France Throws Cyber Stones From Its Glass House

Source: L'Expansion.L'Express.fr 20 NOV 2012

The government of France shouldn't be so quick to charge the U.S. with being responsible for the Flame malware found on President Sarkozy's computer. Kaspersky Lab had remarkably little evidence to support their charge that it was created by the team that created Stuxnet and Duqu, and CrySys Labs said that it probably wasn't created by the Stuxnet/DuQu team.

Further, France is in no position to throw stones. It's use of cyber espionage operations is well-known inside the U.S. Intelligence Community as well as by the German gov't who consider them a more severe risk to intellectual property theft than Russia or China. France's state-owned energy firm EDF also conducted cyber espionage attacks against Greenpeace.

Related:

Report: French officials accuse US of hacking Sarkozy's computers
Votre Secrets, Monsieur? "The idea of the French using their intelligence service to obtain scientific, economic, and technological information from friendly countries is not new."

Add to Cart View detail

Was Flame's Gauss Malware Used To Uncover Hezbollah Money Laundering via Lebanese Banks?

Today, Kaspersky announced that it had discovered yet another nation-state sponsored piece of malware that's closely related to Flame (aka Flamer, SkyWiper) called Gauss which targets Lebanese banks:

Gauss is a project developed in 2011-2012 along the same lines as the Flame project. The malware has been actively distributed in the Middle East for at least the past 10 months. The largest number of Gauss infections has been recorded in Lebanon, in contrast to Flame, which spread primarily in Iran.
Functionally, Gauss is designed to collect as much information about infected systems as possible, as well as to steal credentials for various banking systems and social network, email and IM accounts. The Gauss code includes commands to intercept data required to work with several Lebanese banks – for instance, Bank of Beirut, Byblos Bank, and Fransabank.

On December 13, 2011, the New York Times published an article on the Obama Administration's claim that Lebanese banks were engaging in money laundering services for Hezbollah. The investigation led to the take down of the Lebanese Canadian Bank and it was at least six years old according to the Times article.

On June 27, 2012, the U.S. Treasury Dept designated four individuals under the Kingpin act for laundering money through Lebanese banks.

There's no question that Lebanon's banking system has been a target of the U.S. government for several years and apparently for good reason. I can easily imagine someone in the IC suggesting that an espionage platform (Flame) which has worked well for many years against Iran be tweaked to help conduct intelligence on alleged money laundering by drug cartels and terrorists via Lebanon's banks. 

Mr. Makram Sadr, the Secretary General of Lebanon's Banks, said on July 4, 2012 that the U.S. Treasury Dept has failed to produce any evidence that Lebanese banks are involved in such activities.

Add to Cart View detail

Arquilla's "Cool War" is Fiction

In this article for Foreign Policy, John Arquilla poses the question "Could the age of cyberwarfare lead us to a brighter future?". Arquilla proposes that it will but his article utterly fails to make the case.

He builds his case for pure cyber war as an alternative to kinetic war by using Stuxnet as an example claiming that it achieved "a serious disruption of Tehran's nuclear enrichment capabilities -- and possibly of a secret proliferation program." The fact is that Stuxnet caused limited disruption (by design) and it failed to halt Iran's nuclear enrichment program. It's also important to note that Stuxnet was only discovered because the malware design was flawed, which underscores the fundamental problem with Arquilla's imaginings of the efficacy of a pure cyber war. The effects of malware are often unpredictable and unpredictability is the enemy of military planners.

Later, he suggests that Flame, the cyber espionage tool which apparently infected Iran's network years before the Stuxnet worm was created, demonstrates how cyber espionage can replace old school tradecraft - "The code that comprises it seems to make the point that we no longer need physical agents in place if we can now rely on artificially intelligent agents to dredge up the deepest secrets." This is as ridiculous a notion as the one that Arquilla offers about cyberwarfare replacing boots on the ground. Both Chinese and Russian intelligence services continue to recruit human assets for acts of espionage even as they utilize cyber espionage as a force multiplier. HUMINT isn't going away - ever.

Arquilla writes that "On balance, it seems that cyberwar capabilities have real potential to deal with some of the world's more pernicious problems, from crime and terrorism to nuclear proliferation. In stark contrast to pitched battles that would regularly claim thousands of young soldiers' lives..." I challenge Professor Arquilla to present even a shred of evidence that supports his fantasy that this future could ever come to pass. I don't know what John Arquilla's motivations are behind this embarrasingly weak article but I wouldn't accept this from a student let alone a professor of his standing.

Add to Cart View detail

Flame, Russia and the ITU: A Geopolitical Agenda?

Both the ITU and the Russian government have been united in their interest to secure a global cyber warfare treaty since at least 2010. In recent weeks, Evgeniy (Eugene) Kaspersky has been increasing his rhetoric regarding a future cyber catastrophe and most recently his company was chosen by the ITU to investigate the Flame attack. That attack prompted today's press release by the ITU calling for "greater international collaboration" on cyber security matters at their upcoming conference in Dubai; a conference sponsored by Kaspersky Labs and where CEO Kaspersky will deliver the keynote:

Cybersecurity will be a major agenda theme at ITU Telecom World 2012 (Dubai, 14-18 October 2012), supported by key partners, one of whom is Kaspersky Lab. This agenda will explore issues such as mitigating risks posed by major coordinated cyber-attacks at the national level, the threats posed by malware such as Flame, and strengthening international cooperation. Kaspersky Lab CEO Eugene Kaspersky will deliver a Visionary Keynote speech at the event, outlining the magnitude and global nature of cyberthreats today.

 The Russian government has long been an advocate of an Information Warfare treaty limiting the use of cyber weapons and other acts of IW because it serves the interests of the Russian government (which has other means of conducting IW) while restricting cyber weapons development in the West. An excellent overview of the ramifications of such a treaty is Tom Gjelton's "Shadow Wars: Debating Cyber Disarmament".

Evgeniy Kaspersky, Kaspersky Labs, and the Russian Security Service

In November 2009, the Duma Committee on Security met on “the legislative, organizational and technical security aspects of the national info-communications infrastructure.”  The meeting included the Experts Council and several additional experts.  The invited experts were primarily senior government officials—including two from the FSB--with two from industry.  One was the President of MFI-Soft—the company that provides internet intercept systems to the FSB ISC—and the other was Evgeniy Kaspersky, Director of JSC Kaspersky Labs.

The President of MFI-Soft Alexander Ivanov is a former senior military communications officer.  MFI-Soft’s bread and butter are lawful intercept systems including SORM-1, SORM-2, and SORM-3.  MFI-Soft holds numerous licenses from the FSB and FSTEC for work on state secret information and encryption systems.  JSC Kaspersky Labs does as well.  While the Duma Security Committee did not post the meetings minutes, both companies are now involved in pushing Russian standards for the Commonwealth of Independent States (CIS).

Kaspersky Labs holds numerous security clearances authorizing work on projects involving state secret information (current list is posted at http://www.kaspersky.ru/license). The FSB only licenses two antivirus companies for work with state secret information; JSC Kaspersky Labs and Dr. Web. The licensing requirements effectively give JSC Kaspersky Labs and Dr. Web a monopoly on the Russian market since the IT market is dominated by the Russian Government and large industry closely aligned with the government.  Indeed, in 2009, the Russian Federal Antimonopoly Service (FAS) initiated proceedings against Kaspersky for possible violations of Russian antitrust laws, but no action appears to have been taken. Russian government tenders posted at zakpuki.gov.ru frequently specify JSC Kaspersky Labs products as required based on their FSB/FSTEC licenses.  The licenses are almost certainly critical to Kaspersky’s future.  According to Interfax, Kaspersky sales totaled $538 million in 2010 (last year for full data).  However, the revenue breakdown was stated in such a way that it is impossible to identify specific sources.

Summary

Kaspersky's elevation of Flame to a status that it doesn't deserve (a "highly sophisticated cyber weapon") takes on a new meaning when you examine the close relationship between Kaspersky Labs and the Russian government along with their relationship with the ITU and their parallel interests in promoting international cyber security agreements and cyber warfare treaties. Is Flame a means to a geopolitical end that favors those players interests? I think it is.

RELATED:
"Kaspersky's Problematic Flame Analysis"

Add to Cart View detail

Kaspersky's Problematic "Flame" Analysis

Countries infected by Flame (SecureList 28MAY12)

I'm beginning to wonder what's going on over at Kaspersky Labs. Eugene Kaspersky has begun sounding like Richard Clarke with his warning about mega-cyber disasters during his keynote address at the AUSCERT IT security conference. Then there's his repeating of the Russian government mantra that a cyber weapons treaty is needed (it's not). Now Kaspersky Labs has called a virus whose only purpose is to steal data a "cyber weapon". Come on, guys. You've done some terrific research in the past with DuQu. Now all of a sudden, it seems like you've become evangelists for a Russian government strategy to raise the stakes in cyber war rhetoric. Espionage is not warfare and never has been. Hence a tool created solely to conduct cyber espionage cannot also be legitimately called a cyber weapon.

You've also wrongly simplified the scope of cyber actors out there to three when it has never been that cut and dried:

Currently there are three known classes of players who develop malware and spyware: hacktivists, cybercriminals and nation states. Flame is not designed to steal money from bank accounts. It is also different from rather simple hack tools and malware used by the hacktivists. So by excluding cybercriminals and hacktivists, we come to conclusion that it most likely belongs to the third group.

You've conveniently failed to mention an important fourth category: mercenary hacker crews - principally from Russia and the Commonwealth of Independent States - who steal IP and sell it to both corporations and governments. Crews that would love a tool like Flame and who, in my opinion, are the most likely actors involved in using such a tool. If you'd be forthcoming with more information - such as Flame's Command and Control server URLs - a lot more could be learned about who may be behind this virus.

UPDATE (31 MAY 2012): See my related article "Flame, Russia and the ITU: A Geopolitical Agenda?"

Add to Cart View detail