After experiencing serious unrest during the late 1990s, Bahrain undertook several steps to enhance the inclusion of the Shiite majority in governance. However, protests erupting following the uprising that overthrew Egyptian President Hosni Mubarak on February 11, 2011, demonstrate that Shiite grievances over the distribution of power and economic opportunities remain unsatisfied. The new unrest comes four months after smaller protests against the efforts by the Sunni-led government’s efforts to maintain its tight grip on power in the October 23, 2010, parliamentary election. That election, no matter the outcome, would not have unseated the ruling Al Khalifa family from power, but the Shiite population was hoping that winning a majority in the elected lower house could give it greater authority with which to challenge the ruling family. In advance of the elections, the government launched a wave of arrests intended to try to discredit
some of the hard-line Shiite leadership as tools of Iran.
Documents
North Atlantic Treaty Organization
NATO Sensors for Urban Operations Technical Report
Increasingly NATO nations are being involved in military operations that are radically different from traditional scenarios, and that involve operations in towns and cities that may be occupied by a combination of non-combatants and hostile forces. This will lead to requirements for new concepts of operations to be developed, and the impact of novel sensors, or novel ways of deploying or using existing sensors to be investigated. Previous studies have looked at the requirements for operations in this new theatre but have not addressed sensor characteristics or limitations specifically.
New York
New York Enhanced Security Guard Training Program Instruction Plan
Eighty-five percent of the critical infrastructure in the United States belongs to private enterprise and corporations. Thus, security guards are literally one of the nation’s first groups of defenders and play an integral role in prevention and deterrence efforts. Success in prevention and deterrence of both general crime, and terrorist acts as well, begins with the establishment of a baseline and maintenance of a robust all-hazards and all-crimes management infrastructure. The professional security guard industry in New York State with an excess of 140,000 certified security guards inhabit that baseline. This program will provide security guards with the basic awareness of terrorism issues that can potentially affect responsibilities within the purview of their employment. It will improve observation, detection and reporting capabilities while enhancing coordination capability with other emergency response professionals. Additionally, this program will elaborate on previously provided instruction, thereby elevating participants’ familiarity with access control issues and security technology.
United States
US National Grid Training Information and Maps
US National Grid Training Information, Grid Reader, and Demonstration Maps.
Intelligence Fusion Centers, Louisiana
(U//FOUO) Louisiana State Analytical & Fusion Exchange (LA-SAFE) Overview
FOUO Louisiana State Analytical & Fusion Exchange (LA-SAFE) Overview from February 2011.
Florida, Intelligence Fusion Centers
(U//FOUO) CFIX Chemical Suicide Identification Guide
FOUO Central Florida Intelligence Exchange Chemical Suicide Identification Guide for 911 Communications, February 2011.
Corporate
HBGary Qosmos Deep Packet Inspection White Paper
Given the massive volumes of data that the U.S. and other governments must manage and the volume of traffic across IT networks, government-wide security solutions pose significant technical challenges. According to Phil Bond, president of TechAmerica, “Now more than ever, a partnership between the public and private sectors in leveraging IT to achieve a more transparent government is essential to securing the public’s safety.”
Arizona, Intelligence Fusion Centers
(U//LES) Arizona Fusion Center Warning: Police Officers Targeted on Facebook
On October 28, 2010 a DUI traffic stop by MCSO uncovered a CD containing multiple photographs and names of over 30 Phoenix PD officers and civilian employees. All of the names and photographs found on the CD were obtained from Facebook and reveal the identity of several patrol and undercover officers. All officers who were identified on the CD have been notified. It is unknown how many more CDs (if any) may be circulating. This information is provided for Officer Safety and Situational Awareness purposes.
Corporate
HBGary QinetiQ Cyber Attack Response Report
Beginning in March 2010, HBGary, Inc. was contracted to assist in the identification, analysis, and removal of malware from QinetiQ North America (QNA) internal systems. This was in response to what QNA believed to be an organized and sophisticated cyber attack involving the potential theft of ITAR controlled data. HBGary was given background on the attack, which included information on targeted attacks on digital data systems that have occurred in the past.
Federal Bureau of Investigation
(U//FOUO) FBI Terrorist Training and Recruitment of CONUS Subjects: Lackawanna, Portland, and Northern Virginia
This assessment addresses the central role of terrorist training in three significant post-9/11 continental United States (CONUS) terrorism investigations: Lackawanna, Portland, and Northern Virginia. This assessment does not address other individuals who may have sought training independently, nor does it address groups of individuals who sought training in regions outside of South or Central Asia.
Department of State
U.S. State Department OSAC: Is China Next for Social Unrest?
The recent social unrest and subsequent government overthrows in Egypt and Tunisia have had deep reverberations not only around the Middle East, but throughout the world. While speculation proliferates about which country will be the next to experience such tumult, a critical analysis of important variables present in both countries should be applied to any other country when making this assessment. In this report, those variables will be analyzed with respect to the People’s Republic of China, and the probability it will be the next country to experience social unrest.
Corporate
HBGary Windows Rootkit Analysis Report
This report focuses on Windows Rootkits and their affects on computer systems. We also suggest that combining deployment of a rootkit with a BOT makes for a very stealth piece of malicious software. We have used various monitoring tools on each of the rootkits and have included most but not all of the monitor logs due to space constraints. However, if a log is needed for perusal it is available. Some of the rootkits we investigated contained readme files which were, for the most part, quite informative and actually substantiated some of our monitoring log findings. For the rootkits that contained readme files we have either included them within the document or have included a link for them. At the beginning of this report we have included clean monitoring logs from two different tools that we employed on the rootkits. We have other clean logs but did not include them for the sake of space. Once more, as the logs for the rootkits will be available if needed so will these clean logs.
Transportation Security Administration
(U//FOUO) TSA Liquid and Natural Gas Pipeline Threat Assessment 2011
The Transportation Security Administration’s (TSA’s) mission includes enhancing the security preparedness of U.S. hazardous liquid and natural gas pipeline systems. This TSA Office of Intelligence (TSA-OI) threat assessment primarily addresses the potential for attacks against the pipeline industry in the Homeland and assesses the tactics, techniques, and procedures (TTPs) used in attacks against pipelines and related infrastructure overseas for their potential use by terrorists in the Homeland.
Transportation Security Administration
(U//FOUO) TSA Pipeline Security Smart Practices Report
U.S. hazardous liquids and natural gas pipelines are critical to the nation’s commerce and economy and, as a consequence, they can be attractive targets for terrorists. Before September 11, 2001, safety concerns took precedence over physical and operational security concerns for a majority of pipeline operators. Security matters were mainly limited to prevention of minor theft and vandalism. The terrorist attacks of 9/11 forced a thorough reconsideration of security, especially with respect to critical infrastructure and key resources. Pipeline operators have responded by seeking effective ways to incorporate security practices and programs into overall business operations.
Intelligence Fusion Centers, Louisiana
(U//LES) LA-SAFE Geomagnetic Storm Warning
A series of coronal mass ejections (CMEs) are en route to Earth from a sunspot which will buffet the Earth’s magnetic field during the next 12 to 60 hours. These CMEs are a result of the strongest solar flare in more than four years, which peaked on February 15th and registered as an X-flare. X-flares are the strongest type of solar flare. NOAA forecasters estimate a 45% chance of geomagnetic activity on February 17, 2011. Geomagnetic storms usually last 24 to 48 hours, but some may last for many days. They also have the capability of disrupting communication systems, navigation systems and electric grids.
Corporate
HBGary General Dynamics Malware Development: Task Z
General Dynamics has selected HBGary Inc to provide this proposal for development of a software tool, which provides the user a command line interface, that will enable single file, or full directory exfiltration over TCP/IP. General Dynamics has requested multiple protocols to be scoped as viable options, and this quote contains options for VoIP (Skype) protocol, BitTorrent protocol, video over HTTP (port 80), and HTTPS (port 443). HBGary will research and analyze the best solution given the client’s choice of protocol(s). As outlined in the Bill of Materials on page 4 of this document, cost per protocol is provided separately, and one or more of the options can be chosen by General Dynamics. HBGary will develop this user mode application with listen capabilities, trace cleanup, and ensure network sniffer testing doesn’t trigger any alerts. The application will be provided for user testing, and validation at the close of the development cycle which will be scheduled jointly between HBGary, and General Dynamics.
Corporate
HBGary General Dynamics Malware Development: Project C
General Dynamics has selected HBGary Inc to provide this proposal for development of a software application targeting the Windows XP Operating System that, when executed, loads and enables a covert kernel-mode implant that will exfiltrate a file from disk (or other remotely called commands) over a connected serial port to a remote device. The enabling kernel mode implant will cater to a command and control element via the serial port. The demonstration will utilize an exploit in Outlook as the delivery mechanism for said software application. The subsequently loaded implant will be stable and will not crash the demonstration system. A usermode component will be included as part of the exploitation package that exercises the kernel mode implant for demonstration purposes. The loaded implant will use the connected serial port to remotely enable functions which can be visible on the collection computer connected on the other end of the serial line. The purpose of the demonstration setup is to verify the functionality for the customer and validate that all work has been completed.
Department of Homeland Security, Federal Bureau of Investigation
(U//FOUO) DHS-FBI Cyanide Production Indicators Guide
FOUO DHS-FBI Cyanide Production Indicators Reference Guide from November 2010.
Infragard
HBGary InfraGard IT/IS Rules of Behavior
HBGary InfraGard IT/IS Rules of Behavior Agreement from October 4, 2010.
Intelligence Fusion Centers
Fusion Centers Map, Locations, Contact Information
A nearly complete list of the actual physical locations, phone numbers, and email addresses of fusion centers around the United States.
Corporate
HBGary Team Themis Corporate Information Reconnaissance Cell Documents
Internet based communications, most predominately the growing spectrum of social media platforms, allow people to coordinate and communicate in a highly efficient and collaborative manner, even when vastly geographically distributed. These same services and technologies can also make it difficult to attribute information to specific entities. Anonymizing and misattribution technologies used to mask location and identity have become commonplace. In many cases, people and/or organizations use the inherent insecurity in Internet communications to conduct criminal or unethical activities. This represents a paradigm shift in the capability of individuals and small groups to conduct effective planning and execution of asymmetric operations and campaigns that can have major impacts on large organizations or corporations. Despite the increased capability and anonymity that these new communications technologies provide, it is still possible to counter individuals and groups who are leveraging networks, platforms, and/or applications to conduct criminal and/or unethical activities. In such cases, it is necessary to develop a more forward leaning investigative capability to collect, analyze, and identify people or organizations conducting such activities. In order to effectively track and understand the complex, interconnected networks involved in these actions, it becomes critical to utilize proven, cutting-edge tools and analytical processes; applying them in a deliberate, iterative manner against those involved in illicit activities. The most effective way to limit the capability of individuals and/or groups is to develop a comprehensive picture of the entities involved through focused collection, conduct rapid analysis to identify key nodes within the network, and determine the most effective method for influencing/limiting these entities.
Corporate
HBGary McAfee Management Presentation
Confidential HBGary McAfee Management Presentation from November 2010.
Federal Bureau of Investigation
HBGary Infragard Hospital Cyber Attacks Brief
HBGary Northern California Infragard “Anatomy of a Cyber Terrorist Attack on the Nation’s Hospital Infrastructure” from October 19, 2010.
Corporate, Defense Advanced Research Projects Agency
HBGary DARPA Cyber Genome Technical Management Proposal
While it is a challenging undertaking, we plan to research and develop a fully automated malware analysis framework that will produce results comparable with the best reverse engineering experts, and complete the analysis in a fast, scalable system without human interaction. In the completed mature system, the only human involvement will be the consumption of reports and visualizations of malware profiles. Our approach is a major shift from common binary and malware analysis today, requiring manual labor by highly skilled and well-paid engineers. Results are slow, unpredictable, expensive and don’t scale. Engineers are required to be proficient with low-level assembly code and operating system internals. Results depend upon their ability to interpret and model complex program logic and ever-changing computer states. The most common tools are disassemblers for static analysis and interactive debuggers for dynamic analysis. The best engineers have an ad-hoc collection of non-standard homegrown or Internet-collected plug-ins. Complex malware protection mechanisms, such as packing, obfuscation, encryption and anti-debugging techniques, present further challenges that slow down and thwart traditional reverse engineering technique.
Corporate, Defense Advanced Research Projects Agency
HBGary General Dynamics DARPA Cyber Genome Program Proposal
Current technologies and methods for producing and examining relationships between software products, particularly malware, are lacking at best. The use of hashing or “fuzzy” hashing and matching techniques are conducted at the program level, ignoring any reflection of the actual development process of malware. This approach is only effective at finding closely related variants or matching artifacts found within malware that are only tangent to the development process, such as hard coded IP address, domains, or login information. This matching process is often unaware of internal software structure except in the most rudimentary sense, dealing with entire sections of code at a time, attempting to align matches while dealing with arbitrary block boundaries. The method is akin to an illiterate attempting comparing two books on the same topic. Such a person would have a chance of correlating different editions of the same book, but not much else. The first fundamental flaw in today’s approach is that it ignores our greatest advantage in understanding relationships in malware lineage, we can deduce program structure into blocks (functions, objects, and loops) that reflect the development process and gives software its lineage through code reuse.