Tom Fox-Brewster
November 13, 2014
Tracking Isis, stalking the CIA: how anyone can be big brother online
“Our choice isn’t between a world where either the good guys spy or the bad guys spy. It’s a choice of everybody gets to spy or nobody gets to spy.” So said the security luminary Bruce Schneier at BBC Future’s World-Changing Ideas Summit in October. He was considering a world in which the metadata zipping around us and the static information sitting on web servers across the globe is accessible to those with the means and the will to collect it all.
With so many cheap or free tools out there, it is easy for anyone to set up their own NSA-esque operations and collect all this data. Though breaching systems and taking data without authorisation is against the law, it is possible to do a decent amount of surveillance entirely legally using open-source intelligence (OSINT) tools. If people or organisations release data publicly, whether or not they mean to do so, users can collect it and store it in any way they see fit.
That is why, despite having a controversial conviction to his name under the Computer Misuse Act, Daniel Cuthbert, chief operating officer of security consultancy Sensepost, has been happily using OSINT tool Maltego (its open-source version is charmingly called Poortego) to track a number of people online.
Over a few days this summer, he was “stalking” a Twitter user who appeared to be working at the Central Intelligence Agency. Maltego allowed him to collect all social media messages sent out into the internet ether in the area around the CIA’s base in Langley, Virginia. He then picked up on the location of further tweets from the same user, which appeared to show her travelling between her own home and a friend or partner’s house. Not long after Cuthbert started mapping her influence, her account disappeared.
ISIS INTELLIGENCE
But Cuthbert has been retrieving far more illuminating data by running social network accounts related to Islamic State through Maltego. By simply adding names to the OSINT software and asking it to find links between accounts using commands known as “transforms”, Maltego draws up real-time maps showing how users are related to each other and then uncovers links between their followers. It is possible to gauge their level of influence and which accounts are bots rather than real people. Where GPS data is available, location can be ascertained too, though it is rare to find accounts leaking this - only about 2% of tweets have the feature enabled, says Cuthbert.
He has been trying, with mixed results thanks to Twitter’s deletion of accounts spreading Isis propaganda, to determine how tech savvy its members are and how they operate online. Over the past month, Cuthbert has looked at links between a number of pro-Isis users, including one with the handle @AbuHussain104, who has only tweeted 28 times, yet has more than 1,300 followers already. The prominent pro-sharia law Islamic activist Anjem Choudary has been a keen retweeter of Hussain’s words.
The London-based professional hacker has noted the group’s ability to attract followers online; his research shows how a handful of Isis-affiliated accounts have myriad links and wide influence.
Though he is dubious about the veracity of some of the beheading footage, Cuthbert, who also produces documentaries, says the films are well edited.
Having gathered intelligence a handful of influential accounts, Cuthbert is now on the lookout for slipups that reveal the true identity or location of the tweeter. “This is a concern for high-ranking Isis leaders, so much so, they issued a guide on using social media,” he notes, referring to reports of an as-yet unconfirmed document.
Whether they are Isis members or not, web denizens are prone to giving away a lot on social networks, but businesses are often guilty of failing to clean up after themselves too. Recorded Future, another provider of OSINT tools that also came up against Twitter’s censors, claims to have coverage of more than 600,000 open web sources across seven languages from which to find patterns or useful data.
In October it found that 44% of Fortune 500 companies have had employee usernames and passwords leaked online this year. The credentials, stolen during small-scale cyber attacks using freely traded exploit tools against unpatched sites and servers, were posted on variety of forums and paste sites, according to Recorded Future.
Metagoofil, which runs on Linux or Mac machines, is an ideal software for uncovering data businesses have mistakenly leaked onto the internet. Running this free tool in a Linux distribution, hackers can command it to hunt for files related to a particular domain, specifying how many Google searches to look through and how many documents to download. It will then extract whatever metadata the user is looking for and store it all in a file for perusal later on.
GETTING CREEPY WITH SHODAN
For those who want instant visual results, the Shodan search tool is a remarkable piece of work. Simple searches can reveal miraculous details. For instance, type “IP camera” into the search bar and more than 1.3m internet-connected IP cameras show up from across the world. Add “country:gb” and you’ll be shown more than 54,000 based in Great Britain. You could specify a manufacturer too, such as Samsung. That provides just 13 results. From there, it’s a matter of clicking on the IP addresses to see which ones allow you to view live footage either with or without a password (if you guess the password, even if it’s a default one such as “admin”, it will mean you are likely to have broken the Computer Misuse Act).
Either way, it is very easy to find poorly secured cameras - many have a username of “admin” and no password whatsoever, according to previous research. It is that straightforward: no coding skills required.
I ran a search for webcamXP, which bills itself as “the most popular webcam and network camera software for Windows”, and uncovered a large number of UK-based feeds without any authentication (see images below). One was inside a classroom at Lancaster University, which ironically has one of the top cyber security research teams across UK academia. I managed to view an entire seminar free of charge (though there was no sound and there was nothing useful to be gained other than looking at the morose faces of students awake before midday).
The university took down the feed soon after the Guardian disclosed its discovery.
Many showed footage from inside people’s living rooms. They are likely to be oblivious to the fact that anyone on the web can see into their lives, unless they simply do not care. As a pro-privacy writer, I am choosing not to publish images from inside people’s homes. But my searches made it apparent anyone can create their very own voyeuristic version of Gogglebox, all because people have neglected to put usernames and passwords on their CCTV cameras.
Even a search as simple as “default password” on Shodan will bring up reams of results, showing you exactly what login credentials are needed to access things like routers and web servers. It is startling how much insecure kit there is on the internet.
It is possible to take information found on Shodan and use it for even more malicious means such as data theft. For hackers, the search service provides a marvellous way to see how many vulnerable systems are open and ripe for compromise. Searching for systems running the now unsupported Windows XP (meaning it is vulnerable to many exploits - though you will need proper security skills to exploit them) brings up fruitful results - 54,000 machines in fact.
A search for all UK government organisations running Windows XP brings up 36 servers, a number of which are based in Whitehall, including one at the Foreign & Commonwealth Office. Using targets selected with Shodan, anyone with basic knowledge of hacker tools that throw exploits at vulnerabilities in XP would most likely be able to compromise scores of machines running the OS.
USING OSINT FOR GOOD
If Shodan and other OSINT tools can be used by malicious hackers, they can and are used by ethical ones too. Their initial aims are the same: to find and take advantage of vulnerabilities. It is only that penetration testers are paid by companies to break into networks to show where weaknesses lie and how to keep others out.
“The tools are mostly for reconnaissance,” says Christian Martorella, creator of Metagoofil and theHarvester, another OSINT software that pentesters - or “ethical hackers” - use to map their clients’ internet footprint. “This helps the pentester to have as much information as possible about the targets and plan the attacks. This phase is very important but … pentesters usually overlook this phase or dedicate little time, while attackers seem to spend more time in this phase.”
Privacy-conscious folk can also benefit from OSINT. While looking into how his internet service provider [ISP] was interfering with his internet connection, in a method similar to that used by Verizon for its controversial “permacookie” tracking software, researcher Lee Brotherston last month used Shodan to find servers that intercepted his traffic. The wide range of Perftech servers he found were based across the world, and though his ISP was simply using a “man-in-the-middle” technique to add a warning banner to a website he visited, Brotherston was concerned such interference has been used in the past by repressive regimes to spy on people’s web activity.
What if the ISP was coerced by a government and dropped malware onto people’s machines as they tried to access websites? The much-maligned surveillance tool FinSpy is used for just for that purpose: it is placed into the data centres of ISPs and intercepts traffic to force surreptitious downloads of surveillance software. Instead of dropping banners, as Brotherston’s ISP did, it injects malicious JavaScript.
“When you hear about repressive governments that start installing malware on activists’ machines and then arresting them… it’s the same technique. They’re injecting data into a webpage,” says Brotherston, a Canada-based Brit. “If you’re injecting this, you may have a valid business case for doing, it but someone could break in and start dropping malware on people’s machines.”
A number of developers, inspired by the success of Shodan creator John Matherly, have drawn up search sites for hackable systems. Perhaps the most useful for security professionals, whether of the blackhat or whitehat variety, is the Kickstarter-funded PunkSPIDER, a web app vulnerability search engine, which issues an alert as soon as the visitor arrives: “Please do not use this site for malicious purposes … use it wisely or we’ll have to take it away”. It’s remarkably simple. Type or paste in a URL and it will reveal what vulnerabilities have been documented for the related site.
I SPY … A SURVEILLANCE STATE
Such is the openness of the web, and such is the carelessness of so many web denizens, any determined citizen can gather up reams of sensitive information on others and collect enough data to create a decent picture of who they are, where they are and what they are doing. The tools are now accessible for the typical web user.
As the work of Cuthbert and Brotherston attests, such operations can have ostensibly “good” intentions. Although I felt uneasy looking at people through their CCTV cameras without them knowing, I was at least able to alert Lancaster University to the problem so it could take action.
But as security expert Schneier said in an email discussion with the Guardian, it is not the “average web user” that should concern us. Rather, it is those who use OSINT as a starting point for more malicious means. “It’s other countries, it’s criminals, it’s hackers. And you can’t design a surveillance system that only the people you want are able to exploit it.”
As the US and UK governments demand that the likes of Apple and Google do not close off users’ data to intelligence agencies and law enforcement with high-grade encryption, they are also asking technology companies to open up more avenues for criminals to do their own snooping.
No comments:
Post a Comment