hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
HP Security Research | Cyber Risk Report 2015IranIranIn HP Security Briefing Episode 11, 16 we presented our findings on threat actors operating withinthe Islamic Republic of Iran. Iran’s <strong>cyber</strong> doctrine pivots on the belief that “The <strong>cyber</strong> arena isactually the arena of the Hidden Imam” 17 and relies heavily on warfare tactics. 18 In November of2010, Iran’s Passive Civil Defense Organization announced a plan to recruit hackers for a “softwar” in <strong>cyber</strong>space. 19 On February 12, 2014, the Ayatollah Ali Khamenei delivered a messageto the Islamic Association of Independent University Students, instructing them to prepare for<strong>cyber</strong> war:“You are the <strong>cyber</strong>-war agents and such a war requires Ammar-like insight and Malik Ashtar-likeresistance; get yourselves ready for such war wholeheartedly.”The Ayatollah stressed that this was the students’ religious and nationalistic duty. 20 As notedin the <strong>report</strong>, Iran’s <strong>cyber</strong> landscape has changed significantly from 2010 to the present. Therewas a noticeable transition from Iran’s increasing awareness of <strong>cyber</strong> intrusions to the regime’sinstitution of defensive <strong>cyber</strong> capabilities. The focus then shifted to implementing strategicoffensive <strong>cyber</strong> capabilities. From the discovery of Stuxnet to the creation of a vast <strong>cyber</strong> army,Iran has made significant developments in the <strong>cyber</strong> war arena in a relatively short time. 2116http://h30499.www3.<strong>hp</strong>.com/t5/HP-Security-Research-Blog/HPSR-Threat-Intelligence-Briefing-Episode-11/ba-p/6385243.17http://www.memri.org/<strong>report</strong>/en/print7371.htm.18http://www.inss.org.il/index.aspx?id=4538&articleid=5203.19http://www.forbes.com/sites/jeffreycarr/2011/01/12/irans-paramilitarymilitia-is-recruiting-hackers/.20http://www.haaretz.com/mobile/1.574043.21http://h30499.www3.<strong>hp</strong>.com/<strong>hp</strong>eb/attachments/<strong>hp</strong>eb/off-by-on-software<strong>security</strong>-blog/177/1/Companion%20to%20HPSR%20Threat%20Intelligence%20Briefing%20Episode%2011%20Final.<strong>pdf</strong>.22http://www.webamooz.ir/home/%D9%85%D8%AF%D8%B1%D8%B3%DB%8C%D9%86-2/.23http://h30499.www3.<strong>hp</strong>.com/<strong>hp</strong>eb/attachments/<strong>hp</strong>eb/off-by-on-software<strong>security</strong>-blog/177/1/Companion%20to%20HPSR%20Threat%20Intelligence%20Briefing%20Episode%2011%20Final.<strong>pdf</strong>.24http://www.defenddemocracy.org/behrouzkamalian.25http://www.jpost.com/International/EU-to-discuss-sanctions-against-over-80-Iranian-officials.26http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:2011D0235:20130312:EN:PDF.27http://www.ict.org.il/LinkClick.aspx?fileticket=p02YcWmn_94%3D&tabid=492.28http://h30499.www3.<strong>hp</strong>.com/<strong>hp</strong>eb/attachments/<strong>hp</strong>eb/off-by-on-software<strong>security</strong>-blog/177/1/Companion%20to%20HPSR%20Threat%20Intelligence%20Briefing%20Episode%2011%20Final.<strong>pdf</strong>.29http://www.iran<strong>cyber</strong>news.org/2013/10/sharifuniversity-ctf-online-qualifier.html.30http://ctf.aeoi.org.ir.31http://shabgard.org.Our <strong>security</strong> <strong>research</strong> uncovered the following factors implying Iran’s indirect operationalinvolvement in the activities of the Iranian <strong>cyber</strong> underground:• Threat actor group Shabgard’s training portal at Webamooz.ir offered accredited IT training inconjunction with Shahid Beheshti University. 22• Threat actor group Ashiyane offered training in conjunction with the Sharif UniversityIT center. 23• According to the Iranian Republic News Agency, Ashiyane’s leader, Behrouz Kamalian,ordered the group to work for the Iranian government by attacking foreign government andmedia websites. 24• Behrouz Kamalian’s father, Hossein Kamalian, has served as the Iranian ambassador toThailand, Laos, Myanmar, Bahrain, France, and Yemen.• The European Union exposed Behrouz Kamalian’s involvement in human rights violations—namely his involvement assisting the regime with cracking down on protesters during the2009 political unrest in Iran. 25• The EU <strong>report</strong> also linked Ashiyane to Iran’s Revolutionary Guard. 26• A <strong>report</strong> from Israel’s Institute for Counterterrorism notes that it has been alleged thatAshiyane is responsible for training Iran’s Cyber Army (ICR). 27• Despite Iran’s strict laws regulating Internet access and content, Ashiyane members do notfear being held accountable for their actions. 28• Some of the threat actor groups profiled in the <strong>report</strong> use gamification as a trainingmechanism, including capture the flag (CTF) contests sponsored by Sharif University 29 and theAtomic Energy Organization of Iran (AEOI). 30It is interesting to note that HPSR Security Briefing Episode 11 had a significant impact on someof the threat actors profiled in the <strong>report</strong>. After nearly 11 years of activity, the website andforums for Shabgard are now defunct. 319