jump to navigation

Israel Blamed for Fueling Flame Cyber Weapon in Middle East May 29, 2012

Posted by Paolo Passeri in Information Security.
Tags: , , , , , , , , , , ,
add a comment

The day after its discovery, there are few doubts that the infamous malware dubbed Flame (or sKyWIper) has been developed by a government with significant budget and effort. The complexity of the malware suggests that it has been used for a huge cyber-espionage campaign and, easily predictable, Israel is listed as the main culprit, even if in good company if it is true, as argued by some bloggers, that the malware was created by a strict cooperation coproduction between CIA and Mossad.

Israeli vice Premier Moshe Ya’alon has contributed to fuel the Flame: speaking in an interview with Army Radio, Ya’alon has hinted that Jerusalem could be behind the cyber attack, saying “Israel is blessed to be a nation possessing superior technology. These achievements of ours open up all kinds of possibilities for us.” In light of this statement, it does not appear a simple coincidence the fact that the main victims of the cyber weapon, as reported by Kaspersky Lab, are nations who may not be just considered in good neighborhood relations with Israel.

Consequently it is not that surprise the fact that the same interview has been readily reported by the Iranian News Agency Fars (which has interpreted it as a sign of liability and has hence blamed Israel for waging cyber war in Iran) as well as it is not that surprise the tone of several comments to an article posted on the Haaretz newspaper’s Web site (“Nice One Israel, Proud of You!!!!”).

Of course it is too soon to jump to conclusion,in any case, whether Israel (and U.S.) is behind Flame or not, I could not help but wonder how it is possible that a malware has been able to go undetected for at least 5 years. Are endpoint protection technologies really dead, leaving us at the mercy of a (cyber)world ruled by APTs?

If you want to have an idea of how fragile our data is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated) at hackmageddon.com. And follow the author of this article @paulsparrows on Twitter for the latest updates.

Related Articles

Pentagon flexing muscles at Pyongyang: B-52 bombers take part in largest U.S. exercise in Korea for the first time May 29, 2012

Posted by David Cenciotti in North Korea.
Tags: , , , ,
add a comment

Although North Korea’s most recent attempts to project an image of strength to the rest of the world have failed, the U.S. military is undoubtedly focusing on the Korean peninsula.

Even if the news that U.S. Special Forces have already parachuted into North Korea to perform surveillance operations on Pyongyang activities, reportedly (accidentally?) disclosed by Army Brig. Gen. Neil Tolley, commander of U.S. Special Operations Forces in South Korea, was (awkwardly) denied by U.S. Forces Korea, an official PACAF press release leaves no room for interpretations.

According to the news release, two B-52 Bombers from Anderson Air Force Base, Guam, took part in exercise Max Thunder 12-1 at Gwangji Air Base, Republic of Korea, on May 17, 2012.

The mighty bombers have already been involved in joint drills in the region, as happened in 2010, when they took part to Keen Sword in Japan. However, this is the first time the B-52s attend the largest Air Combat Command exercise in Korea.

Here’s an excerpt of the most interesting parts of the press release:

“This is the first time B-52′s flew in MT 12-1. It has tradition as a fighter aircraft exercise since 2008.”

“Bringing the B-52 to Max Thunder is really great training for everyone,” said Capt. Seth Spidahl, Anderson Air Base B-52 pilot and liaison at Max Thunder. “A lot of the time we don’t get to integrate with other fighter aircraft.

MT 12-1 is the largest Air Combat Command exercise in Korea conducted twice a year.

[...]

The decision to integrate B-52s into MT 12-1 was decided just hours before their executed mission, Spidahl said.

“Normally we don’t plan from the exercise location but, since we don’t normally play in Max Thunder, it seemed appropriate,” he said.

During the exercise, the B-52s were tasked to bring approximately 40 percent of the weaponry to the fight and were instructed to hit roughly 85 percent of the planned targets for the mission.

“It’s important to display our capabilities and show what we bring to the fight,” he said. “During a time of actual war B-52s would support the fight. So it’s important to exercise those capabilities now.”

[...]

“B-52s brought a different spin to Max Thunder,” said Col. Patrick Matthews, Max Thunder deployed commander.

[...]

The combined joint two-week exercise allowed the U. S. Air Force to work alongside the ROK Air Force through exercise scenarios simulating combined operations against a hostile force.

Therefore, after an “Elephant Walk” with sixty USAF and ROKAF F-16s at Kunsan Air Force Base (and a long-range exercise  involving B-1 bombers and troubled F-22 Raptors featuring the Block 3.1 upgrade to validate new strike tactics), the U.S. have once again decided to rely on the B-52, their most famous, combat proven and effective bomber, to impress Pyongyang. And maybe Beijing too.

Image credit: U.S. Air Force

Related Articles

Italy’s Reaper drones to be “weaponized” May 29, 2012

Posted by David Cenciotti in Military Aviation.
Tags: , , , , , ,
add a comment

Although it could take a year or more to complete the process, Italy’s Reaper drones could soon be given the official go ahead to procure the Hellfire missiles and laser guided bombs that Rome has requested since the first MQ-9 drone was delivered to the Italian Air Force last year.

According to a WSJ article, the Obama administration has already given Congress a notification of a proposed sale of six kits needed to arm Italy’s fleet of Predator B (MQ-9 Reaper) drones and a formal notification should follow as soon as this week.

Even if the sale could still be blocked (as it could open the door for similar sales to other allies, making foreign sales of drone technologies, more difficult to control), a stop is unlikely, according to lawmakers and others familiar with the matter that talked to the WSJ, meaning that Italy will be, besides UK, the only other U.S. ally to fly armed drones in Afghanistan and elsewhere.

The Italian Air Force has ordered six Reapers to be used in surveillance tasks in both Homeland Security and Expeditionary scenarios. The first two Reaper UAS (Unmanned Aircraft System) took part in Operation Unified Protector in Libya while the remaining four will be delivered by the end of 2012.

The Reaper is more capable than its predecessor Predator A (four of those are currently flying in support of ISAF in Afghanistan, after serving in Iraq): it carries a Multi-spectral Targeting System (MTS-B), that is a suite of sensors integrating an infrared sensor, a color/monochrome daylight TV camera, and laser designator and illuminator. It is also equipped with the Lynx IIE Synthetic Aperture Radar although the system will be implemented with the impending required software upgrade.

The U.S. Reapers can be armed with both AGM-114 Hellfire anti-armour missiles and GBU-12/38/49 laser-guided and GPS-guided PGMs (Precision Guided Munitions) that could be important to protect Italian and NATO troops operating on the ground.

“On several occasions, if we had armed drones we would have saved human lives” said an Italian drone pilot during a media briefing in June 2011.

Italy has about 4,200 military in Afghanistan, most of which in the western part of the country.

Related Articles

Odyssey of an A-4 Skyhawk Pilot during the Falklands War: Captain Alberto Jorge Philippi’s story May 29, 2012

Posted by Richard Clements in Military Aviation, Military History.
Tags: , , , , ,
5 comments

Whilst much has been written about the British involvement in the Falklands/Malvinas conflict a short story was written by an Argentinean pilot who was involved in the attack on the beach head at San Carlos.

The article written a year after the conflict finished describes how Captain Alberto Jorge Philippi took off from the Rio Grande naval base as a three ship A-4 Skyhawk formation and headed towards the Malvinas at 27,000 feet.

Once Philippi and his colleagues were 100 miles from the islands they dropped to an altitude of 100 feet. Philippi describes how the weather was poor with low clouds and rain as they followed the coast to the southern entrance to the San Carlos sound where they dropped to an altitude of 50 feet.

[Read also: This impressive image was taken 30 years ago today: Argentine A-4B Skyhawks low level attack on HMS Broadsword]

Even though the radar altimeter was set to sound at 30 feet, Philippi mentions how it went off numerous occasions as they sped up the sound towards the British fleet which was in the process of landing thousands of troops from amphibious landing craft.

Philippi then spotted the masts of a ship amongst the rocks at his 11 O’clock and signalled to his colleagues this was to be their target. After closing to the rocks to hide his aircraft and confuse the frigates fire control radar, Philippi turned hard wing tip skimming the wave tops to bring the target onto his nose.

Once Philippi was 1,000 – 1,500 meters from the Frigate (HMS Ardent) he performed a pop-up delivery from around 300 feet, waited for the cross hairs to meet over the bow of the ship and released his weapons.

Once the bombs were away, Philippi turned hard to the right whilst loosing the altitude he had gained to deliver his weapons back down to the 50 feet he was at prior to release.

Seconds later, Philippi’s colleague Jose Cesar Arca’s voice came over the radio and said “Very Good Sir” as the bombs impacted the back of the ship. Arca’s bombs also found their target even though Arca had flown through the debris and smoke kicked up by Philippi.

The pilots had decided to escape using the route they had used to get to the target area but, within minutes, Marcelo Gustavo Marquez, the third pilot of the same formation, shouted “Harrier! Harrier!” down his radio.

The A-4 pilots immediately jettisoned their external stores to escape and seek safety in the clouds. Whilst in the process of ejecting the external stores, Philippi felt an explosion at the back of his jet and immediately felt the nose of the jet rise uncontrollably. As he wrestled with the increasingly unresponsive stick he took a look over his right shoulder to see the Sea Harrier at some 150 metres away.

Image credit: Imperial War Museum

“I am going to eject, I am well” Phillipi said over his radio and with that he opened the speed brakes to reduce speed, placed his hand on the ejection handle and pulled. The force of the ejection knocked Philippi out and he came to hanging from his parachute within cloud: he had lost his helmet and mask during the ejection, but thanked God he was still alive.

Whilst still hanging from the chute Philippi removed his boots, inflated his life jacket and loosened his harness before making a slash into the sea some 100 metres from shore.

After a rather hard swim to shore the Skyhawk pilot did what any downed pilot does and activated his distress signal and waited to be picked up. He then witnessed one of the British ships bombard a grounded Argentine ship thinking it was still a threat.

Phillipi headed south and was alone for three days before coming across a sheep farm where the farmer fed him, gave him some clothes before he was picked up by helicopter and flown to Darwin, where Philippi’s problems didn’t end. There he witnessed the attacks by the Harriers and British Army and eventually flew out on the last helicopter to Puerto Argentino (Port Stanley).

A couple of days later Philippi was flown back to the mainland on a C-130, which did the whole trip at 50 feet.

Richard Clements for TheAviationist.com

Related Articles

If you suffer motion sickness this video is not for you: low level flying with a Super Hornet May 28, 2012

Posted by David Cenciotti in Military Aviation.
Tags: , , ,
add a comment

Someone might find it a bit boring whereas others will suffer motion sickness symptoms.

Anyway, I think this video gives a clear idea what flying a U.S. Navy’s VFA-137 F/A-18E Super Hornet during a low level sortie through the Sierra Nevada in East California out of Naval Air Station Lemoore, Ca., looks like.

Since it does not feature any soundtrack, the footage let’s you literally hear the typical cockpit sounds as the pilot, wearing a JHMCS helmet, pulls some Gs on aggressive low level turns needed to avoid obstacles and take advantage of terrain masking (to prevent detection by enemy radar systems).

As already explained, in the age of stealth bombers, standoff weapons, drones, cyberwar, electronic warfare, etc. low-level high-speed flying is still one of the most important parts of both planes and helicopters combat pilot training.

H/T to @AeroSamm for the heads-up

Related Articles

“Flame” malware infiltrating Middle East computers: the most complex Cyber Weapon, ever! May 28, 2012

Posted by Paolo Passeri in Information Security.
Tags: , , , , ,
add a comment

Irony of fate: not even a day after the publication of a provocative article on the role of Cyber Warfare for maintaining peace, a new cyber threat appears, which is destined to leave an indelible mark on the cyber weapons’ landscape.

Today is one of those days that the Infosec Community will remember for a long time. It looks like the mystery of the malware targeting the Iranian Oil business a month ago has come to a solution, and it is not that kind of conclusion we would have hoped and expected.

Nearly in contemporary Kaspersky Lab, CrySyS Lab and the Iranian Computer Emergency Response Team Coordination Center have unleashed details of what has been defined (arguably) the most complex malware ever found.

The malware, which has been dubbed Flame (Kaspersky), or sKyWIper (CrySyS Lab), or also Flamer (CERTCC), has some unprecedented features that make it one of the most complex threats ever discovered:

  • The Cyber Weapon Malware is a sophisticated attack toolkit, It is a backdoor, a Trojan, and has worm-like features (three in one). According to Kaspersky its development has taken a couple of years and it will probably take year to fully understand the 20MB of code of Flame.
  • According to CrySyS Lab Flame has been in the wild since 2007, having been seen in the following geographical regions: Europe on Dec 5 2007, The United Arab Emirates on Apr 28 2008 and the Islamic Republic of Iran on Mar 1 2010;
  • Flame is controlled via an SSL channel by a C&C infrastructure spread all around the world, ranging from 50 (Kaspersky) to 80 (CrySyS) different domains;
  • Flame owns many capabilities, including sniffing the network traffic, taking screenshots, recording audio conversations, intercepting the keyboard. C&C operators may choose to upload up to about 20 modules, which can expand Flame’s functionality;
  • The complete set of 20 modules is 20 MB in size when fully deployed (about 20 times larger than Stuxnet and maybe it is the reason why it wasn’t discovered for so long);
  • Flame includes a piece of code (about 3,000 lines) written in LUA, a not so common occurrence for malware;
  • Top 7 affected countries include Islamic Republic of Iran (189 Samples), Israel/Palestine (98 samples), Sudan (32), Syria (30), Lebanon (18), Saudi Arabia (10), Egypt (5).
  • Flame appears to have two modules designed for infecting USB sticks: “Autorun Infector” (similar to Stuxnet) and “Euphoria” (spread on media using a “junction point” directory that contains malware modules and an LNK file that trigger the infection when this directory is opened);
  • Flame may also replicate via local networks using the following:
    1. The printer vulnerability MS10-061 exploited by Stuxnet – using a special MOF file, executed on the attacked system using WMI;
    2. Remote jobs tasks.
    3. When Flame is executed by a user who has administrative rights to the domain controller, it is also able to attack other machines in the network: it creates backdoor user accounts with a pre-defined password that is then used to copy itself to these machines.

    So far

  • So far no 0-day vulnerabilities have been found, despite the fact that some fully-patched Windows 7 installations have been compromised, might indicate the presence of high-risk 0-days.

With no doubt a beautiful piece of malware written with the precise intent of Cyber-Espionage. Besides the resounding features of the malware, I found particularly interesting the same infection mechanism used by Stuxnet, that make me think of (another) possible double agent implanting the first infection.

This (legitimate) suspicion is also reinforced by the disarming conclusions issued by CrySyS Lab:

The results of our technical analysis support the hypotheses that sKyWIper was developed by a government agency of a nation state with significant budget and effort, and it may be related to cyber warfare activities.

[Originally posted on Hackmageddon.com: http://hackmageddon.com/2012/05/28/a-flame-on-the-cyberwarfare-horizon/]

If you want to have an idea of how fragile our data is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated) at hackmageddon.com. And follow the author of this article @paulsparrows on Twitter for the latest updates.

Related articles

Report unveils the presence of more than a million counterfeit electronic parts in U.S. combat planes May 28, 2012

Posted by Richard Clements in China, Military Aviation.
Tags: , , , , , , ,
add a comment

The Senate Armed Services Committee has just released a year long report in the use of counterfeit parts in military equipment whose findings are simply shocking.

The report unveils the presence of some 1,800 cases of fake parts (worth more than a million components) than a in SH-60B helicopters and in C-130J and C-27J cargo planes as well as the US Navy’s P-8 Poseidon.

The report highlighted that more than 70 percent of the counterfeit parts were traced back to China, but it blamed weaknesses in the U.S. supply chain, and China’s failure to curb the counterfeit parts manufacturers.

U.S. servicemen rely on a multitude of sophisticated electronic parts found in all sorts of systems, from GPS to Night Vision equipment and these counterfeit parts have not passed through the rigorous testing that the real parts have.

Indeed, whilst the report laid the blame squarely at the feet of the Chinese it said: “U.S authorities and contract companies contributed to the vulnerabilities of the defense supply chain by not detecting the fake parts or routinely failing to report suspected counterfeiting to the military.”

The report did however praise the National Defence Authorization Act, signed into law on Dec 31, 2011, by President Barack Obama, whose intention is to stop the flood of these counterfeit parts into the U.S. even by reducing sourcing from unknown supplier.

Just think to what would happen if China tried to intentionally flood the U.S. military with counterfeit parts: a failure could put the lives of U.S. service personnel in danger at the wrong moment both in combat and during normal training activities.

That’s why integrity of the supply chain must be considered a national security matter.

Image credit: U.S. Navy

Update from Syria: amphibious armoured vehicles, heavy mortars and tanks. May 28, 2012

Posted by David Cenciotti in Syria.
Tags: , , , , , , , ,
add a comment

In this article you can find some new details that Bjørn Holst Jespersen, a contributor of The Aviationist, has continued to post on his blog, as he keeps collecting and analyzing images and footage from Homs, Hama, Idlib, Damascus and other Syrian towns made available on Social Media.

Hence this is an update to the original Special feature: all the weapons used by the Syrian regime on Homs and following posts about the Syrian uprising published on The Aviationist.

BRDM-2

Another weapon has been seen used by the Syrian regime in Homs. It’s a four wheel amphibious armored vehicle with a turret mounted heavy machine gun. The weapon is shown in a video that was linked-to in a tweet from an activist:

@HamaEcho:
“Police” armored car shooting at Khaldiyah neighbourhood of Homs today. [ YouTube link ] #Homs #Syria (4:02 PM – 13 May)

A frame from video on MyAbotarek’s YouTube channel showing the vehicle firing towards the camera.

In the video the vehicle is seen firing at least 15 rounds in the direction of the rather courageous camera man. To identify the vehicle, Bjørn stitched together two frames from the video in the image below:  it’s a Russian (or Soviet) made BRDM-2.

The BRDM-2 is an amphibious armoured patrol car, and its main weapon is a 14.5 mm KPV heavy machine gun.

Apparently, its blue color and the absence of tracks are meant to make it a police vehicle. But even if such vehicles have been used for police purposes in other countries, keeping on the 14.5 mm machine gun makes it a military weapon.

Left: two frames from  video on MyAbotarek’s YouTube channel stitched together. Right: photo of a BRDM-2 in Polish service from Wikipedia.

According to Wikipedia, Syria is estimated to have some 950 of these vehicles, even if it was rarely spotted during the uprising. Bjorn believes that a possible explanation is that the armour of the BRDM-2 is significantly thinner than that of the BMP-1: the thickness of the armour of the hull floor is 2-3 mm and the hull sides 7 mm (also according to Wikipedia) makes it quite vulnerable in urban warfare.

And with an estimated number of BMP-1s for Syria of 2,100 (by 2005) there have been plenty of these until now. Although someone saw the use of the BRDM-2 as an attempt to make it appear as if the regime is complying with the Annan ceasefire agreement (and not as the result of either a decreased level of tension or a lack of better armoured vehicles) the BRDM-2 was used as a police since at least Nov. 10, 2011, as shown in a post on the Military In The Middle East.

Left frame: Under “Police” the Arabic lettering can be translated literally as “maintaining security and order forces”. Images and caption from Military In The Middle East.

240 mm mortar updates

Two M-240 mortars believed to be used against Old Homs. The one to the left has its barrel tilted to horizontal position. From a video uploaded on Mar. 28 to 434343aaa’s YouTube channel (via @GRAFIXEL and @ArabSpringFF)

The frames above are from one of the first video documenting presence of the 240 mm mortars. In the video there are two of the towed M-240 mortar model. The footage also shows at least 3 tanks at the start.

The two mortars are placed West of Homs close to the Al-Waer neighbourhood at this position. Please notice as well that all the areas in Homs that have been shelled are within the 9.5 km range of this weapon (see post linked-to at the end of this section for map).

In a video uploaded on Apr. 14 that Bjørn has just recently discovered, the mortar to the left has been covered (image below). The video does not show the one to the right. His guess is that if it was still there it would have been filmed. Possibly it has been moved and covered.

Also in this video the tanks mentioned above have disappeared. Instead a number of tanks can be seen in two buildings close by at this position.

Left frame: something covered in the exact same position as the M-240 in the earlier recording. Frame to the right: tanks hidden/parked in building. Source:  video uploaded on april 14. to 434343aaa’s YouTube channel.

The area where the mortars are placed is part of a military academy and contains more artillery positions. Bjørn has a closer look at the area in this post.

T-62 tank

A tank has been extensively used in Syria by the regime: the T-62. The main gun on this model is a 115 mm smooth-bore.

Here below you can find an image depicting a T-62 tank. According to the uploader the tank is positioned on the edge of the Baba Amr neighbourhood, at Homs.

A T-62 tank on the edge of Baba Amr, Homs. The T-62 and the T-55 both have five road wheels, but the T-62 has larger gaps between the last three wheels while the T-55 has a large gap between the first and second. Image source: engahns546‘s Panoramio account.

Browsing Panoramio, Bjørn has found anoter interesting photo showing three tanks located not far from where Baba Amr borders to the Inshaat neighbourhood in Homs. The one to the right is a T-72. The tank in the middle is some kind of road clearing vehicle based on the T-72, and the one to the left should be another T-72.

Three T-72 tanks in Baba Amr, Homs. The number of road wheels is the easiest way to tell the T-72 apart from the T-62 and T-55. Image source: engahns546‘s Panoramio account.

Related Articles

Photo: The USS Nimitz passing under the Golden Gate bridge May 27, 2012

Posted by David Cenciotti in Aircraft Carriers.
Tags: , , ,
2 comments

The following pictures were taken, more or less at the same time, few hours ago.

They show the USS Nimitz passing under Golden Gate bridge and entering the Bay to attend the Festival in San Francisco for 75th anniversary of the bridge, from two different points of view: the first, was taken from the shoreline of the San Francisco Bay, by a photographer who uploaded it to Flickr; the second was taken on board the flattop as it sailed under the brigde with the personnel lined up on the flight deck, and posted to the aircraft carrier’s Facebook page.

The aircraft carrier has just completed carrier qualifications off the southern coast of California and no CVW-11 plane is on board.

Image credit: Steve Rhodes

Image credit: USS Nimitz Facebook page

Thanks to the Internet and Social Media, we can follow some events as they happen.

Robosaurus breathing fire among C-17 and C-5 cargo planes at March Air Reserve Base May 26, 2012

Posted by David Cenciotti in Bizarre.
Tags: , , , , ,
add a comment

Modeled after Trasformers toys, Robosaurus is a transforming dinosaur robot, with the driver (or “pilot”) sitting in the head of the ‘bot, with the ability to transform from a 48-foot semi trailer into a futuristic Tyrannosayrus Rex.

It was created by inventor Doug Malewicki in 1989 and is currently owned and operated by Monster Robots, Inc. It is used at motorsport events and air shows to eat and burn vehicles with a flame shooting out of its nostrils.

On May 20, Robosaurus performed at March Air Reserve Base, California, home of the 452d Air Mobility Wing (452 AMW), during the 2-day March Field AirFest 2012 air show.

Here are some of the most interesting images of the robot as it shoots fire out for the crowd.

Image credit: DoD, U.S. Air Force