Technical OSINT innovation contest: the 2008 Malware Challenge

While the worlds of most OSINT analysts do not typically overlap with those working in the more rarified fields of digital network intelligence, forensic analysis, and network warfare, there are a highly specialized subset that may be interested in testing their skills as part of a challenge of their own. While clearly not as high profile as the recent DNI OSINT contest, the 2008 Malware Challenge promises interesting responses of its own.

The winners of the malware challenge will be announced at the 2008 Ohio Information Security Summit on 31 October 2008. We had not previously seen this conference, but it appears to be a small regional conference that is unusually well attended by the usual round of ex-spooks and ex-cops that have moved into the cyber security industry as of late.

The challenge scenario is reproduced below:

"A system administrator within your organization has come to you because a user's PC was infected with malware. Unfortunately, anti-virus is unable to remove the malware. However, the administrator was able to recover the suspected malware executable. Your job is to analyze the malware.
Participants should download the malware sample and analyze it. The end result should be a document containing details on the analysis performed. The analysis document can be written in any form, but the questions and statements below should be answered within it. Participants should note what questions are being answered.
The questions...
* Describe your malware lab.
* What information can you gather about the malware without executing it?
* Is the malware packed? If so, how did you determine what it was?
* Describe the malware's behavior. What files does it drop? What registry keys does it create and/or modify? What network connections does it create? How does it auto-start, etc?
* What type of command and control server does the malware use? Describe the server and interface this malware uses as well as the domains and URLs accessed by the malware.
* What commands are present within the malware and what do they do? If possible, take control of the malware and run some of these commands, documenting how you did it.
* How would you classify this malware? Why?
* What do you think the purpose of this malware is?

Bonus questions: (These questions are not required to be answered but could be used to break a tie for prizes.)
* Is it possible to find the malware's source code? If so, how did you do it?
* How would you write a custom detection and removal tool to determine if the malware is present on the system and remove it?

Analysis documents should be submitted in PDF format to 2008challenge@malwarechallenge.info by 12:00 Midnight EST (5:00 AM GMT) on October 26, 2008."

Additional information, including other contest rules and FAQ, can be found at the challenge website.

Interestingly, we note that Steve Jackson Games is among the sponsors providing prizes for the winners. SJG was most famously the victim of a botched Secret Service raid in 1990, which seized files and texts that were part of one its published gaming lines. For those that are not familiar with this disastrous episode from the earliest days of the cyber intelligence account, it was best recounted in Bruce Sterling’s still timeless book, The Hacker Crackdown. (In our opinion, this is also a text which should be mandatory reading for those involved in SIGINT, MEDEX, or eCrime analysis. And while the USSS has indeed come a long way since then, we do from time to time encounter other shops still grappling to come to terms with the new threat environment with often equally absurd results.)


h/t Spy Logic

A glimpse of a future naval (and network) special operations mission: Google edition

The jesters and the futurists have long featured offshore structures as the future of human activities. Reality continues to bear out these predictions. We have previously discussed large scale offshore habitation structures and their potential impact for future intelligence and unconventional warfare problems. This time around, it is the concept of the maritime data center – previously discussed as a moored vessel – recast as an offshore terminal type platform.

We are enthused by the possibility of seeing a real life data haven come into its own – and run by a professional multinational entity (rather than the sad sort of anarchist disgrace that was Sealand). But one can easily see the fascinating potential for convergence of a whole range of threats directed against such facilities, involving both naval and network conflicts.

Once again, our froggy friends will no doubt be forced to ponder such actions. And while there are no doubt legions of would-be hackers just waiting to strap on a wetsuit to live out their own episode of the Rock against a network contagion, they are apt to be disappointed. One suspects that the signals intelligence folks will be far more likely to have to come to terms with what the widespread proliferation of such offshore datacenter platforms will mean in an environment where bandwidth and storage are nearly infinite and entirely cheap, and may be rented from the cloud through a complex and shift network of shell companies, taking advantage of low staffing levels and limited oversight incentives. The Russian Business Network’s latter day successors will no doubt be wet.

h/t Futurismic

DNI Open Source Innovation Challenge 2008

We are unabashed believers in the unique contributions offered by open source intelligence as a discipline, and have been greatly pleased to see the increased prominence of such efforts within the Intelligence Community over the past decade. Today’s OSINT is a far cry more advanced from the early days of the 1990’s, when the first glimpses of the potential offered by the information revolution were visible in the newly opened media markets of the Soviet Union.

One of the most dramatic shifts since that time has been the development of OSINT as more than a mere data gathering function, increasingly focused on providing insight through rigorous analysis and imaginative exploration. Analytic outreach naturally goes hand in hand with open sources. And while the intelligence community is still grappling with the best manner to encourage and develop such efforts, this evolution is a fascinating space to observe and participate in.

Thus we are immensely interested to see the results of the DNI’s Open Source Innovation Challenge for 2008. This is a frankly unprecedented effort - and long overdue. Announced via email and on their public blog, the invitation speaks for itself:

Special Announcement

The Open Source Innovation Challenge

We are pleased to announce an exciting opportunity in conjunction with the DNI Open Source Conference 2008: "The Open Source Innovation Challenge." This is a unique occasion for representatives from academia; think tanks; industry; the media; federal, state, local, and tribal government; and other diverse sectors to use open source information to address real intelligence challenges. Subject matter experts from any field can apply innovative research techniques, thus giving new insight to the Intelligence Community.

Can you provide the most innovative and relevant answer to the Challenge questions?

The Office of the Director of National Intelligence (ODNI) has provided two Challenge questions (below) and instructions to all conference registrants. Those who choose to accept the Challenge can submit a answer for one of the two challenge questions posed. Entries will be reviewed by a panel of judges consisting of senior IC representatives. The three entries judged to be the best answers to Challenge questions will be announced during the opening plenary session of the DNI Open Source Conference on September 11th and the answers will be presented at the concluding conference plenary on September 12th. The Challenge is open to all conference registrants, including those who are not able to attend due to overwhelming registration demand.

Challenge Questions

1. Using the best open sources to inform your answer, is Al Qaeda a cohesive organization with strong and centralized control, intent and direction?

2. According to open sources, who will be the global leader in alternative fuels and why?

Challenge Guidelines

1. Challenge Participants and Entries: Entries can be submitted either by individuals or teams, with no limit to the number of individuals on a team. Teams can consist of individuals from any number of organizations, rather than representatives exclusively from a single university, company or organization; multidisciplinary teams are encouraged. Each person, however, can only enter the Challenge once—as an individual or part of a team, not both. At least one member of each team must be a registered conference attendee and entries from individuals must be submitted by a registered (not necessarily a confirmed) attendee. Entries should address one of the two Challenge questions proposed; entries attempting to address both questions will be disqualified.

The remainder of the full guidelines may be found here.

This seems to us an excellent opportunity for a number of academic and private sector shops to demonstrate their mettle in front of a very serious – and no doubt quite attentive – audience. The timing – and timelines – reminds us more than somewhat of the Burundi exercise of years past. This is certainly no coincidence, and we have long felt it was time to update the original work performed for the 1995 Aspin-Brown Commission on Intelligence in a modern context.

To all those participating, bonne chance.

A glimpse of a future naval special operations mission

Thanks to the jesters at the futurist court’s table over at io9, we note a most interesting concept in circulation for new urban development project – at sea. The environment will be a tailored cross between luxury resort, cruise ship, and a small city. Throw in a casino and conventional center, and you have an interesting playground for what the designers presumably hope will be the rich and famous.

Should such a vessel ever be constructed, however, one can imagine its prominence as a target for maritime terrorism and piracy. And while authoring that threat assessment would be quite interesting, we are not sure we would want to be in the company directors’ shoes when briefing those results to an insurer such as Lloyds of London.

More interestingly yet, this inevitable threat raises the distinct possibility that a future naval special operations mission would be required to respond to a potential incident aboard. With anywhere between 20,000 to 50,000 souls on board, and what will likely be an internal architecture quite different from other maritime vessels, such a mission would no doubt be taxing in the extreme for even the most capable unit. Even the barge-like hull structure and high rise type construction envisioned by the ship’s builders would impose its own complications on such an operation.

While the concept itself looks slick enough, it is far from certain whether it would ever be ready for primetime. However, the idea does provide interesting fodder for intelligence professionals seeking to explore future scenarios for unconventional warfare and counterterrorism. And one cannot beat that back to the 80’s feel of the whole endeavor, even if one should include the more modern elements of Somali pirates and radical Islamist terrorist actors in the scenario itself. After all, it has been some time since considering the response to a vessel hijacking incident has been new enough to occasion comment.

For those future operators which may one day be tasked with this kind of mission, at least there is some solace to know that it will likely occur in a pleasant climate. After all, the rich do not generally favour less hospitable weather – which makes this a far cry from the typical oil rig takedown.

An alternative film for intelligence analysis exercises

We have been surprised at the level of discussion sparked by our previous consideration of the classic 12 Angry Men and other films, for teaching the fundamentals of intelligence analysis and writing to entry level candidates. Apparently, the technique is more widespread and popular among instructors than we knew. Frankly, we have found that it is something possible only in professional in service sessions, where there is usually enough contact time to permit such hands-on practical work. Typical academic environments rarely afford sufficient engagement to lose the several hours involved, and we have found that most students assigned to view the same film on their own will tend to present remarkably similar work product (although the assignment tends to be very popular with students, particularly prior to weekends and in coed classes.)

We have thus given the matter some consideration, seeking a better replacement for the now classic Joint Military Intelligence Training Center exercise which utilized the film The Hunt for Red October (briefly mentioned in our earlier post on the topic.) That film was an excellent choice for the time, insofar as the limitations of Hollywood typically permit – and was even used as a teaching aid at the submarine school in Groton for a time after its release (though albeit moreso for its counterexamples). Its utility was no doubt derived from the unique historical basis for Clancy’s original book – a composite of several real world cases of great strategic importance during the Cold War.

The purpose of the film exercise was to provide the analyst student with a chance to practically apply basic tradecraft dealing with ambiguity, and to create a collaborative analytical product using simplified unclassified material. Each student would be assigned to a smaller group, which would then be tasked with a specific intelligence component to focus on. The students would then seek to answer a key question regarding the factors which influenced the defection of the fictional Russian submarine captain in light of these larger strategic issues within the Cold War. The film material itself was treated as authoritative narrative – requiring a degree of suspension of disbelief, but not terribly so if the students were unfamiliar with actual undersea warfare. This typically led to some excellent discussions and more than a few unique analytic outcomes.

Replicating this exercise in a more modern context has proven to be no easy task. There simply have not been films which encapsulate the unique factors which made the Red October exercise such a good choice. But as much as we liked the case, its value is limited for students who will be engaged in the Long War for some time to come.

We considered – and rejected – quite a few other options. The 1996 film The Peacemaker was one possibility, but for most students the Balkans conflict is as remote as its World War I antecedents, and WMD terrorism and homeland security issues are now viewed through a far different lens in the post 9/11 world. The 2005 film The Great Raid could offer potential, but was a more limited tactical scenario in a far less ambiguous information environment, from which actual historical materials would be far better suited as a source of instruction. We briefly contemplated the film Spy Games, but it is far more suited for a history of intelligence class than an analysis course. Syriana too came under consideration, particularly given the involvement of a former case officer in its scripting, but the explicit politicalization of the film also ruled it out. The drug film Traffic was rejected for similar reasons. Most of the other contemporary drama or action films can be dismissed out of hand, being little more than flights of fancy – something that removed films such as Swordfish, the le Carre works, and all of the Bond pieces from our list.

This left us with few options. Thankfully, our dilemma appears to be solved – for the time being – by the 2007 release of The Kingdom. It is unsurprising the film’s early releases were trialed in the greater Washington DC metro area, and that a high number of community professionals were among those early audiences. While the work suffers from the usual Hollywood inaccuracies and the insufferable modern politicization, it does present a narrowly scoped case which is itself a composite mélange of historical incidents of ongoing relevance. While we hate to be seen promoting the Bureau – particularly through the fantasist version of that organization presented in the film – if one ignores those aspects, there is value in the sense of realism otherwise conveyed across the piece through a good application of the director’s art.

Again, the key to turning the film into a good analytic exercise – rather than just a several hour long break from lecture – is to encourage deeper discussion of the underlying factors that led to, and would result from, the incidents depicted. The students should be able to pull out a number of specific points that can be summarized and expanded with additional open source research into unique finished analytic papers. The film offers a variety of these springboards – from the tactical aspects of attack TTP, to terrorist propaganda operations, to the role of re-integration programs for former terrorist prisoners, to profiles of host nation CT capabilities, or to the issues of radicalization within specific industries, geographies, or societal segments. The instructor may need to assist the students in settling upon these aspects during post-screening discussions. This is less a group product, although a collaborative framework can be created in which individual papers support a larger work, especially using a wiki production environment.

Despite finding what we feel is a good solution for the time being, we will continue to seek out alternatives for use in other areas of the contemporary intelligence domain beyond the CT sphere – and will of course welcome any suggestions (along with reasoning in defense of the choice) that our wider audience might contribute for general circulation.