5 ms·

CIA 2010 covert communication websites

65 points by xk3 3y ago

082349872349872 3y ago
Let's see if HN preserves whitespacing, even though it doesn't display it. Edit: it does. Another channel beyond 'class="age" title='!
thewildginger 3y ago
Nothing like finding a webpage you can read from Lynx. IDK about the pictures though https://lynx.invisible-island.net/ https://lynx.invisible-island.net/
- cirosantilli 3y ago
  The ultimate compliment.
zoklet-enjoyer 3y ago
There's a great Darknet Diaries episode about this. https://youtube.com/watch?v=uh_q02eefFM&pp=ygUHI2NoeWNpYQ https://youtube.com/watch?v=uh_q02eefFM&pp=ygUHI2NoeWNpYQ
- babelthuap 3y ago
  [dead]
- cirosantilli 3y ago
  I started this research after YouTube suggested me that video. I knew about the sites, but I had missed the Reuters articles that gave the 7 starting points.
socketcluster 3y ago
Based on the choice of fonts and colors, you know this is a serious hacker website ;p
- cirosantilli 3y ago
  Of course :-)
hughesey 3y ago
Heya, Founder of https://viewdns.info/ https://viewdns.info/ here (used by and mentioned in the article a bit). If anyone is doing this kind of research, feel free to reach out at feedback@viewdns.info as I'm more than happy to extend some free API credits etc! -Hughesey
- cirosantilli 3y ago
  Thanks for the awesome service! I wish I had known this, I went to quite a few cybercafes to get some extra IPs XD I really wish the reverse IPs would hit even when it's not the last IP though! Many more hits would come out of that. Related mentions under: https://ourbigbook.com/cirosantilli/cia-2010-covert-communication-websites/viewdns-info https://ourbigbook.com/cirosantilli/cia-2010-covert-communic...
CSMastermind 3y ago
So my assumption is that spies in foreign countries would periodically visit these websites to receive coded instructions in the news updates? And maybe they made the websites tailored to the individual asset's interests so it looks less suspicious when they visit? Meaning if your source is a huge star wars nerd you make a star wars fan site for them to check out? Presumably there's no way for the source to send information back through these websites right?
- nneonneo 3y ago
  The Reuters story (https://www.reuters.com/investigates/special-report/usa-spies-iran/ https://www.reuters.com/investigates/special-report/usa-spie...) made this more explicit: there was a password field on the site, poorly disguised as a search feature, that would open a chat box when the right password was entered, into which the source could enter messages. On many of these sites, the password is validated by a bit of obfuscated JavaScript, which then loads a Java applet implementing the actual chat window.
  - figassis 3y ago
    Wow, these guys really did not give a damn about informants. That is some high school level amateur work. Sequential ips, password field, I wonder if they even used ssl. If they did, likely some US affiliated vendor.
    - DanAtC 3y ago
      Anyone with better skills is in the private market making a lot more money.
    - cirosantilli 3y ago
      Yeah. They just didn't have the patience to setup separate ranges for each of their ~900 sites. It's quite sad.
fpvftw 3y ago
[flagged]
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
thinkingemote 3y ago
Was steganography used in the images? It's one of those techniques that we learn about years ago but never seen it being used in the wild.
- cirosantilli 3y ago
  I would love to know... even finding the source of those stock photos would be awesome. My initial suspicion is that the image split is just an ancient webdev thing (which they used much after it was popular) to reduce the size of each individual image. But who knows!
nneonneo 3y ago
Come to think of it, maybe it isn’t such a good plan to give every one of your informants a unique domain to communicate on. Pretty much any government these days can survey all the internet traffic in their country. Wouldn’t it be a little tiny bit suspicious that, say, an Iranian sports news site is frequented by like 1-2 people in the whole of Iran? The entire premise of this covert messaging system was flawed at the outset, and it’s just tragic that dozens of people lost their lives due to a system this poorly thought out.
- cirosantilli 3y ago
  Exactly. The best bet is to use a service that is used by a huge number of users and try to hide your traffic in it. I wonder why they didn't do gmail -> gmail for example. Maybe there are good reasons.
  - nneonneo 3y ago
    China is a special case in that GMail (and many other services) are blocked; most of the directly-accessible major services are operated by companies that will readily cooperate with the government. Hosting your spies in an environment where even the content would be available to the government seems like a generally bad idea. Using a VPN could subject a spy to additional scrutiny, especially if they work in a sensitive domain.
cirosantilli 3y ago
Thank for the submission! This was also previously posted at: https://news.ycombinator.com/item?id=36279375 https://news.ycombinator.com/item?id=36279375 from before my recent update that added ~75 new websites with a new technique: https://twitter.com/cirosantilli/status/1717445686214504830 https://twitter.com/cirosantilli/status/1717445686214504830 Except the previous one was at: https://cirosantilli.com/cia-2010-covert-communication-websites https://cirosantilli.com/cia-2010-covert-communication-websi... which is the corresponding static website version of https://ourbigbook.com/cirosantilli/cia-2010-covert-communication-websites https://ourbigbook.com/cirosantilli/cia-2010-covert-communic...

65 points by xk3 3y ago

Let's see if HN preserves whitespacing, even though it doesn't display it. Edit: it does. Another channel beyond 'class="age" title='!

thewildginger 3y ago

Nothing like finding a webpage you can read from Lynx. IDK about the pictures though https://lynx.invisible-island.net/ https://lynx.invisible-island.net/

cirosantilli 3y ago
The ultimate compliment.

zoklet-enjoyer 3y ago

There's a great Darknet Diaries episode about this. https://youtube.com/watch?v=uh_q02eefFM&pp=ygUHI2NoeWNpYQ https://youtube.com/watch?v=uh_q02eefFM&pp=ygUHI2NoeWNpYQ

babelthuap 3y ago
[dead]
cirosantilli 3y ago
I started this research after YouTube suggested me that video. I knew about the sites, but I had missed the Reuters articles that gave the 7 starting points.

socketcluster 3y ago

Based on the choice of fonts and colors, you know this is a serious hacker website ;p

cirosantilli 3y ago
Of course :-)

hughesey 3y ago

Heya, Founder of https://viewdns.info/ https://viewdns.info/ here (used by and mentioned in the article a bit). If anyone is doing this kind of research, feel free to reach out at feedback@viewdns.info as I'm more than happy to extend some free API credits etc! -Hughesey

cirosantilli 3y ago
Thanks for the awesome service! I wish I had known this, I went to quite a few cybercafes to get some extra IPs XD I really wish the reverse IPs would hit even when it's not the last IP though! Many more hits would come out of that. Related mentions under: https://ourbigbook.com/cirosantilli/cia-2010-covert-communication-websites/viewdns-info https://ourbigbook.com/cirosantilli/cia-2010-covert-communic...

CSMastermind 3y ago

So my assumption is that spies in foreign countries would periodically visit these websites to receive coded instructions in the news updates? And maybe they made the websites tailored to the individual asset's interests so it looks less suspicious when they visit? Meaning if your source is a huge star wars nerd you make a star wars fan site for them to check out? Presumably there's no way for the source to send information back through these websites right?

nneonneo 3y ago
The Reuters story (https://www.reuters.com/investigates/special-report/usa-spies-iran/ https://www.reuters.com/investigates/special-report/usa-spie...) made this more explicit: there was a password field on the site, poorly disguised as a search feature, that would open a chat box when the right password was entered, into which the source could enter messages. On many of these sites, the password is validated by a bit of obfuscated JavaScript, which then loads a Java applet implementing the actual chat window.
- figassis 3y ago
  Wow, these guys really did not give a damn about informants. That is some high school level amateur work. Sequential ips, password field, I wonder if they even used ssl. If they did, likely some US affiliated vendor.
  - DanAtC 3y ago
    Anyone with better skills is in the private market making a lot more money.
  - cirosantilli 3y ago
    Yeah. They just didn't have the patience to setup separate ranges for each of their ~900 sites. It's quite sad.

fpvftw 3y ago

[flagged]

deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

thinkingemote 3y ago

Was steganography used in the images? It's one of those techniques that we learn about years ago but never seen it being used in the wild.

cirosantilli 3y ago
I would love to know... even finding the source of those stock photos would be awesome. My initial suspicion is that the image split is just an ancient webdev thing (which they used much after it was popular) to reduce the size of each individual image. But who knows!

nneonneo 3y ago

Come to think of it, maybe it isn’t such a good plan to give every one of your informants a unique domain to communicate on. Pretty much any government these days can survey all the internet traffic in their country. Wouldn’t it be a little tiny bit suspicious that, say, an Iranian sports news site is frequented by like 1-2 people in the whole of Iran? The entire premise of this covert messaging system was flawed at the outset, and it’s just tragic that dozens of people lost their lives due to a system this poorly thought out.

cirosantilli 3y ago
Exactly. The best bet is to use a service that is used by a huge number of users and try to hide your traffic in it. I wonder why they didn't do gmail -> gmail for example. Maybe there are good reasons.
- nneonneo 3y ago
  China is a special case in that GMail (and many other services) are blocked; most of the directly-accessible major services are operated by companies that will readily cooperate with the government. Hosting your spies in an environment where even the content would be available to the government seems like a generally bad idea. Using a VPN could subject a spy to additional scrutiny, especially if they work in a sensitive domain.

cirosantilli 3y ago

Thank for the submission! This was also previously posted at: https://news.ycombinator.com/item?id=36279375 https://news.ycombinator.com/item?id=36279375 from before my recent update that added ~75 new websites with a new technique: https://twitter.com/cirosantilli/status/1717445686214504830 https://twitter.com/cirosantilli/status/1717445686214504830 Except the previous one was at: https://cirosantilli.com/cia-2010-covert-communication-websites https://cirosantilli.com/cia-2010-covert-communication-websi... which is the corresponding static website version of https://ourbigbook.com/cirosantilli/cia-2010-covert-communication-websites https://ourbigbook.com/cirosantilli/cia-2010-covert-communic...