ISIS has adapted its approach in the digital space to resist the efforts of U.S. Cyber Command, aimed at disrupting and restricting its use of the internet, some experts say. A new report, made public today, details the items in ISIS’s digital toolbox that itthe group uses to resist these disruptive attempts.
While terrorist and jihadist groups have long utilized technology and the internet to serve various objectives, it’s undeniable that ISIS has become the most adept of these groups in the digital realm. ISIS’s slick propaganda videos, online outreach and calls to action have forced governments such as the U.S. to reevaluate its digital strategy creating new offices and even going on the offensive. In fact, Cyber Command is getting its first real test in the first openly declared cyber war against ISIS.
However, as the Washington Post reported last week, some within the military are not pleased with CYBERCOM’s efforts against the terrorist group, partly because the organization was stood up to address more sophisticated cyber actors such as nation-states. ISIS, while less technologically sophisticated than nation-states that have the capability to conduct destructive cyberattacks, uses technology and cyber for different means and has adapted its approach in the digital space to resist CYBERCOM’s efforts, according to a new report made public today.
The report, titled “Tech for Jihad: Dissecting Jihadists’ Digital Toolbox” and released by Flashpoint, an intelligence firm, notes that while “most communication platforms lack the sophistication necessary to ensure sufficient security … today’s jihadists constantly seek alternative ways to advance their agendas and communicate securely.” As such The report explains 36 of the most noteworthy tools and technologies leveraged by groups such as ISIS conducted by examining primary sources from the Deep and Dark Web. Most of the technologies, the report notes, have been used long before ISIS developed a public presence.
Jihadist organizations, according to the report, utilize encryption to protect their communications on a variety of platforms and services that include web browsers, email services, mobile devices and mobile applications. While many use traditional browsers such as Chrome, Firefox and Safari, these services are not secure. “Jihadists enact stringent online security measures starting with the World Wide Web’s most fundamental portal: browsers,” the report said. “[T]ech-savvy jihadists are increasingly turning to highly-secure, alternative browsers such as Tor Browser and Opera Browser, so they can operate online more clandestinely without easily divulging their IP address and risking third-party surveillance.” They also use VPNs and DNS tools to obfuscate their location and IP address.
Encrypted tools are leveraged to protect emails as well as communications on mobile applications. Protected email services used by these groups include services that offer end-to-end encryption on emails, inbox encryption services that encrypt attachments and subject lines and services that guard against spam and phishing attempts. Additionally, common mobile encrypted communicates are Threema, WhatsApp and Telegram.
These groups have also leveraged tools that hide and delete files on devices as well as a tool called Net Guard, described as an open source firewall allowing users to specify apps connected to the internet.
While the exact culprit is not verifiable, one of the report’s authors said there has been a noticeable decline in ISIS’s Twitter activity and a significant uptick in use of encrypted platforms. This is likely a combination of the mass shuttering of social media accounts by the social media companies, CYBERCOM’s efforts against the group and the efforts of non–governmental hacktivist groups such as Anonymous, said Laith Alkhouri, co-founder and the Director of Research & Analysis Flashpoint, in an interview with told C4ISRNET.
Alkhouri said one of the ways ISIS has been effected in cyberspace iswas the disruption of password-protected deep web forums used to communicate and release propaganda prior to widespread social media release. He was unable to say exactly who perpetrated these disruptions and hacks of one of ISIS’s top administrators.
ISIS’s true hacking and cyber capabilities are often described as proficient, but disorganized. The group’s Their jihadist hacking community is just that, a loosely knit community of ideologically driven hackers working in the group’s name, another report from Flashpoint, released in April and titled, “ISIS Cyber Capabilities,” said.
Alkhouri said ISIS does not have an official hacking or cyber wing and has not taken credit for any of the cyber activity perpetrated in its name on its official media channels, but it has praised calls to commit acts against perceived enemies in its name. The mere fact is that ISIS has never acknowledged the presence of ISIS hackers that proclaim that they are hacking on their behalf, he said. ISIS does not coordinate or supervise the hacking collective working in their name.
Given ISIS’ capabilities and exploitation of technology — there’s a difference between the pro-ISIS hackers and ISIS, he added, noting that ISIS is not a cyber threat on par with nation-states. They use technology and the internet to further their agenda.
This is not say the group or its supporters will never pose a threat in cyberspace. “The challenge I look for or that concerns me when I look at the future is what happens if the non-state actor — [ISIS] being one example — starts to view cyber as a weapon system? That would really be a troubling development,” CYBERCOM Commander Adm. Michael Rogers told Congress in April.
Alkhouri said ISIS or pro-ISIS hacking groups could recruit individuals or organizations with far greater sophistication to join their ranks. He said he only saw one instance in which an individual that did not totally share the group’s ideology was recruited and helped the organization in the digital arena. British ISIS member Junaid Hussain, who was killed in an August 2015 drone strike and led the effort to launch and grow the so-called “Cyber Caliphate,” recruited Ardit Ferizi, a Kosovar hacker that collected and sent the personally identifiable information of U.S. service members to ISIS. Ferizi was eventually indicted by the U.S. Justice Department for his efforts.
“As pro-ISIS cyber attacks and capabilities have gradually increased over time but remained relatively unsophisticated, it is likely that in the short run, these actors will continue launching attacks of opportunity. Such attacks include finding and exploiting vulnerabilities in websites owned by, for example, small businesses, and defacing these websites,” Flashpoint’s April report forecasts. “Other attacks may include DDoS attacks. Furthermore, advanced targeting and exfiltration are not far-fetched if the group is able to recruit outside experts into its fold… advancement of the cyber capabilities of pro-ISIS actors largely depends on the group’s ability to bring in a technological savvy, diverse group of people with broad technical skills.”
For some in the government these commercially available technologies that can be accessed by all pose a grave threat. “I think the biggest challenge for national security in the 21st Century as opposed to the 20th Century is that the things that are most likely to affect the future the most are going to be developed outside of the Defense Department,” William Roper, director of the Strategic Capabilities Office, said at the Defense One Tech Summit in June.
A recent report by the Rand Corporation discovered open-source and commercial off the shelf devices can have adverse effects on militaries in future urban conflicts. These technologies “are persistent and are dual-use, which means that they can benefit society or harm it,” the report said. “Although they are intended for commercial purposes, such as learning about shoppers’ preferences and finding new markets, they can easily be used by police and security services to identify and track criminals, terrorists, insurgents and spies.”
From its days as an al-Qaida affiliate in Iraq almost driven to extinction, ISIS has endured rising from the ashes of the Iraq War insurgency to rebrand, proving how it can adapt and evolve to changing circumstances, much to the fear of its enemies.
Alkhouri said the first creation of proprietary encryption technology for communication by al-Qaida in 2007 set a precedent for proprietary software development going forward. Jihadi organizations can now trust their own proprietary technology as opposed to western technology, especially as smartphones and encryption for shielding communication is becoming more widespread.
ISIS and other groups have coped with technology changes. Alkhouri provided the unique example of members using Xbox Live and PlayStation 4 to as one unexpected form of communication used. He said ultimately it will be a whack-a-mole kind of process: When one platform is scrutinized and attacked, ten other platforms will pop up.
