Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

7/6/2017
04:55 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Hacking the State of the ISIS Cyber Caliphate

Researchers say Islamic State's United Cyber Caliphate remains in its infancy when it comes to cyberattack expertise.

Hackers operating within the Islamic State's United Cyber Caliphate may be well-versed and conversant in encrypted communications tools such as Telegram and WhatsApp, but they're still novices when it comes to their actual cyberattack expertise.

While the online propaganda machines and presence of some of the world's most prominent terrorist groups appear technologically advanced and organized, their underlying cyberattack tools and techniques are still rudimentary and limited, security researchers say. As such, they're not likely to disrupt a power plant with a cyberattack any time soon like a nation-state could do, yet there is always a concern of their eventual partnering with more advanced and resourced attack groups to wreak physical or other damage via cyberattacks.

Kyle Wilhoit, senior security researcher with DomainTools, has been studying the cyber capabilities of several terrorist groups. He found that the United Cyber Caliphate - the cyber arm of ISIS that has been in operation for nearly three years - employs techniques similar to those of a so-called script kiddie or fledgling hacker.

"Their relative overall technical expertise is low," he says.

The cyber terrorist group's denial-of-service attack MO is akin to a crowdsourced attack not unlike Anonymous employed in its heyday, for instance. "Their denial-of-service attacks are being executed through Windows applications on multiple hosts, but not infected" bots or a botnet infrastructure, he says. In other words, they're mostly using their own, or supporters', machines to pummel websites with SYN or other flood attacks, for example.

To cover its tracks, the terror group also employs domain-registration proxies for their online activity, he says, to help hide their real identities. 

"They are also leveraging what cybercriminals use," he says, test-driving malware development toolsets. "Just recently, with this research … [I] found them dabbling in the creation of malware."

Wilhoit spotted the Cyber Caliphate using the known underground crime toolkit Ancalog Exploit Builder to generate fake HTML pages to a command and control server. "That piece of malware looked like it was in the development phase. It wasn't weaponized," he says.

The terrorist group is most advanced when it comes to communicating among its members, he says. The members use the encrypted messaging platforms Telegram and WhatsApp to discuss and share information about hacking tools or targets they're going after, he says.

"Looking at their toolsets, I found that ultimately as it stands right now they don't have advanced enough technological capability to cause a major problem" or widespread damage, he says. "But that's not to say in the future" they couldn't become a bigger threat, he says.

Ken Wolf, senior analyst for cyber terror research at Flashpoint, concurs that the cyber terror groups are not skilled or sophisticated in their DoS attacks. His team also has spotted ISIS supporters in one top-tier ISIS forum employing a downloadable DoS tool they dubbed "Caliphate Cannon."

"It was written by a forum member" who appears to be an entry-level coder, he says. Members of the forum downloaded the tool and ran it from their machines in crowdsource-style, HTTP-flood DoS attacks against mainly Middle East government targets in January, for example.

"We've seen other cases where actors have been aggregating … open-source tools" for those attacks, he says. "But there's nothing that we've seen that's suggesting they are using those to inspire their own tool development," Wolf says.

"The greatest value that these actors provide is in their propaganda value," he says.

Ground Battle

It's unclear how the intensified ground battles in Raqqa, Syria and Mosul, Iraq, have affected the Islamic State's cyber powers. Wolf says his team of researchers hasn't seen any Telegram communications out of the United Cyber Caliphate (UCC) since late April, nor any real cyber activity. He says that could indicate manpower losses or other disruptions to their operations as a result of the ground battles.

"We've seen over the past year a few instances in which the United Cyber Caliphate or other groups aligned with it have announced members of their teams were killed in Syria. Most recently – in March – a UCC leader was killed in an airstrike in Syria," Wolf says. "But there's a lot of uncertainty who these actors are, or where they might be," whether on the ground fighting or elsewhere, he says.

Wilhoit says defending against cyber terror groups like the United Cyber Caliphate now doesn't require any different denial-of-service defenses than state-of-the-art firewalls and other best practices. "If you follow basic security precautions, most of these [attacks] can be blocked. They are not using infected botnets to perform denial-of-service attacks," and they are relatively small attacks, he says.

"I'm somewhat surprised that they are not further along than this," Wilhoit says of UCC's cyberattac capabilities. 

Related Content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We are really excited about our new two tone authentication system!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4126
PUBLISHED: 2020-12-01
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.
CVE-2020-4129
PUBLISHED: 2020-12-01
HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
CVE-2020-9115
PUBLISHED: 2020-12-01
ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of ...
CVE-2020-9116
PUBLISHED: 2020-12-01
Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit this vulnerability. Due to insufficient verification, this could be exploited to cause the attackers to obtain higher privilege.
CVE-2020-14193
PUBLISHED: 2020-11-30
Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The ...