Sitrep Egypt: 2011

The crockpot turned cauldron of the Middle East was kicked into high gear by crackdowns on social media. Last week in three blog posts, two for Cybercrime Corner, and one for Securing Our eCity, I analyzed regional social media policies.

From Libya to Egypt, the North African coast has become a region of unrest after seeing corruption [alleged] exposed in Tunisia by WikiLeaks-released cable traffic from the U.S. Department of State.

Twitter tags #Jan25 and #Egypt related events faster than the news cycle for Vietnam, and even faster than both Gulf Wars. With a cell phone and internet communication technology (ICT), everyone's a reporter. Everyone's a photographer.

Global Voices, a source I used recently for my Tunisia story, relates one tale from Egypt which underscores digital devices in the combat zone:

In fact, Egypt's internet went down yesterday just a few minutes after this video denoting the death of a protester was posted by Associated Press. Violent reprisals are everywhere.

The world is watching and organizers are quick to adapt. As noted in Egypt Protests 2011,

Result: a lot of voices, but which ones are worth following is hard to determine. There's a niche here. Those who report accurately are linked to, which raises their credibility in aggregators like topsy.com.

Is cellular data a risk to totalitarian governments?

While this is a short-term solution to a larger problem, expect tactics on the government side to grow in sophistication as each Islamic country becomes the focus of protests. The cellular phone networks are now the platform of choice because four billion global cellular devices.

Read: SC Magazine's recent article talking about the vulnerabilities

Here are a couple of attack methods which could counter Twitter or other SMS / MMS text messaging social media platforms:

Caller ID spoofing – Briefly covered in a 2010 Cybercrime Corner article, the technology to spoof caller IDs could be used to spam/DoS the most credible Twitter resources. In conjunction with an online DoS this could be attempted to shut down Twitter. The governments in North Africa and other regions may have the ability to filter the Tweets coming from cell phones according to one industry expert.

Cell phone bricking – If there are vulnerabilities in mobile devices, expect nation-states under duress from protesters to use a kill switch built into most cellular devices. In 2010, I collaborated with ESET's Aryeh Goretsky, McAfee's very first employee, to analyze the attack surface of cellular devices. This included extensive review of the smsanalysis.org supporting research.

Our key finding was simple:

Word on the Egyptian street

While Egypt initially resorted to shutting down social media sites, organizers quickly rallied around other internet techologies, shifting their operations so quickly that initial reports from Tweeters in Egypt yesterday stated that the entire internet was coming down.

Let's think about that for a minute – removing internet technology backbone of commerce is not sustainable and actually it will add to the problem rather than remove the problem. Once again this is a matter of the cultural value of saving face rather than personal accountability, as was written about in Cyberwar PsyOps Part 1 and Part 2.

Outside threats: #AnonOps Hivemind DDoS and others

Earlier Cybercrime Corner analysis on Western-based DDoS attacks:

This week, the AnonOps shifted its fire to the #OpEgypt target. Recently it was called off due to the internet being completely taken down by the Egyptian authorities.

Battle damage assessment: Egypt 2011

BDA for the entire blended attack is zero internet communication, or near zero. I'm surprised that AnonOps doesn't realize that in warfare you don't cease operations until the job is done, but a quick look at their targeting feed shows that four new targets took priority less than 40 minutes ago: Twitter, Facebook, and Google. As of 0930 PST:

I'm at a loss to understand why these targets are related to Egypt, but one key factor in all these hiveminds is that co-opting the account of the main influencers (or physically putting a gun to their head) will gain temporary control of a lot of the hive who simply follow orders.

[UPDATE: Correction: These IP addresses are redirecting web traffic, not redirecting #LOIC attacks.]

Law enforcement action like that taken in the UK is only one risk factor, I wouldn't be surprised to see counter-intelligence operations against these smart-by-half cyberwarfare enthusiasts in the very near future. Word to the wise: Unless you're living in a van down by the river pirating Wi-Fi, being part of #AnonOps is not a healthy long-term choice.

CIOs: Persistent threat assessment

As most experts state, cyberwar is the persistent threat of 2011.

Do a threat assessment based on your industry and customer profiles. Ramp up your defensive procedures in case the low orbit ion cannons of protest single your business out for DDoS.

Look at the motivation for defacement differently with a cultural twist. If an equivalent to the Iranian Cyber Army happens to deface your page, consider the full implication of this being more than just graffiti. Take it with a grain of salt if you must. However, reporting the act to the IC3.gov will aid global efforts against cyberwarfare, therefore I urge you to consider adding the reporting step into your procedures.

Attend free first-responder training. Consider sending one or more of your IT folks to the regional and [often] no-cost Cyberterrorism First Responder trainings that DHS does.