About Me

Matthew Wollenweber

Matthew Wollenweber
Matthew Wollenweber is a Sr. Consultant at Foundstone. He has years of experience doing Penetration Testing, Red Team ...

Read More

Feeds & Podcasts

Blogs

Meet the Bloggers

Archive

Tags

#SecChat $1 million guarantee 12 Scams of Christmas access to live fraud resolution agents Acquisition Alex Thurber Android antivirus Apple botnet Channel Partners cloud security Compliance Consumer counter identity theft credit card fraud and protection credit fraud alerts credit monitoring credit monitoring and resolution critical infrastructure Cyber Security Mom cyberbullying Cybercrime cybermom data breach data center data center security Data Protection Dave DeWalt DLP Email & Web Security embedded encryption Endpoint Protection enterprise facebook fake anti-virus software Family Safety Friday Security Highlights global threat intelligence google government Hacktivism how to talk to kids how to talk to teens identity fraud identity fraud scams identity protection identity protection $1 million guarantee identity protection fraud identity protection surveillance identity surveillance identity theft identity theft expert identity theft fraud identity theft protection identity theft protection product Identity thieves and cybercriminals intel iphone kids online behavior lost wallet protection malware McAfee McAfee Channel McAfee Family Protection McAfee Identity Protection McAfee Initiative to Fight Cybercrime McAfee Labs McAfee security products Mid-Market Mobile mobile malware mobile security monitor credit and personal information Network Security online personal data protection online safety Operation Aurora PCI personal identity theft fraud personal information loss personal information protection phishing privacy proactive identity protection proactive identity surveillance Public Sector restore credit and personal identity Risk and Compliance scam scams scareware security smartphones social media social networking social networks spam Stuxnet twitter vulnerability Web 2.0 work with victim restore identity

Cyber Jihad Isn”™t Here Yet

Friday, November 9, 2007 at 1:33pm by Matthew Wollenweber
Matthew Wollenweber

There’s a lot of hype circulating around about a Jihad application meant to wage cyber war in the near future. A lot of people have speculated and while the experts are dismissive, the topic is still getting a lot of press and worrying average users. I took a bit of time to examine the binary and I don’t believe it poses a huge threat. Here are my reasons why:

  1. The program is written in Visual Basic. While there’s nothing wrong with that, VB is not the preferred programming language of very many professionals. C\C++\C# would tend to be better choices for complicated and efficient programs. VB tends to be a language for quick applications or for those beginning programming.
  2. There is a tracking website required to use the application. Terrrorists don’t like to be tracked. Further, the site tracks referrals – thus it would be trivial to create cliques of users, which again is something terrorists would be desperate to avoid.
  3. The website variables are in English. Extremists/Islamic Jihadists tend to not speak English, remember all the stories about the few English speakers they use? These guys have some understanding of English – indicating they might not be the stereotypical terrorist.
  4. The web url is hard coded and it’s to a real web server. We’re in an age of dynamic dns and fast flux. A static/real url is very amateur and easily blocked.
  5. There didn’t appear to be capability to dynamically update the program remotely – this would be key for updates and avoiding being blocked. I did a VERY QUICK analysis, but didn’t see this capability.
  6. The executable wasn’t encrypted and didn’t fight malware analysis – real malware writers love to do malicious things to AV guys. They weren’t in this executable.
  7. The webserver had frontpage extentions – this again just seems out of place for cyber war.

All told, the little bits of analysis make the code look to be written by high school or early college kids. If their network gets large enough, maybe they could have caused harm. Right now the websever isn’t working and the app seems like a no-go. I’d suggest everyone block traffic to the server http://al-jinan.net and stop worrying.

Bookmark and Share

Submit your own comments / message for this post

Your email is never published nor shared. Required fields are marked *

 

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Comments (10)

  • 1389 November 24, 2007 9:42AM

    You’ve provided a good explanation of why al Qaeda’s malware jihad is a dud. I’ve updated this blog post to link to your article:

    al Qaeda Declares Internet Jihad Starting November 11, 2007

  • Matthew Wollenweber November 14, 2007 6:58AM

    Apologies, I didn’t mean to start a fight about which programming language is better than another. In my opinion each has it’s own place. I can code in VB and I’ve used it many times.

    I won’t get into a flame war with you guys. However, there’s a rational discussion in here if you want it. First, VB is a very powerful language. However, the bar to start righting graphical, internet driven programs in VB is significantly less than it is to do the same in C/C++. Simply put, someone with less experience can more quickly produce a more featureful program. Clearly, none of this is a negative.

    From my personal experience, I’ve seldom seen performance oriented software written in VB. To me, performance, is key in a DoS application — you want it to dump as much data as you can. True, VB supposedly compiles down to the same binaries as MS Visual C++, but that’s fairly recent. Likewise, I’ve found the syntax difficult to scale into large projects. Finally, I’ll say that I’ve never seen many examples of writing raw packet tools in vb. I’m sure it can be done, but it’s far more common in other languages.

    So again, apologies for anyone that feels I insulted VB. That wasn’t my intention. Personally, I’m fairly language agnostic. But, I do stick by my analysis of the tool. It wasn’t very sophisticated or modular. It didn’t appear that it could upgrade the feature set easily. Ultimately, no apparent attack happened. Some combination of the tool and/or planning appeared inadequate — which fits with my analysis.

  • john of sparta November 13, 2007 3:27PM

    C+ was my English grade.
    VB is Virginia Beach.
    what code?
    those are my bonafides.
    the “killer app” here is Phase One. (Kos’s opening salvo).
    could it be a “shake-down cruise”? try it to see what happens and then refine. how about a diversion?
    or even worse, a “plant”. eliminate the talkers.

    the threat has always been there.
    when would the threat become real and succeed?
    stay tuned.
    same Bat Time, same Bat Channel.

  • sfcmac November 13, 2007 1:57PM

    All the nitpicking over computer language and programming aside, doncha think if the ‘cyber jihadists’ were that hellbent and capable of blowing the internet to smithereens, they would have done so already?

    Sheesh.

  • FreedomNeocon November 13, 2007 7:56AM

    RTOFL… looks like the author hurt the feelings of some terrorist / jihadi sympathizers (aka anti-war liberals, 60s retreads desperately trying to ‘matter’)

    That or the actual clowns who wrote the thing defending their buffoonish amateur work.

    Seriously… the comments sound like people trying to promote some new product (it will get better, just wait and see!), rather then commenting on a malicious piece of software “supposidly” written by a bunch of thugs and murderers.

    I say supposidly, because the thing honestly appears to be a middle-school “intro to programming” joke. Its THAT BAD. Might as well be “10 goto 10″

  • Smaack November 13, 2007 7:38AM

    Um… why would you be showing them the shortcomings of their design? Are you gonna volunteer to re-write it for them next?

  • mcgurk November 13, 2007 6:25AM

    Wow, the commenters are a bunch of dicks, aren’t they? The review seems pretty clear cut and reasonable. A cursory investigation of the program reveals signs that its pretty amateurish, easily countered, and not that big a deal. You don’t have to be a September 10th-er to believe this is possible. While cyber-jihadism is real and ongoing (youtube is full of jihadi propaganda), this “hacker” program is largely a creation of media hype. It appears as if the program is more valuable as propaganda than as a DDOS tool. Its not surprising. The jihadis are a pretty fucking stupid bunch of twats. They can pull a trigger, press a butan and receive paradise, and film themselves while sawing off heads, but that’s about it. I mean, look, VB? Get the fuck outta here.

  • mg November 13, 2007 3:01AM

    “… C\C++\C# would tend to be better choices for complicated and efficient programs. VB tends to be a language for quick applications or for those beginning programming.”

    What a maroon. Could you be any more clueless? C# is .net managed and so is VB (version after 6). Both ‘compile’ to the same executable. You seem to be too busy getting stuck on stupid in your efforts to talk down VB.

    If you had listed C/C++ and maybe added assembly, then you could have made a valid point about the sophistication of the binary

  • Kostyakostmi November 12, 2007 11:19PM

    Good grief. What a load of condescension on your part. Not very security minded or forward thinking, are we?
    1. “VB is not the preferred programming language of very many professionals. C\C++\C# would tend to be better choices for complicated and efficient programs.” So what? Jihadis like to hit and run. Simple, swift, and functional with as much collateral damage as possible is perfect.
    2. “Terrrorists don’t like to be tracked. Further, the site tracks referrals – thus it would be trivial to create cliques of users, which again is something terrorists would be desperate to avoid.” True enough, however, ever hear of blind sites? how-about “freaking”, where you jump onto other peoples networks and sites and jump out again, with little thought for the other guy. Gee, that sounds Jihadish.
    3. “Extremists/Islamic Jihadists tend to not speak English, remember all the stories about the few English speakers they use?” Not only is your head in the sand, but it must be up something else. Besides the obvious dolt speak, if you learn code you don’t need English, dufus. Knowledge of English did not stop 19 Islamonazi martyr boys from commandeering 4 jumbo jets and smashing them and their contents (people-real people) into things. They will learn what they need to learn to blow you and your neighbors cat into the next lifetime. Think, please.
    4. “A static/real url is very amateur and easily blocked.” These guys count on spread. The more junk you throw the more potential damage. They don’t give a rat’s tail about “slick”. Only you care about that, and THAT is what they hope you are concerned with. THINK!
    5. “rontpage extentions – this again just seems out of place for cyber war.” Look, for brevity I’m going to skip the rest of your curlish drivel. Has the thought ever occurred to you that this might just be the opening salvo? So what if they’re amatures? So what if they’re high school AV geeks? Don’t discount them. Two kids with guns and internet Goth ramblings terrorized suburban Colorado. Another solo nutter shot-up Virginia Tech, and you still want to brush this off?
    God help us all. And remind me not to call on you to save my chestnuts. WAKE -UP! Stop whacking-off on World of Warcraft, and start planning a strategy about “Whack-a-Jihadi”.

  • Beckwith November 12, 2007 3:34PM

    Just what the world needs, another propeller-head that has appointed himself critic. Remember, nobody asked him — he just volunteers his arrogant opinion — and you know what they say about opinions.

    A skilled VB programmer can produce the exact same product as a skilled C++ programmer — this is petty programmer bias..

    I would like to point out that it is easy to criticize any software product.

    I would also loke to point out that this is undoubtedly an early version — it will get better.

    This statement, “All told, the little bits of analysis make the code look to be written by high school or early college kids,’ is nothing more than bad manners.

    Go back to your cubicle.