Stuxnet and Flame

Depiction of a compartmented "Behind the Green Door" US secure communications center (Photo credit: Wikipedia)

Cyberwarfare is getting interesting, and not just because of what it means for "traditional" international relations.  Increasingly, it looks like anyone can run a serious cyber-espionage operation.  How long until these tools are in the hands of more non-state actors?  When do they become a major tool in domestic politics?  IntelNews reviews the situation.  Excerpts:

Stuxnet, which caused unprecedented waves of panic among Iranian cybersecurity experts, was 500 kilobytes in size. Flame is over 20 megabytes in size, consisting of 650,000 lines of code; it is so complex that it is expected to take programming analysts around a decade to fully comprehend. The two are different, of course. Stuxnet was an infrastructure-sabotaging malware, which destroyed hundreds —maybe even thousands—of Iranian nuclear centrifuges. Flame, on the other hand, appears to be an espionage tool: it aims to surreptitiously collect information from infected systems.

Both, of course, were directed against Iran.  But they don't end there.

...there is no little doubt that Flame’s handlers have collected massive amounts of intelligence for at least two years. The program was apparently able to record conversations conducted over Skype; take desktop snapshots every 15 seconds or so; and collect usernames and passwords, among other capabilities. And all that while circumventing even the strongest antivirus software. But there is also the other side of the equation: as in the case of Stuxnet, Flame is now effectively freeware. Anyone can ostensibly access it, copy it, modify it, and re-launch it against his or her target of choice...

Cover via Amazon

Over 100 Israeli systems are already reported to have been infected by Flame, as well as systems in several other countries in the region.  The United States?  I have found no conclusive reports one way or another.  And even then, we'd have to distinguish between government and corporate and other systems.  But the "freeware" aspect intrigues me.  How much trouble would it be for the next PFC Manning to insert a version of Flame into SIPRNet?  Or something more restricted?  I can't help but wonder how many cyberactivsts are pouring over the code.

Are we approaching the land of "No More Secrets"?  Is this The Transparent Society discussed by Brin?  Not really, if only for the reason that those who uncover secrets may not be able to understand what they have, or may choose not to share it with the world.  But it does raise the prospect that while the NSA plugs away at monitoring everything we do, there might be a lot more states and non-state actors doing the same to them.  How will that change the game?

Comment: Who authored computer virus that ‘dwarfs Stuxnet’? « intelNews.org

Related articles

• Sworn Declaration of Whistleblower William Binney on NSA Domestic Surveillance Capabilities

  ---

• Experts: U.S. Cyber War on Iran Has Just Begun

  ---

• Confirmed: Flame created by US and Israel to slow Iranian nuke program

  ---

• Development timeline key to linking Stuxnet, Flame malware

  ---

Anonymous strikes again

Anonymous disrupted the website of the Greek Ministry of Justice late last month.

The message, in greek (of course) is supposed to read something like this (and note that I've taken some liberties to make the translation flow better):

Citizens of Greece

     We are Anonymous.
     We watch every day as your government abolishes the constitution and institutions of the country.
     We see them leading you closer and closer to poverty.
     We see them pass laws that deprive you of any right to dignity.
     We see them deliver the country to the IMF and the bankers.
     We know about the soup kitchens in schools,
     for people who are left jobless and now wait in queues for a plate of food.
     We know that your country voted for ACTA in your effort to silence other Greeks.
     We know everything ...
     The Republic in Greece has died.
     It died with a government that has not been elected by the people.
     And for this reason the time for discussion came and went.
     Not negotiating anything with any of those who murdered it.
     You can hunt as you like, you can even capture some of us,
     But when you attempt to silence us ...
     For every one that will you capture 3 others will spring up. Five or ten or a hundred.
     Now the Greeks are all Anonymous.
     We are millions against you and the 300.  In this war tear gas will not help you.

     To the Occupying Government of Greece
     These days is going to vote for a bill that will be the last nail in the coffin of Greece.
     A bill to return the country to a totalitarian rule.
     To bring the country and its people in absolute poverty.
     We will not allow more misery to the Greek people.
     We demand your resignation immediately, and elections.
     We demand that not a cent be paid to your moneylender 'friends.'
     We demand the immediate withdrawal of the IMF from Greece.
     Justice Department, this is only a small sample of what we're capable of doing.
     You have not seen the full wrath of Anonymous.
     For each article of a bill that would shame the vote,
     we will shut down the system and delete the Internal Revenue debts of Greek citizens.
     Debts which requires them to pay the fascists.
     The demonstrations of the Greeks have had their encounter with incredible violence,
     anexelekta hitting, but the internet is our field. And we love this war.
     We are many and we will be swift.

     Citizens of Greece, Anonymous is now fighting on your side ... 

     Government of Greece, let us wait ...

     E X P E C T  U S !

     J U S T I C E  I S  C O M I N G !

The Greek police announced the arrest of three teenagers for the hack.  But the meme goes on--Anonymous has brought down the MoJ website with a DDoS attack, in retribution for the arrests.

In other news, several members of LulzSec, the group that left Anonymous to follow its own agenda--including the recent hack of Stratfor--have been arrested.  It seems that the FBI was able to get one leader to turn on his buddies.  The organization may be crippled.  That is what happens when you start moving from leaderless resistance to a collection of leaders and followers.

Related articles

• Anonymous Attacks Greek Ministry of Justice Website (ibtimes.com)
• Greece steps up pressure in uncertain bond deal (sfgate.com)
• Greek police is going after three teen Anonymous members (thenextweb.com)
• Greek police say schoolboys behind hacking attack (seattlepi.com)
• Anonymous Hacks Public Intelligence in "Friendly Audit" (publicintelligence.net)
• STRATFOR hacked by Anonymous--and so was I (secureliberty.blogspot.com)
• Anonymous Take Down Greek Ministry of Justice Site (techfleece.com)
• Do You Like Online Privacy? You May Be a Terrorist (publicintelligence.net)

A few "secrets"

This is stuff I've already seen in the public domain, but the article at Danger Room does a good job of summing up some of the "secret" military and intelligence programs most people don't hear about.

I gotta wonder what hasn't been revealed (yet).

Boldly going where we've never been before

From the Institute for the Future, a visualization of trends and where they may be leading us

A look at 'the future of science: 2021, from CNN.com

Would anyone care to speculate on what some of these imply for politics and economics?  It sometimes seems like most political discussion is analogous to medieval debates over angels, pins, and biblical interpretation.  I suppose it seems important in its own context, but the world is passing it by.

I really hope this works

From The Guardian

Iceland is crowdsourcing its new constitution.

In creating the new document, the council has been posting draft clauses on its website every week since the project launched in April. The public can comment underneath or join a discussion on the council's Facebook page.

The council also has a Twitter account, a YouTube page where interviews with its members are regularly posted, and a Flickr account containing pictures of the 25 members at work, all intended to maximise interaction with citizens.

Meetings of the council are open to the public and streamed live on to the website and Facebook page. The latter has more than 1,300 likes in a country of 320,000 people.

The crowdsourcing follows a national forum last year where 950 randomly selected people spent a day discussing the constitution. If the committee has its way the draft bill, due to be ready at the end of July, will be put to a referendum without any changes imposed by parliament – so it will genuinely be a document by the people, for the people.

Comment: Randomly-selected councils. Meetings open to the public. All the usual social media sites. This could prove to be very interesting.

The next power in manned space flight: Denmark?

Or is it better thought of as an open-source space program?

A team of Danish volunteers has built a rocket capable of carrying a human into space, and will be launching it in a week's time. The project, which has been funded entirely by donations and sponsorship, is led by Kristian von Bengtson and Peter Madsen.

The rocket is named HEAT1X-TYCHO BRAHE, and its first test flight will carry a crash test dummy, rather than a human, so that the safety aspects of the design can be analysed. It'll launch from a floating platform that the team has also built, which will be towed into the middle of the Baltic sea by a submarine called Nautilus that the pair built as their last project.

The creators are members of the SomethingAwful web community, and have been posting pictures and answering questions there. In response to one question asking what the chances of the person inside dying are, they replied: "Unlike Columbia we're not moving at orbital speeds so 'dying a gruesome death burning up on re-entry' with our kit has a very low outcome probability."

Despite that, the rocket will still break the sound barrier, and subject the pilot (who is forced to stand inside the capsule) to considerable g-forces. As a result, the astronaut will only be able to move his arms, which will be able to operate a camera, the manual override functionality, the exit hatch, an additional oxygen mask and a vomit bag.

When the rocket hits the team's original target suborbital altitude of 150,000m (500,000 feet) and begins to descend again, parachutes will slow it and the team will track it with a GPS link and a "fast boat". The team said: "We should be able to receive a descent plot which can be used in projecting a splashdown ellipse pretty accurately, if we factor in wind speeds and so on."

The first test launch will be taking place on 31 August, 2010, and will set off from Denmark the previous day, as it takes about 36 hours of sailing to reach the site. The team's website is down at the time of writing, presumably due to the attention the launch is generating, but can be found at copenhagensuborbitals.com.

If successful, Denmark will be the fourth country to put one of its citizens into space, following the USA, Soviet Union and China, and the first in the world to do it without government funding.

Open source.  It's not like Denmark, the state, has much to do with it.  But that's even more amazing.

P.S.  I'd hate to be a standing passenger pulling 5g.