How Real Is the Iranian Cyber Threat?

Tom Brewster

August 29, 2014

Persian paranoia: America’s fear of Iranian cyber power

When Israel stepped up Operation Protective Edge in Gaza in July, a crew of hackers going under the name of the Izz ad-Din al-Qassam Cyber Fighters readied their attack tools to show support for their Palestinian brothers.

They attempted to flood a core piece of Israel’s internet infrastructure, the Domain Name System that acts as the web’s phone book for the country. They also tried to take down websites for the national stock exchange and Mossad, the intelligence and special operations body.

Thanks to Israel’s capable cyber defence systems, the attacks caused little trouble, though security firm iSight Partners says the websites were briefly out of action.

Their attacks previously knocked out the websites of top US banks, under the moniker Operation Ababil, but the Cyber Fighters’ gaze has shifted to events closer to home in recent months.

What makes them especially fascinating to the West, however, is that they are almost certainly sponsored by the Iranian government, according to various sources with knowledge of the matter, speaking with the promise of anonymity to the Guardian.

The group, which has compromised large numbers of websites by exploiting vulnerabilities in tools like WordPress, pooling their resources to launch their Distributed Denial of Service (DDoS) strikes, is just one of many actors that form part of Iran’s growing cyber capability, according to US firms.

Indeed, there is a rising anxiety amongst US public and private sector mandarins surrounding Iran’s apparent digital prowess, as evinced by research the Guardian was briefed on ahead of its September release.

‘THE GROUPS ARE ALLOWED TO OPERATE ON FINANCIAL CRIMES…’

Rather than large, singular groups of digital spies, Iran has quietly built up a secret, disparate army of “mercenaries”, each separate from one another but with similar aims, according to the authors of the report, which will be published soon by Silicon Valley security company Norse.

Months of research into Iranian networks uncovered at least 16,000 systems controlled by Iran outside of its borders, 2,000 of which were infected machines of businesses in the US, Israel and other nations of interest, claims Norse chief technology officer and co-founder Tommy Stiansen.

Many of the Internet Protocol addresses (IPs) of those machines are hosting .ir websites - domains that are being used as platforms for attacks. In many cases, visitors to those sites are subsequently infected with malware - software designed specifically for surveillance and to siphon off valuable data from target organisations, according to the firm.

These Iranian mercenaries were ostensibly hacking foreign businesses both for their own gain and for the benefit of their country, says Stiansen. “Cybercrime is tied to the same people doing cyber warfare in Iran,” he adds. “The groups are allowed to operate on financial crimes as well as state sponsored crimes… They don’t have a military machine for their cyber warfare programme.”

Most targets are based in the US, though attacks have also hit the UK, Israel, Germany and Canada, amongst others, Stiansen says, claiming successful attacks were taking place “every week”.

“In US there is a huge infiltration of Iranian activity,” he adds, noting the attacks were “geopolitically tuned”. Critical infrastructure bodies, including utilities and internet service providers, and government bodies are among those on the hit lists of Iran’s online soldiers of fortune.

Various US and European hosting companies have been abused by too. Cloud and hosting services of industry giants like Amazon and GoDaddy are being used to launch the attacks, Norse’s research indicates.

Kurt Stammberger, senior vice president at the firm, suggests Iran’s digital hirelings have used external hosting firms as they “don’t necessarily have access to [the technology] inside of the country to launch attacks”. “They’re using western infrastructure to launch attacks against western infrastructure.”

‘WE’VE GOT TELESCOPES WHERE OTHERS DON’T…’

Norse believes previous research into Iranian activity may have included false assumptions about the actors involved, as Iran has been adept at creating disinformation, using more than 5,000 fake social networking profiles to trick onlookers into following tracks that led to nobody and nowhere.

iSight released a report in May, claiming these fake profiles were being used to spy on military leaders and political staff from across the world. The company told the Guardian it had seen the so-called Newscaster team target Iraqi ambassadors in recent months.

In its own research, Norse set up fake systems that appeared to belong to businesses and critical infrastructure providers that would have proven attractive to attackers. They then collected data on subsequent attacks, tracing a large number back to Iran. Norse also relied on “millions of sensors dropped all over the world” and analysis tools to connect the dots.

Meanwhile, it has mapped networks throughout the Middle Eastern nation to gain a good understanding of the nation’s cyber capability, uncovering various malicious hackers operating within Iran. “We’ve got telescopes where others don’t,” adds Stammberger.

Stiansen also believes he has evidence indicating Turkish and Iranian collaboration on cyber issues. In exchange for oil and other goods Turkey reportedly helped Iran circumvent US and European sanctions, implemented in response to the country’s nuclear programmes. Stiansen suspects there may also be digital deals on the table.

“There was a huge surge of attacks coming out of Turkey once they started cooperating. Believes there is a correlation with Iran’s cyber warfare programme. We will be looking at how Turkey’s cyber programme is being infused with knowledge from Iran probably in exchange for violating sanctions in Iran.”

Neither the Turkish nor Iranian embassies in London responded to requests for comment from The Guardian.

The company plans to release its full ‘Pistachio Harvest’ research in September with two Washington D.C.-based think tanks. Stammberger says the firm will share the most sensitive information with the relevant intelligence agencies, but the rest will be made public.

Security consultants the Guardian contacted on Norse’s claims aren’t entirely sure there is enough proof of Iranian involvement. Some of the systems identified by Norse were hosting all kinds of malicious activity and the use of .ir domains was not enough to confirm the Iranian government backed the attacks, according to researchers from security companies Rapid7 and AlienVault Labs.

“The fact of .ir domains being in there does not lead to any attribution by itself,” says Rapid7’s Mark Schloesser. But Norse believes it has enough evidence to substantiate its claims, which it will soon detail in full.

“When you start seeing this pattern of thousands, tens of thousands of sites that all are controlled by Iranian nationals, that are all located in the West, then you start to think: this seems like more of a programme that has been thought out, that is sophisticated and is directed at a higher level,” Stammberger adds.

‘RECENT COLLEGE GRADUATES WHO ARE VERY TECHNICALLY PROFICIENT…’

Though Norse itself is unsure about previous research into Iran, it couldn’t rule out the claims of a rival firm, CrowdStrike, which says it is tracking four different Iranian groups it calls Kittens. Each Kitten is separate from the other and has its own modus operandi and target list, says Dmitri Alperovitch, CTO and co-founder at CrowdStrike.

Flying Kitten, also known as the Ajax hacking team, is focused on gathering intelligence on foreign governments and corporations of interest. Magic Kitten targets dissidents within Iran, whilst Charming Kitten uses social networking platforms to attack various targets. Finally, there’s Cutting Kitten. “This is a group that has produced a lot of website penetration tools that we see used by Iranian intrusion teams,” Alperovitch says.

CrowdStrike is also tracking a number of individuals – “young individuals, recent college graduates who are very technically proficient”. Alperovitch believes these hackers are likely to strike if the extended negotiations between Iran and the US over the former’s nuclear programme come to nought.

The US is hopeful it can strike a deal which would see sanctions lifted if Iran agrees to limit its activities and turns stores of its enriched uranium into fuel rather than weapons. In July, the deadline for an agreement was extended by four months and moved to November.

“We are very concerned about what is going to happen over the next four months as we wrap up the negotiations. If things don’t go well, we expect to see some of these [Kittens] supported by the regime lashing out to send a message to the West that they’re a power to be reckoned with,” Alperovitch adds.

Iran was the victim of what remains the most infamous act of nation state-sponsored cyber activity: Stuxnet. In 2010, it emerged the Stuxnet malware was used to infect an Iranian nuclear plant in order to upset the nation’s uranium development. Reports later suggested the US and Israel orchestrated the attacks, though neither has confirmed nor denied the claims.

‘WE HAVE SEEN A FEW CASES THAT HAD A BIG IMPACT…’

Iran has been suspected of various documented attacks since then, including the Shamoon event of 2012, which saw 30,000 PCs at oil giant Saudi Aramco infected and wiped.

The DDoS attacks of Operation Ababil knocked out websites of some of US’ top banks, from Bank of America to Wells Fargo. And according to DefenseTech, the Iran Islamic Revolution Guards Corps (IRGC) has a budget of $76m to spend on its cyber efforts.

All this has led to understandable anxiety in the US over Iran’s ability to disrupt American infrastructure at a critical time in relations between the two nations. Iran is certainly a cyber power to watch in this arena, adds Alperovitch.

“The Iranians have gotten a lot more proficient in recent years. They used to be a third tier cyber power in our estimation and they’ve rapidly moved up to second tier,” he says. “They’ve invested a lot of resources into offensive and defensive cyber measures.”

Though it would be easy to accuse American firms of hyping up the threat, the US and others appear to have good reason to be paranoid about Iran’s digital capability. “While some of the campaigns coming from Iran are not very sophisticated we have seen a few cases that had a big impact and were far more sophisticated,” says Jaime Blasco, director of AlienVault Labs.

Professor Ian Brown, associate director of Oxford University’s Cyber Security Centre, says given the past attacks on Iran, it’s highly likely to be shovelling vast sums into offensive technologies.

“Obviously, many other countries will be developing their own capabilities, even if they are unlikely to get to the scale of the Five Eyes. And given Iran was the target of the most sophisticated cyberweapon that is publicly known to date (Stuxnet), I would be surprised if they were not investing in their own capabilities,” Brown adds.

Whatever the truth about the nature of the attackers, and whatever their levels of skill and power, Iran certainly has the attention of the digital defenders of the Western world.