When Terrorists Learn How to Hack

Terrorist groups are expanding their use of the Internet beyond mere messaging and disseminating operational know-how, slowly adding a hacking toolkit that could one-day rival that of criminal or state-sponsored hacking. 

To date attacks have included website defacement, doxing of personally identifiable information, and distributed denial of service (DDoS) attacks. But this could grow to more disruptive attacks, not only with the potential to spread fear, but also raise revenue across the far reaches of the globe.

In the early 2000s, the CIA had identified two known US-designated terrorist organisations, Hezbollah and Hamas, with the capability and intent of using cyber-attacks against US critical infrastructure. 

There were also reports of al Qaeda pursuing technically savvy recruits to hold US networks at risk as well. With the emergence of the so-called Islamic State, a global pool of potential recruits that grew up with the internet, and readymade hacking toolsets available online, the likelihood of such groups turning to offensive cyber capabilities is growing. In September 2016, a Kosovo hacker linked to ISIS named Ardit Ferizi was sentenced to 20 years in prison for hacking the networks of a US company and stealing personally identifiable information of some 1,300 US military members and government personnel. 

Ferizi, who pleaded guilty in June 2016, then provided the stolen information to Junaid Hussain, a British hacker and ISIS recruiter also known as Abu Hussain Al Britani, who was later killed in a US drone strike after he published the stolen personal information under the name of the Islamic State Hacking Division (ISHD), now known as the United Cyber Caliphate, in 2015. Hussain is also thought to be responsible for hacking into US Central Command’s Twitter account.

In the dump, Hussain proclaimed, “O Crusaders, as you continue your aggression towards the Islamic State and your bombing campaign against the Muslims, know that we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands! ‘So wait; we too are waiting.”

The intention was to package the stolen personal data of US military and government officials, such as names, addresses and other sensitive information, as a ‘kill list’ to inspire lone wolf attacks against those individuals and their families, a clear facilitator fear. 

In fact, a Bangladeshi living in Maryland named Nelash Mohamed Das was indicted in September 2016 for allegedly seeking to attack a military member whom appeared on the kill list published by Hussain. In another instance, ISIS-affiliated hackers using a tool named Caliphate Cannon launched their first volley of DDoS attacks against government targets in Egypt, Jordan, Yemen and Iraq in December 2016, resulting in the disruption of several servers hosting hundreds of sites.

Pro-ISIS hackers commonly resort to website defacement, particularly targeting government and media sites so that the group’s propaganda can coopt their audiences. In June, a number of government websites were hacked with messages purporting to be support of the ISIS. 

While fear is the ultimate goal, terrorists could also seek to confuse and sow doubt by spreading disinformation similar to Russian cyber operations in the lead up to the 2016 US presidential elections. Network intrusions could allow terrorists to manipulate critical data or information and bots on social media could amplify terrorist narratives to global audiences, causing audience to overestimate their presence and respond disproportionately, the “judo throw” tactic common among terrorist groups.

At the same time, pointing the blame for hacks at terrorist organisations such as ISIS has been a tactic used to muddy attribution of state-sponsored operations. 

In April 2015, a group claiming to be the Cyber Caliphate targeted French television channel TV5Monde, taking their operations temporarily offline. But French investigators determined the culprits were hackers working on behalf of the GRU, Russian military intelligence. While cyber-attacks by terrorist groups likely necessitate clear attribution, thus claims of responsibility, the use of such methods also allow other nation-states plausible deniability when they engage in such activities.
Terrorist groups have long used guerilla warfare and cutting-edge technologies to pursue their goals, they embrace unconventional tactics to counter a conventionally superior foe. The use of hacking is a natural progression for jihadist groups and other non-state actors seeking to expand their influence, spread fear and uncertainty, and bankroll their operations.

The progressive increase in Internet infrastructure in the developing world means terrorist groups will be able to launch cyber operations from all over the globe. While the technical capability of cyber jihadists has remained unsophisticated in relation to the criminal underground and nation-states, this could change. 

A pro-ISIS information security group named Horizons already regularly publishes detailed guides on computers and encryption, and such spread of operational know-how could eventually include hacking courses, such as the many found on the dark web.

Hacking-as-a-service is a growing industry, and criminal groups could wittingly or unwittingly act on behalf of extremist groups. State-sponsors of terror could fund terrorist hacking operations and publically available hacking tools, either purchased on the dark web or obtainable tools such as the allegedly NSA tools released by Shadow Brokers, could facilitate e-jihad.

Terrorists could disrupt Internet communications or media sites prior or following a terrorist incident, once they develop the capacity to create expansive botnets to launch denial of service attacks that use the Internet of Things to flood networks with false traffic, such as the Mirai botnet that temporarily took down DNS provider Dyn in October 2016. 

Such a disruption could adversely affect how audiences and emergency responders could quickly gain an understanding of the situation, increasing the probability of panic.

Ransomware coupled with propagating worms, such as the WannaCry attacks in May, could provide a mode of both fundraising and disruption for terrorist organisations, such as by targeting hospitals or transportation hubs. Such capacity would also allow terrorist organisations to coerce governments and others to meet their demands, such as prisoner exchanges given the accumulating costs that ransomware produces.

While many have warned of cyber terrorism targeting critical infrastructure, such as the power grid or nuclear power plants to spread panic, blunt government response and potentially even cause loss of life through physical destruction, such operations are far more complex and require deep understanding of the physical engineering of these systems. 

Success in targeting critical infrastructure is not impossible, however, as the 2015 and 2016 attacks on the Ukrainian power grid shows, and this trend could grow with automated hacking capabilities.

The Cipher Brief

You Might Also Read:

Terrorism, A Sea Change In Tactics:

Interpol/Group-IB Unmasking Pro-ISIS Hackers:

 

 

« Snowden’s Haven - A New Surveillance App
GDPR - Its Complicated. »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Link11 GmbH

Link11 GmbH

Link11 provides DDoS protection solutions to protect websites and complete server infrastructures from DDoS attacks.

PlaxidityX

PlaxidityX

PlaxidityX (formerly Argus Cyber Security) is a global leader in mobility cyber security, provides DevSecOps, vehicle protection and fleet protection technologies and services.

Array Networks

Array Networks

Array Networks, the network functions platform company, develops purpose-built systems for hosting virtual networking and security functions with guaranteed performance.

IdenTrust

IdenTrust

IdenTrust enables organizations to effectively manage the risks associated with identity authentication.

Auxilium Cyber Security

Auxilium Cyber Security

Auxilium Cyber Security is independent information security consultancy company.

SmartContractAudits.com

SmartContractAudits.com

SmartContractAudits.com is the leading platform for finding companies providing smart contract auditing services.

Center for Education & Research in Information Assurance & Security (CERIAS)

Center for Education & Research in Information Assurance & Security (CERIAS)

CERIAS is one of the world’s leading centers for research and education in areas of information and cyber security.

InfoSystems Inc

InfoSystems Inc

InfoSystems provides reliable IT solutions to build and maintain strong and secure systems for both SMB and enterprise organizations.

RedLegg

RedLegg

RedLegg is a master provider of information security services, a boutique, nimble, old-fashioned customer service company that enjoys the technology battlefield.

Mr Backup (MRB)

Mr Backup (MRB)

MRB offers Data Protection as a Service for businesses looking to reduce the time, cost and complexity of securing your company data.

Apono

Apono

Apono enables DevOps and security teams to manage access to sensitive cloud assets and data repositories in a frictionless and compliant way.

Anxinsec

Anxinsec

Anxinsec Technology is a security solution and service provider with a focus on new technology and innovations in cybersecurity.

HackNotice

HackNotice

HackNotice Teams is an all-in-one encompassing tool that monitors threats within your organization, different vendors, and third parties whose services you use.

AutoRABIT

AutoRABIT

AutoRABIT provides DevSecOps tools built specifically for Salesforce developers to increase release velocity, produce consistently high-quality code, and enhance data security.

Krista Software

Krista Software

Krista is an intelligent automation platform that combines iPaaS and Conversational AI to automate complete business processes across your teams and apps.

Otava

Otava

Otava is a global leader of secure, compliant hybrid cloud and IT solutions for service providers, channel partners and enterprise clients.