Flame - Stuxnet: Internet Spying?

Flame Virus in the attack                                           [Image by Curtis Edenfield]

Click here for related article [Wired Magazine]

Stuxnet was a nasty virus which disrupted Iran's nuclear IT servers and programs, reportedly a joint product of US and Israeli Intelligence.  It was joined by DuQu, an equally powerful, and of as-yet undetermined origin, but with similar capabilities to Stuxnet  -- and Flame.

And, we all went "Hurrah!" the Iranian "nuclear threat" is gone, and Netanyahu won't be able to initiate World War 3 with his belligerent saber rattling over Iran's non-existent nuclear weapon threat!

The Blue Screen of Death                    [Wikipedia]

But, now, we have FLAME! 
A whole new breed of virus 40 times more powerful than Stuxnet -- which might become the AIDS virus of the Internet.  Is it an Israeli product grown from the cooperative effort between the US and Israel which they are flaunting to the world to demonstrate they can disrupt the IT universe? 

Or, perhaps the Chinese, who have legions of hackers constantly targeting US and Allied Defense and Intelligence systems around the world?  We're concerned it might be the Chinese; but we're more worried it might be Israel acting independently.

(c) Kapersky

To date, Flame has targeted Iran, Lebanon,  Syria, Sudan, and occupied territories in Israel.  The targeting alone pretty much rules out China; why would China care about Lebanon, for example?





Stuxnet was designed to disrupt software, operating systems, and IT equipment.  The coding is similar to that now found in Flame - which covertly gathers and transmits data, and builds code to adapt to changing environments.  Flame also opens a "back door" through which to program infected computers for new espionage/sabotage tasking.  Professor Alan Woodward commented on BBC that "...it can steal everything [typed] from the keys you are pressing to what is on your screen, to what is being said near the machine.

Light years ahead of the US in electronic surveillance

Flame, only recently discovered, may be an extension of electronic espionage, conducted by the KGB during the Cold War, in which they were able to monitor keystrokes from electric typewriters in US embassies and military headquarters  -- far in advance of US technologies of that period; we can only assume the Russians have progressed since then.


Is the new KGB operating at warp speed now, foregoing military might for internet control?  But, does Russia have an interest in Lebanon, or the West Bank?  Or, should we assume some of those Cold War era KGB programers emigrated to Israel and were recruited by Mossad?  Given the targeting of flame, we may have to eliminate the KGB as the culprit.  If it's an Israeli virus, we're very impressed; terrified, but impressed.


Here are some of Flame's capabilities and functions within an infected IT system:
1)  Activate a computer's microphone to record/transmit nearby conversations or over Skype
2)  Convert Bluetooth enabled computers into a "Bluetooth Beacon" to capture names and phone numbers from nearby Bluetooth devices.
3)  Capture and store screenshots on monitors, to include email and instant messaging - sending that content via a hidden SSL channel back to the hacker.
4)  Scanning capability to track all traffic on a local network, collecting usernames and passwords transmitted across the network.
5)  All of the above to capture administrative accounts and hijack administrator privileges for all computers in a network.

Matrix = Reality?

This is no small or innocuous virus, but is so massive it has to enter IT systems in component elements, the first of which is a six megabyte file containing a group of other compressed files -- like zip files, which are later expanded within they system, and which in-turn, serve as hosts for later more functional files entering like Java applets or cookies..

Although computer geeks firmly believe Stuxnet and Flame are unrelated, there is a common denominator in that Flame, like Stuxnet, spreads the virus via infected USB autorun and spooler functions.  The variance comes in that the hacking functions are not automatic, but are manually controlled by the hackers on "at will" commands.

(c) St Martin's Press

Ultimately, Flame can be undetectable as it appears to have a Zero Day functionality; i.e., the malware detects a vulnerability, assesses it, but does nothing to exploit it until ordered to do so by the hacker.  The Zero Day term means that security folks or developers, unaware of the threat, have Zero time to protect against the attack once initiated by the hacker. 

Kind of like the attacks on Pearl Harbor or on the USS Liberty.

So, what now?




We can only assume that the entire IT community is vulnerable.  We know the Administration has been anxious to gain control of the Internet and cell phone systems, and the Flame virus would seem like a proficient mechanism to create such control. 

But, that would label the Administration as the threat -- and of course, we know that can't be true.

Why, we've come to think of our government as a benevolent Big Brother!

CIA vs Petraeus

The CIA Lobby

Will the CIA thrive under Petraeus?

David Ignatius, an old friend of the CIA, provides his assessment of General Petraeus as the new Director.  He advises that, although Petraeus is a good strong soldier, he's a tough taskmaster and the hierarchy really doesn't like his style.  The hierarchy liked Leon Panetta much better, because they could work with him.
         

Click here for related story   (c) David Ignatius

Folks, I have no idea what I'm doing here  (c) HolleewoodMinute

We agree the CIA hierarchy liked Leon Panetta much better -- because, basically, he was a pleasant fellow, and, because he had absolutely no clue as to what was going on, he was JUST the right Director for the hierarchy. And, the CIA hierarchy could tell him how to run things the way they liked, just like they did with George Tenet -- even less qualified than Panetta.


Let's face it; Panetta was a buffoon [still is], and they fed him lots of compliments and gave him lovely briefs, and he did as he was told.  [Now he's at the Pentagon, where he's being managed in the same way.]

Ignatius would have us believe Panetta was effective -- which he was not, and that Petraeus is definitely out of his league because he doesn't understand the Big Picture.

Petraeus: Professional Smart Guy                (c) Telegraph

In reality, Petraeus has a better grasp on the big picture than Panetta could ever hope to have since Petraeus has been in the trenches, he's worked hand in glove with some of the most powerful people in the world -- and he understands how they think, and how their subordinates think.



More-so, he understands the bad guys, and how THEY think; who they are, where they are, their weaknesses and strengths, and their inter-relationships with other bad guys -- and with "good" guys.

Because he has been in the trenches fighting both wars and insurgencies, and terrorism, he understands fully what information the guys in the trenches need, and what their commanders need. Panetta, the accountant, had no more understanding of the purpose of intelligence or the intelligence requirements of the military or counter-terrorism unit than Joe the Plumber.

Leon Panetta never had a clue; never will.  He's been an accountant, a bean counter, a suck-up all his life, and simply a patsy.  Ignatius warns that there are "rumblings" from mid-level CIA officers.  That could be because the in-mates are no longer running things.  Suddenly, they're being held accountable when they don't produce.

Petraeus wants to install some military style order to things -- to which the mid-level CIA officers object.  That's because they don't like taking orders, and have long presumed that no one understands intelligence like they do.  Could be because most of them think like cops -- because most of the their superiors were cops before they came to the CIA.  

Busted the dealer; don't know who the big guys are though

They came from DEA, ATF, highway patrols, and some, even from the military police.  [The CIA Contra coordinator in Guatemala was an ex-USAF policeman who had never fired even a pistol.]

The problem is that most CIA officers don't understand intelligence; first, because they don't know why it's important or how it will be used.  But, underneath it all, they long for the Big Bust -- an Arrest!  They want a "smoking gun" so they can finish their field tour and become a regional director, or run one of the elite stations.  Once a cop; always a cop.


But, running a comprehensive agent network?   Nah.  They're in too much of  hurry for that.  There are tickets to punch, information to hoard, ladders to climb, power to wield.

Teamwork, Information Sharing, Common Objectives

Petraeus wants to groom CIA officers like the military grooms its career officers.  He wants to instill the concept of teamwork [alien to the CIA culture], information sharing as a joint concept to achieve coordinated results. 

He wanted physically fit officers, but the budget guys turned down the $15 million gym allocation [$15 million is the cost of two satellite passes over Qandahar -- which gives you an idea of where CIA fits in the big scheme of things.]

[Petreaus longs for the POAC [Pentagon Officers Athletic Club] with a superbly equipped gym, basketball courts, and an indoor olympic pool.  Officers must pass a rigorous fitness test twice a year.]

Advanced learning includes mixing with the elite

He also wants rotational assignments so officers get school assignments between field assignments; they might even get a few years off for graduate school as Petraeus did [for a PhD at Princeton]. 

The military has the FAO [Foreign Area Officer] program, which sends officers to language school, graduate school [area studies] and then sends them out for regional acclimation. 

The CIA has nothing like that, and most case officers arrive in their new assignment not knowing the language or anything about the area.  Military officers arrive fully conversant in the foreign language as well as the regional history and culture, and may have even attended school in the country of their assignment.

One former Director, Stansfield Turner, began the Exceptional Intelligence Analyst Program which gave analysts with promise the opportunity to explore new ideas and concepts in a variety of environments.  The products of this program went on to achieve significant successes in analysis, management, and operation. 

One military analyst went on to create the DOD Clandestine Services Program, modeled after the CIA, but much more efficient and productive -- and a magnet for competent CIA case officers.

Time to break the CIA mold.

Ignateus is an admirer of the Old School CIA and has many friends who long for the old way of doing things -- which unfortunately created the problems for which the CIA was pretty much dismantled. 

They are bearers of the Cop mentality, and never quite grasped how to run really good espionage operations, instead, grabbing control of productive military operations because they were, after all, CIA.

General Petraeus, we wish you well, and caution you to watch your back.  The Old Guard doesn't like you and will try to make you fail.

Open Secrets

Coming Soon  -- No Secret Left Undisclosed!    (c) Voltage Pictures

Click here for referenced story (WashPost)

  

Senate Select Committee on Intelligence

Three GOP senators who sit on the Senate Intelligence Committee [SSCI] have now taken a public stand on White House leaks -- or rather public disclosures --       which have not only exposed sensitive sources, but also, sensitive methods of intelligence collection.  
    

I won't be available to spy for 33 years   (c) Telegraph

Most recently, the President, in order to claim glory and get more attention for the Executive Action [assassination of a national leader] against Osama bin Laden, announced to the world the name of the Pakistani doctor whom US Intelligence had worked with to track bin Laden to his lair.        

Oddly enough, the doctor was immediately rolled up and thrown into a Pakistani prison, likely to keep him from being snagged by bin Laden followers who would have found new and unique ways to have tortured him before killing him. 

The White House also disclosed to the world the means by which US Intelligence infiltrated an al Qaida cell which was planning to blow up a civilian airliner. 


The recruited asset was thus sacrificed, as was the long-term intelligence he could have continued to gather had he not been identified.

       

This folks, is Human Intelligence [HUMINT], the most valuable and least expensive [in terms of money] of all the -INTs.   We spend hundreds of billions of dollars on Imagery and Electronic Intelligence [IMINT and ELINT], but probably no more than $100 million on HUMINT.

The HUMINT cost is in time and human life.

Case Officers take a long time to train, to include the basics of Spook stuff, then language studies, then area studies and area familiarization, then building cover status in multiple covers, and finally, but hardly the least, recruiting actual field operatives or agents.  At that point, the Case Officer becomes an "agent handler" and his life revolves around training his recruited asset to infiltrate and communicate.

Sound complex?  It is!

   It takes 5 - 10 years to train a Case Offier   (c) PopFi

It takes years to train, position, and acclimate a Case Officer/Agent Handler so he can live a "cover for status" and become proficient in his cover-for-action. 

"Status" puts him in position to function in a clandestine or covert role [the terms describe different operations], while "Action" makes his contact with his operative invisible.




The process to recruit an agent/spy can take days, weeks, months or years, depending on the operation.  The recruited asset may already be inside the target organization, or may have to be trained to get inside.  In either case, all contact with the agent is extremely sensitive, and great measures are taken to guard the identity of that asset. 

Usually, no more than three people know the identity of the individual.

That is, until Mr Obama came into office.

I'm still running for President

As the operations above depict, Obama is so eager for publicity and credit for intelligence successes that he makes conference calls disclosing both source identities, locations, access, and operational objectives, thus destroying years worth of work and endangering the lives of all the support operatives in these situations. 

For every agent handler and recruited agent, dozens of support personnel spend months in preparation and analysis, running photographic and audio surveillance, providing cover documents, laundering money, reviewing security, monitoring local police and intelligence services, processing and analyzing collected information, and a host of other measures.

For every operative like the Pakistani doctor, roughly 100 US and foreign intelligence personnel are involved in support roles in a variety of agencies.  But, only three actually know who the recruited agent is.


So, you can understand why it is essential to guard the source's identity.

That is, unless you are Obama and you want a quick campaign ratings boost by exposing the details of a successful intelligence operation -- sacrificing the agent, the case officer, and spilling the operational details to not only the world press and foreign intelligence agencies, but now providing detailed information to all 100 of the support personnel - endangering them. 

One part of the operational support team    DHS

Operational details are compartmented to maximize the effectiveness of support personnel; they are provided just enough information to perform their function independent of the operation, but in full support of the operation.  For example, one support person's role may simply be to move sterile cell phones from Point A to Point B, to then be passed to the Agent.  Once the cell phone mover understands his/her role, the purpose of the moves, locations, etc. become meaningful, and the individual henceforth becomes self-conscious and a dead give-away to hostile intelligence services [HOIS].

So, when details of a HUMINT operation are disclosed to the press, the entire support staff for that type of operation has to be replaced at a cost of personnel years, and tens of millions of dollars in set up and operational infrastructure.

Imagery or Electronic satellites and systems can be replaced.  Agents with unique access cannot.

    

I'll tell all your secrets to get reelected.

Mr Obama was denied a security clearance as a US Senator because the FBI investigators conducting his background investigation were unable to verify much of the information he provided on his Personal History Statement [PHS], to include an accurate recording of his US birth. 

Given his current conduct, his  security clearance as President should be revoked.


Presidents come and go; the Intelligence process has to continue and function effectively no matter who is in office.