{"id":1628,"date":"2015-11-24T09:59:47","date_gmt":"2015-11-24T14:59:47","guid":{"rendered":"http:\/\/blog.cedsolutions.com\/?p=1628"},"modified":"2015-11-24T09:59:47","modified_gmt":"2015-11-24T14:59:47","slug":"security-manual-reveals-the-opsec-advise-isis-gives-to-recruits","status":"publish","type":"post","link":"https:\/\/blog.cedsolutions.com\/1628\/security-manual-reveals-the-opsec-advise-isis-gives-to-recruits\/","title":{"rendered":"Security Manual Reveals The OPSEC Advise ISIS Gives To Recruits"},"content":{"rendered":"
\"Policemen<\/a>

Policemen guard streets near the Bataclan concert venue, where gunmen killed at least 80 people at the end of a string of attacks across Paris the night before, Nov. 14, 2015. As the death toll rose to 127 with many more wounded and Paris reeled from the violence, President Francois Hollande directly blamed the attacks on the Islamic State group. (Dmitry Kostyukov\/The New York Times)<\/p><\/div>\n

In the wake <\/span>of the Paris attacks, US government officials have been vocal in their condemnation of encryption<\/a>, suggesting that US companies like Apple and Google have blood on their hands for refusing to give intelligence and law enforcement agencies backdoors to unlock customer phones and decrypt protected communications. But news reports of the Paris attacks have revealed that at least some of the time, the terrorists behind the attacks didn\u2019t bother to use encryption<\/a> while communicating, allowing authorities to intercept and read their messages.<\/p>\n

\n
\n
Reports in France say that investigators were able to locate some of the suspects\u2019 hideout<\/a> this week using data from a cellphone apparently abandoned by one of the attackers in a trashcan outside the Bataclan concert hall where Friday\u2019s attack occurred, according to Le Monde<\/em>. Authorities tracked the phone\u2019s movements prior to the attack, which led them to a safehouse in a Paris suburb where they engaged in an hours-long shootout with the other suspects early Wednesday. These would-be attackers, most of whom were killed in the apartment, had been planning to pull off a second round of attacks this week in Paris\u2019s La Defense business district, according to authorities.Other reports indicate that a previous ISIS terrorist plot targeting police in Belgium was disrupted in that country last January because Abdelhamid Abaaoud\u2014suspected mastermind of both that plot and the Paris attacks\u2014had failed to use encryption. He also carelessly left behind a cellphone in Syria, which contained unencrypted pictures and videos, including one now-infamous video showing him smiling from a truck as he dragged bodies of victims through a street.All of this suggests that the attackers were guilty of major OPSEC failures\u2014that is, if it weren\u2019t for the fact that some of them still managed to pull off the Paris attacks without prior detection. This suggests they either did<\/em> use encryption during earlier planning stages of their attacks, or that authorities were so overwhelmed tracking other suspects\u2014French investigators claim they recently thwarted six other attacks\u2014that they overlooked the suspects who pulled off the Paris attacks. This indeed might be the case since Turkish authorities have said they tried to warn French authorities twice about one of the suspects but never got a response.Despite this, US authorities have flooded the media this week<\/a> with stories about how ISIS\u2019 use of encryption and other anti-surveillance technologies has thwarted their ability to track the terrorists. But authorities have also slyly hinted that some of the encryption technologies the terrorists use are not as secure as they think they are<\/a>, or are not being configured and used in a truly secure manner. So what exactly are ISIS attackers doing for OPSEC<\/a>?It turns out that a 34-page guide to operational security<\/a> (.pdf) that ISIS members advise recruits to follow, offers some clues. Aaron Brantly and other researchers with the Combating Terrorism Center at West Point\u2019s military academy uncovered the manual and other related documents from ISIS forums, social accounts and chat rooms. The originals are in Arabic, but the center provided WIRED with translated versions of a number of documents that had been passed through Google Translate.1<\/sup><\/p>\n

The manual advises to avoid using Instagram because its parent company, Facebook, has a poor track record on privacy.<\/p>\n

The guide was originally written about a year ago by a Kuwaiti security firm known as Cyberkov<\/a> to advise journalists and political activists in Gaza on how to protect their identities, the identity of their sources and the integrity of information they report. But members of ISIS have since co-opted it for their own use as well.<\/p>\n

The guide offers a handy compilation of advice on how to keep communications and location data private, as well as links to dozens of privacy and security applications and services, including the Tor browser, the Tails operating system; Cryptocat, Wickr, and Telegram encrypted chat tools; Hushmail and ProtonMail for email<\/a>; and RedPhone and Signal for encrypted phone communications. Gmail, the guide notes, is only considered secure if the account is opened using false credentials and is used with Tor or a virtual private network. Android and iOS platforms are only secure when communications are routed through Tor.<\/p>\n

The manual advises disabling the GPS tagging feature on mobile phones to avoid leaking location data when taking photos\u2014a mistake that a Vice reporter made in 2012 when interviewing murder suspect John McAfee who was on the lam<\/a>. Alternatively, operatives and journalists can use the Mappr app can be used to falsify location data and throw intelligence agencies off their trail.<\/p>\n

The OPSEC manual used by ISIS also advises against using Instagram because its parent company, Facebook, has a poor track record on privacy, and it warns that mobile communications can be intercepted, even though GSM networks are encrypted. It advises readers to use encrypted phones like Cryptophone or BlackPhone<\/a> instead.<\/p>\n

Dropbox is held up for special condemnation\u2014because Edward Snowden advised against using it, and because President Bush\u2019s former Secretary of State Condoleezza Rice is on the company\u2019s investors board.<\/p>\n

There are no surprises among the documents. Most of the recommendations are the same that other civil liberties and journalist groups around the world advise human rights workers, political activists, whistleblowers and reporters to use to secure their communications and obscure their identity or hide their location. The appearance of this and other OPSEC documents in ISIS forums and social media accounts indicate that the jihadis have not only studied these guides closely, but also keep pace with the news to understand the latest privacy and security vulnerabilities uncovered in apps and software that could change their status on the jihadi greatest-hits list.<\/p>\n

‘This is about as good at OPSEC as you can get without being formally trained by a government… But there’s a difference between telling somebody how to do it and then doing it right.’ West Point cyber fellow Aaron Brantly<\/span><\/p>\n

\u201cThis is about as good at OPSEC as you can get without being formally trained by a government,\u201d Brantly, a cyber fellow with the West Point center, told WIRED. \u201cThis is roughly [the same advice] I give to human rights activists and journalists to avoid state surveillance in other countries. If they do it right, then they can become pretty secure. [But] there\u2019s a difference between telling somebody how to do it and then [them] doing it right.\u201d<\/p>\n

Intelligence agencies, of course, are hoping that ISIS jihadis don\u2019t get it right.<\/p>\n

The documents warn that followers should use strong passwords and avoid clicking on suspicious links, to prevent intelligence agencies and everyday hackers from breaching their systems. And there\u2019s advice for communicating even when repressive regimes block Internet and mobile networks to thwart activists from organizing, such as during the Arab Spring. It coaches readers, for example, on how to set up their own private Wi-Fi network or use apps like FireChat to share photos and text short distances without needing internet access.<\/p>\n

It advises users to always use a VPN online to encrypt data and prevent ISPs and spy agencies from reading their communication. But it cautions users to stay away from American providers of VPNs and encrypted chat tools and instead use ones like Telegram<\/a> and Sicher<\/a>, instant messaging apps made by companies based in Germany, or the Freedome<\/a>, a VPN from the Finish computer security firm F-Secure. Apple\u2019s iMessage, an end-to-end encryption service, also gets a thumbs-up for being impervious to both spying from government intelligence agencies and Apple itself.<\/p>\n

<\/div>\n

Although US government officials have repeatedly cited WhatsApp as a tool ISIS uses to thwart surveillance, the Kuwaiti manual actually puts the chat application on a \u201cbanned\u201d list. Although WhatsApp offers end-to-end encryption, a German security firm found problems with its implementation earlier this year<\/a>.<\/p>\n

Brantly says one thing he hasn\u2019t seen in any documents or discussions found in ISIS forums and social media accounts is mentioned of Sony\u2019s PlayStation 4 for protected communication. Although a Belgian official told media last week, prior to the Paris attacks, that ISIS operatives in Belgium had been using Sony\u2019s videogame system to communicate, Brantly says he\u2019s seen no sign of that in their research. \u201cI\u2019ve never seen PlayStation come up in any document,\u201d he says.<\/p>\n

He also says they\u2019ve seen no sign yet that ISIS is using home-brewed encryption programs that its members created themselves. \u201cAl Qaeda developed their own encryption platform for a while. But ISIS right now is largely using Telegram [for encrypted communication],\u201d he says.<\/p>\n

To help jihadis master their OPSEC, ISIS also reportedly provides a 24-hour help desk.<\/p>\n

Documents like the Kuwaiti OPSEC manual aren\u2019t the only aid jihadis have to protect their communications. To help them master their OPSEC, ISIS also reportedly provides a 24-hour help desk<\/a>.<\/p>\n

Brantly says the jihadis they encounter in ISIS forums and chatrooms vary greatly in their technical savviness. He also says there are signs of increased interest not only in securing their own communication but in hacking other targets as an ISIS tactic. The so-called Cyber Caliphate, a hacking group that supports ISIS, claimed responsibility for hacking the US Central Command\u2019s Twitter and YouTube accounts<\/a> earlier this year. ISIS hackers have also taken credit for hacking a number of government ministries in Iran and stealing internal communications and login credentials, some of which they posted online.<\/p>\n

\u201cThere\u2019s a whole section on hacking [in the ISIS forums],\u201d Brantley says. \u201cThey\u2019re not super-talented hackers, but they\u2019re reasonable.\u201d<\/p>\n

1<\/sup> UPDATE 11\/21\/2015: This story has been updated to identify the original source of the document\u2014a Kuwaiti security firm\u2014and the original reason for its creation.<\/p>\n

Security Manual Reveals the OPSEC Advice ISIS Gives Recruits<\/a><\/p><\/blockquote>\n