I'll be speaking at the International Conference on Cyber Security 2009 in New York (Jan 5 - 9). My talk is titled Suddenly Psychic (content modified from the talk of the same name I discussed before). The agenda is below.
A recent US Army intelligence report identifies Twitter as a potential communication channel for terrorist activities. I think it is fantastic that intelligence efforts like this have the foresight to recognize emerging channels of communication and that there is effort being put into proactively enumerating the potential use cases. Yet, I am not impressed with the limited case studies presented in the report (the obvious case of Twitter being used for communication in addition to extremely specific situations of Twitter being utilized to trigger explosive devices). I feel that the use cases presented in this report are a good start, but they do not go beyond the obvious scenarios. Therefore, in this article, I want to further the discussion on how micro-blogging channels may be leveraged by terrorist organizations to obtain real time surveillance and intelligence of their efforts. I feel this sort of a conversation will be beneficial to counter-intelligence efforts (I will write a separate article on how Twitter may be actively leveraged by counter-intelligence).
Before I go any further, I want to get out of the way a probable knee-jerk reaction that I suspect some readers may have at this point. I am in no way proposing Twitter or social media as an evil (in fact I'm a huge fan of Twitter and I use it on a daily basis). That would be as absurd as saying that the Internet is evil because criminals can use it to communicate. Twitter is a channel of communication - my goal is to point out increased capabilities this channel may provide for criminal use.
I also want to point out that discussions like these are often
brushed off as fantastical. Perhaps this response comes from the
tendency to place too much weight on the (flawed) hypothesis that only
past and known mechanisms are going to (re)occur in the near future.
Consider 9/11: the incident would have been brushed off as fantastical
had someone had the foresight to predict the scenario prior. Often,
potential scenarios appear to be less probable not by rational
conclusions, but because to the human tendency to believe that only
past scenarios have the highest probability of occurrence. Nasim
Nicholas Taleb makes this point, in addition to stating that impactful
events are less predictable, in his his book The Black Swan: The Impact of the Highly Improbable - a must read for any security professional.
The heavily armed attackers who set out for Mumbai by sea last week navigated with Global Positioning System equipment, according to Indian investigators and police. They carried BlackBerrys, CDs holding high-resolution satellite images like those used for Google Earth maps, and multiple cellphones with switchable SIM cards that would be hard to track. They spoke by satellite telephone. And as television channels broadcast live coverage of the young men carrying out the terrorist attack, TV sets were turned on in the hotel rooms occupied by the gunmen, eyewitnesses recalled.
The authorities in India that responded to the attacks did not know about the Blackberries until after the fact. However, had the authorities known that the criminals possess Blackberries while the attacks were ongoing, they wouldn't have known how to leverage that knowledge. The point I'm trying to make here is that, in general, organizations that are responsible for researching and responding to incidents like these seem ill equipped because they do not know how to assess and leverage the increased utilization of information technology by criminals.
While the attacks in Bombay were ongoing, Twitter seemed to light up with conversations. From citizen journalists, to concerned individuals looking for relatives, to volunteers who attempted to orchestrate blood donations, there were approximately 80 new 'tweets' on the #Mumbai channel every five seconds!
It is clear how useful a micro-blogging channel like Twitter can be to the public during situations such as in the Bombay attacks. However, in the following list, I want to enumerate how potential terrorists may leverage a channel like Twitter to perform surveillance and mass manipulation, the sort of which were not possible prior to the micro-blogging medium. The list below is presented in the context of the recent attacks in Bombay but they can be applied for other situations as well. This is by no means an exhaustive list, but I think it is enough to get the conversation going.
Circumventing rescue efforts. Twitter was used by
citizens in vicinity of Bombay to call upon the public for blood
donations. Here is an actual Twitter message sent during while the
attacks were ongoing:
This message was then immediately 're-tweeted' by many others, the following is a snippet of just 5 of such 're-tweets':
It is clear that Twitter messages can assist in rescue efforts, and in this case, they played a positive role in broadcasting details on where volunteers may help out by donating blood.
Now, consider a situation where a malicious party were to sign up for multiple Twitter accounts and Tweet messages similar to the one presented in this use-case but using non-existent phone numbers:
JJ hospital needs A-blood urgently. Please call Ashwin at 92331003351 #mumbai
JJ hospital needs A-blood urgently. Please call Ashwin at 92331003352 #mumbai
JJ hospital needs A-blood urgently. Please call Ashwin at 92331003353 #mumbai
JJ hospital needs A-blood urgently. Please call Ashwin at 92331003354 #mumbai
JJ hospital needs A-blood urgently. Please call Ashwin at 92331003356 #mumbai
The potential for abuse in this case relies upon the fact that, during emergency situations, people are likely to accept and re-broadcast messages without verification. The malicious Twitter messages above, with incorrect phone numbers, are just as likely to be re-tweeted. People who are able and want to donate blood will now no longer be able to effectively utilize the micro-blogging channel to contact the proper resources.
Group sentiment analysis. The genuine nature of micro-blogging channels makes them a powerful channel to capture genuine human feelings. In my previous article, Hacking the Psyche, I presented how individual feelings from the social web, including Twitter, can be captured to create an emotion dashboard depicting the past and current states of feelings.
Since the goal of terror attacks is to cause terror - sentiment analysis can be a powerful tool for the terror agents to measure the impact of their attacks. A mashup of an automated sentiment analysis engine using the Twitter API coupled with the Google Maps API can easily give the agents a clear visual of how their terror attacks are impacting the emotional states of individuals in particular locations, for example, are people in target location location x upset / scared / worried / angry / happy in response to the ongoing or recently committed attack? What locations around the world have reacted negatively or positively to the attacks?
Following the news media. This is most likely to be one of the more obvious use cases. As mentioned earlier, the terrorists in the Bombay attacks were found to have used Blackberries to keep up with news websites to measure the impact of their ongoing efforts. Instead of having to surf to multiple news media websites, it is plausible that criminals can utilize traffic in the particular channel of interest, for example #Mumbai, to find pointers (URLs) to high quality reports pre-filtered by the Twitter community. The following is a screenshot of Twitter messages in the #Mumbai channel:
Leveraging and manipulating citizen journalists.
Individuals in the vicinity of the ongoing attacks in Bombay were
providing first hand reporting of police efforts. This information is
likely to be extremely useful to the criminals.
Furthermore, individuals on the scene may be remotely manipulated to
provide specific information that a criminal may be seeking, for
example, the following message could be posed to the #Mumbai
channel by a malicious entity seeking further details: "Can anyone
on-site please confirm the number of choppers above Nariman house asap?"
Data poisoning police efforts. In a future article, I will attempt to enumerate ideas on how police may be able to utilize social media, one of the uses cases being the ability to leverage information from citizen journalists to strategize counter-efforts. A malicious response to this is likely to take the form of data poisoning, where the malicious party may post false information onto the micro-blogging channels while posing as citizen journalists.
Geo-locating and instigating further panic. One of the goals of terrorism is to instigate panic. Many Twitter clients, specially those that run on mobile platforms, allow users to tag their specific geo-location. These information can be queried and coupled with sentiment analysis discussed above to measure the level of panic based on geographical locations.
Further panic and unrest may be instigated by spreading false
rumors. From the malicious party's perspective, it is a lot cheaper to
create panic from spreading rumors than having to carry out physical
activities. To illustrate, here is an example of messages that
overwhelmed the #Mumbai
channel by a single Twitter message from someone suggesting that the
terrorists may be reading the information being posted. It was unlikely
that the terrorists in the Mumbai incidents were reading Twitter, but
the point I'm trying to make here is how fast such a rumor can
snowball.
So what does all of this mean? The goal of this article is to spread
awareness and raise consciousness. The ideas presented in this article
may appear far fetched at the moment, but with the explosive growth and
integration of social applications into the lives of the Generation Y
culture, it is increasingly probable that malicious parties are likely
to leverage social media channels as time progresses. I feel it is
important that we have a good grasp of how criminals may utilize these
channels so we better understand the tactics of enemies we are likely
to deal with in the future.
Perhaps it may also be useful to extend this thought process to criminal use of social media in terms of cyber-warfare. Many people expect cyber-warfare tactics to be limited to defects in the network and application layers, yet it is increasingly plausible that government sponsored crime may take upon use cases that leverage social applications. I have discussed the abuse of sentiment analysis in my Hacking the Psyche article that illustrates one such example. If you are interested in this topic and if you are in New York during January 6 - 8, I will be speaking at the 2009 International Conference on Cyber Security.
During the next few months, I will be presenting a brand-new talk titled "Suddenly Psychic: Knowing Everything About Everyone" at various conferences around the world. I will be presenting it with Akshay Aggarwal, a good friend of mine. Akshay and I have enjoyed researching the business, security, criminal, social, and psychological implications of this topic, and we look forward to sharing our research with you.
Currently, this talk is scheduled debut at the Microsoft Blue Hat Conference [v8] in October, followed by Hack in the Box in Kuala Lumpur.
TITLE: Suddenly Psychic: Knowing Everything About Everyone
ABSTRACT:
Imagine a world where you can remotely influence other people's behavior. This talk will expose how information about people in the physical world, coupled with voluntary information from new communication paradigms such as social networking applications, can enable you to remotely read people's minds to influence their behavior.
Topics of discussion will include:
The goal of this presentation is to raise consciousness on how the new paradigms of social communication bring with it real risks as well as marketing and economic advantages. Perspectives on negative and positive uses will be presented in addition to academic discussions and thoughts on how to enable the upcoming online social age.
I presented "Bad Sushi: Beating Phishers at their Own Game" with Billy at the Microsoft Blue Hat 2008 conference. It was a great opportunity to get to know the Microsoft security and product teams. I'd like to thank Billy Rios, Andrew Cushman, Katie Moussouris, Sarah Blankinship, Celene Temkin, Dana Hehl, and the rest of the Blue Hat team for inviting me.
Speaking of Microsoft, I'm moving to Seattle tomorrow. I'm looking forward to getting in touch with a lot of old friends there so that should be good. If you are in the area, just let me know - it will be good to catch up.
I presented Bad Sushi: Beating Phishers at their Own Game (with Billy) at Blackhat Europe (Amsterdam) 2008 last week. I always enjoy doing this talk, and the feedback was quite positive. For more information, check out Nate's coverage of the conference over at ZDNet's Zero Day.
I'll be presenting the Bad Sushi talk at Microsoft's BlueHat conference in May this year. I'll be apartment hunting and visiting friends in the Seattle area the last week of April, right before the conference, so if you happen to be in Seattle at that time just let me know!
I presented Bad Sushi: Beating Phishers at their Own Game with Billy Rios last week at the Black Hat Briefings in DC. The best part of the experience was the opportunity to talk to people in the audience after the presentation, and to hear their perspectives on the subject.
Here is what others have to say about the presentation:
Black Hat Lifts the Cover Off ID Theft Phishing Networks [eWeek]
The myth of the Ninja Hacker [CNET]
Black Hat D.C. wraps up [CNET]
Black Hat, Day 1: Cracking GSM and skimming ATMs [ZDNet, thanks Nate]
Black Hat: Honor Among Thieves?
Here is some additional coverage:
Bank scammers scammed, says security researcher [The Register]
World of Phishing Exposed (podcast)
Researchers Expose "Stupid Phisher Tricks" [Dark Reading]
How phishers work -- the inside story [Guardian]
Most Phishers Clueless, Say Researchers
If you were unable to attend the presentation, but would like to get a glimpse of the material, please read the on-line interview with Billy and me that I linked to earlier: Interview with Nitesh Dhanjani and Billy Rios, Spies in the Phishing Underground.
Since the presentation, Billy and I have discussed new material applicable to this presentation, and so I think we will be continue to present updated versions of this talk at future security conferences.
Help Net Security has posted an interview with me and Billy Rios titled Spies in the Phishing Underground.
If you enjoyed the interview, and if you want more details and screen-shots, check out our talk at the Federal Black Hat Briefings 2008 [February 20]. The title of the talk is Bad Sushi: Beating Phishers at their Own Game. Following is a brief description:
This talk will expose the tools and tactics used by the phishing underground. Follow us as we track real life phishers hiding in the shadiest corners of the Internet, analyze the tools used by phishers, and discover the sites where real life identities are being bought and sold.
The specific topics covered by this talk will include: how phishers set up a phishing site, a look at the back-doors and phishing kits used by phishers, determining how phishers steal identities, and a detailed look at the forums used to buy and sell the stolen identities.
We are excited about all our discoveries and we looking forward to the conference. We are also concerned about all the information we have discovered, and we are already sharing this information with the authorities.
Also, Billy does a fantastic job of summing up our enthusiasm and concerns in his blog.
I'll be speaking at the DeepSec 2007 conference this week. More information at the conference website.
I'll be speaking at the hack.lu 2007 security conference in Luxembourg on October 20, 2007. My talk is titled Breaking and Securing Web Applications. The conference agenda is here.
I'll be at the Black Hat briefings in Las Vegas this week. In addition to the briefings, I enjoy going to Black Hat to reconnect with old friends, and to make new friends in the security industry. It is also a delight to meet people who read my blog and to have the chance to hear their thoughts and philosophies.
If you will be there as well, and would like to catch up, please send me an email.
