Islamic State supporters shun Tails and Tor encryption for Telegram – ComputerWeekly.com

Supporters of the terrorist group Islamic State (Isis) are shunning sophisticated security and encryption software, including the Tails operating system and the Tor network, which could be used to cover their tracks when viewingterrorist propaganda online, communications between jihadi sympathisers have revealed.

Find out what are the most appropriate threat intelligence systems and services for your organisation

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

The disclosures come as the UK government prepares to introduce new restrictions on encryption following the terrorist attacks that killed more than 20 people, including children, at a concert in Manchester, and killed eight andinjured 47 at London Bridge.

Isis has claimed responsibility for the Manchester and London attacks and has also been linked to atrocities in Paris, Germany and Brussels.

Confidential messages show that Isis supporters had little interest in encryption techniques to hide their web browsing activities, or to createa secureversion of propaganda websites that would be difficult for law enforcement to censor or take down.

The messages between supporters recovered by police and the FBI investigating an internet terrorist reveal that Isis supporters preferred method of communication is mobile phone apps Telegram Threema, ChatSecure and Signal, which are designed for people with little or no technical knowledge.

Internet terrorist Samata Ullah communicated with Isis supporters on a Telegram discussion group known as the Khayr group. Police also retrieved a guide to ChatSecure, another mobile phone chat app, from Ullahs computer.

Ullah, who was jailed for eight years in May 2017 after posting encryption training videos on an Islamist blogsite, sent messages to an unidentified Isis supporter raising concerns that the terror groups supporters were not using more secure communications tools.

I dont know Akhi [brother], he wrote. It seems they have some bad info. They refuse to use Wikr [a mobile phone messaging system] and tails. They say threema is the best, then signal, and in extreme case chat secure [sic].

Ullahs Isis contact replied: And they say telegram with virtual sim or open vpn is enough protection.

Another message reads: Dawla [Isis] security groups seem to be very stubborn and not very flexible.

It was only when one of Ullahscontacts inKenya was arrested on 29 April 2016 that attempts were made to persuade fellow Isis supporters to adopt stronger forms of encryption.

The Kenyan said in a letter smuggled out of prison: Tell all KN [Khalifa News] and CCA [Cyber Caliphate Army] teams to be very careful online. It is very much advisable that phones be avoided & instead use PCs with TOR and TAILS.

Many Isis supporters, who often refer to themselves as fanboys, have little technical knowledge and it is difficult to convince them to use encryption software, one counter-terrorism organisation told Computer Weekly.

They have experimented a couple of times with ZeroNet and Onion [Tor] sites on occasions, but those sites are usually very short-lived, a spokesman said, speaking on condition of anonymity. While there are some tech savvy supporters, the majority of their fan base is not very tech savvy and trying to get a newbie to not only understand ZeroNet and Tor but to actually use them consistently is a challenge.

Isiss policy is to saturate the internet with ideas and jihadi content, through social media platforms such as Twitter, according to a report by counter-terrorism think-tank Quilliam.

The terror group distributes daily videos and photographs, which are circulated as widely as possible through self-appointed distributors, often with no official connection to the organisation.

Islamic State has revolutionised jihadist messaging by jettisoning operational security in the pursuit of dynamism, Quilliam reports in a study, The Virtual Caliphate: Understanding Islamic States Propaganda Strategy.

Ullah proposed using ZeroNet which uses BitTorrent peer-to-peer networking and integrates with the Tor secure internet network to create a secure version of a pro-Islamic blogsite, Ansar al Khilafah (Supporters of the Caliphate).

The WordPress propaganda blogsite had attracted interest from the UKs media arm of Isis, according to messages recovered by investigators.

The head of English Islamic State media wants to have the right to proofread all content before it is published on the wordpress in future, one Isis supporter told Ullah. If you would agree to it, they would promote the wordpress.

Ullah replied: Sure. thats good.

But in a series of exchanges, it becomes clear that Isis had no interest in using ZeroNet to create a version of the blog that would be difficult for law enforcement to censor or take down.

An Isis supporter told Ullah: First thing is, the brother almost completely dismissed the idea of zero net. So you will either have to give up the idea or try and convince them.

David Wells, a former GCHQ intelligence officer, told Computer Weekly that mobile phone apps offered a more practical alternative to ZeroNet, Tails and Tor for Isis supporters that may not have technical expertise.

More secure technologies are rarely easy to use, and pragmatically any terrorist group would rather their networks were using something pretty secure than not communicating [at all] when needed or doing something stupid like [sending an] SMS, he said.

A forensic report revealed that Ullahs ZeroNet version of the Answar al Khilafah blog did not work in practice.

ZeroNet would have been cumbersome to use for Isis supporters who were used to exchanging news on social media. It required each user to download the blogs contents, including the Isis magazine Dabiq, onto their own computer, putting them at risk of possession of terrorist materials.

Correspondence recovered from Ullahs computer equipment revealed that he had struggled to find a way to update the ZeroNet version of the site without writing code for each update, and to find ways of displaying videos and other feature-rich content.

Isis favours the mobile app Telegram as a platform for sharing propaganda and for group discussions because it has the ability to create public channels that unlimited numbers of people can view, according to the counter-terrorism specialist.

Isis members begin by creating a private distribution channel on Telegram which is restricted to a few people. These members are responsible forcopying messages from the private channels to publicly advertised open channels, where teams of people then share them through disposable Twitter and social media accounts.

The public channels usually have multiple backups to keep the data flowing if one of them gets suspended by Telegram administrators, said the specialist. Since the private channels have no links to join, they are considered private by Telegram and therefore wont be shut down.

Telegram is said to take down an average of 100 to 200 public Isis channels a day, but Isis creates multiple back-ups of each channel to keep data flowing.

However, the messaging service does not take down private discussion groups between Isis supporters because they are not publicly accessible, said the counter-terrorism specialist.

Encrypted communications is pretty much all they [Isis] do. Id say if theyre not using a walkie-talkie or a cell phone, theyre on one of the encrypted [mobile] apps.

If Isis had taken up ZeroNet, it may have drawn the intelligence services attention to its activities, Wells told Computer Weekly.

If a terrorist group chooses a bespoke or unusual communications provider or service, then this has huge challenges for the intelligence services but it also allows them to focus their efforts, he said.

Experimenting with unproven systems is likely be a low priority for Isis commanders in Syria, who have to deal with the day-to-day realities of civil war with the Assad regime and US drone strikes, said Ross Anderson, professor of computer security at Cambridge University.

If I was running Daeshs technology and some foot soldier says why dont we use ZeroNet, I would say get lost, I have far more interesting and important things to do, said Anderson. Why should I spend weeks investigating this stuff and seeing if it works?

Isis may be avoiding Tor and Tails for similar reasons. The US National Security Agency (NSA) and the UKs GCHQ could narrow down the search for Isis supporters if the terror group started using specialist applications such as Tails and Tor.

Anderson said: They could just harvest all the Tails users in the observable universe and de-dupe them against lists of known users, look for all the new ones and go searching for those.

Isis has used a variety of techniques to avoid detection. During the attack on the Bataclan theatre in Paris in November 2015, terrorist teams used multiple pre-paid burner phones, which they instantly discarded.

Investigators found a crates worth of disposable phones, an investigation by the New York Times has revealed. They used only new phones that they would then discard, including several activated minutes before the attacks, or phones seized from their victims, it said.

Although investigators concluded that the attackers were likely to have used encryption software, no evidence of it was found.

Follow this link:
Islamic State supporters shun Tails and Tor encryption for Telegram - ComputerWeekly.com