Microsoft Hotmail Scandal? Google's Gmail Team Should Pay Attention!

Microsoft's Hotmail Scandal story (read Saturday's Register story here) ignores the basic fact that no responsible/credible person would ever use the Hotmail service. Only two audiences comprise 100% of the Hotmail userbase:

1. Phishers, crooks, and scammers use Hotmail accounts to lie, cheat and steal their way to propserity.
2. Morons and imbeciles who don't know any better use Hotmail.

Given the Hotmail audience, who the heck cares what the Microsoft license agreement says. Ditto for Yahoo, whose appalling lack of security earns them so much bad Karma that they rank lower on the list of good-fortune beneficiaries than Vladimir Putin (do a search to the left for "Yahoo" and see some of my Yahoo indictments). 

Fair warning:  Google needs to pay attention, as I am getting more and smarter phishing/scam attempts from Gmail addresses in just the last month. Something as simple as a forward site at Google where we can pass on suspicious accounts? You could use Google analytics to quantify bad cyber citizens and delete their accounts.

DOD's Hagel: "We come in peace. Take this to your leader."

Yesterday's New York Times (see the full story here) reports some remarkable 1984-like doublespeak from Defense Secretary Chuck Hagel. Net-net: "The U.S. does not seek to militarize cyberspace, but we're going to triple our staff just in case."  Based on this and other data exhaust I will list below, it seemed prudent to make sure my tux fit. Because 2014 is going to be some kind of party.

Other data exhaust that predicts a truly gala 2014:

1. 92% of all ATMs use Windows XP. Crooks can now infect ATMs and then send SMS messages to embedded cell phones to get said ATMs to spew cash (see Wednesday's Register story here). By the way, the ATM exploit has been credited to "Mexican cybercooks." The Symantec video showing how to do the exploit even used a Latino spokesperson. Give me a break! This is most certainly a Russia-inspired false flag operation.
2. China is embarrassed and out for revenge after reports (see Thursday's Computerworld story here) that the NSA has been installing back doors in Huawei's hardware (see Saturday's New York Times story about the NSA exploit here).
3. And once again, Time Magazine's runner-up Person of the Year, Edward Snowden, released documents showing that Microsoft sold your personal information to the the feds and cops for $50 a person (see the Saturday Register story here). The source was allegedly "Syrian" hactivists, clearly a false flag operation of either Russia or China (take your pick, although my vote leans toward Russia).
4. As I reported on March 10th, Russia is so intent on proving that they're more than just a regional power that they played their "Snake" virus card in Ukraine (see my story here).

 So make sure your tux fits. You wouldn't want to miss the party.

Ukraine Data Exhaust

This morning, I took a look at the all-time readership history of The Morgan Doctrine! Unsurprisingly, the USA tops the list. But most surprisingly, Ukraine is a solid number two, followed (in order) by China, France, the UK, Germany, Russia, India, Canada and Singapore. Several hypotheses come to mind, which I'll keep to myself for now.

Malaysia Flight 370: Hypothetical White House Conversation

PRESIDENT: Who's the guy with the Teddy Bear?

NSA DIRECTOR: Mister President, we call him Rainman. He wrote the classified Tripwire program that produced these data.

PRESIDENT: Yeah, well…that is the purpose of this meeting. Why the hell don't we tell the world what happened to Malaysia flight 370? I've seen your hi-res videos.

NSA DIRECTOR: We're confident that a foreign government engineered this disappearance to see exactly how advanced our global surveillance technology truly is.

RAINMAN: [Expletive]ing Chinese.

PRESIDENTIAL AIDE: Sir! You do NOT use that language in front of the president!

NSA DIRECTOR: Please forgive this outburst. Our Rainman is an autistic computer savant, and excitement sometimes presents itself as Tourette's.  I promise you, if it weren't absolutely necessary for him to be here…

PRESIDENTIAL AIDE: [interrupting]…That Teddy Bear stinks. Get it out of here.

NSA DIRECTOR: Sir, with due respect, the last person who tried to separate Rainman from his Teddy Bear has never completed a cell phone call since. In fact, any digital record of his life, including credit history, has ceased to exist on the planet. He currently lives in New York City's Central Park where he begs for food.

PRESIDENT: Back to the purpose of this meeting. Exactly why are we not showing the world what happened to flight 370?

NSA DIRECTOR: Sir, because we don't want the world to know the extent of our technology. Unlike the Russians who tipped their hand by using the SNAKE virus in Ukraine…

RAINMAN: [Expletive]ing Russians!

NSA DIRECTOR: Mister President, I am so very sorry…

SNAKE Added to Perfect Virus Report Card

Three years ago I did my first Virus Report Card (February 7, 2011), comparing Stuxnet, Zeus/SpyEye and Duqu to The Perfect Virus (see all 22 Principles of the Perfect Virus here). Just a month ago, I updated it with the Mask/Careto virus (see the update here). Thanks to the Russian "Snake" technology unleashed in Ukraine, here is yet another update.

While SNAKE lost some stealth points, it is nevertheless a step up in the virus food chain in that it allows the Command and Control (C&C) system to actually take over the target servers. With the exception of Stuxnet, which wreaked havoc with Iranian nuclear centrifuges, the other virus technologies infected client computers that had established a trusted relationship with more secure institutions in order to loot the data assets of the less-than-secure client. SNAKE, on the other hand, goes for the gold and actually takes over the target infrastructure. That's a big leap and one I suggested yesterday might have been a big Russian mistake letting out of the bag in Ukraine.

The BAE Systems report (read it here) did an exceptionally thorough job analyzing SNAKE and suggesting ways to determine it's presence on your system. Major points of special interest:

1. SNAKE appears to be exclusively targeted toward Windows clients and servers. That has all kinds of implications that are beyond the scope of this writeup, although I would advise extreme caution to those who drive automobiles with computers powered by Windows mobile technology ("Hey Achmid, watch me have a bunch of cars slam on their breaks during The Great Satan's rush hour!").
2. While SNAKE has the capability to dynamically reassign C&C servers for peer-to-peer control, it comes equipped with a large number of hard-coded C&C server locations. That seems silly, and may indicate expediency and a tight time line forced deployment of a less-than-perfectly secure virus.
3. Point 2 above is reinforced by the fact that SNAKE was delivered with debugging hooks still compiled into the code that exposes the names of two developers (vlad and gilg) as well as the  name of this particular variant (sengoku). Sure, this could be a not-so-subtle "false flag" pointer to Russia, but my opinion is that the last-compiled versions of SNAKE on January 28, 2014 were rushed into operation in Ukraine because of Russian premeditation.
4. Another possible "false flag" indicator is that the decryption XOR mask used by SNAKE was the same one used in the Agent.BTZ virus that hit Pentagon secure systems in 2008. While this seems rather silly for any government trying to avoid the "A" word (attribution), again it is my opinion that expediency trumped stealth. Ergo, Russia must have made a conscious decision to play the SNAKE cards face up due to their view of Ukraine's importance to them.
5. Finally, Putin's ego and his desire to again be a major player on the global cyberwarfare stage may have dictated that Russia's fingerprints be firmly on this technology.

We still don't have a good idea how SNAKE was initially delivered in Ukraine, but given the number of Russian-leaning Ukrainians in important positions, one well-placed thumb drive could have done it all.

Net-net: 2014 is shaping up to be a most interesting year.