, transmitter, emitter, computer software, or other munitions component to properly function, wholly or in part. (Note: adapted directly from JP 1-02 of misfire.)

↑ Return to the top

probability of effect (PE)

(U) probability of effect (PE): The chance of a specific functional or behavioral impact on a target given a weapon action.

↑ Return to the top

target state

(U) target state: The condition of a target described with respect to a military objective or set of objectives.

↑ Return to the top

targeted vulnerability

(U) targeted vulnerability: An exploitable weakness in the target required by a specific weapon.

objective vulnerabilityobjective vulnerability: A vulnerability whose exploitation directly accomplishes part or all of an actual military objective.
access vulnerabilityaccess vulnerability: A vulnerability whose exploitation allows access to an objective vulnerability.

↑ Return to the top

weapon action

(U) weapon action: The effect-producing mechanisms or functions initiated by a weapon when triggered. The weapon actions of a kinetic weapon are blast, heat, fragmentation, etc. The weapon actions of a cyber attack weapon might be writing to a memory register or transmission of a radio frequency (RF) waveform.

↑ Return to the top

weapon effect

(U) weapon effect: A direct or indirect objective (intended) outcome of a weapon action. In warfare, the actions of a weapon are intended to create effects, typically against the functional capabilities of a material target or to the behavior of individuals. Effect-based tasking is specified by a specific target scope, desired effect level, and start time and duration.

direct effectdirect effect: An outcome that is created directly by the weapon’s action. Also known as a first order effect.
indirect effectindirect effect: An outcome that cascades from one or more direct effects or other indirect effects of the weapon’s action. Also known as second, third, Nth order effects, etc.

↑ Return to the top

Warning – FBI Cyber Division Bulletin: Increased Cyber Intrusions

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

FBI Cyber Division Bulletin: Health Care Systems and Medical Devices at Risk for Increased Cyber Intrusions

Health Care Systems and Medical Devices at Risk for Increased Cyber Intrusions for Financial Gain

2 pages
April 8, 2014

(U) Cyber actors will likely increase cyber intrusions against health care systems—to include medical devices—due to mandatory transition from paper to electronic health records (EHR), lax cybersecurity standards, and a higher financial payout for medical records in the black market.

(U) The deadline to transition to EHR is January 2015, which will create an influx of new EHR coupled with more medical devices being connected to the Internet, generating a rich new environment for cyber criminals to exploit. According to open source reporting from SANS, Ponemon, and EMC²/RSA, the health care industry is not technically prepared to combat against cyber criminals’ basic cyber intrusion tactics, techniques and procedures (TTPs), much less against more advanced persistent threats (APTs). The health care industry is not as resilient to cyber intrusions compared to the financial and retail sectors, therefore the possibility of increased cyber intrusions is likely.

(U) A SANS report dated February 2014, indicates health care security strategies and practices are poorly protected and ill-equipped to handle new cyber threats exposing patient medical records, billing and payment organizations, and intellectual property. Data analysis revealed multiple devices (e.g., radiology imaging software, digital video systems, faxes, printers) and security application systems (e.g., Virtual Private Networks (VPN), firewalls, and routers) were compromised. Once medical devices are compromised, malicious traffic is transmitted through VPNs and firewalls. The biggest vulnerability was the perception of IT health care professionals’ beliefs that their current perimeter defenses and compliance strategies were working when clearly the data states otherwise.

(U) According to a Ponemon Institute report dated March 2013, 63% of the health care organizations surveyed reported a data breach in the past two years with an average monetary loss of $2.4 million per data breach. The majority of each data breach resulted in the theft of information assets. Lastly, 45% reported that their organizations have not implemented security measures to protect patient information.

(U) An EMC²/RSA White Paper published in 2013 indicated that in the first half of 2013, over two million health care records were compromised, which was 31% of all reported data breaches. Cyber criminals are selling the information on the black market at a rate of $50 for each partial EHR, compared to $1 for a stolen social security number or credit card number. EHR can then be used to file fraudulent insurance claims, obtain prescription medication, and advance identity theft. EHR theft is also more difficult to detect, taking almost twice as long as normal identity theft.

(U) Reporting Notice

(U) The FBI encourages recipients of this document to report information concerning suspicious or criminal activity to the local FBI field office. The FBI’s 24/7 Strategic Information and Operations Center can be reached by telephone at 202-323-3300 or by e-mail at SIOC@ic.fbi.gov. FBI regional phone numbers can be found online at https://www.fbi.gov/contact/fo/fo.htm. When available, each report submitted should include the date, time, location, type of activity, number of people, and type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact.

Revealed – DHS National Cybersecurity and Communications Integration Center Heartbleed Advisories

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

The following advisories were issued by the National Cybersecurity and Communications Integration Center on April 10, 2014. Both notices are marked with distribution restrictions based on US-CERT Traffic Light Protocol. The advisory marked with TLP: GREEN is not intended for public distribution.

“Heartbleed” OpenSSL Vulnerability	TLP: GREEN	4 pages	Download
“Heartbleed” OpenSSL Vulnerability	TLP: WHITE	2 pages	Download

Security researchers from Google Security recently discovered a vulnerability with the Heartbeat extension (RFC6520) to OpenSSL’s Transport Layer Security (TLS) and the Datagram Transport Layer Security (DTLS) protocols. According to open source reports, the vulnerability has existed within certain OpenSSL frameworks since at least 2012. The Heartbeat extension is functionally a “keep-alive” between end-users and the secure server. It works by sending periodic “data pulses” of 64KB in size to the secure server and once the server receives that data; it reciprocates by re-sending the same data at the same size. The out-of-bounds “read” vulnerability exists because the Heartbeat extension in OpenSSL versions 1.0.1 through and 1.0.2-beta (including 1.0.1f and 1.0.2-beta1) do not properly validate the data being sent from the end-user. As a result, a malicious actor could send a specially-crafted heartbeat request to the vulnerable server and obtain sensitive information stored in memory on the server. Furthermore, even though each heartbeat only allows requests to have a data size limited to 64KB segments, it is possible to send repeated requests to retrieve more 64KB segments, which could include encryption keys used for certificates, passwords, usernames, and even sensitive content that were stored at the time. An attacker could harvest enough data from the 64KB segments to piece together larger groupings of information which could help an attacker develop a broader understanding of the information being acquired.

According to a Trusted Third Party, exploit code written in Python Script has been observed in publicly available online outlets. There have also been a number of underground forums discussing the vulnerability, which indicates interest from nefarious actors. Internal Trusted Third Party assessments reveal that the code is 100% effective against the specific versions of SSL protocol noted above. However, at this time it has not been observed having the capability to compromise all SSL protocols. It is also important to note that at this time there have been no reported malicious attacks that exploit this vulnerability.

The following vendors and products may include vulnerable OpenSSL versions within their product distributions:8
• CentOS Project – CentOS 6
• Debian Project – Debian GNU/Linux 7.0
• FreeBSD Project – FreeBSD 10.0 and prior
• Gentoo Foundation – Gentoo releases through 8 April 2014
• Novell, Inc – openSUSE 12.3 and 13.1
• Red Hat Inc – Fedora 19 and 20, Enterprise Linux/Desktop/HPC Node/Server/Workstation v.6; Enterprise Linux Server AUS v.6.5; Enterprise Linux Sever EUS v.6.5.z Enterprise Virtualization 3; and Storage Server 2.1
• Android mobile devices
• Third Party code using Python/Perl/Ruby
• OpenVPN
• Aruba Networks: ArubeOS 6.3.x and 6.4.x; ClearPass 6.1.x, 6.2.x, and 6.3.x
• Check Point Software Technologies: All versions of Security Gateway, Security Management, Multi-Domain Management/Provider-1, Data Center Security appliances, Endpoint Security Server, Endpoint Connect and SSL Network Extender, Gaia, Gaia Embedded, SecurePlatform 2.6, SecurePlatform Embedded, IPSO 4.x, IPSO 5.x, IPSO 6.2
• Cisco Systems: AnyConnect Secure Mobility Client for iOSl Desktop Collaboration Experience DX650, Unified 7900, 8900, 9900 series IP Phones, TelePresence Video Communication Server (VCS)
• Fortinet Inc: FortiGate (FortiOS) 5.0 and higher, FortiAuthenticator 3.0 and higher, FortiMail 5.0 and higher, FortiVoice, and FortiRecorder
• Juniper Networks: JUNOS OS 13.3R1, Odyssey Client 5.6r5 and later, IVEOS 7.4r1 and later as well as 8.0r1 and later, UAD 4.4ra and layer as well as 5.0r1 and later, JUNOS Pulse (Desktop) 4.0r5 and later as well as 5.0r1 and later, Network Connect 7.4r5 through 7.4r9.1 and 8.0r1 through 8.0r3.1, JUNOS Pulse (Mobile) for Android and iOS 4.2r1 and later
• F5 Networks: BIG-IP AAM 11.5.0 – 11.5.1; BIG-IP AFM 11.5.0 – 11.5.1; BIG-IP Analytics 11.5.0 – 11.5.1; BIG-IP APM 11.5.0 – 11.5.1; BIG-IP ASM 11.5.0 – 11.5.1; BIG-IP Edge Clients for Apple iOS 1.0.5, 2.0.0 – 2.0.1; BIG-IP Edge Clients for Linux 7080 – 7101; BIG-IP Edge Clients for MAC OS X 7080 – 7101; BIG-IP Edge Clients for Windows 7080 – 7101; BIG-IP GTM 11.5.0 – 11.5.1; BIG-IP Link Controller 11.5.0 – 11.5.1; BIG-IP LTM 11.5.0 – 11.5.1; BIG-IP PEM 11.5.0 – 11.5.1; BIG-IP PSM 11.5.0 – 11.5.1

Many of the vulnerable vendors noted above have already begun issuing patches and have information posted on their websites and portals addressing the vulnerability and a plan of action.

On a more positive note, the web browsers Firefox, Chrome, and Internet Explorer on Windows OS all use Windows cryptographic implementation, not OpenSSL.

…

The nature of this vulnerability is such that if encryption keys are captured by a malicious actor, then previously captured transmissions including usernames, passwords, and other sensitive content could be obtained and decrypted. From an end-user’s perspective, changing passwords before system patches have been implemented could still leave SSL transmissions vulnerable. Until patches are fully implemented, closely monitoring email accounts, bank accounts, social media accounts, and other assets are strongly recommended. End-users can set their web browsers so that they automatically detect revoked certificates; Firefox does this automatically.

…

Can I share this product?

Recipients may share TLP: GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels.

SECRET – U.S. Army Cyber Electromagnetic Activities (CEMA) Manual

The following manual was released by the U.S. Army on February 12, 2014. The manual was first reported by Steven Aftergood of the Federation of American Scientists.

FM 3-38 Cyber Electromagnetic Activities

96 pages
February 12, 2014

FM 3-38, Cyber Electromagnetic Activities, provides overarching doctrinal guidance and direction for conducting cyber electromagnetic activities (CEMA). This manual describes the importance of cyberspace and the electromagnetic spectrum (EMS) to Army forces and provides the tactics and procedures commanders and staffs use in planning, integrating, and synchronizing CEMA.

This manual provides the information necessary for Army forces to conduct CEMA that enable them to shape their operational environment and conduct unified land operations. It provides enough guidance for commanders and their staffs to develop innovative approaches to seize, retain, and exploit advantages throughout an operational environment. CEMA enable the Army to achieve desired effects in support of the commander’s objectives and intent.

The principal audience for FM 3-38 is all members of the profession of arms. Commanders and staffs of Army headquarters serving as joint task force or multinational headquarters should see applicable joint or multinational doctrine concerning cyberspace operations, electronic warfare (EW), and spectrum management operations (SMO). Trainers and educators throughout the Army will also use this manual.

…

CYBER ELECTROMAGNETIC ACTIVITIES DEFINED
1-1. Cyber electromagnetic activities are activities leveraged to seize, retain, and exploit an advantage over adversaries and enemies in both cyberspace and the electromagnetic spectrum, while simultaneously denying and degrading adversary and enemy use of the same and protecting the mission command system (ADRP 3-0). CEMA consist of cyberspace operations (CO), electronic warfare (EW), and spectrum management operations (SMO) (see figure 1-1 on page 1-2).

1-2. Army forces conduct CEMA as a unified effort. Integration is the arrangement of military forces and their actions to create a force that operates by engaging as a whole (JP 1-02). Synchronization is the arrangement of military actions in time, space, and purpose to produce maximum relative combat power at a decisive place and time (JP 1-02). CEMA integrates and synchronizes the functions and capabilities of CO, EW, and SMO to produce complementary and reinforcing effects. Conducting these activities independently may detract from their efficient employment. If uncoordinated, these activities may result in conflicts and mutual interference between them and with other entities that use the electromagnetic spectrum (EMS). CO, EW, and SMO are synchronized to cause specific effects at decisive points to support the overall operation.

1-3. The CEMA element is responsible for planning, integrating, and synchronizing CO, EW, and SMO to support the commander’s mission and desired end state within cyberspace and the EMS. During execution the CEMA element is responsible for synchronizing CEMA to best facilitate mission accomplishment. (See chapter 2 for more information on the CEMA element.)

1-4. Cyberspace operations, EW, and SMO are essential to the conduct of unified land operations. While these activities differ in their employment and tactics, their functions and capabilities must be integrated and synchronized to maximize their support to unified land operations. The integration of these activities requires an understanding of the functions and capabilities being employed.

CYBERSPACE OPERATIONS

1-5. Cyberspace operations are the employment of cyberspace capabilities where the primary purpose is to achieve objectives in or through cyberspace (JP 3-0). Cyberspace operations consist of three functions: offensive cyberspace operations, defensive cyberspace operations, and Department of Defense information network operations (see chapter 3).

ELECTRONIC WARFARE

1-6. Electronic warfare is any military action involving the use of electromagnetic and directed energy to control the electromagnetic spectrum or to attack the enemy (JP 3-13.1). EW consists of three functions: electronic attack, electronic protection, and electronic warfare support. These functions are referred to as divisions in joint doctrine (see chapter 4).

SPECTRUM MANAGEMENT OPERATIONS

1-7. SMO are the interrelated functions of spectrum management, frequency assignment, host-nation coordination, and policy that enable the planning, management, and execution of operations within the electromagnetic operational environment during all phases of military operations. SMO are the management portions of electromagnetic spectrum operations (EMSO). EMSO also include electronic warfare (see chapter 5)

…

FUNCTIONS OF CYBERSPACE OPERATIONS

3-1. Army forces coordinate and integrate CO through CEMA. They do this to gain and maintain freedom of action in cyberspace and as required to achieve periods of cyberspace superiority.

3-2. Cyberspace superiority is the degree of dominance in cyberspace by one force that permits the secure, reliable conduct of operations by that force, and its related land, air, maritime, and space forces at a given time and place without prohibitive interference by an adversary (JP 1-02). Such interference is possible because large portions of cyberspace are not under the control of friendly forces. Cyberspace superiority establishes conditions describing friendly force freedom of action while denying this same freedom of action to enemy and adversary actors. Ultimately, Army forces conduct CO to create and achieve effects in support of the commander’s objectives and desired end state.

3-3. CO are categorized into three functions including offensive cyberspace operations (OCO), defensive cyberspace operations (DCO), and Department of Defense information network operations. These functions are described in joint doctrine as missions in cyberspace that require specific actions in cyberspace (see joint doctrine for CO). Figure 3-1 on page 3-2 depicts the three interdependent functions of CO.

OFFENSIVE CYBERSPACE OPERATIONS

3-4. Offensive cyberspace operations are cyberspace operations intended to project power by the application of force in or through cyberspace (JP 1-02). Army forces conduct OCO across the range of military operations by targeting enemy and hostile adversary activity and related capabilities in and through cyberspace. OCO are designed to support the commander’s objectives and intent consistent with applicable authorities and legal frameworks. (See paragraph 3-38 for additional information on authorities and other legal considerations.)

3-5. OCO are conducted in and through cyberspace where information technology infrastructures, along with the people and systems that use them, exist in an area of operations and pervade an operational environment. To varying degrees, host-nation populations, governments, security forces, businesses and other actors rely upon these infrastructures and supporting networks or systems. Given these conditions, OCO require deliberate coordination and integration to ensure desired effects (changes in behavior which do not suggest the ways or means those changes were created) are created and focused at the right place and time in support of the commander’s objectives.

3-6. Using OCO, commanders can mass effects through the employment of lethal and nonlethal actions leveraging all capabilities available to gain advantages in cyberspace that support objectives on land. For example, cyberspace capabilities and other information-related capabilities may be directed at an enemy weapons system consisting of the targeted platform and its operators. The cyberspace capability could create degrading effects on the platform while an information-related capability influences, disrupts, corrupts, or usurps the decisionmaking of the operator. (See FM 3-13 for additional information on inform and influence activities (IIA) and information-related capabilities.)

CYBERSPACE ATTACK

3-7. A cyberspace attack consists of actions that create various direct denial effects in cyberspace (for example, degradation, disruption, or destruction) and manipulation that leads to denial that is hidden or that manifests in the physical domains. For the Army, cyberspace attacks are a type of cyberspace operation employed primarily in support of OCO. Cyberspace attacks are primarily employed outside of LandWarNet, but they are coordinated and deconflicted inside of the Department of Defense information networks (DODIN). (See paragraph 3-24 for additional information on the DODIN.)

3-8. Army forces conduct or facilitate cyberspace attacks in support of OCO within designated areas of operation. For example, when employed as part of an offensive cyberspace operation, a cyberspace attack may be directed at information resident in, or in transit between, computers (including mobile phones and personal digital assistants) and computer networks used by an enemy or adversary. Enemy or adversary actors may be denied the ability to use resources or have their information resources used for friendly proposes as a result of a cyberspace attack. In every instance, commanders and staffs follow appropriate authorities and legal guidance. (See paragraph 3-38 for additional information on authorities and other legal considerations.)

3-9. Using specific portions of cyberspace and the electromagnetic spectrum (EMS) as primary pathways or avenues of approach, cyberspace attacks may employ capabilities such as tailored computer code in and through various network nodes such as servers, bridges, firewalls, sensors, protocols, operating systems, and hardware associated with computers or processors. Tailored computer code is only one example of a cyberspace capability (a device, computer program, or technique, including any combination of software, firmware, or hardware) designed to create an effect in or through cyberspace. The development and employment of tailored computer code represents the core and unique technical nature of CO capabilities. Computer code is designed to create specific effects, and when employed this code moves in the form of data packets in and through cyberspace across wired and wireless driven communication technology and systems. Cyberspace attacks must therefore be coordinated and integrated in support of the commander’s objectives and consistent with applicable assessment measures and indicators.

3-10. Cyberspace attack capabilities are employed to support maneuver operations by creating simultaneous and complementary effects. For example, a cyberspace attack capability may be employed in conjunction with electronic attack, offensive space control, fires, and information related capabilities to deceive, degrade, destroy, and disrupt a specific enemy integrated air defense system or enemy safe haven (see table 3-1 on page 3-4).

Top-Secret – Cyber War FBI-Edu Racket 0042

cyber-war-racket-0042

UNVEILED – Cyber Command Suffers Second Defeat, Dump It

Cyber Command Suffers Second Defeat, Dump It

First Cyber Command Defeat:

http://cryptome.org/0002/uscybercom/uscybercom-defeat.htm

Cyber Command suffered its second defeat with the win of Edward Snowden. The first defeat was won by Bradley Manning. This suggests Cybercom deserves dissolution and a better command instituted, or, best, nothing like it.

The commander for both losses, General Keith Alexander, has to go. And a new, agile Cybercom, if it is to endure, needs to be separated from the venerable, deeply experienced, albeit sclerotic, National Security Agency. Different missions require different enabling legislation, leadership, funding, policy, staffing, training, operation and security.

An effective Cybercom may not be possible within the military culture of tradition, over-staffing, minutely specified military occupation specialty, heirarchical rank, medieval separation of officers from enlisted members, advancement in rank by longevity and favoritism, special training for combat, and further divided between military and civilian — the latter further fragmented between inside civilians and outside contractors with multiple sub-contractors.

The legislation and implementation of this complex traditional, command-driven organization assures it will not be capable of handling the challenges of cyber swarming, rapid evolution of technology and techniques — much of it grown outside established institutions — youthful contempt for authority, national and international disloyalty and disinterest, and most of all, ingrained insurgency.

For this insurgency, outwitting national security establishments is considered to be sport, a game, a test of prowess, bragging rights, and it is winning in cyber space, only periodically, laughingly infrequently, defeated, caputured and imprisoned by use of legacy, lumbering, clumsy, expensive, failure-and-excuse-prone mechanisms, in which legacy leaders like NSA, FBI, CIA, White House and Congress — supported by contractors, lobbyists and donors — can only dissimulate, apologize and promise to do better with more funding and more draconian crack-down on civil liberties.

Cyber Command is a failure — sibling of Department of Homeland Security — a boondoggle, a huge transfer of funds to the cybersecurity (and homeland security) industry from legacy military pork barrels. Thousands of suitably-skilled youngsters — most self-trained by a subversive culture hostile to authority — have been enlisted, hired and contracted to run cyber offensive and defensive operations under the rigidly ranked command of military officers accustomed to obedience and respect of rank.

Cybersecurity contracting — commercial and institutional — is an equally great failure. It too is a boondoggle, spoiled rotten with generous and laxly-overseen funding, often led by ex-military officers and those long accustomed to military grade perquisites, protected by secrecy, back-slapping, insider favoritism, laziness, lack of competition, forgiveness of corruption, shallow and classified IG investigation, all the attributes of its single customer, the national security consortium beloved of governments and autocrats.

No wonder the coddled and well-paid youngsters defy, dance around, ridicule and outrun these balloon-headed officers and liquored-contractors, this is what they have done most of their teenage and adult lives. Their loyalty is to their own culture, open, non-secret, disputatious, daring and fun-filled, most emphatically not venerated-military or rich-contractor grade.

What would a replacement for Cybercom be like? Not military, not commercial, not NGO, then what?

Plenty of cyber initiatives are underway which demonstrate effective alternatives to heirarchical military, commercial and NGO cyber deadwood. They have been created and are run by some of the most brilliant brains and imaginations in the world, agile, cheap, mostly volunteer and leaderless, disputatious, humorous, dismissive of authority of any kind, gov, mil, com, edu, org.

Don’t expect to hire or contract or academicize them. The best of them do not go inside institutions — except to social engineer and disclose the secrets of authoritative corruption.

Examples abound: just read the official demonizations of outsiders spilling insider secrets of gov, mil, com and ngo.

Instead of wasting treasure on dim-witted cybercommands listen to those secret-spilling demons, better understood as angels out-dancing the pinheads.

TOP-SECRET – Defense Security Service Cybersecurity Operations Division Counterintelligence Presentation

Defense Security Service Cybersecurity Operations Division

33 pages
For Official Use Only
December 2012

DSS Supports national security and the warfighter, secures the nation’s technological base, and oversees the protection of U.S. and foreign classified information in the hands of Industry

CI Mission

DSS CI identifies unlawful penetrators of cleared U.S. defense industry and articulates the threat for industry and government leaders

Scope

-10K+ firms; 13K+ facilities; 1.2m personnel
-1 CI professional / 261 facilities
-10.5% of facilities report

Capability

• (U) 11 personnel conducting analysis, liaison, field support, strategic development and program management
• (U) Wide range of skill sets – CI, CT, LE, Cyber, Security, Intel, IA, CNO and more
• (U) Direct access to cleared industry across 25 DSS field offices nationwide
• (U) Large roles at U.S. Cyber Command, National Security Agency, National Cyber Investigative Joint Task Force and the Department of Homeland Security

Challenges

• (U) Secure sharing of threat information with industry partners
• (U) Identifying and reporting suspicious network activity
• (U) Limited resources to execute for an quickly expanding mission area Significant Achievements and Notable Events
• (U) Since September, 2009 – Assessed over 3,000 cyber-related suspicious contact reports from Industry and the Intelligence Community; facilitating action on over 170 federal investigations/operations
• (U) Developed four benchmark product lines for Industry and the Intelligence Community to include the 3rd edition of the DSS Cyber Trends
• (U) Briefed at 24 venues and over 1,000 personnel in FY12 on the cyber threat
• (U) In FY12, delivered over 350 threat notifications to industry, detailing adversary activity occurring on their networks.

…

(U) FY12 Industry Cyber Reporting

• (U//FOUO) 1,678 suspicious contact reports (SCR) categorized as cyber incidents (+102% from FY11)
• (U//FOUO) 1,322 of these were assessed as having a counterintelligence (CI) nexus or were of some positive intelligence (PI) value (+186% increase from FY11)
• (U//FOUO) 263 were categorized as successful intrusions (+78% increase from FY11)
• (U//FOUO) 82 SCRs resulted in an official investigation or operation by an action agency (+37% increase from FY11)

TOP-SECRET- Identifying IP Addresses, Hostnames Associated With Malicious Cyber Activity

DHS-FBI Bulletins Identifying IP Addresses, Hostnames Associated With Malicious Cyber Activity Against the U.S. Government

May 2, 2013 in Department of Homeland Security, Federal Bureau of Investigation

The following bulletins were released in February 2013 by the U.S. Computer Emergency Readiness Team (US-CERT) on a limited basis to “confirmed members of the cybersecurity community of practice, which may include critical infrastructure owners and operators, systems administrators, and information security practitioners.” Both versions of the bulletin were found to be available on a number of public websites associated with various professional associations and trade groups.

Joint Indicator Bulletin (JIB) – INC260425 27 pages February 18, 2013 Download
Joint Indicator Bulletin (JIB) – INC260425-2 10 pages February 26, 2013 Download

Various cyber actors have engaged in malicious activity against Government and Private Sector entities. The apparent objective of this activity has been the theft of intellectual property, trade secrets, and other sensitive business information. To this end, the malicious actors have employed a variety of techniques in order to infiltrate targeted organizations, establish a foothold, move laterally through the targets’ networks, and exfiltrate confidential or proprietary data. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation and other partners, has created this Joint Indicator Bulletin, containing cyber indicators related to this activity. Organizations are advised to examine current and historical security logs for evidence of malicious activity related to the indicators in this bulletin and deploy additional protections as appropriate. In addition, DHS would welcome any additional information your organization may be able to share regarding this or similar activity, which may be provided to the US Computer Emergency Readiness Team (US-CERT) at soc@uscert.gov.

Document Overview

This Joint Indicator Bulletin is comprised of several sections covering malware indicators, network traffic, tool indicators, hostnames, and IP addresses known to be associated with the ongoing malicious activity. If suspicious network traffic or malware is identified based on these indicators, affected systems should be investigated for signs of compromise.

To support developing shared situational awareness of cyber threats, DHS welcomes any additional information your organization may be able to share regarding this or similar activity. Such information can be provided to the United States Computer Emergency Readiness Team (US-CERT) at soc@us-cert.gov.

…

Indicator Descriptions

As a general matter, malicious cyber actors have multiple tools at their disposal and can represent a significant threat to targeted victim organizations. Such actors frequently compromise victim organizations with targeted spear-phishing campaigns, understand how to move laterally within a network to acquire targeted data, and often maintain undetected persistence on victim networks for months or even years. The indicators provided in this Bulletin include malware and compromised IP addresses and domains used by such actors.

Malware

Malicious activity like that described in this Bulletin usually originates via targeted spear phishing email campaigns that compromise victim organizations. These emails can result in the installation of one or more pieces of malware used to enable complete control of those systems. The presence of such malware is a strong indication the computer or network has been compromised.

Client Tools

During the course of a computer intrusion, malicious actors often download additional tools to victim systems for the purpose of evading local security measures and to compromise additional computers on victim networks. These tools might have legitimate uses, but, when combined with other indications of an intrusion, could indicate that the computer has been compromised. The presence of these tools alone is not necessarily a positive indication of malicious activity, but may enable an organization to identify malicious activity.
IP Addresses, Hostnames and Second-Level Domains

Malicious actors routinely compromise hosts on the Internet for the purpose of obscuring their activity, particularly the exfiltration of computer files from end-point victims. The majority of these compromised hosts have been configured to prevent identification of the source of the intrusion activity. The traffic from these hosts is generally legitimate, but, because they have been compromised, activity to and from these IPs should be reviewed for indications of malicious traffic.

Malicious actors also make use of numerous Internet hostnames for the purpose of compromising and controlling victim systems. Actors have been known to register second-level domains for their exclusive use in these activities. In addition, malicious actors have been known to use DNS providers that allow the use of specific hostnames that are part of shared second-level domains.

Many of these hostnames and domains may be legitimate hosts or domains that have been co-opted by malicious actors. Any number of the IP addresses or domains in this Bulletin may have been remediated prior to publication of this list. In some cases, a single IP address from this indicator list may represent hundreds or even thousands of legitimate independent websites, or may represent a small business network. A number of indicators contained in this Bulletin resolve back to large scale service providers whose services are being abused. For these reasons, outright blocking of these indicators is not recommended. Rather, traffic from these IPs or domains should be investigated for signs of compromise.

******************************
IP Address Awareness List
******************************

107[.]6[.]38[.]55
108[.]171[.]207[.]62
108[.]171[.]244[.]138
108[.]171[.]246[.]87
108[.]171[.]248[.]182
108[.]171[.]248[.]83
108[.]171[.]248[.]86
108[.]171[.]252[.]41
108[.]171[.]254[.]76
112[.]121[.]164[.]2
112[.]133[.]203[.]215
112[.]133[.]203[.]250
115[.]119[.]92[.]178
115[.]178[.]60[.]19
116[.]212[.]100[.]94
117[.]121[.]241[.]186
119[.]75[.]5[.]132
119[.]75[.]5[.]134
12[.]10[.]250[.]105
12[.]10[.]250[.]109
12[.]10[.]250[.]110
12[.]10[.]250[.]97
12[.]100[.]63[.]135
12[.]147[.]51[.]99
12[.]162[.]189[.]184
12[.]173[.]220[.]231
12[.]173[.]220[.]233
12[.]182[.]10[.]124
12[.]218[.]86[.]2
12[.]233[.]148[.]145
12[.]233[.]148[.]185
12[.]235[.]72[.]138
12[.]235[.]72[.]140
12[.]36[.]96[.]236
12[.]51[.]6[.]132
12[.]7[.]168[.]121
122[.]126[.]32[.]234
122[.]155[.]3[.]147
122[.]160[.]137[.]76
124[.]122[.]156[.]219
128[.]173[.]95[.]6
128[.]95[.]9[.]2
129[.]25[.]5[.]200
129[.]44[.]254[.]145
134[.]208[.]10[.]195
141[.]151[.]164[.]87
142[.]0[.]143[.]207
146[.]145[.]183[.]100
150[.]176[.]56[.]194
158[.]255[.]208[.]211
161[.]58[.]179[.]230
164[.]106[.]102[.]188
164[.]119[.]10[.]170
164[.]119[.]11[.]2
164[.]119[.]54[.]244
164[.]119[.]54[.]247
165[.]165[.]38[.]19
168[.]215[.]137[.]6
168[.]93[.]98[.]3
173[.]10[.]48[.]243
173[.]224[.]208[.]155
173[.]224[.]211[.]14
173[.]224[.]211[.]16
173[.]224[.]214[.]70
173[.]224[.]215[.]73
173[.]224[.]216[.]217
173[.]252[.]255[.]52
182[.]173[.]77[.]26
184[.]105[.]135[.]166
184[.]22[.]26[.]50
184[.]72[.]82[.]144
184[.]82[.]164[.]104
184[.]82[.]47[.]200
189[.]87[.]87[.]3
190[.]13[.]160[.]114
193[.]219[.]90[.]29
194[.]106[.]162[.]203
195[.]22[.]21[.]72
195[.]29[.]247[.]78
196[.]36[.]199[.]217
198[.]15[.]88[.]37
198[.]15[.]88[.]39
198[.]69[.]219[.]173
199[.]119[.]201[.]162
199[.]119[.]201[.]167
199[.]119[.]201[.]67
199[.]119[.]206[.]11
199[.]119[.]206[.]111
199[.]119[.]206[.]19
199[.]119[.]206[.]99
199[.]119[.]207[.]237
199[.]15[.]113[.]218
199[.]15[.]117[.]98
199[.]67[.]16[.]122
199[.]67[.]23[.]45
199[.]71[.]213[.]17
199[.]71[.]213[.]91
199[.]83[.]88[.]98
199[.]83[.]89[.]45
199[.]83[.]93[.]22
199[.]83[.]93[.]51
199[.]83[.]93[.]88
199[.]83[.]95[.]51
199[.]83[.]95[.]60
200[.]53[.]40[.]219
202[.]176[.]81[.]175
202[.]180[.]175[.]16
202[.]43[.]33[.]5
202[.]95[.]222[.]143
202[.]95[.]222[.]145
202[.]95[.]222[.]158
202[.]95[.]222[.]182
202[.]95[.]222[.]183
203[.]118[.]56[.]213
203[.]123[.]147[.]34
203[.]146[.]102[.]166
203[.]146[.]249[.]189
203[.]150[.]230[.]121
203[.]238[.]57[.]1
203[.]64[.]84[.]226
203[.]81[.]38[.]54
203[.]81[.]53[.]14
203[.]82[.]57[.]109
204[.]111[.]73[.]156
204[.]111[.]75[.]107
204[.]12[.]11[.]212
204[.]12[.]11[.]54
204[.]12[.]116[.]166
204[.]12[.]208[.]122
204[.]12[.]208[.]125
204[.]12[.]21[.]69
204[.]12[.]22[.]114
204[.]12[.]224[.]75
204[.]12[.]236[.]182
204[.]12[.]236[.]183
204[.]12[.]63[.]133
204[.]12[.]9[.]251
204[.]13[.]24[.]14
204[.]15[.]132[.]254
204[.]152[.]198[.]194
204[.]16[.]139[.]5
204[.]17[.]34[.]150
204[.]180[.]235[.]103
204[.]180[.]235[.]106
204[.]45[.]101[.]246
204[.]45[.]108[.]237
204[.]45[.]117[.]174
204[.]45[.]123[.]141
204[.]45[.]124[.]100
204[.]45[.]124[.]162
204[.]45[.]124[.]163
204[.]45[.]137[.]74
204[.]45[.]146[.]250
204[.]45[.]147[.]19
204[.]45[.]153[.]52
204[.]45[.]190[.]89
204[.]45[.]198[.]18
204[.]45[.]201[.]107
204[.]45[.]205[.]44
204[.]45[.]230[.]75
204[.]45[.]39[.]4
204[.]45[.]52[.]20
204[.]45[.]64[.]66
204[.]45[.]75[.]250
204[.]45[.]79[.]180
204[.]45[.]79[.]20
204[.]45[.]79[.]218
205[.]159[.]83[.]11
205[.]159[.]83[.]31
205[.]159[.]83[.]91
205[.]164[.]0[.]34
205[.]172[.]20[.]42
205[.]196[.]178[.]23
205[.]209[.]161[.]195
205[.]209[.]161[.]5
205[.]237[.]192[.]123
205[.]242[.]114[.]4
206[.]125[.]45[.]187
206[.]192[.]55[.]117
206[.]204[.]190[.]237
207[.]150[.]197[.]155
207[.]179[.]111[.]5
207[.]182[.]238[.]195
207[.]210[.]252[.]17
207[.]250[.]229[.]52
207[.]250[.]49[.]172
207[.]250[.]49[.]173
207[.]36[.]0[.]193
207[.]36[.]17[.]15
207[.]46[.]17[.]125
207[.]59[.]239[.]122
207[.]65[.]231[.]21
207[.]75[.]209[.]108
207[.]97[.]226[.]130
208[.]106[.]145[.]153
208[.]106[.]146[.]98
208[.]106[.]82[.]119
208[.]109[.]238[.]15
208[.]109[.]238[.]72
208[.]109[.]238[.]80
208[.]109[.]238[.]96
208[.]109[.]49[.]66
208[.]118[.]188[.]166
208[.]118[.]188[.]179
208[.]118[.]188[.]57
208[.]186[.]112[.]40
208[.]221[.]198[.]12
208[.]43[.]154[.]7
208[.]43[.]175[.]82
208[.]43[.]208[.]14
208[.]43[.]225[.]196
208[.]43[.]255[.]135
208[.]43[.]54[.]164
208[.]43[.]71[.]116
208[.]44[.]238[.]249
208[.]57[.]237[.]141
208[.]67[.]248[.]66
208[.]69[.]32[.]230
208[.]77[.]45[.]61
208[.]77[.]45[.]69
208[.]87[.]242[.]93
209[.]104[.]217[.]69
209[.]104[.]217[.]72
209[.]104[.]217[.]76
209[.]114[.]160[.]115
209[.]114[.]222[.]100
209[.]116[.]102[.]225
209[.]158[.]71[.]20
209[.]175[.]175[.]227
209[.]175[.]175[.]230
209[.]200[.]117[.]198
209[.]208[.]95[.]158
209[.]208[.]95[.]86
209[.]212[.]104[.]171
209[.]234[.]81[.]205
209[.]242[.]13[.]230
209[.]242[.]21[.]134
209[.]34[.]224[.]52
209[.]34[.]231[.]197
209[.]34[.]231[.]59
209[.]34[.]233[.]26
209[.]67[.]56[.]252
209[.]75[.]160[.]176
209[.]75[.]160[.]98
210[.]184[.]116[.]198
210[.]193[.]52[.]160
210[.]202[.]22[.]129
210[.]205[.]6[.]219
210[.]220[.]197[.]2
210[.]245[.]64[.]107
210[.]249[.]80[.]141
211[.]115[.]70[.]114
211[.]232[.]57[.]150
211[.]232[.]57[.]235
211[.]232[.]57[.]249
211[.]233[.]58[.]69
212[.]116[.]151[.]146
212[.]150[.]22[.]228
213[.]79[.]32[.]179
216[.]134[.]222[.]200
216[.]136[.]62[.]143
216[.]174[.]25[.]177
216[.]183[.]190[.]162
216[.]183[.]40[.]56
216[.]185[.]0[.]220
216[.]185[.]0[.]9
216[.]196[.]249[.]210
216[.]213[.]99[.]218
216[.]215[.]112[.]83
216[.]226[.]191[.]103
216[.]24[.]192[.]117
216[.]24[.]192[.]121
216[.]24[.]192[.]206
216[.]24[.]192[.]28
216[.]24[.]192[.]44
216[.]24[.]192[.]7
216[.]24[.]192[.]81
216[.]24[.]192[.]83
216[.]24[.]192[.]95
216[.]24[.]196[.]113
216[.]24[.]198[.]14
216[.]24[.]198[.]20
216[.]24[.]199[.]243
216[.]24[.]199[.]62
216[.]24[.]200[.]180
216[.]24[.]201[.]166
216[.]24[.]201[.]198
216[.]24[.]203[.]58
216[.]24[.]204[.]124
216[.]24[.]205[.]30
216[.]24[.]205[.]36
216[.]24[.]205[.]69
216[.]36[.]123[.]12
216[.]68[.]165[.]14
216[.]83[.]42[.]66
216[.]9[.]65[.]6
216[.]99[.]146[.]18
216[.]99[.]148[.]18
217[.]20[.]138[.]42
217[.]22[.]119[.]13
217[.]23[.]9[.]215
218[.]233[.]206[.]2
218[.]234[.]17[.]30
218[.]234[.]21[.]219
220[.]68[.]224[.]116
222[.]231[.]46[.]51
24[.]120[.]244[.]9
24[.]123[.]91[.]130
24[.]123[.]91[.]198
24[.]123[.]91[.]206
24[.]123[.]91[.]6
24[.]123[.]91[.]70
24[.]123[.]91[.]98
24[.]129[.]188[.]158
24[.]172[.]220[.]130
24[.]173[.]220[.]130
24[.]173[.]34[.]139
24[.]199[.]240[.]74
24[.]227[.]145[.]210
24[.]248[.]197[.]112
24[.]249[.]191[.]150
24[.]39[.]42[.]50
24[.]39[.]5[.]85
24[.]43[.]98[.]12
24[.]73[.]123[.]50
24[.]96[.]236[.]182
24[.]97[.]167[.]250
27[.]254[.]34[.]246
38[.]104[.]203[.]222
38[.]104[.]203[.]242
38[.]107[.]179[.]5
4[.]22[.]103[.]26
59[.]116[.]133[.]122
59[.]12[.]137[.]111
59[.]12[.]137[.]146
59[.]12[.]137[.]148
59[.]12[.]137[.]149
59[.]12[.]137[.]150
59[.]12[.]137[.]181
59[.]12[.]137[.]182
59[.]12[.]137[.]183
59[.]12[.]137[.]194
59[.]120[.]140[.]156
59[.]120[.]199[.]82
60[.]51[.]214[.]129
61[.]19[.]248[.]201
61[.]19[.]248[.]203
61[.]218[.]191[.]55
61[.]218[.]191[.]60
61[.]219[.]136[.]132
61[.]72[.]144[.]248
61[.]78[.]60[.]130
62[.]2[.]205[.]146
62[.]244[.]209[.]98
63[.]102[.]52[.]138
63[.]105[.]34[.]53
63[.]105[.]34[.]59
63[.]126[.]12[.]3
63[.]134[.]215[.]111
63[.]134[.]215[.]34
63[.]139[.]221[.]10
63[.]139[.]45[.]83
63[.]147[.]185[.]60
63[.]147[.]31[.]177
63[.]149[.]11[.]233
63[.]149[.]120[.]135
63[.]150[.]10[.]200
63[.]175[.]119[.]46
63[.]200[.]116[.]50
63[.]202[.]58[.]43
63[.]209[.]10[.]247
63[.]224[.]141[.]199
63[.]64[.]153[.]68
63[.]73[.]10[.]131
63[.]73[.]11[.]12
63[.]73[.]11[.]6
63[.]84[.]30[.]211
63[.]86[.]122[.]121
63[.]93[.]109[.]217
63[.]97[.]151[.]230
64[.]124[.]105[.]75
64[.]14[.]253[.]120
64[.]151[.]127[.]68
64[.]151[.]127[.]70
64[.]198[.]120[.]50
64[.]2[.]115[.]238
64[.]222[.]187[.]237
64[.]233[.]222[.]39
64[.]28[.]82[.]36
64[.]3[.]53[.]146
64[.]3[.]53[.]148
64[.]30[.]223[.]147
64[.]45[.]251[.]11
64[.]5[.]38[.]17
64[.]52[.]255[.]20
64[.]6[.]188[.]250
64[.]6[.]188[.]253
64[.]62[.]136[.]154
64[.]62[.]136[.]157
64[.]73[.]238[.]72
64[.]8[.]114[.]123
64[.]80[.]153[.]108
64[.]85[.]177[.]5
64[.]85[.]19[.]6
64[.]88[.]7[.]113
64[.]9[.]204[.]233
65[.]107[.]54[.]151
65[.]114[.]166[.]37
65[.]14[.]25[.]67
65[.]183[.]217[.]55
65[.]49[.]145[.]3
65[.]66[.]118[.]57
65[.]89[.]156[.]126
65[.]97[.]169[.]210
66[.]0[.]135[.]16
66[.]109[.]21[.]182
66[.]111[.]37[.]26
66[.]116[.]58[.]230
66[.]124[.]120[.]193
66[.]129[.]222[.]10
66[.]139[.]186[.]199
66[.]140[.]144[.]70
66[.]153[.]20[.]170
66[.]159[.]250[.]224
66[.]178[.]7[.]201
66[.]181[.]65[.]4
66[.]197[.]231[.]160
66[.]197[.]242[.]218
66[.]197[.]242[.]221
66[.]197[.]242[.]222
66[.]199[.]231[.]210
66[.]199[.]231[.]243
66[.]202[.]107[.]117
66[.]202[.]29[.]73
66[.]220[.]10[.]72
66[.]220[.]10[.]93
66[.]220[.]242[.]230
66[.]228[.]114[.]54
66[.]235[.]214[.]66
66[.]35[.]32[.]70
66[.]36[.]28[.]222
66[.]39[.]205[.]171
66[.]52[.]140[.]13
66[.]55[.]14[.]77
66[.]59[.]109[.]179
66[.]79[.]165[.]158
66[.]92[.]181[.]123
66[.]92[.]241[.]200
66[.]93[.]151[.]226
66[.]93[.]75[.]206
67[.]102[.]105[.]76
67[.]102[.]7[.]4
67[.]107[.]22[.]67
67[.]112[.]49[.]250
67[.]114[.]87[.]218
67[.]135[.]235[.]198
67[.]159[.]164[.]124
67[.]159[.]49[.]188
67[.]159[.]8[.]36
67[.]210[.]105[.]137
67[.]210[.]105[.]216
67[.]210[.]68[.]122
67[.]215[.]163[.]66
67[.]215[.]181[.]130
67[.]215[.]181[.]150
67[.]222[.]165[.]4
67[.]42[.]55[.]113
67[.]76[.]57[.]77
67[.]77[.]204[.]97
67[.]91[.]212[.]115
67[.]93[.]1[.]197
67[.]93[.]1[.]204
67[.]93[.]1[.]228
67[.]93[.]15[.]229
67[.]93[.]15[.]235
67[.]93[.]15[.]240
67[.]93[.]16[.]219
67[.]93[.]255[.]249
67[.]93[.]3[.]3
67[.]93[.]30[.]146
67[.]93[.]30[.]189
67[.]93[.]4[.]27
67[.]93[.]4[.]71
67[.]93[.]4[.]72
67[.]93[.]4[.]89
67[.]93[.]54[.]130
67[.]93[.]54[.]98
69[.]105[.]31[.]51
69[.]106[.]172[.]188
69[.]175[.]28[.]12
69[.]2[.]43[.]123
69[.]2[.]71[.]205
69[.]20[.]125[.]16
69[.]20[.]20[.]129
69[.]20[.]5[.]213
69[.]20[.]57[.]71
69[.]3[.]160[.]20
69[.]3[.]160[.]30
69[.]3[.]160[.]50
69[.]3[.]160[.]60
69[.]48[.]233[.]181
69[.]48[.]233[.]187
69[.]57[.]60[.]42
69[.]68[.]56[.]35
69[.]69[.]94[.]20
69[.]72[.]146[.]33
69[.]94[.]112[.]253
69[.]94[.]65[.]101
69[.]94[.]69[.]101
70[.]166[.]13[.]132
70[.]166[.]13[.]148
70[.]168[.]88[.]230
70[.]85[.]134[.]234
70[.]86[.]77[.]114
70[.]89[.]213[.]145
70[.]89[.]213[.]181
70[.]89[.]213[.]201
70[.]89[.]213[.]22
70[.]89[.]213[.]227
70[.]89[.]213[.]241
70[.]89[.]213[.]249
70[.]89[.]213[.]66
70[.]90[.]53[.]170
71[.]183[.]201[.]26
71[.]2[.]214[.]46
71[.]4[.]109[.]162
71[.]8[.]243[.]14
71[.]8[.]243[.]16
72[.]148[.]171[.]41
72[.]151[.]101[.]55
72[.]167[.]146[.]235
72[.]167[.]34[.]212
72[.]167[.]37[.]238
72[.]167[.]47[.]217
72[.]22[.]11[.]2
72[.]242[.]187[.]211
72[.]242[.]59[.]164
72[.]248[.]173[.]82
72[.]248[.]239[.]146
72[.]32[.]197[.]150
72[.]35[.]85[.]32
72[.]37[.]215[.]244
72[.]52[.]116[.]106
72[.]52[.]209[.]143
72[.]52[.]209[.]145
72[.]52[.]221[.]158
72[.]93[.]90[.]44
74[.]10[.]186[.]7
74[.]112[.]123[.]171
74[.]117[.]58[.]92
74[.]117[.]60[.]141
74[.]117[.]62[.]210
74[.]117[.]62[.]88
74[.]117[.]63[.]250
74[.]208[.]111[.]135
74[.]208[.]148[.]125
74[.]208[.]65[.]251
74[.]208[.]67[.]95
74[.]213[.]40[.]2
74[.]52[.]63[.]114
74[.]52[.]63[.]138
75[.]146[.]252[.]217
75[.]146[.]252[.]218
75[.]148[.]254[.]115
75[.]149[.]183[.]228
75[.]52[.]111[.]62
75[.]77[.]82[.]225
75[.]77[.]82[.]242
75[.]77[.]82[.]70
76[.]12[.]37[.]97
76[.]164[.]171[.]3
76[.]164[.]171[.]5
76[.]164[.]171[.]6
76[.]76[.]146[.]89
76[.]76[.]54[.]137
8[.]4[.]112[.]2
82[.]165[.]181[.]105
83[.]238[.]134[.]58
87[.]229[.]126[.]60
89[.]175[.]175[.]186
89[.]175[.]175[.]187
89[.]175[.]175[.]188
93[.]152[.]156[.]106
96[.]10[.]19[.]210
96[.]47[.]232[.]16
96[.]47[.]232[.]161
96[.]57[.]145[.]11
98[.]110[.]71[.]108
98[.]126[.]0[.]12
98[.]126[.]0[.]163
98[.]126[.]10[.]124
98[.]126[.]103[.]164
98[.]126[.]106[.]19
98[.]126[.]114[.]4
98[.]126[.]15[.]250
98[.]126[.]18[.]74
98[.]126[.]18[.]82
98[.]126[.]18[.]83
98[.]126[.]19[.]163
98[.]126[.]203[.]45
98[.]126[.]21[.]116
98[.]126[.]25[.]35
98[.]126[.]28[.]245
98[.]126[.]3[.]235
98[.]126[.]3[.]236
98[.]126[.]3[.]237
98[.]126[.]41[.]178
98[.]126[.]5[.]35
98[.]126[.]6[.]104
98[.]126[.]6[.]105
98[.]126[.]66[.]147
98[.]126[.]68[.]186
98[.]126[.]7[.]220
98[.]126[.]7[.]250
98[.]126[.]7[.]251
98[.]126[.]91[.]27
98[.]126[.]97[.]197
99[.]13[.]110[.]214
99[.]4[.]102[.]249

******************************
Domain Name Awareness List
******************************

a-af[.]arrowservice[.]net
able[.]arrowservice[.]net
a-cl[.]arrowservice[.]net
a-dl[.]arrowservice[.]net
admin[.]arrowservice[.]net
adtkl[.]bigish[.]net
adtkl[.]gmailboxes[.]com
a-ep[.]arrowservice[.]net
a-ex[.]arrowservice[.]net
a-f[.]gmailboxes[.]com
afghanistan[.]toutges[.]us
aga[.]toh[.]info
a-gon[.]arrowservice[.]net
a-he[.]arrowservice[.]net
a-if[.]arrowservice[.]net
a-iho[.]arrowservice[.]net
aiic[.]arrowservice[.]net
a-ip[.]arrowservice[.]net
ait[.]busketball[.]com
alarm[.]arrowservice[.]net
amne[.]purpledaily[.]com
ams[.]busketball[.]com
a-ne[.]arrowservice[.]net
anglo[.]arrowservice[.]net
aol[.]arrowservice[.]net
a-ol[.]arrowservice[.]net
apejack[.]bigish[.]net
a-pep[.]arrowservice[.]net
a-rdr[.]arrowservice[.]net
arm[.]armed[.]us
ascn[.]arrowservice[.]net
asp[.]arrowservice[.]net
asp[.]busketball[.]com
a-te[.]arrowservice[.]net
atom[.]busketball[.]com
atomic[.]bigish[.]net
a-uac[.]arrowservice[.]net
auto[.]gmailboxes[.]com
a-za[.]arrowservice[.]net
backsun[.]busketball[.]com
barity[.]gmailboxes[.]com
bass[.]busketball[.]com
bbs[.]busketball[.]com
bbs[.]marsbrother[.]com
bda[.]arrowservice[.]net
blacman[.]busketball[.]com
blog[.]arrowservice[.]net
blog[.]busketball[.]com
bring[.]busketball[.]com
built[.]arrowservice[.]net
busketball[.]com
buycow[.]busketball[.]com
buyer[.]arrowservice[.]net
buywater[.]busketball[.]com
bwbc[.]bigish[.]net
center[.]arrowservice[.]net
chamus[.]gmailboxes[.]com
cirfsun[.]gmailboxes[.]com
city[.]gmailboxes[.]com
class[.]arrowservice[.]net
cleanbeef[.]gmailboxes[.]com
cliffkl[.]gmailboxes[.]com
cmf[.]busketball[.]com
cmf[.]gmailboxes[.]com
cmp[.]gmailboxes[.]com
contact[.]arrowservice[.]net
contact[.]bigish[.]net
corn[.]busketball[.]com
cov[.]arrowservice[.]net
covclient[.]arrowservice[.]net
cow[.]arrowservice[.]net
cowboy[.]bigish[.]net
crab[.]arrowservice[.]net
ctimoon[.]marsbrother[.]com
ctisu[.]bigish[.]net
ctisun[.]gmailboxes[.]com
ctx[.]bigish[.]net
ctx-na[.]purpledaily[.]com
cws[.]gmailboxes[.]com
date[.]gmailboxes[.]com
dec[.]globalsecuriy[.]org
default[.]arrowservice[.]net
demavda[.]arrowservice[.]net
diaup[.]gmailboxes[.]com
diplomatism[.]nsmp[.]ru
documents[.]busketball[.]com
domain[.]arrowservice[.]net
domain[.]busketball[.]com
dowjs[.]busketball[.]com
dowjs[.]gmailboxes[.]com
download[.]gmailboxes[.]com
downupdate[.]bigish[.]net
dowph[.]bigish[.]net
drb[.]arrowservice[.]net
drinkwater[.]gmailboxes[.]com
eatbeef[.]gmailboxes[.]com
eciie[.]marsbrother[.]com
ecliar[.]marsbrother[.]com
eclimx[.]marsbrother[.]com
ecli-mxcdb[.]arrowservice[.]net
ecli-newf[.]marsbrother[.]com
ecli-noa[.]marsbrother[.]com
ecli-tda[.]marsbrother[.]com
ecli-tmp[.]marsbrother[.]com
ecli-un[.]marsbrother[.]com
eshop[.]gmailboxes[.]com
ever[.]arrowservice[.]net
fbtel[.]gmailboxes[.]com
finekl[.]bigish[.]net
fme[.]busketball[.]com
fmp[.]bigish[.]net
fn[.]bigish[.]net
follow[.]purpledaily[.]com
food[.]busketball[.]com
foreignpolicy[.]zonet[.]us
free[.]gmailboxes[.]com
frickl[.]purpledaily[.]com
friends[.]arrowservice[.]net
fsol[.]businessformars[.]com
ftel[.]businessformars[.]com
gao[.]gaokew[.]com
gatu[.]arrowservice[.]net
gg[.]arrowservice[.]net
gl[.]gmailboxes[.]com
glj[.]purpledaily[.]com
gmailboxes[.]com
happy[.]arrowservice[.]net
help[.]gmailboxes[.]com
hill[.]arrowservice[.]net
home[.]arrowservice[.]net
honeywater[.]keren[.]la
host[.]arrowservice[.]net
house[.]gmailboxes[.]com
index[.]arrowservice[.]net
info[.]bigish[.]net
info[.]hj-spa[.]com
information[.]trickip[.]org
int[.]busketball[.]com
intel[.]busketball[.]com
intel[.]gmailboxes[.]com
invest[.]gmailboxes[.]com
itlove[.]bigish[.]net
jackhouse[.]bigish[.]net
junier[.]busketball[.]com
kbwfj[.]arrowservice[.]net
klbis[.]bigish[.]net
kl-hqun[.]gmailboxes[.]com
kllhd[.]bigish[.]net
klwest[.]purpledaily[.]com
klzafin[.]bigish[.]net
loading[.]bigish[.]net
love[.]arrowservice[.]net
love[.]busketball[.]com
lovecow[.]homenet[.]org
lovewater[.]now[.]im
mail[.]bigish[.]net
mail[.]gmailboxes[.]com
mail-na[.]businessformars[.]com
main[.]busketball[.]com
main[.]gmailboxes[.]com
max[.]arrowservice[.]net
mbc[.]busketball[.]com
mc[.]bigish[.]net
me[.]busketball[.]com
micyuisyahooapis[.]com
midstate[.]arrowservice[.]net
milk[.]arrowservice[.]net
mini[.]arrowservice[.]net
miss[.]pwnz[.]org
mko[.]busketball[.]com
mkx[.]arrowservice[.]net
mkx[.]gmailboxes[.]com
monewf[.]bigish[.]net
monlc[.]marsbrother[.]com
mos[.]arrowservice[.]net
moto[.]busketball[.]com
mpe[.]arrowservice[.]net
msdn[.]bigish[.]net
new[.]arrowservice[.]net
newfe[.]purpledaily[.]com
news[.]busketball[.]com
newspappers[.]org
nokkia[.]bigish[.]net
nousage[.]arrowservice[.]net
nrcod[.]arrowservice[.]net
oliver[.]arrowservice[.]net
omin[.]marsbrother[.]com
ope[.]coastmaritime[.]org
opp[.]coastmaritime[.]org
opp[.]globalsecuriy[.]org
orca[.]arrowservice[.]net
paekl[.]gmailboxes[.]com
pdns[.]info[.]tm
phb[.]arrowservice[.]net
pieckl[.]bigish[.]net
point[.]gmailboxes[.]com
ppt[.]arrowservice[.]net
ppt[.]ezua[.]com
purpledaily[.]com
qhun-mons[.]businessformars[.]com
records[.]marsbrother[.]com
release[.]busketball[.]com
repid[.]arrowservice[.]net
rfckl[.]bigish[.]net
rice[.]bigish[.]net
rixiokl[.]bigish[.]net
russiaactions[.]summitnato[.]ro
saltlakenews[.]org
sbasun[.]busketball[.]com
scpkl[.]bigish[.]net
sea[.]arrowservice[.]net
service[.]arrowservice[.]net
service[.]purpledaily[.]com
services[.]busketball[.]com
services[.]gmailboxes[.]com
skill[.]arrowservice[.]net
sksucc[.]arrowservice[.]net
sona[.]arrowservice[.]net
spckl[.]bigish[.]net
spcmon[.]marsbrother[.]com
sremx[.]bigish[.]net
ssun[.]arrowservice[.]net
stock[.]bigish[.]net
stoneal[.]bigish[.]net
stulaw[.]bigish[.]net
stuwal[.]gmailboxes[.]com
suicide[.]suicide-forum[.]com
sun[.]arrowservice[.]net
suncirf[.]bigish[.]net
suntop[.]arrowservice[.]net
sword[.]bigish[.]net
tclient[.]arrowservice[.]net
tia[.]gmailboxes[.]com
topbox[.]gmailboxes[.]com
topbus[.]busketball[.]com
topkl[.]bigish[.]net
topmoney[.]purpledaily[.]com
tour[.]bigish[.]net
trb[.]arrowservice[.]net
trip[.]arrowservice[.]net
ttestt[.]arrowservice[.]net
ug-rj[.]arrowservice[.]net
update[.]busketball[.]com
updating[.]ddns[.]info
usapappers[.]com
ustop[.]bigish[.]net
vipmx[.]businessformars[.]com
vockl[.]bigish[.]net
walk[.]bigish[.]net
walstb[.]gmailboxes[.]com
was[.]arrowservice[.]net
wasa[.]arrowservice[.]net
wcasekl[.]gmailboxes[.]com
web[.]arrowservice[.]net
weblog[.]bigish[.]net
webmail[.]arrowservice[.]net
westjoe[.]purpledaily[.]com
westking[.]bigish[.]net
westnew[.]marsbrother[.]com
what[.]arrowservice[.]net
whl[.]bigish[.]net
wk[.]gmailboxes[.]com
works[.]myddns[.]com
workstation[.]arrowservice[.]net
www[.]arrowservice[.]net
www[.]globalsecuriy[.]org
www-01[.]marsbrother[.]com
www-02[.]marsbrother[.]com
www2[.]dsmtp[.]com
www2[.]wikaba[.]com
www-dell[.]marsbrother[.]com
www-hp[.]marsbrother[.]com
www-ibm[.]busketball[.]com
wwww[.]arrowservice[.]net
zgrshy[.]zyns[.]com
zgrshy10[.]zyns[.]com
zgrshy11[.]zyns[.]com

******************************
Malware Indicator Awareness List
******************************

MD5 Checksum

242946ed32dc3749e5b4f7827b905e5e
b2ddcf194cacc69ee7bcd3f9989f6162
5c58a8d8cab00ad3fac419da03644b59
1cc0ce317edad8521c236c84b74e14f8
9d42ce823fc711eaeb542f4050f17125
8845cb5b4e450cb10a3b6ca41a9b4319
1fe90bd6a1092ec74f78181785e785f8
a6e7504315f5dada56189635cd7a27b1
957b13cffeea1722a2369e2bb5e79287
0e98cffc64a1e822946066f62e1fd02c
1a87d955bc876098f50b8a48d8db4aaf
a207590fdcec8018c5a902483b651302
9087f73602d81be177b568e15f6b033b
a884545277cae36928f36c372f6a18ac
051967e8a92a6e1b02a6c8b2225b01c5
314d5943e55c065e40f3a20ab56de7a3
697b18e734740ad9129ebd241040492a
7f7cc1a8d7a6bbe6a52c94bb7f41f727
b8988e23d4d8427584637d1f9ab78a8e
e6446d52e9f4b5c2c5a9ac850281cae8
bf778439895829ff986207900bfcfe02
1d69504a3d3ac32275fa4df8af25d1f7
cf96139290c09963a32506cd85825ed3
3b266b165468b810cd456cdf88ca8619
88c0e5a4ca408ac12acaaf7a9ef9eb49
08ac41ce00bf436a3dc23c4639d5f5ed
2a8f14ed1cb6fdb49ab946fc54fc8c86
4a54d7878d4170c3d4e3c3606365c42c
659fb07c70034571de7a1b4b5ac86b01
7c6443e646c973ac10a1048d521a70a9
82c598abdf848c6fef03c63f5cf7feaf
888eadff6982de01c60891ce185473b7
9a847c1f54359ffd3c335e97600f6f5d
a19e68e72084d867a39776faaa6f5fce
e27f0975fd3278e7303102783767c508
d36427db95cd055a5a25f445d80c27ee
e3faff9149fed468aa63f10a40b935d6
c7f7d8bf633a1b81088315b93831e82d
7f90942ace185ca1ba5610f6eddf3376
ad95f613fc4b644bd5e3230eb0b5dbcc
4943a255952e107fec41e9c29a5b2724
c7d5845718c7fa5a777bcd801d8e00f4
34062335f95d074272a5487be37ee701
3f82f1cba90d320af90d965a321a1187
45a4141f603c8bfa7950e15a074ef976
4bc894e369f31b7190eaeb99c23eb000
55f41be09de5dcd5aaa0132804506868
6eb99bed5b5fcb3fdb26f37aff2c9adb
87cf89742ef0a1c1f76664caa6c0a1a7
b9f20ff30ce6dbb461ab6d27fe8c4bda
bcc6addece28265390b2d535d65c49b8
fc277785c49d743697adc06a3db77c5d
2de36fa400225c39481283daf4a686d8
324a7d63a178f3ac8dde5b59675ef282
37bd6fceaf412427db8c8a34c5ad9ba7
3a33dbe37292a1cbfa760d1892812e08
c243a7c1cf23b91f73100bb9e947439e
caafdafdd17abe0f0303a456bcd4ab01
e194a6d7f1aa6671d2134047050a4322
e35414a5cb10bccf6424ee51f0cdd6cc
21e35f309f7d6368fd8346ba409fab73
3fa99e50933ce584d010ec194229764a
41b551d30321a5ae1342180d1e73e82e
7cd15bb31ff889e81f370d0535e02493
9428a54a7acd6adc3f9b662ef432edf4
f82d3b270b16780044817978f4f3fe1a
22e10cbe46f406f5f1be0d613db4c2c3
a6cba31fcca49ff9ed6fd9894644de9e
48fc61a8f94c6e7c9c8965817f57af7e
00b61db083b07a64fb6072b42aa83dc1
aea5dc22e706c836d056f4ba1f13dea3
3599a78c7e99b451c00d3490f17f842f
137aad4c7c4e0d8ba0ad74c34cf8434c
14095f921f50cf639bf00b389ea79959
2d2876bd1f263babe9d09e8e950916cc
ac9e0b2af215821f7223b6eaeaea03db
c5851c22c2a2e4bccf015a20e0af6cac
c9645367f032bf12b251e4f30e21b936
cec766518fa5b607157e92e9c24c0d03
da521200a939a9fe85f467d65d419990
6428ac60d1eea0f20073cfb869674266
affc4d42a6a66f6a745c5702608d0442
c296ae9220c44e51cfbeb029b6103d1b
cfdd9241adcda8755c54032fd2b5757d
db22512d361a339cfadaa275c550b385
e2a557b39231ee91724c150e3ec4b493
491db327f479a1a34898229811fa8a5d
6b6a9062e9c74a98a1f1a2fe7c2adcd7
D46D261EC92DAF703CD584F10037198C
ce2f4abe8b4f3a57891ca865c4fe6ece
3de1bd0f2107198931177b2b23877df4
a207590fdceb8018b5a902483b651302
0ba71b7dbf0394f509ef6174faa0bbf0
1a8ee0ec99320e213432a26a91df8811
232d1be2d8cbbd1cf57494a934628504
6ae05937bce80b7d16497cb82e6a52d6
73e81b099f9b469a07063555e822dac1
39f1ac84ad939fb72cc6e438ecea9729
3a2cdf3c09c061a5cf6a58069506955a
f3c6c797ef80787e6cbeeaa77496a3cb
217c9dc682018c7055c660dd5dd0f8ca
1cb4b79e338bec06e65ff8d37de53c55
dd2aec3803ce39c4a148325d33f575e3
5474e37159b1a438659e7e5bf1f45389
48437eb28ff1bfff5c0a4661a8c3055d
310cba19e6f7fd07adf203c27e46a0c9
9cb4ee95948292be131f7c4ee3bdcf21
7ce22cb797d2940818154ce0dcc48306
53f1e2e5f0152a3a119e112b6cf5426e
204c13f7ed2d3e5c78f3ef8a44eb561c
ca6fe7a1315af5afeac2961460a80569
53f49c58613669f25921de0b6dae1268
82e0472271500713cd2457921ab1c565
93e33bf0417a857ae894ed294aa0e15a
9e5df2cfd0c8def21c9e114d1d2696dd
******************************
IP Address Awareness List
******************************

100[.]42[.]216[.]230
108[.]166[.]200[.]130
108[.]171[.]211[.]152
108[.]171[.]251[.]102
113[.]196[.]231[.]13
12[.]11[.]239[.]25
12[.]14[.]129[.]91
12[.]15[.]0[.]131
12[.]167[.]251[.]84
12[.]2[.]49[.]115
12[.]232[.]138[.]23
12[.]30[.]41[.]134
12[.]33[.]114[.]160
12[.]33[.]114[.]224
121[.]55[.]220[.]79
122[.]146[.]219[.]130
129[.]44[.]254[.]139
140[.]112[.]19[.]195
140[.]116[.]72[.]95
161[.]58[.]177[.]111
161[.]58[.]93[.]50
163[.]20[.]172[.]230
172[.]254[.]222[.]138
173[.]10[.]39[.]53
173[.]160[.]48[.]149
173[.]163[.]133[.]177
173[.]224[.]213[.]184
173[.]224[.]213[.]247
173[.]224[.]215[.]177
173[.]231[.]45[.]231
173[.]254[.]222[.]138
199[.]119[.]201[.]124
203[.]170[.]198[.]56
204[.]11[.]236[.]81
204[.]111[.]73[.]150
204[.]111[.]73[.]155
204[.]12[.]248[.]2
204[.]13[.]68[.]10
204[.]14[.]142[.]210
204[.]14[.]88[.]45
204[.]215[.]64[.]28
204[.]249[.]169[.]4
204[.]249[.]169[.]5
204[.]45[.]16[.]204
204[.]74[.]218[.]145
204[.]9[.]208[.]14
205[.]159[.]83[.]12
205[.]209[.]161[.]13
205[.]209[.]172[.]204
205[.]234[.]168[.]48
207[.]173[.]155[.]44
207[.]36[.]209[.]221
207[.]40[.]43[.]102
207[.]71[.]209[.]148
208[.]109[.]50[.]151
208[.]185[.]233[.]163
208[.]239[.]156[.]123
208[.]37[.]108[.]211
208[.]53[.]100[.]162
208[.]68[.]171[.]220
208[.]69[.]32[.]231
208[.]77[.]45[.]131
208[.]77[.]45[.]142
208[.]77[.]45[.]82
208[.]77[.]51[.]210
208[.]87[.]241[.]135
209[.]113[.]219[.]6
209[.]18[.]107[.]90
209[.]208[.]114[.]83
209[.]208[.]95[.]7
209[.]247[.]221[.]40
209[.]247[.]221[.]50
209[.]25[.]220[.]42
209[.]74[.]45[.]226
209[.]75[.]160[.]64
210[.]244[.]193[.]249
211[.]21[.]210[.]220
216[.]1[.]59[.]4
216[.]143[.]158[.]107
216[.]145[.]228[.]153
216[.]213[.]199[.]194
216[.]215[.]103[.]2
216[.]36[.]123[.]11
216[.]62[.]168[.]249
216[.]65[.]11[.]111
218[.]32[.]87[.]100
219[.]87[.]141[.]74
24[.]249[.]171[.]231
46[.]105[.]227[.]80
50[.]62[.]130[.]15
58[.]86[.]239[.]103
60[.]251[.]74[.]9
61[.]218[.]144[.]43
61[.]221[.]67[.]184
63[.]102[.]52[.]130
63[.]111[.]125[.]50
63[.]114[.]150[.]17
63[.]120[.]209[.]85
63[.]126[.]244[.]253
63[.]134[.]229[.]137
63[.]134[.]229[.]138
63[.]134[.]233[.]60
63[.]134[.]233[.]62
63[.]138[.]249[.]244
63[.]139[.]221[.]130
63[.]139[.]221[.]26
63[.]147[.]185[.]40
63[.]147[.]31[.]178
63[.]162[.]4[.]2
63[.]162[.]42[.]46
63[.]163[.]61[.]9
63[.]171[.]89[.]5
63[.]195[.]112[.]159
63[.]200[.]159[.]118
63[.]211[.]192[.]150
63[.]211[.]192[.]181
63[.]225[.]225[.]42
63[.]228[.]128[.]19
63[.]245[.]62[.]11
63[.]246[.]147[.]11
63[.]64[.]175[.]136
63[.]73[.]10[.]130
63[.]73[.]11[.]15
63[.]82[.]1[.]226
63[.]84[.]24[.]72
63[.]84[.]24[.]77
63[.]97[.]51[.]121
64[.]122[.]68[.]213
64[.]126[.]12[.]2
64[.]14[.]81[.]30
64[.]184[.]2[.]3
64[.]25[.]15[.]226
64[.]32[.]164[.]43
64[.]34[.]172[.]210
64[.]4[.]217[.]138
64[.]50[.]130[.]74
64[.]65[.]230[.]242
64[.]81[.]194[.]171
64[.]81[.]252[.]163
65[.]107[.]54[.]158
65[.]112[.]75[.]130
65[.]114[.]195[.]226
65[.]116[.]58[.]5
65[.]119[.]5[.]3
65[.]124[.]105[.]76
65[.]17[.]233[.]30
65[.]207[.]215[.]10
66[.]0[.]167[.]105
66[.]153[.]38[.]202
66[.]155[.]114[.]145
66[.]16[.]75[.]201
66[.]167[.]118[.]29
66[.]179[.]156[.]10
66[.]181[.]8[.]162
66[.]23[.]224[.]213
66[.]28[.]12[.]144
66[.]55[.]14[.]78
66[.]85[.]185[.]201
66[.]92[.]12[.]252
66[.]93[.]91[.]235
67[.]102[.]7[.]3
67[.]109[.]132[.]202
67[.]109[.]90[.]99
67[.]132[.]222[.]231
67[.]133[.]107[.]131
67[.]19[.]22[.]82
67[.]88[.]107[.]8
67[.]93[.]14[.]2
68[.]165[.]209[.]227
68[.]72[.]242[.]130
69[.]11[.]244[.]91
69[.]152[.]184[.]182
69[.]20[.]4[.]85
69[.]20[.]5[.]223
69[.]20[.]6[.]142
69[.]20[.]61[.]230
69[.]25[.]176[.]110
69[.]25[.]50[.]10
69[.]28[.]168[.]10
69[.]3[.]32[.]220
69[.]39[.]133[.]114
69[.]39[.]133[.]115
69[.]39[.]133[.]117
69[.]5[.]38[.]37
69[.]53[.]120[.]170
69[.]55[.]180[.]4
69[.]69[.]94[.]3
69[.]74[.]43[.]87
69[.]90[.]123[.]6
69[.]95[.]204[.]2
70[.]62[.]232[.]98
70[.]86[.]21[.]146
71[.]130[.]117[.]49
71[.]16[.]27[.]212
71[.]6[.]141[.]230
71[.]6[.]51[.]180
71[.]6[.]51[.]181
71[.]63[.]28[.]61
72[.]167[.]162[.]96
72[.]167[.]33[.]182
72[.]22[.]11[.]30
72[.]236[.]177[.]171
72[.]242[.]59[.]163
72[.]245[.]176[.]82
72[.]9[.]145[.]216
72[.]91[.]193[.]160
72[.]94[.]51[.]6
74[.]115[.]0[.]29
74[.]115[.]6[.]20
74[.]165[.]93[.]5
74[.]200[.]213[.]110
74[.]206[.]99[.]189
74[.]208[.]227[.]72
74[.]208[.]45[.]82
74[.]211[.]195[.]39
74[.]213[.]52[.]10
74[.]55[.]160[.]98
74[.]55[.]178[.]42
74[.]63[.]87[.]106
74[.]86[.]197[.]56
74[.]86[.]31[.]98
74[.]9[.]137[.]146
74[.]92[.]102[.]227
74[.]94[.]16[.]166
74[.]94[.]52[.]114
75[.]126[.]166[.]204
75[.]145[.]139[.]19
75[.]148[.]254[.]114
75[.]52[.]208[.]225
75[.]77[.]82[.]115
75[.]77[.]82[.]219
76[.]160[.]133[.]60
76[.]161[.]97[.]99
77[.]247[.]180[.]154
94[.]195[.]239[.]81
98[.]126[.]107[.]34

******************************
Domain Name Awareness List
******************************

advanbusiness[.]com
aoldaily[.]com
applesoftupdate[.]com
arrowservice[.]net
articles[.]twilightparadox[.]com
aunewsonline[.]com
bechtel[.]chickenkiller[.]com
bigish[.]net
businessconsults[.]net
businessformars[.]com
canadatvsite[.]com
canoedaily[.]com
chileexe77[.]com
climate[.]undo[.]it
cnndaily[.]com
cnndaily[.]net
comrepair[.]net
defenceonline[.]net
downloadsite[.]me
e-cardsshop[.]com
economic[.]mooo[.]com
firefoxupdata[.]com
freshreaders[.]net
honeycow[.]keren[.]la
hugesoft[.]org
info[.]serveusers[.]com
issnbgkit[.]net
jobsadvanced[.]com
marsbrother[.]com
mcafeepaying[.]com
news[.]trickip[.]org
newsonet[.]net
newsonlinesite[.]com
niemannews[.]com
nytimesnews[.]net
pop-musicsite[.]com
rssadvanced[.]org
satellitebbs[.]com
staycools[.]net
symanteconline[.]net
thehealthmood[.]net
todayusa[.]org
upload[.]ignorelist[.]com
usabbs[.]org
usnewssite[.]com
voiceofman[.]com
work[.]myftp[.]name
yahoodaily[.]com

MS-ISAC Intel Paper: Common Cyber Threats to Universities

Common Cyber Threats to Universities

Rate this:

Share this:

Rate this:

Share this:

Global Extremists Conducting Cyber Activity in Support of ISIL

Rate this:

Share this:

Hacienda, Mugshot, Olympia, ORB – Slides and Graphics

The HACIENDA Programm

Background: The TCP Three-Way Handshake

The Authors

The Enemy Online

Every device a target

Internet Colonization

Knocking down the HACIENDA

TCP Stealth

Installation

Enabling Knock Using LD PRELOAD

Using TCP Stealth via setsockopt()

Limitations

Summary

Rate this:

Share this:

Das HACIENDA-Programm

Hintergrund: Der TCP Three-Way Handshake

Die Autoren:

Der Feind im Netz

Jedes Gerät ein Ziel

Die Kolonialisierung des Internet

Kontrollverlust

Knock: Eine Abrissbirne für HACIENDA

TCP Stealth

Die Installation von TCP Stealth

Einschalten von Knock mit LD PRELOAD

Benutzung von TCP Stealth mit setsockopt()

Die Grenzen der Technik

Politische Lösungen sind gefragt

Rate this:

Share this:

Rate this:

Share this:

U.S. Strategic Command Cyber Warfare Lexicon

Rate this:

Share this:

FBI Cyber Division Bulletin: Health Care Systems and Medical Devices at Risk for Increased Cyber Intrusions

Health Care Systems and Medical Devices at Risk for Increased Cyber Intrusions for Financial Gain

Rate this:

Share this:

Rate this:

Share this:

FM 3-38 Cyber Electromagnetic Activities

Rate this:

Share this:

Rate this:

Share this:

Rate this:

Share this:

Defense Security Service Cybersecurity Operations Division

Rate this:

Share this:

Rate this:

Share this: