Quantum of Surveillance: Familiar Actors and Possible False Flags in Syrian Malware Campaigns

New Article Submission

Thank you for your interest in Jadaliyya. We welcome all submissions. The most significant requirement is for Jadaliyya submissions to be analytically compelling and offer a perspective or argument that has not been covered at length either on Jadaliyya or elsewhere. Because of the volume of submissions, well-written pieces are prioritized. Length is flexible, 1000 to 2500 words is the average range. However, we will accept longer pieces. Once submitted, several members of the editorial committee will review your piece and one of them will inform you of the decision.
Author Details
Article Details
Select Countries
Select Keywords
Select Topics
Only RTF, Word, and Pages documents accepted.

Recommended image size: 762x800 px

Location of each image should be indicated in the text of the article via a square bracket caption that includes: (1) a description of the image; (2) the photographer/designer and source of the image. Please note we only use images you as the author have the right to use, which usually means those of your own creation or those published under Creative Commons. Alternatively, you need specific permission from the copyright holder.
Please read the Release Form and provide an electronic signature [your full name] below to confirm that you accept its terms
Required
Hyperlink words in your article if they refer to links on the internet. We encourage more, rather than less, links (try to avoid footnotes—embed them as hyperlinks if possible)

Article added successfully.

Pages Menu BETA
Mar 11, 2014 Syria
[Logo of the Electronic Frontier Foundation. Image from eff.org] [Logo of the Electronic Frontier Foundation. Image from eff.org]

Quantum of Surveillance: Familiar Actors and Possible False Flags in Syrian Malware Campaigns

By : Jadaliyya Reports

[The following joint report by the Electronic Frontier Foundation and The Citizen Lab at the University of Toronto was published by the Electronic Frontier Foundation on 23 December 2013]

Quantum of Surveillance: Familiar Actors and Possible False Flags in Syrian Malware Campaigns

Introduction

Malware attacks targeting the Syrian opposition were first publicly reported in early 2012, but observed as early as late 2011. As the campaigns move into their second year, we are publishing an update describing several recent attacks. Over the past two years, while tools have changed, attacks have maintained some common themes: easily available Remote Access Tools (RATs) combined with clever and well-informed social engineering. For example, opposition members have been targeted with fake security tools, fake Skype encryption, and a steady stream of intriguing bait documents and malicious links, tailored to the interests, needs, and fears of the opposition. The opposition, as well as NGOs and journalists working on the conflict, have also been the target of persistent phishing campaigns targeting emails and social media accounts. The attacks continue amid an online climate of degraded connectivity, surveillance, and occasional Internet blackouts. 

While we have not sought to show a statistical correlation, the intensity of the campaigns we have observed, as proxied by the samples we have received, sometimes tracks events on the ground. For example, in late 2012, we began to suspect that malware activities had dwindled. Yet, less than 24 hours after an Internet blackout, we detected new malware campaigns. Similarly, the campaigns that we describe here came to our attention after the possibility of a US military action in Syria appeared to have been replaced by other diplomatic efforts. 

However, links between malware intensity and current events are not always so clear. In June 2013, for example, spurred by a flurry of new cases, we reported on a series of fresh targeted attacks, including fake Freegate proxy software and the use of Windows shortcut files, but without a clear link to a proximate event in Syria. 

The attacks analyzed here include: 

  • An attacker who actively moderated warning comments on a Facebook post with a malicious download link. 

  • New attacks by the same group responsible for the fake Freegate software, and attack in which the attacker leaves tantalizing clues in a debug string. 

  • A Mac OSX Trojan, which may be a “false flag” meant to implicate pro-Assad hackers in Syria, but which does not appear to have been authored by the groups with which we are familiar. 

The campaigns described in this post include many of the elements we have consistently observed in this series of malware campaigns: the use of social media and messages that are crafted to be compelling to the target population. Some attacks also feature command and control servers that have been identified with pro-Syrian-government malware in the past, command and control servers that provide staging for other attacks that have previously been identified by Citizen Lab, and familiar remote access tools, such as XtremeRAT. In another case we identified a remote access tool we have not yet seen employed in these campaigns: njRAT.

[Click here to read the full report]
Tags
Feb 16, 2011 Lebanon
Jadaliyya Reports By :
Jadaliyya Reports

Past is Present: Settler Colonialism Matters!

On 5-6 March 2011, the Palestine Society at the School of Oriental and African Studies (SOAS) in London will hold its seventh annual conference, "Past is Present: Settler Colonialism in Palestine." This year`s conference aims to understand Zionism as a settler colonial project which has, for more than a century, subjected Palestine and Palestinians to a structural and violent form of destruction, dispossession, land appropriation and erasure in the pursuit of a new Jewish Israeli society. By organizing this conference, we hope to reclaim and revive the settler colonial paradigm and to outline its potential to inform and guide political strategy and mobilization.

The Israeli-Palestinian conflict is often described as unique and exceptional with little resemblance to other historical or ongoing colonial conflicts. Yet, for Zionism, like other settler colonial projects such as the British colonization of Ireland or European settlement of North America, South Africa or Australia, the imperative is to control the land and its resources -- and to displace the original inhabitants. Indeed, as conference keynote speaker Patrick Wolfe, one of the foremost scholars on settler colonialism and professor at La Trobe University in Victoria, Australia, argues, "the logic of this project, a sustained institutional tendency to eliminate the Indigenous population, informs a range of historical practices that might otherwise appear distinct--invasion is a structure not an event."[i]

Therefore, the classification of the Zionist movement as a settler colonial project, and the Israeli state as its manifestation, is not merely intended as a statement on the historical origins of Israel, nor as a rhetorical or polemical device. Rather, the aim is to highlight Zionism`s structural continuities and the ideology which informs Israeli policies and practices in Palestine and toward Palestinians everywhere. Thus, the Nakba -- whether viewed as a spontaneous, violent episode in war, or the implementation of a preconceived master plan -- should be understood as both the precondition for the creation of Israel and the logical outcome of Zionist settlement in Palestine.

Moreover, it is this same logic that sustains the continuation of the Nakba today. As remarked by Benny Morris, “had he [David Ben Gurion] carried out full expulsion--rather than partial--he would have stabilised the State of Israel for generations.”[ii] Yet, plagued by an “instability”--defined by the very existence of the Palestinian nation--Israel continues its daily state practices in its quest to fulfill Zionism’s logic to maximize the amount of land under its control with the minimum number of Palestinians on it. These practices take a painful array of manifestations: aerial and maritime bombardment, massacre and invasion, house demolitions, land theft, identity card confiscation, racist laws and loyalty tests, the wall, the siege on Gaza, cultural appropriation, and the dependence on willing (or unwilling) native collaboration and security arrangements, all with the continued support and backing of imperial power. 

Despite these enduring practices however, the settler colonial paradigm has largely fallen into disuse. As a paradigm, it once served as a primary ideological and political framework for all Palestinian political factions and trends, and informed the intellectual work of committed academics and revolutionary scholars, both Palestinians and Jews.

The conference thus asks where and why the settler colonial paradigm was lost, both in scholarship on Palestine and in politics; how do current analyses and theoretical trends that have arisen in its place address present and historical realities? While acknowledging the creativity of these new interpretations, we must nonetheless ask: when exactly did Palestinian natives find themselves in a "post-colonial" condition? When did the ongoing struggle over land become a "post-conflict" situation? When did Israel become a "post-Zionist" society? And when did the fortification of Palestinian ghettos and reservations become "state-building"?

In outlining settler colonialism as a central paradigm from which to understand Palestine, this conference re-invigorates it as a tool by which to analyze the present situation. In doing so, it contests solutions which accommodate Zionism, and more significantly, builds settler colonialism as a political analysis that can embolden and inform a strategy of active, mutual, and principled Palestinian alignment with the Arab struggle for self-determination, and indigenous struggles in the US, Latin America, Oceania, and elsewhere.

Such an alignment would expand the tools available to Palestinians and their solidarity movement, and reconnect the struggle to its own history of anti-colonial internationalism. At its core, this internationalism asserts that the Palestinian struggle against Zionist settler colonialism can only be won when it is embedded within, and empowered by, the broader Arab movement for emancipation and the indigenous, anti-racist and anti-colonial movement--from Arizona to Auckland.

SOAS Palestine Society invites everyone to join us at what promises to be a significant intervention in Palestine activism and scholarship.

For over 30 years, SOAS Palestine Society has heightened awareness and understanding of the Palestinian people, their rights, culture, and struggle for self-determination, amongst students, faculty, staff, and the broader public. SOAS Palestine society aims to continuously push the frontiers of discourse in an effort to make provocative arguments and to stimulate debate and organizing for justice in Palestine through relevant conferences, and events ranging from the intellectual and political impact of Edward Said`s life and work (2004), international law and the Palestine question (2005), the economy of Palestine and its occupation (2006), the one state (2007), 60 Years of Nakba, 60 Years of Resistance (2009), and most recently, the Left in Palestine (2010).

For more information on the SOAS Palestine Society 7th annual conference, Past is Present: Settler Colonialism in Palestine: www.soaspalsoc.org

SOAS Palestine Society Organizing Collective is a group of committed students that has undertaken to organize annual academic conferences on Palestine since 2003.

 

[i] Patrick Wolfe, Settler Colonialism and the Transformation of Anthropology: The Politics and Poetics of an Ethnographic Event, Cassell, London, p. 163

[ii] Interview with Benny Morris, Survival of the Fittest, Haaretz, 9. January 2004, http://cosmos.ucc.ie/cs1064/jabowen/IPSC/php/art.php?aid=5412