Yesterday, a group of hackers calling themselves the “Cyber Caliphate” briefly took over CENTCOM’s Twitter and YouTube accounts and posted pro-ISIS propaganda and anti-US taunts. They also “leaked” some documents that were already available publicly and tried to make it seem as though the US was planning a war with North Korea. Though he acknowledges it’s a decent publicity stunt, P.W. Singer isn’t very impressed:
[S]eizing control of those accounts is the equivalent of controlling a social media megaphone, but not the actual networks that matter to military operations. The networks are civilian controlled and hosted, not Pentagon owned or run. No critical command and control networks were touched, nor, for that matter, were any of the military’s internal or external computer networks that are used to move classified or even run-of-the-mill information.
Fred Kaplan passes along the above XKCD cartoon and shrugs:
Hackers try to launch assaults on Defense Department computers and networks hundreds of times a day. Sometimes they succeed; once in a while, the breach is serious. This one is not.
He nonetheless cautions:
Having a Twitter feed hacked is no big deal, but it indicates that someone was careless with a password or fell for a phishing expedition (i.e., clicked on an email attachment that installed malware); and if doing that exposed Twitter and YouTube to a cyberattack, someone else higher up might get careless with the passwords for a more substantive site.
Classified servers have rarely been hacked by adversaries, at least as far as officials know. (Who knows whether, or how often, they’ve been hacked without detection? The answer is, by nature, unknowable.) But the military runs many “sensitive but unclassified” sites that, if hacked, could reveal vital information about military operations—a particular unit’s travel and logistics plans, the workings of a computer-controlled electrical power grid, the phone numbers and addresses of key officers, and so forth.
The federal government responded to the embarrassment by ordering a security audit for its more than 800 social media managers. By the way, it’s not clear ISIS actually had anything to do yesterday’s prank:
[tweet https://twitter.com/Ali_H_Soufan/status/554699999456423937]However, as Alex Krasodomski points out, these days “it doesn’t take much to be an Isis member”:
Amedy Coulibaly, who murdered four people in Paris and Mountrouge last week, pledged allegiance to the movement while sitting underneath an A4 flag he’d printed out. The hostage taker in Sydney had forgotten his flag, but offered to release a hostage if somebody brought him one. Travelling to Syria or Iraq is no longer a predicate for becoming a terrorist in the Islamic State’s name: all the contacts, material and propaganda that might be associated with planning and carrying out a terrorist attack can be found online.
The hack on @CENTCOM is likely to have fallen in this vein. A ‘lone wolf’, sympathetic to Isis but with no ‘formal’ links carrying the hack out from their bedroom. The internet has brought us all a bit closer. The distance between a wannabe terrorist and extremist content, the distance between a cyberterrorist and their targets, and the distance between their acts and their onlookers. This is the real threat of #CyberJihad: that anybody can get involved.
The Dish 