Isis hackers' 'really, really bad' coding skills limit their cyber capabilities, researcher says

Islamic State hackers struggle to carry out cyberattacks on par with many nefarious cybercriminal groups due to poor coding skills, a security expert said. Kyle Wilhoit, a senior cybersecurity researcher at Domain Tools who analysed Isis cyberattacks over the past two years, presented his findings at the DerbyCon security conference in Louisville, Kentucky over the weekend.

Speaking at the security conference, Wilhoit called three attack tools created by a hacker collective known as the United Cyber Caliphate (UCC) "garbage." The UCC is an umbrella organisation for 17 hacking outfits that have declared their support for the Islamic State.

"ISIS is really really bad at the development of encryption software and malware," Wilhoit said, The Register reports. "The apps are s**t to be honest, they have several vulnerabilities in each system that renders them useless."

Social media giants such as Facebook and Twitter have drawn fierce criticism and scrutiny from lawmakers, particularly in Europe, over the use of their platforms by terrorists and not being able to take down posts fast enough.

Although Isis has become proficient at using social media sites for recruitment and spreading propaganda, and often turn to mainstream encryption platforms such as Telegram and Russian email services for communication, their cyberattack methods, capabilities and tools employed are far less advanced.

Wilhoit said hackers affiliated with Isis failed to develop a secure email system after it accidentally leaked information about its users, essentially making them easy targets. In one instance, he discovered an open server online that contained photographs of Isis militant operations in Iraq that were supposed to be used for propaganda purposes. The photographs, however, still included metadata that could identify where they were taken.

In recent months, some Isis-linked hacking groups have defaced some websites, attempted to infiltrate some web-facing databases using "rudimentary" techniques and started to develop their own malware. Security researchers have previously compared Isis hackers' cyberskills to that of script kiddies.

Wilhoit further noted that websites defaced by these hackers seemed to be relatively easier targets and do not cause any further damage. The malware created by these threat actors also seemed to be plagued with bugs and were actually designed by making minimal changes to existing malware created by others.

Fundraising efforts by Isis have also faced issues as well, the researcher noted, since scammers often use similar tactics and Isis-themed styles to create Bitcoin donation campaigns and websites for donations.

He believes the reason behind Isis' poor cyber capabilities lies in their inability to recruit proper talent.

"If UCC gets more savvy individuals to join then a true online terrorist incident could occur," Wilhoit noted. "But as it stands ISIS are not hugely operationally capable online. As it is right now we should be concerned, of course, but within reason.

"As it stands ISIS are not hugely operationally capable online. There's a lack of expertise in pretty much everything."