[ISN] Militants wire Web with links to jihad

From: InfoSec News (isnat_private)
Date: Thu Jul 11 2002 - 04:00:56 PDT

  • Next message: InfoSec News: "[ISN] Security UPDATE, July 10, 2002"

    Forwarded from: William Knowles <wkat_private>
    [As I was reading this, I could hear the muffled chants of the Vikings 
    in the corner of my home office singing "FUD, fud, fud, fud, lovely 
    fud, lovely fud, fud, fud, fud..."   -  WK]
    By Jack Kelley, 
    ISLAMABAD, Pakistan -- One Web site urges Muslims to travel to
    Pakistan to "slaughter American soldiers." Another solicits donations
    to buy dynamite to "blow up Israeli Jews." A third shows new videotape
    of Osama bin Laden and promises film clips of American casualties in
    Afghanistan. As the United States and its allies hunt them in caves,
    mountains and jungles, al-Qaeda, Hamas and dozens of other militant
    Muslim groups are increasingly turning to the Internet to carry on
    their jihad, or holy war, against the West, U.S. law enforcement
    officials and experts say. It has become one of al-Qaeda's primary
    means of communication, they say. The groups use Web sites to plan
    attacks, recruit members and solicit donations with little or no
    chance of being caught by the FBI or other law enforcement agencies,
    officials say.
    This new cyber-battlefield is allowing al-Qaeda and other groups to
    stay "several steps ahead" of the U.S.-led war on terrorism, a senior
    U.S. law enforcement official says.
    Most of the information on the Web sites is written in Arabic and
    encrypted, or scrambled. The encrypted data is then hidden in digital
    photographs, which makes it difficult, if not impossible, to find or
    read, officials say. The groups regularly change the addresses of
    their Web sites to confound officials.
    "Under the present circumstances of the global war against terrorism,
    the Internet has become a vital tool and, obviously, an easy one to
    exploit," says terrorism analyst Reuven Paz of the International
    Policy Institute for Counter-Terrorism, an independent think tank
    based in Herzliya, Israel. It's "the most efficient way (for
    terrorists) to spread their message on a daily basis."
    U.S. officials have little doubt that al-Qaeda and other militant
    groups are using the Web to set up terrorist attacks against the
    United States. They tell USA TODAY that Abu Zubaydah, 30, a
    Palestinian who was arrested in Pakistan last March and is suspected
    of being bin Laden's operations chief, used a Web site to plan the
    Sept. 11 attacks and to communicate with the terrorists who hijacked
    jets and flew them into the World Trade Center and Pentagon.
    Earlier this year, officials say, they found nearly 2,300 encrypted
    messages and data files in a password-protected section of an Islamic
    Web site that had been downloaded onto Zubaydah's computer. The
    messages began in May 2000, peaked in August 2001 and stopped Sept. 9,
    two days before the attacks, officials say. They declined to identify
    the Web site.
    Volume of messages doubles
    Lately, al-Qaeda operatives have been sending hundreds of encrypted
    messages that have been hidden in files on digital photographs on the
    auction site eBay.com. Most of the messages have been sent from
    Internet cafes in Pakistan and public libraries throughout the world.  
    An eBay spokesperson did not return phone calls.
    The volume of the messages has nearly doubled in the past month,
    indicating to some U.S. intelligence officials that al-Qaeda is
    planning another attack.
    Tuesday, al-Qaeda spokesman Suliman Abu Ghaith told an Arabic
    newspaper that the group's suicide militants were "ready and
    impatient" to attack U.S. targets in America and around the world.
    Since Sept. 11, the FBI, CIA and National Security Agency say they
    have hired dozens more Arabic-speaking analysts and mathematicians to
    interpret and decode the information on the Web sites.
    They add that there's little they can do to stop the terrorist groups
    from using the Web to communicate. There are no laws directly
    regulating the sites or preventing them from operating. Instead,
    officials must persuade the companies that host the sites to shut them
    down. But as soon as a terrorist site is taken off one Web server, it
    often appears on another, officials say.
    In the past five weeks, al-Qaeda's Arabic Web site, alneda.com, has
    emerged on three different servers, in Malaysia, Texas and Michigan.  
    The site was eventually removed from the servers after the Web hosting
    companies, which say they often don't screen or translate the sites,
    received complaints from the public and law enforcement agencies. U.S. 
    officials are expecting the site, which began operating in January,
    to re-emerge soon.
    "The U.S. enemy, unable to gain the upper hand over the mujahedin on
    the battlefield, has since Sept. 11 been trying to gag the world
    media," said a statement posted on alneda.com last week. "The more the
    United States tries to stifle freedom of expression, the more
    determined we will become to break the silence. America will lose the
    media war, too."
    Hatred, hidden messages
    There are dozens of suspected terrorist Web sites, many of which were
    started after the U.S.-led war on terrorism began last fall. Most of
    the Web sites are written in Arabic. All carry statements that express
    hatred for the United States and its allies and fatwas, or religious
    rulings, that call on militant Muslims to kill Americans and attack
    U.S. interests. USA TODAY examined many of the sites and had the
    information there translated from Arabic into English. Among the most
    prominent sites:
    * Azzam.com, a site that U.S. officials believe is linked with
      al-Qaeda, is urging Muslims to travel to Pakistan and Afghanistan
      to fight "the Jewish-backed American Crusaders," or U.S. soldiers.
      It gives such travelers tips on how to avoid raising suspicions of
      employers, diplomats and police.
      "If you are working, either resign from your job and take a year off
      or request unpaid leave from your employer. Many large companies
      offer unpaid leave to their employees for periods ranging from two
      months to one year. That way you can fulfill your obligation (of
      jihad) and not have to give up your job," the site says.
      U.S. officials say azzam.com contains encrypted messages in its
      pictures and texts  a practice known as steganography. They say the
      hidden messages contain instructions for al-Qaeda's next terrorist
      attacks. Mathematicians and other experts at the National Security
      Agency at Fort Meade, Md., are using supercomputers to try to break
      the encryption codes and thwart the attacks.
      At least one known al-Qaeda operative has accessed the site,
      European officials say. German intelligence agencies, which broke
      into the site last fall, found an e-mail address for Said Bahaji, a
      suspected member of the al-Qaeda cell in Hamburg, Germany, that
      planned parts of the Sept. 11 attacks. Bahaji, who was last seen in
      Germany, has since disappeared.
    * Almuhajiroun.com, an English-language Web site also linked to
      al-Qaeda, urges sympathizers to assassinate Pakistani President
      Pervez Musharraf. The Web site, which pictures Musharraf, refers to
      him as "the American puppet." It calls U.S. troops in Pakistan and
      Afghanistan "soldiers of Satan."
      "The punishment of those who wage war against Allah and His apostle
      and strive to make mischief in the land is only this: that they
      should be murdered or crucified or their hands and their feet should
      be cut off on opposite sides or they should be imprisoned," the site
      says in apparent reference to Musharraf.
    * Qassam.net, a site U.S. officials believe is linked to the militant
      Muslim group Hamas, is appealing for donations to purchase AK-47
      rifles, dynamite and bullets "to assist the cause of jihad and
      resistance until the (Israeli) occupation is eliminated and Muslim
      Palestine is liberated." It recommends donations of $3 per bullet,
      $100 per kilogram (2.2 pounds) of dynamite, $2,000 for a Kalashnikov
      assault rifle and $12,000 for a rocket-propelled grenade.
      Donors are asked to send an e-mail to an address on the Web site.
      Recently, they received a response telling them to transfer money to
      "Ahmed Mohammed Ali, Elbatech Bank, account no.: 38926/9/510 Arab
      bank - Gaza branch - Palestine." The account name and number appear
      to change every 48 to 72 hours. "Dear Donor: Please tell us the
      field in which you prefer your money to be spent on such as:
      martyrdom attacks; buying weapons for the mujahadeen; training the
      youth; or inventing and developing missiles, mortars (and)
      explosives," the e-mail said.
      U.S. officials say they are monitoring the site, which is hosted by
      an American company, to see who is using it to donate to Hamas. They
      say they intend to prosecute those Americans who contribute.
      Until the site was taken down, alneda.com carried a warning from Abu
      Ghaith saying the United States should "fasten its seat belt" and
      prepare for more terrorist attacks. The site, which featured the
      words "No pride without jihad," also contained encrypted information
      that directed al-Qaeda members to a more secure site where
      instructions for attacks were given, U.S. officials say.
    Other Internet sites, including jihadunspun.net, offer a 36-minute
    video of bin Laden, with four minutes of previously unaired footage;  
    pictures of President Bush with his head in the sights of a gun; and
    other propaganda.
    Not all the Islamic Web sites are calling for a jihad against the
    United States. The alsaha.com site has hosted chat rooms where members
    criticize bin Laden and al-Qaeda for their misuse of Islam. "(Bin
    Laden) is a disgrace to our religion and has made a mockery of
    everything we believe," said one comment posted on alsaha.com. "He is
    not an Islamist; he is a terrorist who deserves to be killed. God
    bless and protect America!"
    Easy to set up
    It's easy for terrorists to set up a Web site, officials and experts
    In the case of alneda.com, al-Qaeda members used a made-up name, "The
    Center for Islamic Studies and Research," a bogus street address in
    Venezuela and a free Hotmail e-mail account to contact a Web hosting
    company in Malaysia called Emerge Systems, U.S. intelligence officials
    say. The group then wired $87 to a Malaysian bank to pay for the cost
    of the Web site for a year.
    "Internet communications have become the main communications system
    among al-Qaeda around the world because it's safer, easier and more
    anonymous if they take the right precautions, and I think they're
    doing that," former CIA counterterrorism chief Vince Cannistraro says.
    But al-Qaeda operatives now are urging their members to use caution.  
    Just before alneda.com was pulled off its server, it warned its
    members that the site was probably being monitored by the FBI, CIA and
    Customs Service. It promised to e-mail members the new address of the
    Web site once it was in operation. It also told them they could find
    the address in chat rooms on other terror sites, such as Hamas'
    "We strongly urge Muslim Internet professionals to spread and
    disseminate news and information about the jihad through e-mail lists,
    discussion groups and their own Web sites," says a statement on
    azzam.com. "The more Web sites, the better it is for us. We must make
    the Internet our tool."
    "Communications without intelligence is noise;  Intelligence
    without communications is irrelevant." Gen Alfred. M. Gray, USMC
    C4I.org - Computer Security, & Intelligence - http://www.c4i.org
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Thu Jul 11 2002 - 07:33:59 PDT