How the U.S. Hacked ISIS (opens in new tab)

Funny, I had the exact opposite reaction. Part of me wishes we divulged less about our tactics.

They basically summed it up "Hack the human first".

Though the article does not outright say it, read between the lines when you see this:

> They even had file sharing through them. "If we could take those over," Neal said, grinning, "we were going to win everything."

Then see some public CVE's around that time, such as:

> CVE-2015-5474: BitTorrent and uTorrent allow remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.

> Project Zero 2018: Simply put, those JSON-RPC issues create a vulnerability in the desktop and web-based uTorrent clients, which both use a web interface to display website content. An attacker behind a rogue website, Ormandy said, can exploit this client-side flaw by hiding commands inside web pages that interact with uTorrent’s RPC servers. Those commands range from downloading malware into the targeted PC’s startup folder or gaining access to user’s download activity information.

And the remote code execution via media files / video virus (Hollywood movies, porn) https://www.cvedetails.com/vulnerability-list/vendor_id-5842... .

So you have file sharing going on, and can remote code execute, if: you get the target to visit a website you (partly) control, you get the target to click a (.torrent) link you crafted, you get the target to download a manipulated video file, compromised (Adobe) software, or cracked game with the payload. These if's are for a military that can easily DNS hijack, spoof (update) certs, ask help from allies who control 25% of all internet advertisements, set up convincing websites targeted to the region, or reroute internet traffic.

While I share your same streak of curiosity, unfortunately this is an area of life that opening up details of your own operations is probably most likely always a net negative.

Get a TS/SCI and go work for CyberCommand if you want to be in the know.

That information will probably not be revealed. What would be the incentive for the US to do so? Zero. But the incentive of spinning the narrative and keeping the details murky provides a much higher payoff.

> I wish articles like this would divulge some details of the technical side of hacking, rather than keep it a mystical field of study.

Why would you publicly inform your enemy of a vulnerability?

Is that not a double edged sword though? When you reveal sources and methods, you tell ISIS what to do differently. These sorts of things tend to be some of the most closely guarded secrets in the US.

Disclaimer: I had a security clearance when I was in the Army.

I was under the impression that a large portion of it was just google mobilizing their mass manipulation machine for what they decided was the greater good.

It’s not a “mystical field of study”, it’s called cybersecurity and you learn it the way you learn anything else, take books or take a course. Learn about networking, learn about malware, learn about social engineering, do you even know what a reverse shell is? Just learn.

>From media reports you would believe that they are mainly some barbarians that may have or may have not access to electricity, never mind net access.

Isn't that what all reports after 9/11 would have you believe of al-qaeda and the taliban? Complete with videos of masked men "training" in deserts by jumping over logs and climbing ropes? And Reports that Bin Laden is hiding in mountains?

Meanwhile Bin Laden was living in a large compound in Pakistan all but protected by the Pakistani military and I believe 8 of the 9/11 hijackers had degrees in engineering and a couple PhDs among them.

Nobody who has read anything serious about ISIS would think that. They were a nascent nation state, installing their own civil servants to run schools, infrastructure, etc. Their propaganda videos were nearly Hollywood level in production quality. They were barbarians in values, not capabilities. They were a massively serious organization and we got Mattis just in time to exterminate them.

Maybe this campaign was as primitive as they let on. It's likely that bringing down a terrorist group's marketing campaign didn't need or warrant a sophisticated attack, like sabotaging Iran's nuclear programme with Stuxnet did. A concerted attack effort using public knowledge techniques may have been enough.

It's in the interest of cyber-warfare actors to not expose their capabilities unnecessarily. Although efforts are taken to prevent malware from coming to the attention of enemies / rivals, or even being adopted by them or criminals, deployment always comes with that risk.

I'm pretty sure that's a given and I think its pretty expected their not going to put details on some news article

It's not a group of camel herders in the desert in regards to their cybersec team. They managed to recruit TriCk/Junaid Hussein(associated with TeaMp0isoN), to be their teamleader. TeaMp0ison were fairly well-known(at the time at least) and actually quite talented hackers.

He was later killed in a dronestrike.

Bit crudely put, but it hasn't been the case that the US military has easily trounced small guerilla forces in ground combat (e.g. Vietnam, Afghanistan, Somali, etc.), so I assume the idea was to suggest that cyberwarfare works better?

Basically shared my same sentiments. One group isn't even trying the other is fully reactive and trying to uncover how much the other groups know.

USA always will win.

Is the racism critical to expressing your view. I understand those terrorist are horrible evil people and inflicted pain and death on innocent people. Your racist comment is grounded in racism towards Arabs and Muslims. Most victims of ISIS are physically near them

Also since they supplied equipment to them it would not have been as difficult to trojan it.

I tried reading an issue of Dabiq once because I was curious about how they interpreted the Hadith. It was really hard to get, which probably shows that the cyber attack worked. If their servers were still up it should have been easy.

edit: I don't recommend reading Dabiq because a decapitation is really difficult to unsee.

I cringed a bit at that and the end of the next paragraph:

> Once he did that, he would see: 404 error: Destination unreadable.

Sounds like somebody got their ICMP types and HTTP response codes mixed up but, hey, they're journalists, not IT guys. We understood their point.

You may be right, but this isn't a helpful comment. Per the HN guidelines [0]:

    Be kind. Don't be snarky. Comments should get more
    thoughtful and substantive, not less, as a topic
    gets more divisive.

    When disagreeing, please reply to the argument
    instead of calling names. "That is idiotic;
    1 + 1 is 2, not 3" can be shortened to "1 + 1
    is 2, not 3."

    Please don't post shallow dismissals, especially
    of other people's work. A good critical comment
    teaches us something.

[0] https://news.ycombinator.com/newsguidelines.html

Fixed now. Thanks!