Sunday, October 18, 2020

QAnon: How a fringe internet phenomenon is now mainstream

This article is by

Share this article

Article Contributor(s)

Vanshita Banuana

Article Title

QAnon: How a fringe internet phenomenon is now mainstream

Publisher

Global Views 360

Publication Date

October 18, 2020

URL

QAnon supporter in a Trump Rally

QAnon supporter in a Trump Rally | Source: Tony Webster via Wikimedia

In the age of the internet, conspiracy theories come a dime a dozen. They can be shared with an unimaginably huge audience with extreme ease. Most conspiracy theories center around specific large-scale events, but sometimes they do end up centering around a person instead. This has been recently observed in a group of conspiracy theorists called ‘QAnon,’ who are essentially supporters of incumbent U.S President Donald Trump, and believe that he is on a mission to expose a global secret network of high-profile pedophiles (and also cannibals, depending on who you ask).

QAnon followers believe that Democratic party members such as Hillary Clinton and Barack Obama are a part of this group, along with Hollywood celebrities such as Oprah Winfrey and Ellen DeGeneres. It is even believed that religious leaders like Pope Francis and the Dalai Lama are also in this group.

What is QAnon?

QAnon is an umbrella term for a large set of theories and sub-theories. It is considered a ‘big tent conspiracy theory,’ which means that it is still evolving and adding more claims under its belt. The most pervasive and foundational claim is that of a global cabal of pedophiles, and that Trump’s sole purpose is to unmask them.

It all started in October 2017, an anonymous account calling themself “Q Clearance Patriot” posted the first message associated with QAnon, on a site called 4chan. Q claimed to be a high ranking intelligence officer who knew classified information about Trump’s “war” against the aforementioned global cabal. Q also claimed to predict something called “The Storm,” which refers to the time Trump finally exposes the cabal and brings its members to justice.

The event’s title, “The Storm,” was inspired by a remark made during a photo op around the same time the first post appeared on 4chan. While standing with military generals (who QAnon followers believe recruited Trump to run for President with the aim of destroying the cabal) Trump made a remark about “the calm before the storm.” QAnon followers consider this to be a message for them. There have been many predictions about when this storm will occur, as well as other predictions that later never happened, such as Republicans winning a large number of seats in the 2018 midterm elections. As is common among conspiracy theorists, they twisted the results to continue to fit their beliefs.

The person(s) behind ‘Q,’ as the original poster is known, remains unknown. After first appearing on 4chan Q’s posts bounced around on similar sites. These days the posts— known as “drops”— are posted on a site called 8kun. To date, Q’s posts total to around 5,000, and there are some apparently popular apps that collect all past and present posts in one place. They are usually cryptic and use initials or codes to refer to people, such as HRC for Hillary Rodham Clinton, and POTUS (President of the United States) for Trump. QAnon followers use many common social media platforms like Twitter and Discord to discuss the meaning of the Q Drops.

Other QAnon claims include: Robert Mueller’s investigation into Russia’s collusion with the Trump campaign was actually a cover for investigating Clinton and Obama while Trump only pretended to be involved with Russia in order to force a third-party investigation; the cabal is involved in pedophilia and child murder either because they’re satanists or being blackmailed by the CIA (take your pick)

What was President Trump’s response?

President Trump (L) with Vice President Pence | Source: History in HD via Unsplash

Trump is idolised in QAnon theory, and what he says is monitored as closely as what Q says, and similar to Q’s drops, QAnon followers see messages and codes in things ranging from what number Trump says to what tie he wears, and decode the meaning of these perceived signals.

Anyone who knows anything about Trump knows he is incapable of denouncing anyone who supports him regardless of the absurdity of, or dangers posed by their actions. When asked about QAnon, Trump stated that while he didn’t know much about QAnon, he understood that they “like me very much.” The reporter explained Trump’s role in the conspiracy as a saviour from pedophiles and cannibals, to which Trump replied, “Is that a good thing or a bad thing?” He added that he hadn’t heard about that, but was “willing” to help “save the world from problems” if he can. On top of that, whether he knows or not, he has retweeted content from QAnon supporters multiple times.

Public figures are also revealing themselves to be QAnon followers, such as Marjorie Taylor Greene, a Republican candidate in Georgia who promoted QAnon— and she’s not the only one, joining a small-town mayor who supported QAnon during a radio broadcast. She was backed by Trump, who reportedly called Greene a future star, and called QAnon followers lovers of their country. Greene supposedly has a good chance of being elected to Congress.

Why is this becoming mainstream now?

A QAnon supporting sticker in Brooklyn, United States | Source: Robby Virus via Flickr

The QAnon member base is not a small one by any means. A singular QAnon on one social media platform like Facebook can reportedly have hundreds of thousands of members. It also seems that due to increased Internet usage during pandemic related lockdowns and work-from-home, more and more people are coming to know about QAnon, thereby increasing the number of people who believe and take part in it. There is, apparently, even a recently established church based on QAnon rhetoric that holds sessions via Zoom, and works to indoctrinate people into QAnon through tools such as videos and discussions.

In terms of group dynamics, QAnon has been compared to puzzle games due to the intricacy of the plot it weaves with the help of members’ contributions. Creating a shared reality, a common phenomena among conspiracy theorists, turns a political forum into a social environment, thereby deepening a person’s connection to a conspiracy via that people that they meet in these groups and other social media interactions with QAnon followers.

Perhaps due to the activity of coming together to decode Q’s drops, QAnon followers are intensely involved in the creation of the conspiracy itself, which makes this a unique kind of conspiracy theory, despite many elements of it being those often seen in various older conspiracy theories.

QAnon followers have been making waves offline as well, with a murder and a threat of a murder being attributed to QAnon followers. The FBI considers that QAnon poses a potential threat of domestic terrorism. Photos of Republican rallies in which signs of the letter Q and posters about QAnon are visible are becoming more and more common.

Additionally, QAnon followers seem to be making a joint effort to infiltrate anti-trafficking movements, both online as well as by attending rallies. Many members of QAnon believe that the global cabal is made up of child sex-traffickers or child-eating Satanists, thus making it easy for them to use campaigns such as #SaveTheChildren to lure or recruit people into their ideology. They have also been linked to spreading misinformation about COVID-19 and Black Lives Matter on social media sites such as Twitter and Facebook.

QAnon is a conspiracy theory that combines old and new elements, and which is already causing real harm to people and social causes. What truly makes matters worse, though, is that fact that the person at the center of the QAnon conspiracy, Donald Trump, is just as unlikely to see reason as QAnon followers themselves.

Support us to bring the world closer

To keep our content accessible we don't charge anything from our readers and rely on donations to continue working. Your support is critical in keeping Global Views 360 independent and helps us to present a well-rounded world view on different international issues for you. Every contribution, however big or small, is valuable for us to keep on delivering in future as well.

Support Us

Share this article

Read More

February 4, 2021 5:20 PM

SolarWinds Attack and its implication for U.S. Security: Sabotage or espionage?

SolarWinds, a publicly listed Texas-based company with a value of more than $6 billion, has a very reputed customer list including multiple U.S. government agencies. The company develops softwares for businesses and agencies to help manage and monitor their networks, systems and  IT infrastructure. The company is a service provider to over 425 of the Fortune 500 companies, top 5 U.S. accounting firms, all major U.S. telecom providers, the U.S. treasury, several global universities and educational institutions, the NSA and the White House.

A set of hackers managed to sneak a malicious code into the software update of SolarWinds for a tool called “Orion”. Earlier, in 2020, the hackers had injected malware into the updates of Orion which were released between March and June of 2020. On 5th of Jan, 2021, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure security Agency (CISA), the Office of the director of National Intelligence (ODNI) and the National Security Agency (NSA) made an official joint statement stating, "an Advanced Persistent Threat (APT) actor, likely Russian in origin, is responsible for most or all of the recently discovered, ongoing cyber compromises of both government and non-governmental networks". U.S. government agencies like The Pentagon, National institute of Health, FBI, DHS, the Department of Energy and the Department of Veterans affairs were some significant users of Orion. In fact, in August 2020, the Department of Veterans affairs renewed its Orion license in a 2.8-million-dollar order. The Department of Veterans affairs has been heavily involved in COVID-19 relief.

The Orion hack began as early as March 2020. Over 18,000 customers had installed the compromised software which implies that these customers were vulnerable to spy operations throughout 2020. The malware inserted in the updates provided remote access of an organization’s network to the elite hackers. Since the malware was undetected for months, it gave the hackers an opportunity to obtain information from their targets. In fact, the hackers could also monitor emails and other internal communications. FireEye, the cybersecurity company who were the first to discover the breach describes the capability of the malware, from initially lying dormant up to two weeks, to hiding in plain sight by masquerading its investigation as “Orion Activity”. In 2016, Russian Military hackers used a method called “supply chain” to infect companies performing business in Ukraine with a hard-drive wiping virus called NotPetya. This attack is considered to be one of the most damaging cyber-attacks till date. The infiltration tactic used in the current hack is also identified to be similar to the “supply chain” method.

The Orion software framework contained a backdoor that communicated via HTTP to third party servers. Cybersecurity firm, FireEye has been tracking the trojanized version of Orion plug-in as SUNBURST.

FireEye Logo

FireEye described the use of SUNBURST backdoor on one of its blogs published on 13th December 2020. It stated,

“After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers.”

FireEye described the attack through the SUNBURST backdoor as “highly evasive”. Meanwhile, SolarWinds is facing a class action lawsuit filed by a stakeholder of the IT Infrastructure Management software company in the U.S. District Court for the Western District of Texas on 4th Jan 2021. The lawsuit is filed against SolarWinds’ ex-president, Kevin Thompson and chief financial officer, J. Barton Kalsu on the grounds of violating Federal Securities laws under Securities Exchange Act of 1934. The complaint states that SolarWinds Company failed to disclose that "since mid-2020, Orion monitoring products had a vulnerability that allowed hackers to compromise the server upon which the products ran". The complaint also mentioned that SolarWinds update server had a fairly weak and easily accessible password, ‘solarwinds123’.

Microsoft’s internal security research team found evidence that the same hackers had accessed some internal source code in their company’s systems. Microsoft mentioned that the attempted activities were beyond just the presence of malware SolarWinds code in their environment. Microsoft has “an open source like culture” which allows teams within Microsoft to view the source code. The company acknowledges that it is a threat model but they are downplaying the risk by saying “just viewing the source code should not cause any elevated risk”.

The Russian Hackers have also managed to breach the network of Austin City, Texas. The breach dates back to at-least mid of October 2020. The hackers have seemed to target the U.S. Treasury, Departments of Commerce and Homeland Security, The Pentagon, Cybersecurity firm FireEye, and SolarWinds. The breach of the network of the Austin city is an apparent win for Russian hackers. Theoretically, the compromise could have helped them access sensitive information in accordance with the city governance, elections, city police and by excavating deeper, the hackers can practically burrow inside energy, water and airport networks of the city.

Berserk Bear, the hacking outfit that is currently believed to be behind Austin’s breach appears to have used Austin’s network as grounds to stage larger attacks. Berserk Bear also known as BROMINE inter alia several names is believed to have been responsible for a series of breaches of significant U.S. infrastructures in the past year.

The attacks on SolarWinds, U.S. government and FireEye have been linked to another Russian group called APT29 also popularly known as Cozy Bear. Berserk Bear is allegedly a unit of Russian federal Security Service (FSB). Cozy Bear is known to be affiliated with the Russian Foreign Intelligence Service, or SVR. FSB and SVR are considered to be successors of the Committee of State Security of the Soviet-era which was widely known as the KGB.

The Austin Council seems to have been aware of the breach from October 2020. The FBI and CISA had published an initial advisory warning of “advanced persistent threat actors” (APTs) on October 9th, 2020. The advisory warned the city council of APTs targeting state and local governments. On October 22nd, a follow-up advisory was published in which both agencies accredited the breach to Berserk Bear. CISA published a heat map listing the types of organizations that were breached, scanned or targeted by Berserk Bear. The reputation of Berserk Bear of lurking fit their common pattern of espionage-oriented attacks. Sami Ruohonen, a researcher at Finnish cybersecurity firm F-Secure said that the adversaries have already been in the network for more than a couple of months before someone discovers their existence. Ruohonen also mentioned that this technique is specially preferred by APT groups because, the longer they go unnoticed, the longer they have a remote access to the network. F-Secure, in a report published in 2019, compared Berserk Bear and similar groups to the cyber equivalent of sleeper cells.

The cybersecurity experts have warned Austin city and the U.S that Berserk Bear hackers are not just involved in espionage and sabotage. They can gear up at any moment and create havoc in the United States. These Russian Hackers can cause city blackouts, disturbance in water supply and can even disrupt COVID-19 relief. Vikram Thakur, a technical director at Symantec who has tracked Berserk Bear for years quotes,  “We should be cognizant of the level of information that they have, turning on valves or closing valves, things of that sort — they have the expertise to do it.”

Kevin Thomson, the ex-CEO of SolarWinds | Source: SolarWinds Facebook

SolarWinds replaced their ex-CEO Kevin Thomson with Mr Sudhakar Ramakrishnan. Unlike his predecessor Thomson, who is an accountant by training, Ramakrishnan comes from a security background having led Pulse Secure in the recent past. The new CEO publicly stated that the company will be making 5 critical changes to put security front and center. The company also hired ex-CISA chief Chris Krebs and Facebook’s former security lead, Alex Stamos. Krebs and Stamos work as independent consultants to help the company coordinate its crisis response. Krebs told the Financial Times that it could even take years to uncover the full extent of the hack. On the brighter side, the new CEO mentioned that the company has engaged several cybersecurity experts to assist SolarWinds in its efforts to become more secure.  We can hope that, with better expertise, vision and understanding of threat and vulnerability management, the company is now headed towards a better future.

Read More