LIYBIA: STUXNET Type Virus Attack Being Planned for Libya: Meet the "Unveillance Solution"

by Scott Creighton

"Sinkholes", "Domain Takedowns", "botnets", Infragard, Unveillance, and Endgame. These are but a few of the modern buzzwords and current Public/Private Partnership players in the wide-open world of cyber-security and warfare.

In a policy paper released on May 17th of this year called "International Strategy for Cyberspace" (PDF), the Obama administration declared that the United States "will respond to hostile acts in cyberspace as we would to any other threat to our country.". Immediately afterwards, right on cue, some well timed incidents have occurred, all of which could qualify for the Obama administration's new definition of "act of war":

1. A major defense contractor Lockheed Martin, reported that they had come under severe cyber attacks. The attacks were "confirmed" by the Department of Homeland Security and the Pentagon. Take that for what it's worth.

2. Google, another corporate partner of the United States and the National Security Agency, has claimed that users of their GMail service were also hacked/attacked,  and they are already blaming the Chinese. According to Google, the "victims targeted included "senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists" (source)

3. Anonymous, probably a front group for the National Security Agency or the State Department, announced that it had hacked Iranian government email servers and have even claimed to have taken control of some government computer systems. Perhaps related to the NSA/Anonymous attack, Syria is supposed to have shut down internet access. Did the NSA shut down internet access in Syria because they didn't want the truth about their fake revolution (destabilization campaign) coming from the Syrian people? And are they using the cover of "Anonymous" to mask their act of war? It is entirely possible.

4. "F**k FBI Friday". This past Friday a group calling itself LulzSec hacked into the Infragard database and published names and companies associated with it.  Infragard is a non-profit segway connecting various companies and databases to the FBI. The American Civil Liberties Union (ACLU) warned that there "is evidence that InfraGard may be closer to a corporate  TIPS program, turning private-sector corporations — some of which may be in a position to observe the activities of millions of individual customers — into surrogate eyes and ears for the FBI" (source)

All of these "attacks", either real or imagined, are significant for different reasons. Some, like the Google accusations toward China, are more obvious than others.

The last story however, the "F**K FBI Friday" story, becomes rather interesting when you dig just a little deeper under the surface and you find out that not only is the federal government using malicious software to potentially attack government computers of other nations, an act of war under the Obama administration's own definition, but that it seems they are secretly using our own computers to do it, in what could be considered an attack on OUR computer systems and thus ... an attack on the people of the United States. By extension, according to the new Obama administration's definition, is that an act of war being conducted against... us?

I know it's a little confusing. Let me explain.

The story about the LulzSec hack goes something like this. LulzSec hacked into the Infragard database and then published the names of people and organizations working within the Staziesque organization. They also posted a cute little video up on the Infragard website along with the text "LET IT FLOW YOU STUPID FBI BATTLESHIPS" in a window titled "NATO - National Agency of Tiny Origamis LOL". (source)

After successfully hacking into the Infragard system, LulzSec then went after a few of their "whitehat" hacker companies who are affiliated with Infragard and the FBI. One of those companies is called Unveillance, and this is where things get really interesting.

Unveillance admits that they were hacked for a period of about a week by LulzSec. They claim that the LulzSec group wanted money and information on various computers to stop the attack. The owner of the company claims it was hard on him and his family. Poor guy.

However, according to a LulzSec statement, the owner of the company (Karim Hijazi) offered to pay LulzSec if they would keep their mouths shut about what they found in his network and if they directed attacks toward competitors of Unveillance.

“After doing so, we contacted Karim and told him what we did. After a few discussions, he offered to pay us to eliminate his competitors through illegal hacking means in return for our silence. Karim, a member of an FBI-related website, was willing to give us money and inside info in order to destroy his opponents in the whitehat world,” writes LulzSec. “We even discussed plans for him to give us insider botnet information.”  Yahoo News.

When I read this I became very curious as to what exactly Unveillance does. Why would they need to hide what they do? This is what I found.

Unveillance is a relatively young company which specializes in what's called "sinkhole" technology. As best as I can understand it, what they do is they scour the webs for "botnets" and their "sinkhole" will collect these addresses and store them.

"Botnets" are collections of infected computers which have been hijacked by malicious software programs. Typically what happens with sinkholes is these systems are traced back and the original source of the infection is listed and reported and their original IP addresses are blacklisted, thus protecting Unveillance's clients from infection.

But what makes Unveillance unique is that they go a bit further. They offer what is called "The Unveillance Solution"

The following is from Jeff Bartin's article explaining the Unveillance Solution on CSO Security and Risk blog: "In my research and analysis of Unveillance, I began to realize that there is an offensive capability within the solution. It can take over command and control of the exfiltrating botnet. If you can take over command and control, then you virtually own (or pwn) that entity. The possibility of redirecting the botnet as a DDoS starts to become real. The ability to determine sources is eased. The potential of driving active offensive actions is an actuality. Could I even redirect the botnet back upon its masters?"  Bardin.

What he is saying is that the unique application of the Unveillance Solution is that they can take all of these infected IP addresses collected from the "botnets' of the malicious software programs their "sinkhole" has collected, and turn them into a weapon, using them to initiate DDoS attacks against ANY target they so chose.

Imagine the sum total botnet of 100's viruses all sitting at the fingertips of one Public/Private Partnership company with government contracts. Not only do they already have the IP addresses of all of these systems, OUR SYSTEMS, but they also have a built-in definition of their weaknesses, a virtual map of which systems are susceptible to which intrusion methods. They literally have a diagram of how to infiltrate and hijack perhaps millions of computers which they can use to any purpose their client chooses.

Now imagine the power of a system like that. I'm not the only one who has.

Apparently the U.S. government has also recognized the awesome potential of the "Unveillance Solution" (I heard the owner of Unveillance refer to his program as the "Unveillance Solution" on a recorded conference call... if that name reminds you of another "solution" you're not alone)

"CSFI (www.csfi.us) is officially releasing “Project Cyber Dawn Libya.” Project Cyber Dawn Libya is the result of a collaborative research effort of twenty-one individuals from the USA, Australia, Canada, Egypt, Italy, Tunisia and the UK. This includes www.treadstone71.com.com and www.unveillance.com

"Project Cyber Dawn Libya collates, analyzes, and reports on raw data and its Interconnections that have been harvested from the public domain. Recent events are correlated with known historical data to provide an in-depth view into Libyan Cyber Warfare capabilities and defenses. Through this analysis, CSFI can help the international community to understand not only Libya’s potential to influence the balance in cyberspace, but also the phyBardinsical repercussions of cyber-attacks originating from, and directed towards Libya." Bardin

CSFI is another Public/Private Partnership program designed to recreate and "protect" the interet in the new model outlined by Obama's May 17th paper. Project Cyber Dawn is apparently a plan to attack Libyan computer systems in case the war on Libya extends beyond Gadhafi's exit, which it certainly will now that the people of Libya are sick and tired of NATO bombing the shit out of their homes.

CSFI describes themselves in part this way: "The Cyber Security Forum Initiative (CSFI) is a nonprofit, worldwide organization with a mission to provide Cyber Warfare awareness, guidance and security solutions through collaboration, education, volunteer work and training to assist NATO partners in their common government, military and commercial interests."  Project Cyber Dawn : Libya

If you read the April 17th 2011 CFSI outline on Project Cyber Dawn : Libya (PDF) (unclassified) you quickly come to understand what it is all about. Their inclusion of the "Univeillance Solution" as part of their outline leaves very little doubt as to what they intend to do. Also of note, notice that the CFSI Project Cyber Dawn outline came out two weeks PRIOR to the Obama administration's policy paper on cyber warfare. Talk about the tail wagging the dog.

"In light of the recent STUXNET virus attack on Siemens produced Supervisory Control And Data Acquisition (SCADA) systems, particular focus is given in later chapters to Libya‘s vulnerabilities to this genre of attack and the risks associated with this." Project Cyber Dawn: Libya (PDF)

Later, on page 50, the CFSI paper goes on to expose potential weaknesses in the Libyan cyber defenses and how they can be exploited to the benefit of NATO interests: "With a large number of players in this space, it is likely that there is an equally large compilation of supervisory control and data acquisition systems (SCADA) from numerous vendors spanning several years of revisions and platforms.

The area most vulnerable to a cyber-attack, which could impact not only the Libyan‘s prime source of income, but also the primary source of energy to the country, would be a focused attack on their petroleum refining facilities. Without refined products, it is difficult to fuel the trucks, tanks and planes needed to wage any effective war campaign." Project Cyber Dawn: Libya

They are talking about the exact same kind of attack that the Israel and the U.S. initiated against the Iranian enrichment facilities.

Considering that the "Unveillance Solution" is uniquely capable of conducting massive focused attacks just like the one the CFSI group is talking about, and considering that they are dedicated to helping NATO military efforts, I don't think there's any question about what Project Cyber Dawn: Libya is all about. The only question that remains is what is the next for-profit project that is on the table? Project Cyber Dawn: China? Project Cyber Dawn: Moscow? Project Cyber Dawn: Michigan?

At this point it's impossible to know whether or not your computer is soon to be used to cripple the economy and society of Libya via our for-profit cyber warriors over at Unveillance and their unique "solution". If you've had a case of computer infection in the last couple of years where a malicious program tried to hijack your system, where you got listed in a string of a botnet, odds are you are about to become an unwitting, unpaid participant in the subjugation of another nation when the Obama administration sets loose the internet hounds of war via backdoor access to your computer.

Of course, it's not an act of war when Obama does it. Just like it's not an act of war when he bombs and kills 23 children in Yemen or when he sends an invasion team into another country to exterminate a rather persistent myth. It's just another form of "humanitarian intervention" from what I can gather from the articles on HuffPuff and Think Progress and Fox News alike.

Just another example of "Do as I say not as I do..." geopolitics from the great American Exceptional Empire.