International Cyber Terrorism

include Endgame, Inc. and Netragard of the United States and Vupen from
France. State intelligence agencies often have their own teams to develop cybercollection
tools, such as Stuxnet, but require a constant source of zero-day exploits in
order to insert their tools into newly targeted systems. Specific technical details of these
attack methods often sells for six figure sums.
Common functionality of cyber-collection systems include:
• Data scan: local and network storage are scanned to find and copy files of
interest, these are often documents, spreadsheets, design files such as Autocad
files and system files such as the passwd file.
• Capture location: GPS, WiFi, network information and other attached sensors are
used to determine the location and movement of the infiltrated device
• Bug: the device microphone can be activated in order to record audio. Likewise,
audio streams intended for the local speakers can be intercepted at the device
level and recorded.
• Hidden Private Networks that bypass the corporate network security. A compute
that is being spied upon can be plugged into a legitimate corporate network that
is heavy monitored for malware activity and at same time belongs to a private wifi
network outside of the company network that is leaking confidential information
off of an employee's computer. A computer like this is easily set up by a doubleagent
working in the IT department by install a second Wireless card in a
computer and special software to remotely monitor an employee's computer
through this second interface card without them being aware of a side-band
communication channel pulling information off of his computer.
• Camera: the device cameras can be activated in order to covertly capture images
or video.
• Keylogger and Mouse Logger: the malware agent can capture each keystroke,
mouse movement and click that the target user makes. Combined with screen
grabs, this can be used to obtain passwords that are entered using a virtual onscreen
keyboard.
• Screen Grabber: the malware agent can take periodic screen capture images. In
addition to showing sensitive information that may not be stored on the machine,
such as e-banking balances and encrypted web mail, these can be used in
combination with the key and mouse logger data to determine access credentials
for other Internet resources.
• Encryption: Collected data is usually encrypted at the time of capture and may be
transmitted live or stored for later exfiltration. Likewise, it is common practice for
each specific operation to use specific encryption and poly-morphic capabilities
Page 68 of 174