To catch a spy, think like one

 kw: book reviews, nonfiction, hacking, spies, hackers, cybercrime, deepfakes, home security

A truly successful cybercriminal must have excellent social skills. The popular idea of a "hacker" as a guy in a basement wearing a hoodie and somehow breaking into computer accounts is fiction. The easiest way to get the user credentials needed to get into a computer system is to purchase them on the dark web. The second easiest way is to make a phone call and persuade someone to tell you; that is often easier than you might imagine. But social skills are essential.

As former spy hunter Eric O'Neill tells us in Spies, Lies, and Cybercrime: Cybersecurity Tactics to Outsmart Hackers and Disarm Scammers, the third best way to steal credentials (typically, user name and password) is to exploit weaknesses in an operating system, taking advantage of them before security software is updated to "patch" the weak place. He tells us of one or two such weaknesses, mostly because they don't work well any more. But until a few years ago, forcing a buffer overflow was a common tactic until security programs were re-coded to limit the number of characters entered as a user ID or password.

But here's where things got more scary. HNDL means "harvest now, decrypt later". Getting into a system is one thing; being able to do something useful (to you) with the data files it contains is another. I don't know how many household computers enable encryption of their hard drives; probably very few. But wise business leaders have their IT team encrypt all data. Then someone who breaks in cannot read anything. Crooks have learned to simply copy everything and store it, awaiting the development of more powerful decryption technology, including quantum decryption, that may be able to tackle it in the future. Storage is getting incredibly cheap: hard drives as large as 36 TB are available, and depending on disk capacity, the cost is in the range of $30 to $60 per TB.

The author trains us using two useful mnemonics, one related to intruder techniques, the other to defenses. Firstly, DI²CED (I suppose it is "diced" as in "sliced and diced", a hacker's goal). The keywords are Deception, Impersonation, Infiltration, Confidence, Exploitation, and Destruction. These are like the layers in an onion, each depending on the prior ones. Perhaps that is why a common domain suffix in the dark web is ".onion".

Each chapter ends with a series of tips labeled "Think Like a Spy." This is because cybercriminals, just as confidence actors (con men) of the past, use spycraft techniques. We need to know how a spy thinks to have a chance to avoid the lures and traps that spies use on us. The book is filled with examples, including a near-miss the author experienced and an extended example showing what was needed for a nonprofit corporation he and others worked for/with to recover from a ransomware attack.

The defensive mnemonic is PAID: Prepare, Assess, Investigate, and Decide. Making Preparations beforehand, getting policies in place, is like buying fire extinguishers for your home. A fire may never break out, but if one does, the low price you paid for the extinguishers is a tiny fraction of the damage a fire will do if you have to abandon the house to the flames (note: this is my example, drawn from tidbits here and there in the book). If a smoke alarm goes off, or you see a frying pan catch fire, for example, Assessing the threat needs to take place in a few seconds. Having the extinguisher close at hand makes a big difference in how you Assess the threat. Even then, you may determine that the best action is to call 911 and get outside. For a large business that finds it is under attack, Assessing and then Investigating may need to go on for days or even weeks. In a beginning house fire, if you have extinguishers, Investigation consists of knowing where the nearest one is. Decision is then instant: put out the fire you see, then look for possible others (follow-up Investigation). For a business, Investigation may lead to the threat being seen as either greater or less than it first seemed. Plans that were Prepared beforehand lead to better Decisions.

In the case of the nonprofit, the organization was "rescued" by slow internet connections. The ransomware perpetrator claimed to have downloaded 3 TB of sensitive information. During Investigation, the security team, including the author, determined from system logs that the intrusion was limited in time, and at most 1 GB could have been exported. That's 1/3000th of what the criminal claimed—and that's a common tactic. Scare, scare, scare, and try to keep you from getting time to think. Still, a lot of work had to be done to patch up the security software and restore the systems from backups. Then the criminal could be told, "You got nothing. You get nothing. Go away." Most satisfying.

Other examples relate to personal security. Deepfaked voices and videos are becoming more common. I answered a phone call one day, to hear a cheerful voice say, "Hello, Grandpa." I hung up immediately. I don't yet have grandchildren old enough to use a phone. If a call like that occurs in 10-15 years, I'll need a different plan. Here, Preparing means to have a "family pass phrase" or even a "proof of life" exchange, such as the following:

Caller: "Grandpa, I need help."

Me: "Were you caught by the Jabberwock?"

Real grandchild: "No, it was the Bandersnatch."

But a fake grandkid? The caller will simply hang up, and if they don't you hang up on them. The caller is probably some middle-aged guy with an AI generated voice, cloned from the grandchild's social media posts (do I need to remind you that you shouldn't post family videos on Facebook or TikTok or X or ANYWHERE!!?)

Of course, if it really is your grandchild, the Assessment needs to include demanding the location, saying you will do nothing until you get there (you may need weapons; that is a different discussion).

The last ten pages of the book is a collection of lists of "ten tips" on various subjects covered in the text. This alone makes this a good reference book to keep on hand. I know I need to do so. From a first reading, all I can gather is some impressions, and a few tips and techniques like those above. I need to re-read some parts.

I was motivated to revise my scheme for creating passwords. Carrying it out will take a few days; I have a lot of accounts! I don't want to use a biometric passkey because I already know of two men who could probably fool a biometrics face-print; in both cases, the man and I have been mistaken for one another several times. How many others are there? I am not distinctive enough!

Get this book. Read it right through. Then go back more slowly over parts that pertain to your life. Keep it handy as a reference. It's well written, so reading it is pleasurable, if sometimes a bit scary.

Resources cribbed from the Tips section:

• Federal Trade Commission: https://reportfraud.ftc.gov/
• Identity Theft concerns: https://www.identitytheft.gov/
• Author's newsletter: https://ericoneill.net/newsletter/ - free subscription

Spycraft for us all

kw: book reviews, nonfiction, do it yourself, spies, survival

Espionage is quite exciting to many people. My mother loved spy stories, the more sensational, the better. She had paperback copies of everything by John le Carré, Ian Fleming, and others. She did have sufficient self-control to wait for a book to be released in paperback; beyond that, she was rather compulsive about it!

This "hobby" of hers proved useful in an interesting, and sad, way a few years before she died. After the age of 60 she was afflicted with Alzheimer's Dementia, and it progressed steadily for the following 20 years until she died. She was in the hospital, having had a cancer operation. My brother went to see her, and before he got to her room he found her, in her hospital gown, sneaking out of the hospital. She had pulled out her IV and other tubes. If you don't already know, now is the time to learn it: Anyone with a tendency toward dementia gets delusional for a few days (or longer) after being anesthetized.

My brother asked Mom what was going on. She said, "I'm a prisoner here. They are trying to get me to tell secrets. So many questions!" He wisely jumped right into her world and said, "No, you are here to gather information. Your case worker cannot be seen in this facility, so I am the go-between." He led her back to her room and took the little note pad hospitals often supply like hotels do, saying, "Observe their comings and goings, and the things they ask you, and write it all down." I'll check with you daily and take your notes so you don't get caught with them. She was happy as a clam! She enjoyed her spy role for the next several days until she could be discharged and return home.

This is a good principle when we have delusional relatives. Constantly correcting them just annoys them, and is a significant reason that many become uncommunicative or stop speaking entirely. They don't live in the same world you do any more. Learn what makes them happy in their world, and foster that. Keep them happy, and keep them talking about things they like.

But we are here to talk about spycraft that can be applied to us all. Former CIA officer Jason Hanson has gathered many genuine spy stories (totally different from Hollywood or Fleming!), and uses them as the backdrop for very useful advice, in Survive Like a Spy. This is not his first book on the subject; a few years ago he produced Spy Secrets that can Save Your Life.

Do you think of a spy as a secretive, paranoid person, flitting through the shadows and occasionally fighting some enemy to the death? It is the job of spymasters the world over to minimize or eliminate such scenarios! I think of three lessons that I find important:

1. A spy is very social. He or she makes friends everywhere. Spies tip well, but not ostentatiously, at hotels, restaurants, taxicabs. They cultivate every relationship, gaining credit with as many people as possible, because you never know who can help you out at a critical time. In one of the stories, an operative was at a social function where he was friendly with the host. He was tasked with protecting a brilliant scientist who could be subject to kidnap. Sure enough, he soon saw a few men there who were keeping very close watch over the scientist, obviously looking for a chance to apprehend him. The operative asked the host if he knew where those men's cars were parked; it wasn't hard to find out. Then he partly revealed his role and asked the host to order the cars to be towed away! Realizing the gravity of the situation, the host readily agreed. Soon an announcement was made that cars with such-and-such license numbers were being towed away, and the baddies abruptly left the party.
2. Situational awareness is critical. You never know when a problem may erupt, anything from an argument to a fight to a bombing or gunfire. We hope we never see such things, but we sometimes have a sense that something is afoot. It is best to be observant, and if things seem "off", we shouldn't be shy about gently removing ourselves and those with us from the situation. I know it seems like a wet blanket to be always on alert when all you want to do is relax and have fun. But many times, getting a "spidey sense" that trouble is likely has led not only spies, but folks of all kinds, to "be elsewhere" when the trouble erupted. Also, and this ties into the former point, one story is of an officer who had just finished dinner, and the waiter nervously asked him if he wanted dessert. He began to demur, but the waiter urged him. So he ordered dessert, and then asked the waiter if there was a reason for his jitteriness. The waiter leaned close and told him that another waiter had gone out to tell local muggers that there was a well-to-do American who might soon leave the restaurant. He was kept from being mugged by being observant of the waiter's "spidey sense".
3. Learn if you are being followed by planning a surveillance detection route (SDR). It is good to know several ways to get home (or anywhere else you go frequently), and to vary them, as randomly as you can. It is equally good to be aware of who might be following you. This is harder on foot than when driving, because your car has rear-view mirrors. If any car seems to follow you through more than two turns, make the next turn away from your destination, particularly if it is an illogical direction. If the car follows, then you need to know the location of the nearest police facility and go there. That is safer than trying to "shake the tail", which is harder than you think. My parents went to a good restaurant in a sketchy part of Los Angeles; they were in their seventies. They drove straight home and parked in the driveway. Mom got out to get the mail and Dad was getting his keys ready to open the door of the house. A car pulled up and a young man with a gun jumped out and told them, "Stick it up!" They both began screaming and Mom threw the mail at him. He got flustered and left. That won't always work! Had they taken a more "scenic" drive home, the situation may not have happened at all. When walking, it is good to know the area, and to purposely stop in to this or that boutique or café, particularly because turning to go in a door gives you a chance to look behind you without seeming obvious. There are a lot of added tips in the book, including knowing a safe "hunker down" site where you can wait out a tail. This can take hours.

Many of us lead remarkably safe lives…but not all. And we don't all stay in the safest areas all the time. It is not paranoia to understand that there are people out there who really might have it in for us. We do well to remember the Scout Motto, "Be Prepared." We may never need to use spy skills to survive, but learning them is interesting and can save us trouble, and perhaps save our life.

By the way, I learned a little more: A CIA officer is called an "operative", not an "agent. An agent is the foreign national that an operative cultivates into a source of information that is needed by the U.S. government. In official communications, an agent is also usually called an "asset", but is not the only kind of (human) asset.

Also, while we are on the subject, human intelligence (HUMINT) is usually the most reliable, but there are many others. The internet opens up several new ones. One symptom of that is this kind of statistical page that Google supplies, which I check from time to time to see if the Russians are watching. Hi, Russkies! I see you seeing me. I hope you are having fun! I wonder if they show up in the CNN or Huff Post blog statistics…or if those folks even care.

Illustrating the value of HUMINT

kw: book reviews, nonfiction, counterintelligence, spies, terrorism, memoirs

My first exposure to Muslims was in graduate school, where many classmates were from Iran and Saudi Arabia. I guess that makes sense for a graduate program in Geology. My collecting partner the first two years was an Alaskan who had married a woman from Iran and had converted to Islam. We didn't talk much about religion, mainly because the branch of Shi'a to which he belonged was not particularly evangelical. But I did observe him and his co-religionists, as I suppose he observed me, as it was known that I led a small church. One particular event has stuck with me.

We had returned from a day in the field, and happened to meet two Iranian men in the lab. He cheerfully greeted them, "As salamu alaykum!" One remained silent, and the other, almost shamefacedly, mumbled the standard Arabic response. I am familiar with such things. Converts to a faith are typically more ardent than "old hands" who have been brought up in it. Those guys would probably defend Islam to the death, but were only glancingly observant in their daily life. They were the Islamic version of "nominal Christians".

There is another characteristic of religious conversion. After a number of years, or a decade or two, one who was converted as an adult is somewhat likely to re-convert, either to a different faith, or back to the former one. While most converts retain their new faith their whole life, a significant number do not. Having been "elsewhere" for their formative years, they are more open to different ideas.

In the case of Morten Storm, his conversion to Islam at age 20 was rapid and almost a shattering experience. He'd been quite a troublemaker, in and out of jail in his native Denmark. But he developed a conscience and became disaffected with gang life. He read about Islam in a local library book and was entranced. He plunged into his new faith, and was soon radicalized, even traveling to Yemen, both to learn Arabic and to live among the most devoted Muslims he knew of. He initially followed Salafism, which is comparatively peaceable. His progress into fully radical Islam, and later disaffection with it, to the point of working for three Western intelligence agencies, are revealed in Agent Storm: My Life Inside Al Qaeda and the CIA, written with Paul Cruikshank and Tim Lister.

Islam is not the monolithic entity Westerners tend to see. There are "denominations" that compete strongly with one another. The competition and even hatred within Islam got to Storm's conscience, and after ten years, shortly after being questioned by an agent of the Danish intelligence agency PET, he contacted them and began a near-decade of living a double life. He tells of his association with many radical leaders in Yemen, Denmark, London and elsewhere. The core of the drama is work that led to the killing of Anwar al-Awlaki in 2011.

Morten Storm had considered Awlaki a friend, in spite of his disgust with Awlaki's plans to terrorize civilians, and felt guilty over his death. He was at that time working with both the CIA and PET and MI6. The Americans drove the assassination, against the objections of the Danish and British agents. They'd promised Storm quite a reward for his work, but cut him loose right afterward, claiming they had used other channels to reach Awlaki, not him. He had the documentation to prove them wrong, but they ignored him.

I have read a number of memoirs of former CIA "overseas assets", who were all treated shabbily. The CIA has a pattern of courting an "asset" very diligently (and expensively) but later dropping the ball, leaving him dangling. Such cavalier behavior has a lot to do with the CIA's poor reputation in the spy world.

However it happened, Storm had a third conversion, so to speak. He actually made one more go at helping PET against other al Qaeda leaders who still trusted him, so much so that MI6 and the CIA regained interest. But he was warned by another "asset" that the CIA was planning to allow him to be killed along with their next target. This may or may not have been true, but he was sufficiently distrustful that he decided to get out of the spy business. That is no easy task, and his last chapter is titled "A Spy in the Cold", indicating that neither CIA nor MI6 nor PET did anything to rehabilitate him or even offer him protection.

In the epilogue, we find that he had to rehabilitate himself. Somehow, he managed. The street kid from Denmark had the street smarts to record key conversations, which probably kept the various agencies at arms' length. All the spy agencies have been remarkably slow at recognizing the power of the phone in everyone's pocket. His co-authors simply state that he now lives in "an undisclosed location". May it remain undisclosed.

Spy life like you've never seen it

kw: book reviews, nonfiction, espionage, spies, biographies

In 1998, Bill Powell caught a tiger by the tail, but he didn't know that at first. As a Newsweek reporter in Moscow, he had become accustomed to all sorts of cranks and hard-luck stories walking in and looking for help, or at least a friendly ear. When a fit, conservatively-dressed man of about 50 came to see him, he almost brushed him off. But this man claimed to have met Powell's predecessor while in a prison camp for treason. Powell was intrigued and let him talk, and continued to meet with him. The story took several years to play out.

The plotline of Slava Baronov's life was twisty and complex, but the core of the story was simple. He'd been a colonel in the GRU after serving as a military pilot; while in Bangladesh he grew sufficiently disenchanted with the pervasive lies of the USSR's leaders that he allowed himself to be recruited by the CIA; during the "courtship" prior to "signing on", information he provided about the black box aboard the KAL 007—its survival was never admitted by the USSR—became the only substantive work he ever did for them; soon afterward he found himself out of contact and effectively dangling in the wind. He was arrested by the KGB, tried for treason, but this was now the new Russia, the old USSR was gone, so he didn't get the customary bullet to the head but an actual trial. He concluded he'd been betrayed by someone in the CIA, and this was a few years after Aldrich Ames had been exposed, so what he wanted was twofold: to help the CIA and FBI find the mole, and to find out what really happened, why he was treated so badly.

Against the urging of his wife, and with only grudging permission of his Newsweek superiors, Powell got deeper and deeper into the matter, eventually becoming an intermediary between Baranov and the US government. Powell made it clear he planned to write the story once it had played out, which helps explain why he was not forced into becoming a CIA agent himself. The book that resulted is Treason: How a Russian Spy Led an American Journalist to a U.S. Double Agent by Bill Powell.

If I go further, I'll spoil it. You'll need to read to what extent Baranov was eventually vindicated, and how the CIA atoned. It is a fascinating book.

This agent always gets his ghoul

kw: book reviews, fantasy, mystery, spies

It has been nearly fifty years since I read through my mother's collection of James Bond books. I guess that is time enough to warrant various parodies and other takeoffs of Ian Fleming's superspy. Simon R. Green's favored genre is supernatural horror with mystery mixed in, so his latest series, as yet untitled, places erstwhile members of the Bond family in such a setting. The Spy Who Haunted Me is the third in this series, which has titles that echo Fleming's.

Green borrows other tropes, including the name of his protagonist, Edwin Drood, from Charles Dickens's last, unfinished novel. The earlier Drood is the victim of a rather inept murder plot. This Drood is a force to be reckoned with. His cover name, Shaman Bond, and references to his famous "uncle James", establish the other connections.

The setting: Six secret agents, including Drood/Bond, are enticed into a sort of scavenger hunt through five seemingly unsolved mysteries, including Loch Ness and Roswell, New Mexico. The prize? The secrets of the most famous Independent Agent of them all, Alexander King, a failing nonagenarian.

In the world of this series, humankind is at risk from all the fantastic dream creatures we've imagined over the millennia, and more, including 53 kinds of space aliens (until a 54^th shows up). The Droods, a large clan either gifted with second Sight, or so endowed by courtesy of a torc, a special amulet and necklace they wear, take on the challenge of protecting humanity from all of them. Magic has its place alongside science, and its facile use is a requirement for the Droods and several other classes of protective agent, even some CIA operatives.

It is really hard to say more without giving away too much. Half a century ago, I found Ian Fleming too enamored of sadism and graphic sex; reading him was less enjoyable than it might have been. Simon Green has fewer flaws, and is a better writer, with some rather cool ideas, even if many of them are treated like a magician's rabbits, pulled one after another out of a hat with little logic to hold them together. Fun escape literature.