Download - Foreign Military Studies Office - U.S. Army

was killed as a result. Public opinion becomes the greatest hostage of such
actions, which results in more pressure on governments to concede to the
insurgent’s demands.
Deception and surprise are still cornerstones of an insurgent’s operating
techniques during conflict. Catching an opponent off-guard is crucial to
success. Similar attack strategies and techniques can be used on the Internet.
Most Internet users have been victimized to a degree by some of these methods.
That is, the Internet is a place for mass psychological and virtual manipulation
just as much as it is a place for mass mobilization. A recent example is an
action appearing on spam messages that requests readers to “click here to
remove.” In actuality the action allows spammers to know that the junk mail
messages are being read. 106
Another common deception technique used online (again, it is not
known if insurgents are using this technique) is “phishing.” These are emails
that appear to be from banks and other financial institutions asking for
consumer credit card details—that is “phishing” for details. Insurgents could
use this technique as an alternate funding mechanism to support their cause.
They could pretend to send a user to a reputable site and then steal the user’s
money or identity. A vulnerability in Microsoft’s Internet Explorer makes this
technique appear even more legitimate. An email may load an actual bank
website into the main Internet Explorer web page. A second, smaller popup
page is then brought up. The location bar on the smaller page will be hidden so
that the user doesn’t know the page actually originated from another country.
Because the site operator can recreate the page to mirror an actual bank site, a
degree of trust is created in the mind of the user. The user enters his credit card
information and unknowingly sends information off to the country involved.
Antiphishing websites are even beginning to appear.
To overcome law enforcement efforts to catch them, criminals started
sending image-based messages that can skirt most spam and other filters that
rely on algorithms to seek out text strings. These new techniques involve
steganography, or the embedding of text in an image. 107 Insurgents are believed
to be using these techniques.
Another example of masking or deceiving computer users could be
termed “hiding in plain sight.” For example, many people have heard of .dll
106 John Leyden, “Click Here to Become Infected,” The Register online version, 22
September 2004.
107 Dennis Fisher, “New Scam Tactic Hits Online,” 13 September 2004, from
http://www.eweek.com.
55