Anatomy of a state-sponsored phishing attack: how the Syrian Electronic Army hacked The Onion

Cory Doctorow at 1:06 pm • •

As I blogged earlier this week, the Syrian Electronic Army hacked The Onion's Twitter account and used it to post a bunch of dumb messages attacking Israel, the US, and the UN. Now, the Onion's IT administrators have posted a detailed account of how Syrian hackers used a series of staged and careful phishing attacks to escalate from a single naive user's email credentials to the password for the Onion's social media accounts.

Once the attackers had access to one Onion employee’s account, they used that account to send the same email to more Onion staff at about 2:30 AM on Monday, May 6. Coming from a trusted address, many staff members clicked the link, but most refrained from entering their login credentials. Two staff members did enter their credentials, one of whom had access to all of our social media accounts.
After discovering that at least one account had been compromised, we sent a company-wide email to change email passwords immediately. The attacker used their access to a different, undiscovered compromised account to send a duplicate email which included a link to the phishing page disguised as a password-reset link. This dupe email was not sent to any member of the tech or IT teams, so it went undetected. This third and final phishing attack compromised at least 2 more accounts. One of these accounts was used to continue owning our Twitter account.
At this point the editorial staff began publishing articles inspired by the attack. The second article, Syrian Electronic Army Has A Little Fun Before Inevitable Upcoming Deaths At Hands Of Rebels, angered the attacker who then began posting editorial emails on their Twitter account. Once we discovered this, we decided that we could not know for sure which accounts had been compromised and forced a password reset on every staff member’s Google Apps account.

I'm impressed by the cleverness of triggering a "password reset" message from the IT team, then sending out fake password-reset messages to users who aren't on the IT team to get them to click on yet another link. Most of the recommendations the IT team make are pretty bland ("educate your users"), but these two reccos are good:

Read the rest

No internet for Syria —

Nicole Perlroth: "Syria’s access to the Internet was cut on Tuesday. The most likely culprit, security researchers said, was the Syrian government." [NYT] — Rob •

Onion gets hacked by Syrian propagandists, responds with funny article

Cory Doctorow at 3:00 pm • •

The Onion got hacked by the Syrian Electronic Army, who proceeded to send out a bunch of tweets that could have been mistaken for actual Onion tweets making fun of the sort of thing that Syrian propagandists would tweet if they hacked the Onion's Twitter (see after the jump for the full list). But no, they actually did get hacked.

The Onion responded by putting up a post called Syrian Electronic Army Has A Little Fun Before Inevitable Upcoming Deaths At Hands Of Rebels, which matches the Assadists' bluster and is much funnier:

DAMASCUS, SYRIA—After hacking into The Onion’s Twitter account earlier today, members of the Syrian Electronic Army confirmed that the organization simply wanted to have a little fun before soon dying at the hands of rebel forces. “We figured that before they bust in here and execute every single one of us, we might as well have a good time and post some silly tweets about Israel from a major media outlet’s feed,” said a spokesperson from the pro-Assad group, adding that he and his cohorts “had a few good laughs” and are now fully prepared for their painful and undoubtedly horrific deaths in the coming days. “I mean, we definitely don’t have much time left, so we thought, hey, let’s just enjoy ourselves before getting blown away by rockets, decapitated, beaten to death, or hung during public executions. Why not, right?” At press time, violent screams and pleas for mercy were reportedly overheard as rebel troops broke into the Syrian Electronic Army’s hideout.

Read the rest

Where does Assad's online army come from?

Cory Doctorow at 3:32 pm • •

Syria's brutal Assad regime has damned few allies left in the world, but one of them, Russia, is governed by a dirty-tricking ruling elite who've made a science out of manipulating Internet opinion. This may explain the weird, stilted pro-Assad astroturf army who appear in any discussion of the regime's atrocities to explain that it's all a Jewish conspiracy.

And on like that. SyriaTribune maintains a YouTube channel stocked with clips from — surprise — Vladimir Putin’s Russia Today portraying Assad as the victim of a bloody-minded western conspiracy. A self-described French intellectual named Thierry Meyssan — author of 9/11 The Big Lie — reveals that TV images purporting to show Assad’s massacres of civilians were prepared by the CIA, along with White House deputy national security advisor Ben Rhodes, and “aims at demoralizing the Syrians in order to pave the way for a coup d’etat.” The #FakeRevolution hashtag on Instagram provides pictorial, meme-filled boosterism for Bashar, like a screengrab from Time’ app kindly telling user mybubb1e to stop voting for Assad for Person of the Year or Hillary Clinton with flames shooting out of her eyes and ear, courtesy of Bashar4Ever.

Meet the Assadosphere, the Online Defenders of Syria’s Butcher [Spencer Ackerman/Wired]

Homemade Syrian rebel-tank with gamepad gun controller

Cory Doctorow at 8:21 am • •

The unfortunately named "Sham II" is a homemade Syrian rebel tank whose main gun is directed with an off-brand video-game thumbstick/gamepad controller. Targetting is via webcam and cheap flat-panel display.

The Sham II, an updated version of a previously made Sham I light infantry by Syrian fighters from the al Ansar Brigade, cost approximately $10,000 (not including the gun), according to one rebel fighter whose brother had designed and built it. The vehicle is reportedly covered with steel plating approximately 2.5 centimeters thick. However, the Sham II is admittedly underprepared to defend against rocket-propelled grenades or tank fire. Rebels claimed the Sham II would soon be ushered into a combat role by members of al Ansar's Saad Benmoaz battalion near Aleppo.

Syrian rebels debut homemade fighting vehicle [Threat Matrix] (via /.)

Why dictators (don't) shut down the Internet

Cory Doctorow at 3:56 pm • •

Warren Ellis's Vice column, "How to Shut Down Internets," looks at the phenomenon of Middle Eastern dictators shutting off their nation's Internet during moments of extremis. Here's the money graf:

There are two reasons why these shutdowns happen in this manner. The first is that these governments wish to black out activities like, say, indiscriminate slaughter. That much is obvious. The second is sometimes not so obvious. These governments intend to turn the internet back on. Deep down, they believe they will be in their seats the next month and have the power to turn it back on. They believe they will win. It is the arrogance of power: they take their future for granted, and need only hide from the world the corpses it will be built on.

For me, this raises a couple of much more interesting questions:

1. Why would a basket-case dictator even allow his citizenry to access the Internet in the first place? (A: Because the national economy can't function without it)

2. Why not shut down the Internet the instant trouble breaks out? (A: Because it would be immensely unpopular, even among your sympathizers; also, see 1.)

Update: Bruce Schneier adds: "The reason is that the Internet is a valuable tool for social control. Dictators can use the Internet for surveillance and propaganda as well as censorship, and they only resort to extreme censorship when the value of that outweighs the value of doing all three in some sort of totalitarian balance."

How to Shut Down Internets

Free/open source programmer and Creative Commons activist Bassel Khartabil faces torture in notorious Syrian prison

Cory Doctorow at 5:38 pm • •

Bassel Khartabil, a Palestinian free/open source developer and Creative Commons activist, has been in prison in Syria since June, and his colleagues around the world have been agitating for his release. Now, the news gets worse: a recently released fellow inmate reports that Khartabil has been subject to harsh treatment and torture in Syrian custody. From the Electronic Frontier Foundation's Eva Galperin:

According to a new Amnesty International report, a released detainee has informed Bassel Khartabil’s family that he is being held at the Military Intelligence Branch in Kafr Sousseh and had been tortured and otherwise ill-treated.
In response to this alarming news, Bassel's friends and supporters around the world have launched a letter-writing campaign, hoping to flood Syrian officials and diplomats with physical mail demanding that Khartabil be formally charged and given access to a lawyer or released immediately. Participants are encouraged to send photographs of their letters to info@freebassel.org.

Torture Fears for Open Source Software Activist Detained in Syria

(Image: Bassel, a Creative Commons Attribution (2.0) image from joi's photostream)

Air France pilot begs first class passengers for cash to refuel in Damascus —

An Air France jet was diverted to Damascus due to "tensions" at its destination airport in Beirut. They couldn't take off again without refueling, and the Syrian authorities weren't about to extend credit to Air France (France is part of the coalition calling for UN intervention in the conflict). So the crew passed the hat around the first class cabin, raising "17,000" (units not specified) to pay for fuel -- though in the end, it wasn't needed. — Cory •

Apple rejects "Angry Syrians" —

Frederic Jacobs produced an iOS app called "Angry Syrians," which was apparently blessed by Rovio. It was intended to raise awareness of the ongoing bloodbath in Syria. Apple rejected it because "We found your app contains defamatory or offensive content targeted at a specific group, which is not in compliance with the App Store Review Guidelines." (the defamed and offended group in question is the brutal Assad regime and its supporters). (via Hacker News) — Cory •

Malware targeted at Syrian activists can operate webcam, disable AV, keylog, steal passwords

Cory Doctorow at 10:48 am • •

A fake PDF purporting to contain information on "the formation of the leadership council of the Syrian revolution" is circulating. As the Electronic Frontier Foundation's Eva Galperin and Morgan Marquis-Boire report, it's bad news for people who install it.

The latest surveillance malware comes in the form of an extracting file which is made to look like a PDF if you have file extensions turned off. The PDF purports to be a document concerning the formation of the leadership council of the Syrian revolution and is delivered via Skype message from a known friend. The malware installs a remote administration tool called DarkComet RAT, which can capture webcam activity, disable the notification setting for certain antivirus programs, record key strokes, steal passwords, and more. It sends this data back to the same IP address in Syrian IP space that was used in several previous attacks, including the attacks reported by CNN in February, the Xtreme RAT Trojan EFF reported in March, and this sample from March 21st.
Syrian Internet users should be extremely cautious about clicking on suspicious-looking links, or downloading documents over Skype, even if the document purportedly comes from a friend.

Campaign Targeting Syrian Activists Escalates with New Surveillance Malware

Syrian leader Bashar al-Assad email leak

Cory Doctorow at 12:01 am • •

Syrian activists have leaked a cache of documents purporting to be the private email of Bashar al-Assad and his coterie, penned during the slaughter of the Syrian opposition. The Guardian is working its way through them, authenticating them as thoroughly as they can.

In this overview, Robert Booth, Mona Mahmood and Luke Harding tour the documents' highlights, including advice from the Iranian government on putting down the uprising; a personal spy network that Assad employed to report direct to him, bypassing the nation's own security services; an offer of asylum in Doha, Qatar, should the family flee Syria; and a detailed media strategy for portraying the ruling clan in the best light (he is also advised to stop blaming Al Quaeda for his nation's troubles).

In this article, Robert Booth and Luke Harding document the lavish lifesyte enjoyed by Syria's rulers, who use fixers in London to shop the sales at Harrods, a relay in NYC to run an iTunes account for them (Bashar liked to send maudlin, self-pitying country music to his family, "I've been a walking heartache / I've made a mess of me / The person that I've been lately / Ain't who I wanna be"), and who order gold and diamond jewelry direct from Parisian boutiques. The family also plans a screening of the last Harry Potter movie.

Here are a few of the 3,000 leaked emails to browse yourself.

Others items that caught the fancy of Syria's first lady included a vase priced £2,650. On 17 June 2011 she sent details to the family's London-based fixer Soulieman Marouf, and added: "Pls can abdulla see if this available at Harrods to order – they have a sale at the moment." Marouf replied with good news: "He bought it. Got 15% discount. Delivery 10 weeks." He added: "Today you should be receiving an Armani light … If you need anything else please let me know."
The emails suggest a woman preoccupied with shopping – but also with an eye for a bargain. She was eager to claw back VAT on luxury items shipped to Damascus, it emerges, and complained when a consignment of table lamps went missing in China. Emails sent from her personal account also concern the fate of a bespoke table, after it arrived with two "right" panels instead of a right and a left one. More than 50 emails to and from the UK deal with shopping.
Some of Asma al-Assad's prospective purchases arouse polite comment from her friends. On 3 February 2012, she was browsing the internet for luxury shoes, according to an email titled "Christian Louboutin shoes coming shortly".
She wrote to friends sharing details of new shoes on offer, including a pair of crystal-encrusted 16cm high heels costing £3,795. She asked: "Does anything catch your eye – these pieces are not made for general public." One friend replied dryly: "I don't think they're going 2 b useful any time soon unfortunately."

(Image: A member of the Free Syrian Army burns a portrait of Bashar Assad in Al Qsair. Jan. 25, 2012, a Creative Commons Attribution (2.0) image from syriafreedom's photostream)

Video: In Syrian hospital, doctors torture patients brought in from protests —

Channel 4 News this week aired graphic video secretly recorded by an employee at a hospital in Syria. The video shows evidence that doctors there torture patients. On orders of the Syrian government, protesters must be brought to this military facility for "treatment." — Xeni •

Crossing into Syria: a plea from the Free Syrian Army

Rob Beschizza at 5:11 pm • •

Journalist William Gagan, videographer Geoff Shively and fixer Amine Unitor entered Syria to see, first-hand, conditions close to the border with Turkey. Snuck in through the mountains by a Syrian military defector, they stayed for a day and returned with this footage.

Across the border, they were intercepted by members of the Free Syria Army, who gave permission to film them. In a short plea, they ask for the world's help in their fight against Assad's forces: their message starts at 10:25 in the video.

Back in Turkey, the team observed a rally in support of Syrian president Bashar Assad--and visited border refugee camps swollen by the conflict. Footage of these events is being prepared for release on Monday, said Shively, of the Telecomix hacktivist group.

Named #OpLivestreamSyria, the trip was crowdfunded with just $4,900. Though they were unable to broadcast from within the warzone using the equipment they brought--the Syrian military is known to be able to track and target satellite communications--all returned safely.

"We verified that [our guide] was former Syrian military by seeing his military ID," Geoff said. "The video shows us hiking up the mountain pass, crossing a border past an empty Turkish military guard tower, through razor wire at the border, and hiking hours into Syria to a spot above a town occupied by Assad’s forces."

The video shows them pause and nervously survey the town, quiet in a wooded valley. On a nearby ridge, a tent stands out; it is, they report, likely to belong to rebels. They're approached not long after.

"We got permission to film one of their tents and their crossing, if we blurred their faces," Shively said. "We crossed the border with them past the empty guard tower again, and hike down the mountain into Turkey. The FSA members also requested we record the plea to the world."

According to the United Nations, more than 7,500 civilian have been killed by Syrian forces in the year-old conflict. Syria's government blames the deaths on battles with "terrorists", which it says has killed 2,000 police and security personnel.

Shively adds: "Thank you to everyone who helped fund #OpLivestreamSyria, for the next Op, we are taking suggestions and evaluating the situations in Spain, Egypt, Lebanon, Greece, or elsewhere. "

Marie Colvin: a portrait of the slain war correspondent, by Molly Crabapple

Xeni Jardin at 11:25 am • •

From Molly Crabapple, this wonderful portrait of Marie Colvin, the Sunday Times war reporter who was recently killed in Syria.

More about Colvin here. Killed with her was French photojournalist Rémi Ochlik.

Colvin died trying to retrieve her shoes so she could escape a rocket shelling attack (the custom in Syria is to leave one's shoes at the door before entering a home; the rocket landed a few yards away from her as she was preparing to escape).

Molly says, and I agree:

Looking at Marie Colvin's face, it occurs to me she has the perfect beauty of an older woman- the beauty of good bones and battle scars. The beauty that comes from bravery, from power, from competence, from taking no shit. Earned beauty.

This tribute at the New Yorker is a beautiful read. Reuters today released amateur video believed to have been shot by Syrian rebels just before, and after, the attack. In the video, one of the survivors says he believes—contradicting other reports— that they were not personally targeted by the Syrian government. "They've been bombing civilians for days... we were just unlucky."

Did Syria's army use sat-phone surveillance to hunt down and kill journalists?

Xeni Jardin at 4:14 pm • •

Jillian York and Trevor Timm, writing for the EFF, explore the possibility that the Syrian government used satellite phone surveillance to pinpoint the locations of journalist Marie Colvin of the Sunday Times of London and French photographer Rémi Ochlik, who were murdered in Homs, Syria this week.

On Monday night, Colvin appeared on CNN, telling Anderson Cooper that “the Syrian army is shelling a city of cold, starving civilians.” Responding to Syrian president Bashar Al Assad’s statement that he was not targeting civilians in the barrage of rocketfire raining on Homs, Colvin accused the regime of “murder” and said: “There are no military targets here…It's a complete and utter lie that they are only going after terrorists.” A few hours later, she was dead.
The Telegraph quoted Jean-Pierre Perrin, a journalist for the Paris-based Liberation newspaper who was with Colvin in Homs last week as saying: “The Syrian army issued orders to 'kill any journalist that set foot on Syrian soil'” and that the Syrian authorities were likely watching the CNN broadcast. The Telegraph then described how “[r]eporters working in Homs, which has been under siege since February 4, had become concerned in recent days that Syrian forces had ‘locked on’ to their satellite phone signals and attacked the buildings from which they were coming.”
How could this happen?