cyber warfare | emptywheel

Side by Side: Timeline of NSA’s Communications Collection and Cyber Attacks

By: Rayne Friday June 7, 2013 2:15 pm

In all the reporting and subsequent hubbub about the National Security Administration’s ongoing collection of communications, two things stood out as worthy of additional attention:

— Collection may have been focused on corporate metadata;

— Timing of NSA’s access to communications/software/social media firms occurred alongside major cyber assault events, particularly the release of Stuxnet, Flame, and Duqu.

Let’s compare timelines; keep in mind these are not complete.

Date	NSA/Business	Cyber Attacks
11-SEP-2007	Access to MSFT servers acquired
15-NOV-2007		Stuxnet 0.5 discovered in wild
XX-DEC-2007		File name of Flame’s main component observed

12-MAR-2008	Access to Yahoo servers acquired
All 2008 (into 2009)		Adobe applications suffer from 6+ challenges throughout the year, including attacks on Tibetan Government in Exile via Adobe products.

11-JAN-2009		Stuxnet 0.5 “ends” calls home
14-JAN-2009	Access to Google servers acquired
Mid-2009		Operation Aurora attacks begin; dozens of large corporations confirming they were targets.
03-JUN-2009	Access to Facebook servers acquired
22-JUN-2009		Date Stuxnet version 1.001 compiled
04-JUL-2009		Stuxnet 0.5 terminates infection process
07-DEC-2009	Access to PalTalk servers acquired
XX-DEC-2009		Operation Aurora attacks continue through Dec 2009

12-JAN-2010		Google discloses existence of Operation Aurora, said attacks began in mid-December 2009
13-JAN-2010		Iranian physicist killed by motorcycle bomb
XX-FEB-2010		Flame operating in wild
10-MAR-2010		Date Stuxnet version 1.100 compiled
14-APR-2010		Date Stuxnet version 1.101 compiled
15-JUL-2010		Langner first heard about Stuxnet
19-SEP-2010		DHS, INL, US congressperson informed about threat posed by “Stuxnet-inspired malware”
24-SEP-2010	Access to YouTube servers acquired
29-NOV-2010		Iranian scientist killed by car bomb

06-FEB-2011	Access to Skype servers acquired
07-FEB-2011		AOL announces agreement to buy HuffingtonPost
31-MAR-2011	Access to AOL servers acquired
01-SEP-2011		Duqu worm discovered

XX-MAY-2012		Flame identified
08-JUN-2012		Date on/about “suicide” command issued to Flame-infected machines
24-JUN-2012		Stuxnet versions 1.X terminate infection processes
XX-OCT-2012	Access to Apple servers acquired (date NA)

Again, this is not everything that could be added about Stuxnet, Flame, and Duqu, nor is it everything related to the NSA’s communications collection processes. Feel free to share in comments any observations or additional data points that might be of interest.

Please also note the two deaths in 2010; Stuxnet and its sibling applications were not the only efforts made to halt nuclear proliferation in Iran. These two events cast a different light on the surrounding cyber attacks.

Lastly, file this under “dog not barking”:

Why aren’t any large corporations making a substantive case to their customers that they are offended by the NSA’s breach of their private communications through their communications providers?

Fear, Uncertainty, and Doubt: the Real Cyber Attack on the Truth [UPDATE]

By: Rayne Monday January 14, 2013 1:00 pm

[photo: cdrummbks via Flickr]

[UPDATE - see end of article.]

One weaselly senator–with long-identified agendas and a pathetically thin understanding of technology–takes to the microphone. Suddenly, by virtue of wrapping his senatorial lips around a few scary words on topics about which he knows little, we citizens are supposed to quake in fear and plead for salvation.

Screw that noise. This is textbook “fear, uncertainty, and doubt” — more commonly referred to as FUD in the information technology industry.

Since the 1970s, FUD tactics have used to suppress competition in the computer marketplace, targeting both hardware and software. Roger Irwin explained,

…It is a marketing technique used when a competitor launches a product that is both better than yours and costs less, i.e. your product is no longer competitive. Unable to respond with hard facts, scare-mongering is used via ‘gossip channels’ to cast a shadow of doubt over the competitors offerings and make people think twice before using it.In general it is used by companies with a large market share, and the overall message is ‘Hey, it could be risky going down that road, stick with us and you are with the crowd. Our next soon-to-be-released version will be better than that anyway’. …

FUD has non-technology applications as well; one need only look at product and service brands that encourage doubts about using any product other than their own, in lieu of actually promoting the advantages their product or service might have.

So what’s the FUD about? Senator Joe Lieberman spouted off about cyber attacks in September last year, claiming Iran was behind disruptive efforts targeting U.S. banks.

Right. Uh-huh. Predictable, yes?

But FUD is used in situations where there is competition, one might point out. Yes, exactly; in September 2012, the case for support of unilateral attacks against Iran was up against the news cycle crush, powered by the post-Benghazi fallout and the drive toward the November general election, followed by the terror that was the “fiscal cliff.” That’s a lot of powerful, compelling competition for both attention, votes, and tax dollars, when members of a reliable but lame duck Congress could be mounting up a pre-emptive cyber war without the headwind of public awareness and resistance, or the too-inquisitive pushback from newbies in the next seated Congress. Continue reading →

Blowback: Stuxnet and the Ongoing Risk to Manufacturing Worldwide

By: Rayne Saturday November 10, 2012 6:15 pm

Dear Chevron: Thanks for letting us know you’ve been infected with Stuxnet. It’s difficult to muster sympathy for your management or shareholders, because you were warned.This guy quite clearly warned your industry, as did other firms specializing in technology security.

Every single manufacturer around the world using supervisory control and data acquisition (SCADA) driven equipment in their processes was warned. Businesses at particular risk are those relying on certain ubiquitous applications in a networked environment.

Perhaps you heeded the warning months ago but didn’t disclose widely that your business was working on eliminating the exposures. If your business has been hardening your systems, great. However, the public does have a right to know know if your plant located in their backyard might blow up or release toxic chemicals because your firm was exposed to cyber warfare elements our country sponsored in some fashion.

This goes for any other firms out there that are dealing with the same exposure. Perhaps you believe it’s a business intelligence risk to let your competitors know you’ve got a problem– frankly, we’re way past that. The potential risks to the public outweigh your short-term profitability, and if your plant blows up/dumps chemicals/produces unsafe or faulty products because of Stuxnet, our public problem becomes your public relations/long-term shareholder value problem anyhow.

By the way: perhaps it might be worthwhile to actively recruit American citizens who qualify for security clearance when hiring SCADA application analysts to fix your Stuxnet problems. Why compound your problem for lack of foresight with regard to national security risks? We can see you’re hiring. Ahem. Continue reading →