Yesterday, several Twitter accounts were announcing a manual with the name ISIS OPSEC outlining the terrorist group's cyber security practices. The leaked document is translated and describes various technical details recommended by the group to its new members.
While we initially thought that the ISIS OPSEC manual was revealed by the recent Anonymous campaign against ISIS members, it appears that the US military knows and studied the document some time ago.
The Center for Combating Terrorism at the West Point Military Academy has the document since last year, and as experts say, it was written by Kuwaity Security Company to help journalists and political dissidents living in the Gaza Strip.
The original OPSEC document is written in Arabic (there is) and is supposed to help those who use it to avoid detection by the secret services of Israel.
Obviously, the ISIS members acquired the document, presented it as theirs and began to distribute it to their new members.
The content of the manual contains basic safety tips designed to help beginners maintain low profile and avoid detection by secret services.
The ISIS OPSEC manual details a number of services, Appliances and apps that are allowed or banned.
Thus ISIS members can use:
● Twitter (via HTTPS or SMS)
● Tor Browser
● Aviator Browser
● Opera Mini Browser
● Photo GPS Editor (iOS app, remove geolocation data from photos)
● Cryptophone (encrypted phones)
● BlackPhone (encrypted phones)
● FireChat (IM client, connectivity issues)
● Tin-Can (connectivity issues)
● The Serval Mesh (connectivity issues)
● Freedome (VPN)
● Avast SecureLine! (VPN)
● TrueCrypt (on-the-fly data / disk encryption)
● VeraCrypt (on-the-fly data / disk encryption)
● BitLocker (Windows built-in, on-the-fly data / disk encryption)
● Hushmail (email provider)
● ProtonMail (email provider)
● Tutorial (email provider)
● Threema (encrypted IM client)
● Telegram (encrypted IM client)
● Suripot (encrypted IM client)
● Wickr (encrypted IM client)
● Cryptocat (encrypted IM client)
● PQChat (encrypted IM client)
● Sicher (encrypted IM client)
● iMessage (encrypted IM client)
● Linphone (encrypted VoIP)
● Swisscom (encrypted VoIP)
● Silent Circle (encrypted VoIP)
● RedPhone (encrypted VoIP)
● Signal (encrypted VoIP)
●Apple FaceTime (encrypted VoIP, audio & video)
● MEGA (cloud storage)
● SpiderOak (cloud storage)
● SugarSync (cloud storage)
● Copy.com (cloud storage)
On the blacklist, the manual lists apps and services like Facebook, Instagram, WhatsApp, and Dropbox.
The manual is supplemented by a help desk that operated on 24 basis via the Telegram. The help desk was closed a few days ago.
IS-Encryption-Guide
IS Encryption Guide by AlyssaBereznak
