Technical OSINT innovation contest: the 2008 Malware Challenge

While the worlds of most OSINT analysts do not typically overlap with those working in the more rarified fields of digital network intelligence, forensic analysis, and network warfare, there are a highly specialized subset that may be interested in testing their skills as part of a challenge of their own. While clearly not as high profile as the recent DNI OSINT contest, the 2008 Malware Challenge promises interesting responses of its own.

The winners of the malware challenge will be announced at the 2008 Ohio Information Security Summit on 31 October 2008. We had not previously seen this conference, but it appears to be a small regional conference that is unusually well attended by the usual round of ex-spooks and ex-cops that have moved into the cyber security industry as of late.

The challenge scenario is reproduced below:

"A system administrator within your organization has come to you because a user's PC was infected with malware. Unfortunately, anti-virus is unable to remove the malware. However, the administrator was able to recover the suspected malware executable. Your job is to analyze the malware.
Participants should download the malware sample and analyze it. The end result should be a document containing details on the analysis performed. The analysis document can be written in any form, but the questions and statements below should be answered within it. Participants should note what questions are being answered.
The questions...
* Describe your malware lab.
* What information can you gather about the malware without executing it?
* Is the malware packed? If so, how did you determine what it was?
* Describe the malware's behavior. What files does it drop? What registry keys does it create and/or modify? What network connections does it create? How does it auto-start, etc?
* What type of command and control server does the malware use? Describe the server and interface this malware uses as well as the domains and URLs accessed by the malware.
* What commands are present within the malware and what do they do? If possible, take control of the malware and run some of these commands, documenting how you did it.
* How would you classify this malware? Why?
* What do you think the purpose of this malware is?

Bonus questions: (These questions are not required to be answered but could be used to break a tie for prizes.)
* Is it possible to find the malware's source code? If so, how did you do it?
* How would you write a custom detection and removal tool to determine if the malware is present on the system and remove it?

Analysis documents should be submitted in PDF format to 2008challenge@malwarechallenge.info by 12:00 Midnight EST (5:00 AM GMT) on October 26, 2008."

Additional information, including other contest rules and FAQ, can be found at the challenge website.

Interestingly, we note that Steve Jackson Games is among the sponsors providing prizes for the winners. SJG was most famously the victim of a botched Secret Service raid in 1990, which seized files and texts that were part of one its published gaming lines. For those that are not familiar with this disastrous episode from the earliest days of the cyber intelligence account, it was best recounted in Bruce Sterling’s still timeless book, The Hacker Crackdown. (In our opinion, this is also a text which should be mandatory reading for those involved in SIGINT, MEDEX, or eCrime analysis. And while the USSS has indeed come a long way since then, we do from time to time encounter other shops still grappling to come to terms with the new threat environment with often equally absurd results.)


h/t Spy Logic

A glimpse of a future naval (and network) special operations mission: Google edition

The jesters and the futurists have long featured offshore structures as the future of human activities. Reality continues to bear out these predictions. We have previously discussed large scale offshore habitation structures and their potential impact for future intelligence and unconventional warfare problems. This time around, it is the concept of the maritime data center – previously discussed as a moored vessel – recast as an offshore terminal type platform.

We are enthused by the possibility of seeing a real life data haven come into its own – and run by a professional multinational entity (rather than the sad sort of anarchist disgrace that was Sealand). But one can easily see the fascinating potential for convergence of a whole range of threats directed against such facilities, involving both naval and network conflicts.

Once again, our froggy friends will no doubt be forced to ponder such actions. And while there are no doubt legions of would-be hackers just waiting to strap on a wetsuit to live out their own episode of the Rock against a network contagion, they are apt to be disappointed. One suspects that the signals intelligence folks will be far more likely to have to come to terms with what the widespread proliferation of such offshore datacenter platforms will mean in an environment where bandwidth and storage are nearly infinite and entirely cheap, and may be rented from the cloud through a complex and shift network of shell companies, taking advantage of low staffing levels and limited oversight incentives. The Russian Business Network’s latter day successors will no doubt be wet.

h/t Futurismic

Rent seeking and digital media exploitation

We hear news of one of the more disturbing aspects of legal intrusion into the intelligence field – the tendency of lawmakers and regulators to craft protectionist legislation – enabling and encouraging rent seeking behaviors that would never survive in a more open marketplace.

This time around it is an area which at first blush might seem tangential to the profession of intelligence - but it is more closely associated with other issues in the field than we would like. South Carolina may force those private parties involved in digital forensics to hold a private investigation license – that hoary old document so beloved of fiction authors and scandal page writers.

The PI business has clearly been losing a lot of ground over the past few decades as business has become ever more global in nature – and not that it ever had much ground to begin with, in the more rarified professional atmospheres of major multinationals. The few top tier exceptions in the field have undergone some dramatic shifts – so much so that reporting on the industry’s turmoil became a staple of the Indigo Publication’s Intelligence Online newsletter. Major players from consulting firms and more specialized shops have emerged to carve away what might have been business opportunities, especially since most executives (and more critically, the lawyers who advise them) disdain the “hard-boiled” image that the term PI evokes. Even if in the modern business of investigations such an image is only a stereotype, it has a strong impact on business realities.

Digital forensics is a pretty wide field, even despite its relative youth. It encompasses activities as disparate as internal systems monitoring, to compliance auditing, to the full range of criminal search and seizure. What it means in a networked world is still very much being explored – particularly given the challenges posed by rapidly evolving hostile technology innovations. In its more advanced networked forms, it often begins to resemble more closely activities in the signals intelligence domain. While this is understandable from the perspective of intelligence studies theory, given that the native competencies of intelligence in the cyber domain have yet to be recognized, it is far to early to allow regulatory frameworks to disrupt the development of the discipline – especially a framework which imposes mechanisms better suited to the Industrial age of rail than the modern age of networks.

We oppose this line of thinking not only for the immediate harm it causes, but for the slippery slope it creates. With each new regulatory overreach, additional activities within the intelligence field become new marginal examples that could be brought under one’s favoured framework. From digital media exploitation it is not far to also seize upon the regulation of document exploitation, and from DOCEX it is easy to bring other aspects of OSINT under the sway of those seeking to profit from entrenched positions. How long then before simple searches within a database, or simple overt elicitation contacts, will require a licensing regime – and one ruled by a clique of established players with only the "right" kind of political connections?

This is among the reasons why we have also opposed the creation of arbitrary standards bodies seeking to define professionalism within the intelligence field – especially those composed of academics who cannot even properly conceptualize many of the key aspects of the profession as it is actually practiced, let alone standardize external measures by which practitioners might be judged. We hold no objection to bodies seeking to advance professionalization through a community of interest, a strong literature, and leadership by example. We also see no issue in individual standards being put into place in specific circumstances – such as the conditions under which a court will recognize sufficient expertise for testimony, or how a government agency will certify knowledge and experience ample for the performance of a contract it is to award, or how employees will be evaluated for promotion within a given shop. But these are far different things than the regulatory creature now rearing its ugly head.

We hope that some degree of sanity will return to these discussions, particularly should the lobbyist guns of the major consulting firm players be warmed up to play against the bush league minors that appear to be driving this process. While the South Carolina case is but one state, the precedent could create more widespread attempts at similar rent-seeking behaviors, both geographically and down that slippery slope of further overreach.

h/t Slashdot

SIGINT in the exaflood environment

There has been a lot of talk recently regarding the implications of the rising rate of data exchange for policy issues such as network neutrality and broadband penetration. The term exaflood - coined by one particularly lobbying group - is apt enough, even if one doesn’t necessarily agree with their proposed solution approaches.

There has been however little discussion of the implications of this expansion for the intelligence community – at least in public and academic circles. The current debate is too much caught up in the things of lawyers and politicians, wrangling continuously over legislation drafted when networks were switched by telephone system hardware and connectivity not much different from the transoceanic telegraph systems of a century previously. Those are questions of whether or not the US should even be engaged in such activities, and are far too closely reminiscent of the short-sighted political decisions which resulted in the closure of the Black Chamber – with the potential for equally devastating consequences.

Traditional SIGINT techniques – even within the relatively new realm of digital network intelligence – are the products of an earlier era, in which the target set and its emanations were distinct enough from its environment to be amenable to capture and analysis using a certain degree of discrimination. The kinds of intelligence that will be required against the adversaries of tomorrow will be increasingly less able to rely on the traditional tradecraft which is undergirded by such assumptions.

We do agree with the statement, frequently attributed to former Assistant Director of Central Intelligence for Analysis & Production Mark Lowenthal, to the effect that “there is no such thing as information overload, only poor analytical strategies.” However, the exaflood will challenge both collection and analytical strategies such as never before. Against this backdrop, we look to the continuing infrastructure, language, and human resources challenges faced by those in this section of the community, and greatly wonder if our future community will be adequate to the task.

This is an intelligence challenge that goes far beyond the classic view of conversations that is implied with the COMINT model. Critical value will be found in the relationship and intentionality of information within the digital deluge as much as the actual items itself. One need only look to the importance of identifying individuals in video and photo, such as VOA Iran scandal or the as yet unresolved counterintelligence questions surrounding the relatives of Nada Prouty, for a glimpse of the future impact of such changes on the way the community does business.

Short of some unexpected development in artificial intelligence which will allow for a weakly-godlike appreciation of this overwhelming mass of largely undifferentiated packets, new approaches will be desperately needed. One can only get so far with human-centered processing strategies (at least without introducing a much large pool of vetted practitioners in a Mechanical Turk like system.) And we will still face the essential limitations of time – the time needed to immerse, incubation, and cultivate a longer term appreciation of the narrow windows into complex issues SIGINT will provide, even in the new environment.

It is our contention that the native competency of intelligence in the cyber environment has yet to be recognized. The nature of cyber intelligence in its mature form will have shifted so far from its roots in the SIGINT and even OSINT disciplines that it may well be unrecognizable to the practitioners of today (no matter how complex the Large Scale Internet Exploitation System or how many dark web projects are built for OSINT purposes).

We do not yet know what the new discipline will look like, nor how it will ultimately be shaped. But we are very interested to observe its evolution, and are privileged to be present at its creation.

Living intelligence history through hobbyist cryptanalysis

Following up with the latest in the recent stream of news regarding the ever so eccentric world of code breaking, we are both impressed and amused with the effort at Bletchly Park to recreate the machines that automated much of the attacks against German cryptosystems – and arguably shortened WWII by an incalculable duration. The reconstructed Colossus will test its mettle once again versus the Lorenz cipher, code named FISH.

The original FISH break came about in no small part due to operator error - which involved retransmission of the same lengthy message twice, using only slightly modified cipher settings. Let us hope that similar fortune favours the boffins of Station X once again.

Given that the recreated test also involves a comparison against a modern virtual emulation of the Colossus system, we cannot help but wonder what the results might be if a modern botnet-based cryptanalytic attack was to be added to the race? To be fair, we suppose a virtual analogue of the Y Service intercept system would also have to be crafted – perhaps paired with a software defined radio link or a TCP/IP intercept capability of some flavour. Of course, we would rather prefer the pretty young female clerks that used to operate the radio sets...


h/t Futurismic


UPDATE:

The rebuilt Colossus worked as expected, and achieved a successful break of the encrypted transmissions in a little over three hours. A modern computer analogue did nonetheless manage a successful break faster. Joachim Scheuth, a German cryptologic hobbyist, is to collect the first round of drinks at Bletchley.

However, the exercise did demonstrate the sheer difficulty of SIGINT – particularly in the interception of the weak radio signals of the day using contemporaneous equipment. Something to ponder in this age of far more sensitive systems, and far more elevated expecations.

Strange maps for these territories

Here be dragons, and demons, and every other manner of vision that has ever haunted the mind of man, expressed in the vast emptiness of the blank page that is the edge of the known world.

We lost something, perhaps, when the form of the world was so easily known through remote sensing and other instruments of precision. Not to say one would long for a world of ignorance, but in seeking to craft the stories to fill that void, mankind’s frequent sketches of his fears and hopes found to a certain degree an ultimate and universal expression.

Perhaps this is why maps of the online environment have so taken our fancy. In the place where there is no there, there the human mind is free once again to form the shadows to its dreams.

We note the whimsy, and the rigor, applied to these endeavors. We are amazed by the number of ways in which the shape may be sought, and the patient efforts of those who would catalog the results of those quests.

Perhaps most of all, we find ourselves caught by the recursive nature of the process, by which the vanished maps of earlier ages in the real world are caught up in this consensual hallucination that we share. It is the final resting place of every line drawn to represent the endless hours of a negotiation, or the hard won fruits of the military surveyor or spy in a foreign land. It reminds us of the constant challenge of fixing the battlespace through operational art, and the difficulties of opportunity analysis when what lies over the hill may never be known with any certainty in the endless fog of war. It also reminds us of the constant vigil of indications and warning intelligence, and the ways in which the picture in our mind’s eye may differ from what transpires out of our sight, for the map is never the territory.

Those bitten by the same bug appear now to congregate at Strange Maps, to which we strongly recommend our readers. Students of intelligence, military art, geospatial and remote sensing sciences, and history alike will find much to captivate.

In the end, it may even be that those futile attempts at mapping the virtual may also only ever reside here as the metaphor of cyberspace runs its natural course, and the medium becomes as implicitly assumed as paper.

Yet again, Network Intelligence Example

There must be something in the air – that wonderful early summer sunshine, the fresh air, something… Analysts all over are publicly drawing a blank when required to apply core analytic tradecraft or even basic critical thinking. (Again, we are sure there are many in government and elsewhere grateful for the obscuring effects of classification policy which will cover their own myraid sins.)

Arbor Networks’ Chief Research Officer does a great job calling out Symantec’s muddied interpretation of a short term statistical change in observed cyber attack reporting – despite an acknowledged methodological adjustment in the manner in which such reporting is collected and characterized. Once again, it's in the numbers - tricky things, these are.

It must have given the Arbor folks no small degree of satisfaction to show up one of their competitors in the open source intelligence / cyber intelligence space. This is one of the great reasons why a competitive marketplace for privatized intelligence services can offer better value in the long term for the decision-maker: the best product line over time will win.

Now, to be fair, we have long liked Symantec’s bi-annual OSINT offerings, even despite their marketing slant. But we also appreciate a good coordination fight – and seeing one between two competitors, in an evaluation conducted in full public view, is most refreshing. We hope that it will result in improved rigour and depth for all players in the space.

Remembering capabilities-centric models

Former Spook has an excellent piece commenting on the continuing debate over USAF ISR issues, from acquisition to employment. His points regarding the underutilization of non-traditional assets – from pods of various flavours to onboard sensor suites and especially the Mark I eyeball, brain attached – are well noted indeed.

Intelligence operations planning, in the sense of orchestrated and robust deployment of collection, processing, analysis, and fusion systems of systems, is a rarely taught skill within many organizations – particularly as current players emphasize turf over mission and everyone else assumes that the –INT collection owner will step up in the fight as part of doing business (something that is rarely the case on anything but the most visible of all accounts.)

Those tasked to use such skills are often drawn from very different parts of the community than those taught, and than may have been originally expected to inherit operational or theatre level responsibilities. Under the pressure of real-time environments they will rarely have the chance to learn from the theory, but rather forced to evolve under the brutal Darwinian pressures of warfare and of covert conflicts.

Those in the acquisition community have no such excuses. The long lead lifecycles of major components of the intelligence and warfighting architecture ensure that there is substantial time to consider the implications of the platform, its possible sensor payloads, and its integration into the whole of the operation. And moving away from the strict platform-based thinking, there is plenty of room and potential for innovative new solutions to be integrated in a capabilities-based fashion, rather than waiting for new platforms to be built around them.

In the same manner, we note a fascinating analysis of the recent real world “cyberwar” involving Estonia and Russia, compared to its fictionalized counterpart from the dawn of the networking era. We are fans of mining the creativity and insight of storytellers for potential insights into the future, and are always interested to look back on their successes (or otherwise) in formulating accurate predictions. (It is most fortunate for many an intelligence analyst that their assessments are not public domain, to be subject to such merciless scrutiny over time. That job waits for the historians in the long decades to come after declassification, and usually the unknown authors are long since dead or retired into obscurity.)

What strikes us most about this comparison is the difference between the fictional vision of an advanced state-owned, platform and shooter heavy special operations mission – against the reality of a distributed, commercial off the shelf capabilities-centric event for which attribution, let alone intent, is difficult to characterize effectively.

Call this among the clearest evidence of the clash of mindsets between generations of warfare – leaping what was a 3rd generation model (based on a World War II kinetic analogy) with the prediction of 4th generation technologies (yet to be developed, and famously written on an ancient manual typewriter with a vision inspired by a single advertisement for an early Macintosh computer); into true operationalized 4th generation technologies used in what may be the precursor of a 5th generation fashion.

What is scary is how many intelligence and information operations professionals just entering the field still believe in the fictional variant (or at least want very much for it to be true…); and how much the acquisitions community is structured to support the fantasy rather than the realities. Because after all, it is easy to have advertisements for the large, flashy and photogenic platforms plastered all over the Metro, but it is extremely difficult to market abstract concepts in which a few inches of circuit board and a few lines of code are the real engines of capabilities.

Thinking spatially in the Parallel World and beyond

We are quite used to grappling here with the issues created by the emerging importance of the Parallel World of the nets in the consideration of current and future intelligence challenges. It is one of our enduring areas of fascination – from the conflicts to the concepts. Over at the End of Cyberspace blog, there has been an ongoing locus in the conversation for some time now on what exactly the generation after next communications technologies will look like, which we have been following based on its implications for our interests.

The fine authors there now note a particularly interesting paper by Nigel Thrift, which although burdened with a regrettable volume of academic jargon and fuzziness, raises interesting concepts regarding the conceptualization of space, time and communication.

Those that recognize our long-standing interest in the convergence of these subjects will note the similarity to the Proteus Insight of Starlight. As the original Proteus study’s authors wrote:

“Perspective is everything. Not until late in the 19th century did science discover that the night sky has depth as well as breadth, that constellations not only are in the eye of the beholder, that they are distant illusions. By the early 20th century, when quantum physics wed astronomy, the illusion became deeper. However we characterize the apparent pattern of the clusters, the light we see in Manassas or Arizona takes about 400 years to reach us from the nearest star in the group. Each night in the sky, there appears an event that is already over. We are seeing the past in the Present.
"We can think of no better metaphor than Starlight to characterize the central problem for the Intelligence Community as it looks toward the future. Whether we examined the world of a criminal mastermind, of virulent disease, or a high-technology space race, the pattern of events in that world commonly turned on three characteristics: complexity, venues, and time - all of which can be captured in the metaphor of Starlight.”
We find these mirrored in the focus of the Thrift paper, which outlines the transformative effects of technological contexts on human activities, in particular focusing on time-space, sensorium (perception), and language.

We are particularly struck by the line “Vocabularies of spatial configuration will multiply.” One of the more difficult aspects we have found in teaching geospatial and imagery intelligence disciplines to new analysts is the lack of the ability to verbalize many key concepts, except through abstraction or practical demonstration. It is for the lack of such vocabulary that we believe these particular disciplines have so long languished in the academic intelligence studies field, and that the traditional players within the intel academy have so poorly addressed geospatial and imagery education needs. (In addition to the barriers to entry posed by systems technology support requirements or access to high quality imagery sources, Google Earth notwithstanding).

The academy’s failures in the area of geospatial intelligence education are sorely in need of correction. Thankfully, it seems that hope is in the horizon, as the US Geospatial Intelligence Foundation pursues its efforts to spread a model curriculum throughout the intelligence studies field. We wish them the best in their labors, and deeply hope that the increased focus in this area will yield not only new solutions to the classic real world spatial intelligence problems, but those of the Parallel World, and the interactions between the two planes as well.

War in the Parallel World

When is a war a war? When has a war gone “mainstream”, coming out of the shadows of deniable engagements and hidden casualties? What does sustained information warfare truly look like – not in the sterile academic settings of the university lecture, or the exercise conference table – but in the real world of humans and their systems?

If there was ever an answer to the question of threshold, it appears the ongoing cyber conflict involving Russia and Estonia has crossed it. See now Instapundit and Belmont Club, based on the Washington Post.

We have commented on this new conflict before, but a European state on state crisis in the 21st century is more than worth a second glance - if indeed it is truly state on state, for which we have not yet seen definitive attribution.

Wretchard in particular applies an apt name: the Wizard War. This captures, in succinct form, the alienation the typical man on the street might feel in the event of such a war. To be sure, Everyman knows all about the interwebs, and the tubes, and the magic motion picture music box thing that exists to feed their iPods and cameraphones. But the technical understanding of higher level cyber environment dependencies exists at about the same level of comforting abstraction (the legions of Slashdot and the rest of the technical blogsphere aside.) So when more than one banks computers go down, and the panic begins to set in, Everyman will be facing a shattering of illusions for which he is mentally unprepared. The loss of confidence will have a far greater effect than any mere temporary disruption, however mass.

It is in the layers of these abstractions that 5th generation warfare (5GW) lurks and hides. Trying to unpack the complexity of the issues involved in facing a concerted series of attacks against what is our collective hallucination of cyberspace (in Gibson’s terms) begins to take on the character of a Jesuit debating society. We have taken part in our share of these debates throughout our careers, and have yet to find an acceptable set of answers to any of them – but regrettably, keep running into ever more numerous sets of lawyers that all claim they do, even though none of them agree with each other, as the years go by.

In the original Wizard War of World War II (so named by Churchill), these debates were equally as divorced from the prosaic realities of the day. However, it was the boffins of Bletchley Park, and the luminaries of the MI establishment such as R.V. Jones that set the stage for decisive victory – subtly in the European theatre and more brilliantly in the Pacific, illuminated by the impossible brightness of Paul Tibbett’s mission.

But then it was the heyday of the state military-industrial intelligence complexes. It was the time of control, and of massive resources spent towards national ends in a unity of purpose and a shroud of absolute secrecy. That it brought about victory is the lesson of history. But the question before us now stands: can victory be accomplished without reverting to those kinds of organizational and political structures? For today’s environment is far removed from sixty years ago, and some genies can never be put back in their bottles.

There is a good reason that the threshold of cyber war has not yet been fully crossed by state actors (as opposed to their non-state counterparts, whose effects to date have been more akin to terrorism, crime, and disorder than anything approximating a war). Once the triggers have been pulled, there are certain losses which have major systemic effects which ripple beyond borders and far outside of military or even strategic national target sets.

We continue to watch with interest.

Contrasting official lightness with private gravity

We are continually fascinated by the manner in which the private sector so far exceeds government capabilities in understanding the Parallel World. While it is one thing to know that the rapid development of IT and related innovations has been driven by the private sector for at least a generation, it is another thing entirely to realize what that means for organizations still struggling to come to terms with the implications of even the most basic of developments (such as email or even lightweight web publishing.)

To be sure, there are highly technical and very savvy individuals scattered throughout the intelligence community, dedicated to the study and analysis of such issues. But this is increasingly one area in which the open source realm may be dramatically outstripping what occurs in the vault.

By way of example, we reference recent coverage of the ongoing cyber conflict between Russia and Estonia. Again, we make no assertions regarding the incidents, their attribution, or implications beyond what others have already stated in public sources (whether accurately or not, time will tell.) But we are very interested in the increasing levels of technical sophistication and interest being applied to the analysis of current network disruption events.

While Global Guerrillas has a theory type think piece (worth examining in the overall context of John Robb’s contribution to the body of emerging 5GW theory), various Internet security shops are increasingly publishing open versions of analysis at a more technical, and tactical level. As an example of the latter we reference Arbor Network’s corporate blog posts on the subject.

We have seen enough of the failing cyber security report cards, and the constant shuffle of senior executives through the relevant government posts, to venture that the sort of quality of thought behind the focused attention paid to this incident (and others like it) would be simply alien to many otherwise nominally assigned to the responsibility of covering these key accounts. (For more background on the ongoing trials and tribulations of the federal cyber security sector, we can recommend no better and more consistent commentator than can be found at Haft of the Spear.)

Of all the areas in which public/private partnerships for enhanced analysis and intelligence production could be of value, we can see few potential accounts more clearly in need of such unique contributions. It does not take a major Beltway contractor, nor any sort of specialized access program, to accomplish significant aggregation, interpretation, and insight into these sorts of problems – and policymakers are likely to be better served by a more broadly based attempt to integrate more substantive experts into the community’s coverage of these accounts.

To be sure, this will require a culture shift, and a serious re-think of structures and processes by which intelligence is created in support of decision-maker needs to understand this new realm. But it is indeed something entirely new in form, shape, and outcomes. It simply makes no sense to continue to try to force fit industrial age organizations and Taylor inspired processes into a future where they have no place.