10 ms·

A New Threat Actor Targets UAE Dissidents

nxzero 10y ago
Anyone able to estimate the monetary value per person targeted to a state-level actor? Seems like there's no reason to believe a state-level attacker if approached would not buy intell from a criminal network of attackers or that a foreign state-level attacker won't leverage it advantage attack operations to again and barter intel to other states. Case in point, attribution based on the skill of these attacks does not dox the attacker, but the end result of their attacks. Meaning these may not have been sponsored attacks, but someone farming intel to capitalize on.
iamsalman 10y ago
The link is down?
- subliminalpanda 10y ago
  Seems to be working, albeit a bit slow.
facepalm 10y ago
"When a user clicks on a URL shortened by Stealth Falcon operators, the site profiles the software on a user’s computer, perhaps for future exploitation, before redirecting the user to a benign website containing bait content." But how?
- ianpurton 10y ago
  Browsers leave a certain amount of finger print. i.e. Flash version, Java and the browser versions and type is pretty easy to obtain. This may be enough information to produce a targeted attack. They also used timing attacks against various localhost ports using XMLHttpRequest. This is enough to detect Avast, Avira, ESET, Kaspersky, and Trend Micro antivirus products
  - deleted 10y ago
    [deleted]
- nl 10y ago
  Section 3.4: For Internet Explorer, it attempts to create several instances of ActiveXObject to get the versions of Flash, Shockwave, Java, RealPlayer, Windows Media Player, and Microsoft Office (classified as either 2003, 2007, or 2010). For non-Internet Explorer browsers, it attempts to get a list of enabled plugins from navigator.mimeTypes. For all browsers, it captures the user agent, whether cookies are enabled, the OS, the size of the browser window, and the timezone. It classifies browsers into different versions, denoted by letters, based on the existence and behavior of certain JavaScript methods. The script attempts to exploit an information leak in older versions of Tor Browser. We explore the technique used in Section 3.5. For Windows browsers (except Opera, and versions of Internet Explorer before IE9), it sends a series of XMLHttpRequests to 127.0.0.1, which we believe are designed to deduce if the computer is running any one of several specific antivirus programs. The code for this appears to be borrowed from the JS-Recon port scanning tool.21 The creator of JS-Recon presented the tool at BlackHat Abu Dhabi in 2010.22 We explore such techniques in more detail in Section 3.6.
- _9MOTHER9HORSE 10y ago
  See: https://panopticlick.eff.org https://panopticlick.eff.org
- us0r 10y ago
  This was posted here a few (weeks)? ago: http://webkay.robinlinus.com/ http://webkay.robinlinus.com/
deanclatworthy 10y ago
This is an absolutely superb write-up. It's highly disconcerting to read the level of detail that malicious (and supposedly state-sponsored) actors go to target speciifc individuals.
pjs_ 10y ago
The timing attacks on AV software are interesting. Didn't know that was possible. Why doesn't the cross-domain policy reject pings to localhost immediately?
- TazeTSchnitzel 10y ago
  Indeed, why can you contact local network IPs from web pages at all? Browsers should, at the very least, prompt for permission first. Intranet and localhost services often have a lot of implicit trust in whoever can access them. They rarely have strong passwords, if any, for example.
  - tobias3 10y ago
    Popuplar apps such as Dropbox and Spotify use it: https://bugs.chromium.org/p/chromium/issues/detail?id=378566 https://bugs.chromium.org/p/chromium/issues/detail?id=378566
- ruddct 10y ago
  This jumped out at me too, very clever. I imagine that localhost isn't treated any differently to any other domain which might have CORS enabled. Unclear what the correct solution is, though. EDIT: Gaming this out a little bit, another interesting application of this technique could be to create a fairly accurate map of a Windows-centric private network. Example: Start with a bunch of known private network IP spaces, scan through as many IPs as possible, report back addresses that have open/closed/filtered ports.
mouzogu 10y ago
Would it be fair to say that the Tor browser and Tails OS are being specifically targeted? It seems to me using these tools is enough in to provide a suspicion and thereby having the opposite effect than what they are intended for. So essentially, using Chrome on Windows, though perhaps less secure makes you less likely to be targeted than using Tor on Windows or on Tails.
- pdkl95 10y ago
  > using these tools is enough in to provide a suspicion Philip Zimmermann was talking[1] about encryption in general, but the same idea also applies to anonymity tools. What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity. If we use Tor only when we are doing something that needs to be anonymous, using Tor is suspicious. Instead, if Tor is used regularly, using Tor doesn't reveal anything. Security and privacy tools and technologies need to be used by default, if you want them to be available when in the (hopefully) rare situations where you do need them. [1] https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html
  - mouzogu 10y ago
    Thanks. I hope encryption can be better integrated into mass market tools. For example the https://adnauseam.io/ https://adnauseam.io/ browser extension which can be added to Chrome and used to dilute all the data collected by making it contradictory and meaningless. I considered using Tor as my default browser but it felt like I was putting a big red target mark on myself even though I am not doing anything illegal. I would like encryption and obfuscation to be the status quo as mentioned in your quote - so it would be more of a passive protection and therefore less suspicious.
deleted 10y ago
[deleted]
coderdude 10y ago
This reminds me of a recently declassified document from the CIA that discusses how to undermine organizations by being poor managers, employees, etc. It's difficult to search HN for this at this point because A) we always discuss that agency and B) our best search option gives us the option of the past month or the past year. Maybe someone has this bookmarked or downloaded. It came in PDF form. This is happening to us here. I think they're doing it by using the "No true Scotsman" informal fallacy and other methods. We'd blame the hundreds of thousands of new users. I believe they've found a way to unwind this community. Nothing revolutionary will ever come from here (how could it?). I think the community has been compromised and that we won't find out until 50 years from now when most of us are dead. This is how I feel after years of watching the community. I have no stake in it either way. I'm open to opposing views. Thanks vermontdevil for finding the link. If in 1944 they had a field manual for subverting physical organizations, it's foolhardy to believe they don't have a field manual for subverting "online communities with up and down arrows."
- vermontdevil 10y ago
  https://www.cia.gov/news-information/featured-story-archive/2012-featured-story-archive/simple-sabotage.html https://www.cia.gov/news-information/featured-story-archive/...
  - coderdude 10y ago
    Thanks. I had a hard time finding that before my post.
- deleted 10y ago
  [deleted]
- alanwatts 10y ago
  Sock puppet armies aren't science fiction: [1]https://m.reddit.com/r/netsec/comments/38wl43/we_used_sock_puppets_in_rnetsec_last_year_and_are/ https://m.reddit.com/r/netsec/comments/38wl43/we_used_sock_p... And chat bots are now being powered by NLP. [2]http://www.theverge.com/2016/3/24/11297050/tay-microsoft-chatbot-racist http://www.theverge.com/2016/3/24/11297050/tay-microsoft-cha... [3]https://www.motion.ai/ https://www.motion.ai/ Subverting an online community would not be difficult for anyone with some programming knowledge and a desire to learn. The study in the link[1] notes that detection is exceedingly difficult, and even then, in the case of Reddit, the Mods and Admins have negligible power to mitigate such attacks even if they do detect them.
chinathrow 10y ago
The table with the arrests is really troublesome.
feklar 10y ago
In the conclusion to this article "The Growing Trend of Impersonating Journalists" isn't really a new trend, Max Butler(Vision) used that trick to convince bank employees to click on his malware years ago. It's an old spear fishing method to pretend to have written a story about somebody or claim you're writing a book since it guarantees they click your bait. UAE prisons, are also notorious hell holes devoid of any shred of humanity according to escort blogs who've been arrested there and forced to serve the mandatory 3 month sentence for prositution. People dying in the cells from lack of insulin or other medical treatment is common.
- walrus01 10y ago
  The UAE is also a perfect example of why rubber hose cryptanalysis should be considered just as much as the "evil maid" or keyloggers attack vector. Don't want to give up the password to your dm-crypt volume? Okay enjoy your beatings.
  - subliminalpanda 10y ago
    Has there been any research in mitigating these types of attacks? I'm interested in reading about them.
brudgers 10y ago
Powerful interests oft express that power by stifling voices deemed troublesome. To me, it does not seem a phenomenon uniquely restricted to particular countries, cultures, or individuals.

Anyone able to estimate the monetary value per person targeted to a state-level actor? Seems like there's no reason to believe a state-level attacker if approached would not buy intell from a criminal network of attackers or that a foreign state-level attacker won't leverage it advantage attack operations to again and barter intel to other states. Case in point, attribution based on the skill of these attacks does not dox the attacker, but the end result of their attacks. Meaning these may not have been sponsored attacks, but someone farming intel to capitalize on.

iamsalman 10y ago

The link is down?

subliminalpanda 10y ago
Seems to be working, albeit a bit slow.

facepalm 10y ago

"When a user clicks on a URL shortened by Stealth Falcon operators, the site profiles the software on a user’s computer, perhaps for future exploitation, before redirecting the user to a benign website containing bait content." But how?

ianpurton 10y ago
Browsers leave a certain amount of finger print. i.e. Flash version, Java and the browser versions and type is pretty easy to obtain. This may be enough information to produce a targeted attack. They also used timing attacks against various localhost ports using XMLHttpRequest. This is enough to detect Avast, Avira, ESET, Kaspersky, and Trend Micro antivirus products
- deleted 10y ago
  [deleted]
nl 10y ago
Section 3.4: For Internet Explorer, it attempts to create several instances of ActiveXObject to get the versions of Flash, Shockwave, Java, RealPlayer, Windows Media Player, and Microsoft Office (classified as either 2003, 2007, or 2010). For non-Internet Explorer browsers, it attempts to get a list of enabled plugins from navigator.mimeTypes. For all browsers, it captures the user agent, whether cookies are enabled, the OS, the size of the browser window, and the timezone. It classifies browsers into different versions, denoted by letters, based on the existence and behavior of certain JavaScript methods. The script attempts to exploit an information leak in older versions of Tor Browser. We explore the technique used in Section 3.5. For Windows browsers (except Opera, and versions of Internet Explorer before IE9), it sends a series of XMLHttpRequests to 127.0.0.1, which we believe are designed to deduce if the computer is running any one of several specific antivirus programs. The code for this appears to be borrowed from the JS-Recon port scanning tool.21 The creator of JS-Recon presented the tool at BlackHat Abu Dhabi in 2010.22 We explore such techniques in more detail in Section 3.6.
_9MOTHER9HORSE 10y ago
See: https://panopticlick.eff.org https://panopticlick.eff.org
us0r 10y ago
This was posted here a few (weeks)? ago: http://webkay.robinlinus.com/ http://webkay.robinlinus.com/

deanclatworthy 10y ago

This is an absolutely superb write-up. It's highly disconcerting to read the level of detail that malicious (and supposedly state-sponsored) actors go to target speciifc individuals.

pjs_ 10y ago

The timing attacks on AV software are interesting. Didn't know that was possible. Why doesn't the cross-domain policy reject pings to localhost immediately?

TazeTSchnitzel 10y ago
Indeed, why can you contact local network IPs from web pages at all? Browsers should, at the very least, prompt for permission first. Intranet and localhost services often have a lot of implicit trust in whoever can access them. They rarely have strong passwords, if any, for example.
- tobias3 10y ago
  Popuplar apps such as Dropbox and Spotify use it: https://bugs.chromium.org/p/chromium/issues/detail?id=378566 https://bugs.chromium.org/p/chromium/issues/detail?id=378566
ruddct 10y ago
This jumped out at me too, very clever. I imagine that localhost isn't treated any differently to any other domain which might have CORS enabled. Unclear what the correct solution is, though. EDIT: Gaming this out a little bit, another interesting application of this technique could be to create a fairly accurate map of a Windows-centric private network. Example: Start with a bunch of known private network IP spaces, scan through as many IPs as possible, report back addresses that have open/closed/filtered ports.

mouzogu 10y ago

Would it be fair to say that the Tor browser and Tails OS are being specifically targeted? It seems to me using these tools is enough in to provide a suspicion and thereby having the opposite effect than what they are intended for. So essentially, using Chrome on Windows, though perhaps less secure makes you less likely to be targeted than using Tor on Windows or on Tails.

pdkl95 10y ago
> using these tools is enough in to provide a suspicion Philip Zimmermann was talking[1] about encryption in general, but the same idea also applies to anonymity tools. What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity. If we use Tor only when we are doing something that needs to be anonymous, using Tor is suspicious. Instead, if Tor is used regularly, using Tor doesn't reveal anything. Security and privacy tools and technologies need to be used by default, if you want them to be available when in the (hopefully) rare situations where you do need them. [1] https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html
- mouzogu 10y ago
  Thanks. I hope encryption can be better integrated into mass market tools. For example the https://adnauseam.io/ https://adnauseam.io/ browser extension which can be added to Chrome and used to dilute all the data collected by making it contradictory and meaningless. I considered using Tor as my default browser but it felt like I was putting a big red target mark on myself even though I am not doing anything illegal. I would like encryption and obfuscation to be the status quo as mentioned in your quote - so it would be more of a passive protection and therefore less suspicious.

deleted 10y ago

[deleted]

coderdude 10y ago

This reminds me of a recently declassified document from the CIA that discusses how to undermine organizations by being poor managers, employees, etc. It's difficult to search HN for this at this point because A) we always discuss that agency and B) our best search option gives us the option of the past month or the past year. Maybe someone has this bookmarked or downloaded. It came in PDF form. This is happening to us here. I think they're doing it by using the "No true Scotsman" informal fallacy and other methods. We'd blame the hundreds of thousands of new users. I believe they've found a way to unwind this community. Nothing revolutionary will ever come from here (how could it?). I think the community has been compromised and that we won't find out until 50 years from now when most of us are dead. This is how I feel after years of watching the community. I have no stake in it either way. I'm open to opposing views. Thanks vermontdevil for finding the link. If in 1944 they had a field manual for subverting physical organizations, it's foolhardy to believe they don't have a field manual for subverting "online communities with up and down arrows."

vermontdevil 10y ago
https://www.cia.gov/news-information/featured-story-archive/2012-featured-story-archive/simple-sabotage.html https://www.cia.gov/news-information/featured-story-archive/...
- coderdude 10y ago
  Thanks. I had a hard time finding that before my post.
deleted 10y ago
[deleted]
alanwatts 10y ago
Sock puppet armies aren't science fiction: [1]https://m.reddit.com/r/netsec/comments/38wl43/we_used_sock_puppets_in_rnetsec_last_year_and_are/ https://m.reddit.com/r/netsec/comments/38wl43/we_used_sock_p... And chat bots are now being powered by NLP. [2]http://www.theverge.com/2016/3/24/11297050/tay-microsoft-chatbot-racist http://www.theverge.com/2016/3/24/11297050/tay-microsoft-cha... [3]https://www.motion.ai/ https://www.motion.ai/ Subverting an online community would not be difficult for anyone with some programming knowledge and a desire to learn. The study in the link[1] notes that detection is exceedingly difficult, and even then, in the case of Reddit, the Mods and Admins have negligible power to mitigate such attacks even if they do detect them.

chinathrow 10y ago

The table with the arrests is really troublesome.

feklar 10y ago

In the conclusion to this article "The Growing Trend of Impersonating Journalists" isn't really a new trend, Max Butler(Vision) used that trick to convince bank employees to click on his malware years ago. It's an old spear fishing method to pretend to have written a story about somebody or claim you're writing a book since it guarantees they click your bait. UAE prisons, are also notorious hell holes devoid of any shred of humanity according to escort blogs who've been arrested there and forced to serve the mandatory 3 month sentence for prositution. People dying in the cells from lack of insulin or other medical treatment is common.

walrus01 10y ago
The UAE is also a perfect example of why rubber hose cryptanalysis should be considered just as much as the "evil maid" or keyloggers attack vector. Don't want to give up the password to your dm-crypt volume? Okay enjoy your beatings.
- subliminalpanda 10y ago
  Has there been any research in mitigating these types of attacks? I'm interested in reading about them.

brudgers 10y ago

Powerful interests oft express that power by stifling voices deemed troublesome. To me, it does not seem a phenomenon uniquely restricted to particular countries, cultures, or individuals.