TRUTH BE TOLD

TRUTH BE TOLD
WORLD NEWS EVERY DAY

Friday, November 23, 2012

Is the new ‘Gauss’ malware a counter-terror finance intelligence tool?

Reports have spread rapidly over the last week of a new piece of computer malware, named Gauss, that has been detected in thousands of computers, mainly in the Middle East. After the tremendous publicity given to Stuxnet, the cleverly-engineered piece of malware that caused the failure of many of the centrifuges enriching uranium hexafluoride gas for the Iranian nuclear weapons programme, and subsequently to the Flame spyware programme, Gauss has attracted relatively little attention, perhaps because it doesn’t appear to have any destructive properties.
But three things in particular stick out from the news reports about Gauss, especially from the detailed information published by Russian computer security company Kaspersky, which carried out a detailed technical analysis of how Gauss was constructed, all of which point to a possible new trend in cyberwarfare, and in particular how cyberweapons are now being used in the fight against terror financing.
The first is that the malware analysts have concluded that Gauss, like Stuxnet and Flame, was programmed and distributed by a state or state-sponsored hacker group rather than by an independent hacker group: this conclusion was reached on the basis of the sophistication of the programming and encryption techniques used, and because of technical similarities with the previous types of malware that are already believed to have originated in either the US or Israeli intelligence communities, or perhaps through cooperation between the two. The USA and Israel, together with the United Kingdom, Russia and China, are regarded as the countries with the highest level of state capabilities in developing and deploying offensive cyberweapons.
The second is that the vast majority of the Gauss infections so far discovered have been in the Middle East. Of about 2,500 infections in 25 countries counted by Kaspersky Labs up to 31st July 2012, 1,660 were found in Lebanon, 483 in Israel, and 261 in the Palestinian territories. Apart from a few dozen infections in the USA and Germany, most of the remaining computers infected have been in Arab countries – although of course these statistics bear the caveat that these are only infections that have been detected using Kaspersky’s virus detection software, which is not installed on all possible target computers. Since the Kaspersky report also suggests that Gauss is planted on target computers largely through USB memory sticks, this suggests that Gauss has been planted using an extensive and carefully run human intelligence operation, which again suggests state involvement.
The third and most interesting feature of Gauss is that, at least according to Kaspersky, it is designed to steal bank log-on credentials of Lebanese banks, including the Bank of Beirut, Byblos Bank and Fransabank; and the company’s report claims that this “is the first publicly known nation-state sponsored banking Trojan.”
So what does this all mean? My guess is that either the USA or Israel, or both countries working in tandem, have decided to go well beyond the traditional forms of financial intelligence gathering, using Know Your Customer and transaction data from the international banks carrying our transactions with the Lebanese banking system, which have yielded disappointing results, not least because the European Union has refused to designate Hizbollah as a terrorist organization. Instead, they designed Gauss as spyware to be planted directly on computer systems in Lebanese banks known or suspected to carry out banking operations for Hizbollah, and especially if these banking operations also involve the large sums of Iranian money that have helped to keep Hizbollah afloat. It’s equally possible that Gauss has been engineered to propagate itself from Lebanese bank computers (or bank computers in Dubai, which is also known to act as a proxy for Iranian transactions that the international banking system is supposed to block.
I would also hazard a guess as to a further, longer-term, purpose of Gauss, based on a paragraph in the Kaspersky report that refers to an encrypted payload within the Gauss programme designed to “target a certain system (or systems) which have a specific programme installed. This could either be to withdraw Hizbollah or other Iranian-related funds from the banks where they are deposited, upon receipt of an appropriate message from a command-and-control server, in order to cause embarrassment or tactical damage to the target organization at a suitable time, or simply to wipe all the data relating to these target accounts.
Whether Gauss is indeed nothing more than spyware or it also contains some more destructive payload, what seems to be clear is that cybertools have now become a more sophisticated weapon for counter-terror finance and perhaps also for economic warfare in the Middle East. How effective they will be in fighting Iran and its Lebaanese proxy Hizbollah remains to be seen; but if in some way they help to remove either the nuclear threat that Iran currently poses to the rest of the Middle East and perhaps the whole of the free world, or at least they reduce the threat of Hizbollah reprisal attacks in the event of an Israeli preemptive strike against Iran, they will be a welcome addition to the West’s arsenal, they more so since they are bloodless weapons.


Penny Wise, Pound Foolish

By David Nordell
 
The drastic spending cuts forced on Britain's new Tory-LibDem government by its predecessor's wastefulness have not only damaged the war on terrorism through a heavy downscaling of British forces in Afghanistan, and in fact across the board of national defence spending. They have also severely damaged the fight against terror finance, both within the United Kingdom and in fact internationally: one of the victims of the spending cuts has been the UK's Financial Intelligence Unit (UKFIU), part of the Serious Organised Crime Agency, which has recently lost almost its entire professional leadership.
 
SOCA/UKFIU's director, David Thomas, together with several key department heads, all took early retirement in October, spurred by a combination of budget cuts and the government's planned reorganisation of SOCA and various other national crime-fighting agencies into a new National Crime Agency. In practical terms, the agency's has lost all its top intelligence professionals in one blow and will in any case lose some of its formal tasking for analysis of financial intelligence; it will be left mainly with the role of reporting agency for the Suspicious Activity Report (SAR) regime, which obliges financial and other regulated businesses to report on every suspicious financial transaction.
 
The SAR regime, both in Britain and everywhere else, has in any case come in for severe criticism. This has not only been from the banks and other businesses that have had to spend significant resources on filing SARs, but also from financial intelligence professionals, audit reports such as one on SOCA itself by KPMG a few years ago that found that the majority of SARs were just gathering dust because the banks' practice of 'defensive SAR filing' meant that UKFIU staff couldn't cope with the mass of reports, and indeed from independent analysts such as this writer. But the hollowing-out of the UKFIU almost certainly means that the signal-to-noise ratio between the SARs filed and the number that produce useful intelligence -- whether in terms of leading to convictions or simply frustrating planned terrorist activity -- will deteriorate significantly.
 
SOCA was founded with the intention of becoming Britain's equivalent of the FBI, the only major national crime-fighting agency in a nation that, a little like the USA, has its police organised in regional forces. The results have proved to be controversial, not least because the UKFIU itself incorporated a lot of former customs and revenue officers (like Thomas himself) who were not seen as 'real policemen.' It was also because the agency threw together a lot of different functions, from computer crime to trafficking in women and children, from drug smuggling to UKFIU's focuses of money laundering, terror finance and asset recovery; national police liaison with Interpol and Europol are also included. Another reason has been that only a minority of SOCA officers have been given arrest powers. And in spite of some well-publicised increases in its budget in the past, more recent cuts have led to its leaking hundreds of experienced officers.
 
The loss of much of UKFIU's intelligence capabilities shouldn't be taken lightly, even though the country retains one other national agency specifically tasked with combatting terror finance, the National Terror Finance Investigation Union (NTFIU): this is jointly staffed by the Metropolitan Police's Special Branch and by the Security Service (MI5), and took the credit for 'Operation Overt,' the foiling of the plot to blow up airliners scheduled from Heathrow to the USA using liquid explosives. By most estimates, the UK is a net exporter of terrorist funds, partly money collected within the Muslim and other immigrant communities for use in other theatres of terrorist operations, and partly money originating elsewhere that routed through Britain's massive financial industry. As a result, any downgrading of this intelligence capability is likely to make the task of terror financiers worldwide easier, and very possibly to lead to an increase in terrorist activity.

No comments:

Post a Comment