Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

60 5. CYBER ATTACK AGAINST INTERNAL DISSIDENTSpurposes. Groups such as the ICA, the Cyber Fighters, or the Cutting Sword could also possiblytarget organizations such as the Green Movement for purposes of information theft. Theuse of DNS hijacking could clearly sever this purpose: dissidents attempting to log on to theirgroup’s home page may receive a malware payload as a result of this technique. The malwarecan then reside on their system, sending information on the users back to the hackers (as weshall see in similar events occurring in China in Chapter 7) or even disabling the systems as inthe Aramco attack.The Iranian Cyber PoliceBy mid-2010, the Ahmadinejad regime apparently felt a desperate need to showcase thenation’s cyber prowess. Not only had they experienced negative repercussions from dissidents’use of Twitter following the 2009 elections, but in June 2010, the Stuxnet worm becameknown to the general public based on a security report by a small Belarusian firm known asVirusBlockAda. 135 We will discuss Stuxnet more in detail later in the book (Chapter 13), butthe political effect within the Iranian regime was very significant. In early 2011, the Iraniangovernment announced the creation of a “Cyber Police” that will handle “Internet crimes.”According to Iranian Police Chief Esmaeil Ahmadi Moghaddam, the “Internet crimes” inquestion include the use of cyberspace for “espionage and riots”—perhaps a reference toStuxnet and the 2009 postelection protests. Further, he stated that the Cyber Police would specificallyfocus on dissident groups. 136 The Cyber Police has already been active—making afew headlines in 2012. Specifically, they arrested several Iranian Facebook users from a groupcalled “Daaf and Paaf” that had organized an online beauty contest on Facebook. The chief ofthe Cyber Police, Kamal Hadian, stated that the group was spreading corruption and immorality.137 More recently, the Cyber Police announced that they plan to start blocking the illegaluse of Virtual Private Networks (VPNs) within Iran. 138 Likely this is because VPNs can allowusers to access Web sites outside of the Iranian Internet—avoiding filtered and blockedcontent. VPN would also prevent the Iranian government from examining the contentof the communications of an Iranian user with the rest of the world. In another current development,there are reports that the Iranian government intends to create a “Halal Internet”that imposes what has been termed as an “Electronic Curtain” of monitoring and restrictionon Iranian Internet traffic. 139The use of social media in the wake of the 2009 Iranian presidential elections, as well as thediscovery of Stuxnet led the Iranian government to accelerate and strengthen its cyber efforts.The ICA, with possible connections to the IRGC, has launched several high-profile attacksand at the same time seems to be establishing a sizable botnet. The Cyber Police, on the otherhand, appears to be cracking down on the internal use of the Internet in Iran. In one way, theICA can be viewed as an offensive asset and the Cyber Police as a defensive one.Both the ICA and Cyber Police are relatively new, and it is feasible we will read more aboutthem in the near future. Another harrowing possibility includes the collaboration of thetwo bodies: the intelligence gathered by the ICA by breaking into dissident systems couldbe transmitted to the Cyber Police, which would proceed to arrest the identified dissident.Further, it is certainly possible that these organizations (or others like them) may also startworking with tech-savvy Iranian proxies, such as Hezbollah (discussed in Chapter 4) andKata’ib Hezbollah (discussed in Chapter 9).