Tuesday, June 9, 2015


How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last

"Equation Group" ran the most advanced hacking operation ever uncovered. ~ fucking A , man :o



Aurich Lawson
CANCUN, Mexico — In 2009, one or more prestigious researchers received a CD by mail that contained pictures and other materials from a recent scientific conference they attended in Houston. The scientists didn't know it then, but the disc also delivered a malicious payload developed by a highly advanced hacking operation that had been active since at least 2001. The CD, it seems, was tampered with on its way through the mail.
It wasn't the first time the operators—dubbed the "Equation Group" by researchers from Moscow-based Kaspersky Lab—had secretly intercepted a package in transit, booby-trapped its contents, and sent it to its intended destination. In 2002 or 2003, Equation Group members did something similar with an Oracle database installation CD in order to infect a different target with malware from the group's extensive library. (Kaspersky settled on the name Equation Group because of members' strong affinity for encryption algorithms, advanced obfuscation methods, and sophisticated techniques.)
Kaspersky researchers have documented 500 infections by Equation Group in at least 42 countries, with Iran, Russia, Pakistan, Afghanistan, India, Syria, and Mali topping the list. Because of a self-destruct mechanism built into the malware, the researchers suspect that this is just a tiny percentage of the total; the actual number of victims likely reaches into the tens of thousands.

A long list of almost superhuman technical feats illustrate Equation Group's extraordinary skill, painstaking work, and unlimited resources. They include:
  • The use of virtual file systems, a feature also found in the highly sophisticated Regin malware. Recently published documents provided by Ed Snowden indicate that the NSA used Regin to infect the partly state-owned Belgian firm Belgacom.
  • The stashing of malicious files in multiple branches of an infected computer's registry. By encrypting all malicious files and storing them in multiple branches of a computer's Windows registry, the infection was impossible to detect using antivirus software.
  • Redirects that sent iPhone users to unique exploit Web pages. In addition, infected machines reporting to Equation Group command servers identified themselves as Macs, an indication that the group successfully compromised both iOS and OS X devices.
  • The use of more than 300 Internet domains and 100 servers to host a sprawling command and control infrastructure.
  • USB stick-based reconnaissance malware to map air-gapped networks, which are so sensitive that they aren't connected to the Internet. Both Stuxnet and the related Flame malware platform also had the ability to bridge airgaps.
  • An unusual if not truly novel way of bypassing code-signing restrictions in modern versions of Windows, which require that all third-party software interfacing with the operating system kernel be digitally signed by a recognized certificate authority. To circumvent this restriction, Equation Group malware exploited a known vulnerability in an already signed driver for CloneCD to achieve kernel-level code execution.
Taken together, the accomplishments led Kaspersky researchers to conclude that Equation Group is probably the most sophisticated computer attack group in the world, with technical skill and resources that rival the groups that developed Stuxnet and the Flame espionage malware.
"It seems to me Equation Group are the ones with the coolest toys," Costin Raiu, director of Kaspersky Lab's global research and analysis team, told Ars. "Every now and then they share them with the Stuxnet group and the Flame group, but they are originally available only to the Equation Group people. Equation Group are definitely the masters, and they are giving the others, maybe, bread crumbs. From time to time they are giving them some goodies to integrate into Stuxnet and Flame."

In an exhaustive report published Monday at the Kaspersky Security Analyst Summit here, researchers stopped short of saying Equation Group was the handiwork of the NSA—but they provided detailed evidence that strongly implicates the US spy agency.
First is the group's known aptitude for conducting interdictions, such as installing covert implant firmware in a Cisco Systems router as it moved through the mail.
Second, a highly advanced keylogger in the Equation Group library refers to itself as "Grok" in its source code. The reference seems eerily similar to a line published last March in an Intercept article headlined "How the NSA Plans to Infect 'Millions' of Computers with Malware." The article, which was based on Snowden-leaked documents, discussed an NSA-developed keylogger called Grok.
Third, other Equation Group source code makes reference to "STRAITACID" and "STRAITSHOOTER." The code words bear a striking resemblance to "STRAITBIZARRE," one of the most advanced malware platforms used by the NSA's Tailored Access Operations unit. Besides sharing the unconventional spelling "strait," Snowden-leaked documents note that STRAITBIZARRE could be turned into a disposable "shooter." In addition, the codename FOXACID belonged to the same NSA malware framework as the Grok keylogger.
Apart from these shared code words, the Equation Group in 2008 used four zero-day vulnerabilities—including two that were later incorporated into Stuxnet.

The similarities don't stop there. Equation Group malware dubbed GrayFish encrypted its payload with a 1,000-iteration hash of the target machine's unique NTFS object ID. The technique makes it impossible for researchers to access the final payload without possessing the raw disk image for each individual infected machine. The technique closely resembles one used to conceal a potentially potent warhead in Gauss, a piece of highly advanced malware that shared strong technical similarities with both Stuxnet and Flame. (Stuxnet, according to The New York Times, was a joint operation between the NSA and Israel, while Flame, according to The Washington Post, was devised by the NSA, the CIA, and the Israeli military.) Beyond the technical similarities to the Stuxnet and Flame developers, Equation Group boasted the type of extraordinary engineering skill people have come to expect from a spy organization sponsored by the world's wealthiest nation. One of the Equation Group's malware platforms, for instance, rewrote the hard-drive firmware of infected computers—a never-before-seen engineering marvel that worked on 12 drive categories from manufacturers including Western Digital, Maxtor, Samsung, IBM, Micron, Toshiba, and Seagate.
The malicious firmware created a secret storage vault that survived military-grade disk wiping and reformatting, making sensitive data stolen from victims available even after reformatting the drive and reinstalling the operating system. The firmware also provided programming interfaces that other code in Equation Group's sprawling malware library could access. Once a hard drive was compromised, the infection was impossible to detect or remove.

Enlarge / Forensics software displays some of the hard drives Equation Group was able to commandeer using malicious firmware.
Kaspersky Lab
While it's simple for end users to re-flash their hard drives using executable files provided by manufacturers, it's just about impossible for an outsider to reverse engineer a hard drive, read the existing firmware, and create malicious versions.
"This is an incredibly complicated thing that was achieved by these guys, and they didn't do it for one kind of hard drive brand," Raiu said. "It's very dangerous and bad because once a hard drive gets infected with this malicious payload it's impossible for anyone, especially an antivirus [provider], to scan inside that hard drive firmware. It's simply not possible to do that."

Kaspersky Lab

Equation Group's work

One of the most intriguing elements of Equation Group is its suspected use of interdiction to infect targets. Besides speaking to the group's organization and advanced capabilities, such interceptions demonstrate the lengths to which the group will go to infect people of interest. The CD from the 2009 Houston conference—which Kaspersky declined to identify, except to say it was related to science—tried to use the autorun.inf mechanism in Windows to install malware dubbed DoubleFantasy. Kaspersky knows that conference organizers did send attendees a disc, and the company knows the identity of at least one conference participant who received a maliciously modified one, but company researchers provided few other details and don't know precisely how the malicious content wound up on the disc.

"It would be very easy to trace the attack back to the organizers and point them out, and this could in turn result in some very serious diplomatic incidents," Raiu said. "Our best guess is that the organizers didn't act in a malicious way against the participants, but [that] some of the CD-ROMs on their way to the participants were intercepted and replaced with the malicious variants." Even less is known about a CD for installing Oracle 8i-8.1.7 for Windows sent six or seven years earlier, except that it installed an early Equation Group malware program known as EquationLaser. The conference and Oracle CDs are the only Equation Group interdictions that Kaspersky researchers have discovered. Given how little is known about the interdictions, they weren't likely to have been used often.
A separate method of infection relied on a worm introduced in 2008 that Kaspersky has dubbed Fanny, after a text string that appears in one of the zero-day exploits used by the worm to self-replicate. The then-unknown vulnerability resided in functions that process so-called .LNK files Windows uses to display icons when a USB stick is connected to a PC. By embedding malicious code inside the .LNK files, a booby-trapped stick could automatically infect the connected computer even when its autorun feature was turned off. The self-replication and lack of any dependence on a network connection made the vulnerability ideal for infecting air-gapped machines. (The .LNK vulnerability is classified as CVE-2010-2568.)
Some two years after first playing its role in Fanny, the .LNK exploit was added to a version of Stuxnet so that the worm could automatically spread through highly sensitive computers in Iran. Fanny also relied on an elevation-of-privilege vulnerability that was a zero day at the time the worm was introduced. In 2009, the exploit also made its way into Stuxnet, but by then, Microsoft had patched the underlying bug with the release of MS09-025.

Enlarge / The LNK exploit as used by Fanny.
Kaspersky Lab
A far more common infection vector was Web-based attacks that exploited vulnerabilities in Oracle's Java software framework or in Internet Explorer. The exploits were hosted on a variety of websites related to everything from reviews of technology products to discussions of Islamic Jihad. In addition to planting exploits on the websites, the attack code was also transmitted through ad networks. The wide range of exploit carriers may explain why so many of the machines Kaspersky observed reporting to its sinkholes were domain controllers, data warehouses, website hosts, and other types of servers. Equation Group, it seems, wasn't infecting only end user computers—it was also booby-trapping servers known to be accessed by targeted end users.
Equation Group exploits are notable for the surgical precision exercised to ensure that only an intended target was infected. One Equation Group-written PHP script that Kaspersky unearthed, for instance, checked if the MD5 hash of a website visitor's username was either 84b8026b3f5e6dcfb29e82e0b0b0f386 or e6d290a03b70cfa5d4451da444bdea39. The plaintext corresponding to the first hash is "unregistered," an indication that attackers didn't want to infect visitors who weren't logged in. The second hash has yet to be deciphered Update: now been cracked; see this brief.
"We could not crack this MD5, despite using considerable power for several weeks, which makes us believe [the plaintext username] is a relatively complex one," Raiu said. "It definitely indicates that whoever is behind this username should not be infected by the Equation Group, [and] actually it shouldn't even see the exploit. I would assume this is either one of the group members (a fake identity), one of their partners, or a known identity of a previously infected victim."
The PHP script also took special care not to infect IP addresses based in Jordan, Turkey, and Egypt. Kaspersky observed users visiting the site who didn't meet any of these exceptions, yet they still weren't attacked—an indication that an additional level of filtering spared all but the most sought-after targets who visited the site.

Enlarge / An example of malicious PHP script Equation Group injected into hacked discussion forums.
Kaspersky Lab
More recently, Kaspersky has observed malicious links on the site standardsandpraiserepurpose[.]com that looked like
standardsandpraiserepurpose[.]com/login?qq=5eaae4d[SNIP]0563&rr=1&h=cc593a6bfd8e1e26c2734173f0ef75be3527a205
where the h value (that is, the text following the "h=") appears to be an SHA1 hash. Kaspersky has yet to crack those hashes, but company researchers suspect they're being used to serve customized exploits to specific people. The company is recruiting help from fellow white-hat hackers in cracking them. Other hashes include:
  • 0044c9bfeaac9a51e77b921e3295dcd91ce3956a
  • 06cf1af1d018cf4b0b3e6cfffca3fbb8c4cd362e
  • 3ef06b6fac44a2a3cbf4b8a557495f36c72c4aa6
  • 5b1efb3dbf50e0460bc3d2ea74ed2bebf768f4f7
  • 930d7ed2bdce9b513ebecd3a38041b709f5c2990
  • e9537a36a035b08121539fd5d5dcda9fb6336423
The PHP exploit code also serves unique Web pages and HTML code to people visiting with iPhones, behavior that Kaspersky found telling.
"This indicates the exploit server is probably aware of iPhone visitors and can deliver exploits for them as well," Kaspersky's report published Monday explained. "Otherwise, the exploitation URL can simply be removed for these." The report also said one sinkholed server receives visits from a large pool of China-based machines that identify themselves as Macs in the browser user agent string. While Kaspersky has yet to obtain Equation Group malware that runs on OS X, they believe it exists.

Six codenames


In all, Kaspersky has tied at least six distinct pieces of malware to Equation Group. They include: EquationLaser: an early implant in use from 2001 to 2004.
DoubleFantasy: a validator-style trojan designed to confirm if the infected person is an intended target. People who are confirmed get upgraded to either EquationDrug or GrayFish.
EquationDrug: also known as Equestre, this is a complex attack platform that supports 35 different modules and 18 drivers. It is one of two Equation Group malware platforms to re-flash hard drive firmware and use virtual file systems to conceal malicious files and stolen data.
It was delivered only after a target had been infected with DoubleFantasy and confirmed to be a target. It was introduced in 2002 and was phased out in 2013 in favor of the more advanced GrayFish.

GrayFish: the successor to EquationDrug and the most sophisticated of all the Equation Group attack platforms. It resides completely in the registry and relies on a bootkit to take hold each time a computer starts. Whereas EquationDrug re-flashed hard drives for six models, GrayFish re-flashed 12 classes of hard drives. GrayFish exploits a vulnerability in the CloneCD driver ElbyCDIO.sys—and possibly drivers of other programs—to bypass Windows code-signing requirements.

Enlarge / The VBR means Virtual Boot Record. It is a special area of the disk that is responsible for loading the operating system. The Pill is an injected piece of code ("blue pill", "red pill" - Matrix references) that is responsible for hijacking the OS loading. It works by carefully altering the loading mechanism to include malicious code that the OS blindly "swallows." The BBSVC service is another GRAYFISH mechanism used when the Pill cannot be injected, for some unknown reason. It loads further stages of Grayfish at the time the OS starts. In essence, it's a weaker mechanism than the pill, because it exposes one single malicious executable on the hard drive of the victims. This is why BBSVC is a polymorphic executable, filled with gibberish and random data to make it hard to detect. The platform kernel "fvexpy.sys" is one of the core components of Grayfish. It is designed to run in Windows kernel mode and provide functions for the platform components.
GrayFish is the crowning achievement of the Equation Group. The malware platform is so complex that Kaspersky researchers still understand only a fraction of its capabilities and inner workings. Key to the sophistication of GrayFish is its bootkit, which allows it to take extraordinarily granular control of the machines it infects.
"This allows it to control the launching of Windows at each stage," Kaspersky's written report explained. "In fact, after infection, the computer is not run by itself anymore: it is GrayFish that runs it step by step, making the necessary changes on the fly."

Fanny: A computer worm that exploited what in 2008 were two zero-day vulnerabilities in Windows to self-replicate each time an infected USB stick was inserted into a targeted computer. The main purpose of Fanny was to conduct reconnaissance on sensitive air-gapped networks. After infecting a computer not connected to the Internet, Fanny collected network information and saved it to a hidden area of the USB drive. If the stick was later plugged in to an Internet-computer, it would upload the data to attacker servers and download any attacker commands. If the stick was later plugged into the air-gapped machine, the downloaded commands would be executed. This process would continue each time the stick was switched between air-gapped and Internet-connected machines.

Kaspersky Lab
TripleFantasy: A full-featured backdoor sometimes used in tandem with GrayFish.

Kaspersky Lab

Mistakes were made

No matter how elite a hacking group may be, Raiu said, mistakes are inevitable. Equation Group made several errors that allowed Kaspersky researchers to glean key insights into an operation that went unreported for at least 14 years.
Kaspersky first came upon the Equation Group in March 2014, while researching the Regin software that infected Belgacom and a variety of other targets. In the process, company researchers analyzed a computer located in the Middle East and dubbed the machine "Magnet of Threats" because, in addition to Regin, it was infected by four other highly advanced pieces of malware, including Turla, Careto/Mask, ItaDuke, and Animal Farm. A never-before-seen sample of malware on the computer piqued researchers' interest and turned out to be an EquationDrug module.

Following the discovery, Kaspersky researchers combed through their cloud-based Kaspersky Security Network of exploits and infections reported by AV users and looked for similarities and connections. In the following months, the researchers uncovered additional pieces of malware used by Equation Group as well as the domain names used to host command channels. Perhaps most costly to the attackers was their failure to renew some of the domains used by these servers. Out of the 300 or so domains used, about 20 were allowed to expire. Kaspersky quickly registered the domains and, over the past ten months, has used them to "sinkhole" the command channels, a process in which researchers monitor incoming connections from Equation Group-infected machines.
One of the most severe renewal failures involved a channel that controlled computers infected by "EquationLaser," an early malware platform abandoned around 2003 when antivirus programs began to detect it. The underlying domain name remained active for years until one day, it didn't; Kaspersky acquired it and EquationLaser-infected machines still report to it.
"It's really surprising to see there are victims around the world infected with this malware from 12 years ago," Raiu said. He continues to see about a dozen infected machines that report from countries that include Russia, Iran, China, and India.
Raiu said 90 percent or more of the command and control servers were closed last year, although some remained active as recently as last month.
"We understand just how little we know. It also makes us reflect about how many other things remain hidden or unknown."
The sinkholes have allowed Kaspersky researchers to gather key clues about the operation, including the number of infected computers reporting to the seized command domains, the countries in which these compromised computers are likely located, and the types of operating systems they run.
Another key piece of information gleaned by Kaspersky: some machines infected by Equation Group are the "patients zero" that were used to seed the Stuxnet worm so it would travel downstream and infect Iran's Natanz facility.
"It is quite possible that the Equation Group malware was used to deliver the Stuxnet payload," Kaspersky researchers wrote in their report.
Other key mistakes were variable names, developer account names, and similar artifacts left in various pieces of Equation Group malware. In the same way cat burglars wear gloves to conceal their fingerprints, attackers take great care to scrub such artifacts out of their code before releasing it. But in at least 13 cases, they failed. Possibly the most telling artifact is the string "-standalonegrok_2.1.1.1" that accompanies a highly advanced keylogger tied to Equation Group.
Another potentially damaging artifact found by Kaspersky is the Windows directory path of "c:\users\rmgree5" belonging to one of the developer accounts that compiled Equation Group malware. Assuming the rmgree5 wasn't a randomly generated account name, it may be possible to link it to a developer's real-world identity if the handle has been used for other accounts or if it corresponds to a developer's real-world name such as "Richard Gree" or "Robert Greenberg."
Kaspersky researchers still don't know what to make of the 11 remaining artifacts, but they hope fellow researchers can connect the strings to other known actors or incidents. The remaining artifacts are:
  • SKYHOOKCHOW
  • prkMtx - unique mutex used by the Equation Group's exploitation library (gPrivLibh)
  • "SF" - as in "SFInstall", "SFConfig"
  • "UR", "URInstall" - "Performing UR-specific post-install..."
  • "implant" - from "Timeout waiting for the "canInstallNow" event from the implant-specific EXE!"
  • STEALTHFIGHTER (VTT/82055898/STEALTHFIGHTER/2008-10-16/14:59:06.229-04:00
  • DRINKPARSLEY - (Manual/DRINKPARSLEY/2008-09-30/10:06:46.468-04:00)
  • STRAITACID - (VTT/82053737/STRAITACID/2008-09-03/10:44:56.361-04:00)
  • LUTEUSOBSTOS - (VTT/82051410/LUTEUSOBSTOS/2008-07-30/17:27:23.715-04:00)
  • STRAITSHOOTER - STRAITSHOOTER30.exe
  • DESERTWINTER - c:\desert~2\desert~3\objfre_w2K_x86\i386\DesertWinterDriver.pdb

Hacking without a budget

The money and time required to develop the Equation Group malware, the technological breakthroughs the operation accomplished, and the interdictions performed against targets leave little doubt that the operation was sponsored by a nation-state with nearly unlimited resources to dedicate to the project. The countries that were and weren't targeted, the ties to Stuxnet and Flame, and the Grok artifact found inside the Equation Group keylogger strongly support the theory the NSA or a related US agency is the responsible party, but so far Kaspersky has declined to name a culprit.
Update: Reuters reporter Joseph Menn said the hard-drive firmware capability has been confirmed by two former government employees. He wrote:
A former NSA employee told Reuters that Kaspersky's analysis was correct, and that people still in the intelligence agency valued these spying programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.
Update: Several hours ater this post went live, NSA officials e-mailed the following statement to Ars:
We are aware of the recently released report. We are not going to comment publicly on any allegations that the report raises, or discuss any details. On January 17, 2014, the President gave a detailed address about our signals intelligence activities, and he also issued Presidential Policy Directive 28 (PPD-28). As we have affirmed publicly many times, we continue to abide by the commitments made in the President’s speech and PPD-28. The U.S. Government calls on our intelligence agencies to protect the United States, its citizens, and its allies from a wide array of serious threats - including terrorist plots from al-Qaeda, ISIL, and others; the proliferation of weapons of mass destruction; foreign aggression against ourselves and our allies; and international criminal organizations.
What is safe to say is that the unearthing of the Equation Group is a seminal finding in the fields of computer and national security, as important, or possibly more so, than the revelations about Stuxnet.
"The discovery of the Equation Group is significant because this omnipotent cyber espionage entity managed to stay under the radar for almost 15 years, if not more," Raiu said. "Their incredible skills and high tech abilities, such as infecting hard drive firmware on a dozen different brands, are unique across all the actors we have seen and second to none. As we discover more and more advanced threat actors, we understand just how little we know. It also makes us reflect about how many other things remain hidden or unknown."

Chemtrails Exposed: A History of the New Manhattan Project

Chemtrails Exposed: A History of the New Manhattan Project

“Discoveries and inventions are not terminals; they are fresh starting points from which we can climb to new knowledge.” – Dr. Willis R. Whitney, founder of General Electric Laboratories
After so many years of watching airplanes produce the lines in the sky, largely without knowing of what this Project consists or why, we have recently gained an understanding. Evidence suggests that today’s chemtrail spraying operations consist of airplanes saturating our atmosphere with nano-sized particles influenced by electromagnetic energy for the purpose of weather modification.
U.S. patent #4,686,605 “Method and Apparatus for Altering a Region in the Earth’s Atmosphere, Ionosphere and/or Magnetosphere” shows how stratospheric and tropospheric aerosols can be manipulated using electromagnetic energy in order to modify the weather. The ground-based antennas (known as ionospheric heaters) needed to produce the appropriate electromagnetic energy exist. For a detailed discussion, please see the author’s previous article “Smoking Gun: The HAARP and Chemtrails Connection.”
The 1996 U.S. military document “Weather as a Force Multiplier: Owning the Weather in 2025″ outlines a program using aerosols sprayed from airplanes which are then manipulated with electromagnetic energy in order to modify the weather. This document will be discussed shortly.
The common thread here is weather modification; or as the Library of Congress calls it, “weather control.” Lots of other evidence supporting this assertion exists as well, but these two documents are the most salient.
Motives are plenty. Most notably, significant direct benefits can be gained by playing financial markets which rise and fall with the weather such as the weather derivatives and catastrophe reinsurance markets; not to mention agricultural and energy commodities. Enron pioneered the markets. With foreknowledge of the weather, so many scams could be concocted that it boggles the mind. Weather routinely changes the course of Human history. It determines what we do every day. It determines the outcomes of wars and influences elections. Control of the weather is God-like power. Money and power junkies want it.
Controlling Earth’s weather would necessarily require a gigantic scientific effort. Oddly enough, when one looks for a National effort in weather modification, one finds a lot. Specifically, if one looks, one can find a history of weather control programs involving electromagnetic energy and atmospheric particles; all in a coherent chronological order.
This paper is the result of thousands of dollars and countless hours spent researching many thousands of pages of source, organizational and Government documents related to weather modification and the atmospheric sciences. This article serves as the foundation for a series of shortly forthcoming articles detailing the history and current state of this Project. May this work help end the spraying. For the fact that these environmental modifications have been done without our informed consent, may this work contribute to the largest class-action lawsuit in history.
This paper examines the origins and development of this; the first planetary level scientific endeavor. Now is our opportunity to gain a deeper understanding of the New Manhattan Project.
The Origins of Weather Modification
People have been attempting to modify the weather for ever. Most commonly, man has gone about making it rain; especially in times of drought. The earliest recorded efforts were those of mystics. Local shaman would be called upon to ingest a certain concoction in order to communicate with the weather gods and ask for help. In some cases, the sacrifice of certain animals in certain fashions may have been the thing to do. Sometimes a good old rain dance may have done the trick.
Some early Western efforts to stop destructive weather are outlined in professor James Fleming’s book Fixing the Sky. On page 78 he writes, “In ancient Greece, the official ‘hail wardens’ of Cleonae were appointed at public expense to watch for hail and then signal the farmers to offer blood sacrifices to protect their fields: a lamb, a chicken, or even a poor man drawing blood from his finger was deemed sufficient.”
A little later professor Fleming writes, “In Austria, it was traditional to ring ‘thunder bells’ or blow on huge ‘weather horns’ while herdsmen set up a terrific howl and women rattled chains and beat milk pails to scare away the destructive spirit of the storm.”
Much of the early Western attempts at weather modification involved the detonation of explosive charges in the lower atmosphere. It was hypothesized that atmospheric explosions cause precipitation.
Early American Involvement
Although there has been much international participation, this article focuses on America’s participation in the New Manhattan Project. Throughout the development of the New Manhattan Project, America was the world’s technological leader; especially in the area of military technology. America led the way and developed most of this Project. America continues to lead the Project today. Therefore the early history of weather modification in America is relevant.
James Pollard Espy (1785-1860) also known as “The Storm King” was the first meteorologist in U.S. government service. Although he never received Federal funding for it, he suggested that forest fires can produce rainfall and that experiments in this area should be carried out. His magnum opus was a book called The Philosophy of Storms. This book contains a long section entitled “Artificial Rains.”
The first Federally funded weather modification field effort took place in Texas in 1891, with funds appropriated by the Congress in the amount of nine thousand dollars through the Department of Agriculture. The experiment involved weather modifier Robert St. George Dyrenforth (1844-1910) attacking the atmosphere with balloons, kites, dynamite, mortars, smoke bombs and fireworks. The results were inconclusive, but you can bet that the atmosphere was absolutely terrified!
From these early efforts until the beginning of the scientific era in 1946, the realm of weather modification was inhabited largely by a motley collection of pseudo-scientists and con artists similar to Dyrenforth. These people, who referred to themselves as “rainmakers,” traveled around the Country (mostly the West), going where local governments were willing to pay for their services. If a certain region was experiencing a severe drought, people were often desperate for solutions. These rainmakers’ activities often involved the mixing and open air release of dangerous chemicals. Some of these efforts were Federally funded. Since the days of Robert Dyrenforth, the Federal money has not stopped flowing.
Nikola Tesla
In the late 1800s, inventor Nikola Tesla (1856-1943) popularized the use of electromagnetic energy. In his 1905 United States patent number 787,412 “Art of Transmitting Electrical Energy Through the Natural Mediums” Tesla describes how electromagnetic energy may be sent and received through the atmosphere. The Supreme Court found that U.S. patent #645,576 “System of Transmission of Electrical Energy” proves he invented radio; not Marconi. He pioneered radar. He invented wireless signal and power transmission. Yes, power can be transmitted wirelessly; we’ll have more about that later.
Tesla’s musings and scientific discoveries pioneered what are today’s ionospheric heaters which use electromagnetic energy to cause atmospheric perturbations from great distances and play a defining role in the New Manhattan Project. Specifically, he pioneered the use of a certain type of electromagnetic energy called extremely-low frequency (ELF). This is a specific type of energy known to be used in the New Manhattan Project; the other being very-low frequency (VLF) electromagnetic energy.
In her book Tesla: Man Out of Time, Margaret Cheney writes that he did a good deal of theorizing about weather control. She also writes that he theorized that the entire earth might be illuminated by shooting electromagnetic energy 35,000 feet up into the atmosphere. 35,000 feet is about the altitude of today’s offending airplanes.
The Beginning of the Scientific Era
The scientific era of weather modification began famously in 1946 with a trio of scientists from General Electric Laboratories: Irving Langmuir, Vincent Schaefer and Bernard Vonnegut. Leading the group was the world famous Nobel Peace Prize winning scientist Irving Langmuir (1881-1957). This trio popularized the fact that, under certain circumstances, dumping substances from airplanes into clouds causes precipitation. Early experiments used dry ice while later experiments pioneered the use of silver iodide. Also invented were silver iodide generation equipment and many other weather related scientific instruments. Much of this trio’s work here was done in cooperation with the Office of Naval Research and the Air Force. Although others had previously dumped stuff out of airplanes in attempts to modify the weather, the G.E. scientists practiced a sound scientific method previously unseen in the field.

Schaefer, Langmuir & Vonnegut
image source: General Electric Laboratories
Following the famous scientific weather modification efforts of the G.E. Labs trio, the public’s imagination was sparked and a government regulated weather modification industry flourished. To this day, the government-regulated weather modification industry (or “conventional” weather modification industry as we will call it) expels dry ice, lead iodide or silver iodide (usually silver iodide) from airplanes.
However, the conventional weather modification industry is distinct from the New Manhattan Project and therefore is not the focus of this article. The New Manhattan Project employs electromagnetic energy to manipulate dispersed particles while conventional weather modifiers do not. Also, conventional weather modification efforts are conducted on a regional basis while the New Manhattan Project is global.
Not long after the scientific breakthroughs of the G.E. Labs trio, fueled by high level political rhetoric and popular interest, the United States federal government began pouring hundreds of millions of dollars annually into basic atmospheric research. Since then, the United States government is admitted to have spent many tens of billions of dollars on weather modification and the atmospheric sciences. Much of that was expended in 1950s, ’60s and ’70s dollars. If one is to control the weather, one must know how the atmosphere works. Or as geoengineer Dr. Clement J. Todd wrote in 1970, “Our ability to manage precipitation depends upon four factors: (1) understanding the physical processes of the atmosphere, (2) real-time knowledge of the weather we wish to manipulate, (3) devising the optimum treatment material and technique, and (4) delivery of that treatment to the cloud where and when we wish.”
The majority of the vast expanses of literature pertaining to weather modification and the atmospheric sciences is geared towards conventional weather modification. However, both the New Manhattan Project and conventional weather modification are supported by basic atmospheric research. So, buried in this body of literature, one may find glimpses of the New Manhattan Project. The rest of this paper recounts these glimpses.
Bernard Vonnegut
One member of the G.E. Labs trio, Bernard Vonnegut (1914-1997) went on to pioneer weather modification research involving the use of artificial electric charges and atmospheric aerosols. His work in this area was performed under Government contracts outsourced to a research and development firm called Arthur D. Little Inc.

Bernard Vonnegut
image source: Life Magazine
The earliest recorded instances of electricity being intentionally used to modify particles in the atmosphere can be found in the 1884 experiments of Sir Oliver Lodge (1851-1940). The 1918 U.S. patent #1,279,823 “Process and Apparatus for Causing Precipitation by Coalescence of Aqueous Particles Contained in the Atmosphere” by J.G. Balsillie built upon Lodge’s work. Using this knowledge as a basis, Mr. Vonnegut resumed Lodge’s work; this time with massive funding and modernized scientific equipment.
Beginning in 1953, Bernard Vonnegut, Arthur D. Little et al., conducted experiments involving stainless steel wires miles long strung from the tops of telephone poles, connected to a power supply and discharging corona. The coronal discharge’s effect upon ambient aerosols and the clouds above was monitored and analyzed. Through 1961, these experiments were carried out in Massachusetts, New Hampshire, Texas, Illinois and New Mexico. These types of experiments are referred to as “space charge” experiments. The U.S. Signal Corps and the U. S. Coast Guard provided support. Others performed similar experiments.

Space charge experiment
image source: The Massachusetts Institute of Technology
The 1958 “Final Report of the Advisory Committee on Weather Control” contained an article by Bernard Vonnegut, Vincent Schaefer, J. S. Barrows and Paul MacCready titled “The Future.” In it they outline an atmosphere saturated with “chemicals” and “altering” atmospheric electrical variables. It reads:

When the nature of thunderstorm electrification is understood it may prove possible to control this process by the introduction of chemicals into the atmosphere or by altering electrical variables. Such variables might be atmospheric conductivity, field, and space charge, or perhaps the corona giving properties of the earth’s surface.
When we become sufficiently sophisticated concerning the dynamics of the atmosphere it is possible that weather may be controlled by the large scale release of chemical or more probably thermonuclear heat energy.
In 1961, Bernard Vonnegut, Arnold W. Doyle and D. Read Moffett wrote a paper for Arthur D. Little titled “Research in Electrical Phenomena Associated with Aerosols.” This was a report about their experiments of the previous 3 months involving the effects of electromagnetic energy upon a grounded sphere in a small chamber surrounded by gas. Please consider the implications of that. We will revisit this paper much later.
If you are wondering… yes, Bernard Vonnegut was related to the novelist Kurt Vonnegut. They were brothers.
***
In 1958 the chief White House advisor on weather modification, Captain Howard T. Orville, said the U.S. defense department was studying “ways to manipulate the charges of the earth and sky and so affect the weather” by using an electronic beam to ionize or de-ionize the atmosphere over a given area.
***
The Department of Commerce Weather Bureau reported in 1960 that they were conducting a weather modification study in which, “Chemicals are introduced into the cloud which noticeably changes the surface tension of the droplets. Electrification effects are being observed by artificially electrifying the droplets and subjecting them to impressed electric fields.”
***
For better or for worse, this super secret program had a prophet. His name was United States Navy Admiral William Francis Raborn (1905-1990).

William Francis Raborn
image source: United States Navy
In the January 1963 edition of the U.S. Naval Institute Proceedings, Admiral Raborn outlined a program using electromagnetic energy to modify the weather. His article was entitled “New Horizons of Naval Research and Development.” In this paper, underneath the heading of ‘Environmental Warfare’ he wrote:

The possibilities for the military employment of the “weather weapon” may be as diverse as they are numerous. An ability to control the weather could introduce greater changes in warfare than those which occurred in 1945 with the explosion of the first nuclear weapons.

A severe storm or hurricane striking a naval force may well inflict greater damage than could an enemy. The capability to change the direction of destructive storms and guide them toward enemy concentrations may exist in the future arsenal of the naval tactical commander.
Ground, sea, air and amphibious operations might be supported by the dissipation of fog or clouds, or by the production of rain or drought. Conversely, the creation of solid, low overcasts might be used to conceal troop concentrations, movements, and task force deployments. Large-scale weather control techniques might be used to cause extensive flooding in strategic areas or even to bring a new “ice age” upon the enemy. By influencing the ionosphere and atmosphere simultaneously, magnetic, acoustic, and pressure effects might be generated in such a way that ocean-wide sweeping of mines would occur.
Creating or dissipating atmospheric temperature/humidity ducts might modify the refractive index of the atmosphere enough to influence radar or radio transmission. Artificially-induced ionospheric storms might produce a blackout of communications.
Certain electromagnetic waves are unable to pass through an area of precipitation. A cloud seeding generator could be employed under appropriate meteorological conditions to produce precipitation that would interfere with the operation of radio-guided or remotely-controlled devices or vehicles. We already have taken our first steps toward developing an environmental warfare capability. We are using satellite weather data from Tiros II for current, tactical operations and more accurate, long-range weather predictions. Some experiments in fog dissipation have shown promise, and some exploratory research has been conducted on ways to change the heading of major storms.
For these reasons – and because our advances in science make it reasonable – we are now engaged in planning a ten-year, comprehensive study of the atmosphere, a study which we will designate ATMOS. This plan will be co-ordinated with our TENOC oceanographic studies.
About the ATMOS program, the author has failed to find any other significant information. The author has looked over a 1961 report pertaining to the Navy TENOC (Ten Year Program in Oceanography) program. Although it did not contain any specific information pertinent to the New Manhattan Project, it did make mention of another, classified TENOC report.
It is notable that the title of Raborn’s article includes the word “horizon” because the type of electromagnetic energy to which he refers is akin to “over the horizon radar.” This type of radar is called “over the horizon” because it is bounced off the ionosphere and therefore is effective far beyond the range of the forty miles or so (depending on terrain) afforded by previous radar systems. Forty miles is approximately the distance one can see over flat land or sea before the curvature of the Earth obscures points beyond. Over the horizon radar, on the other hand, is effective to thousands of miles. Today’s ionospheric heaters evolved as over the horizon radar.
Also of note is the fact that the United States Navy, of which Mr. Raborn was an admiral, is today one of the managers of the HAARP facility in Alaska. The HAARP facility contains the world’s most powerful ionospheric heater which is documented to be able to modify the weather.
***
In the 1967 National Science Foundation’s ninth annual weather modification report, it reads, “ESSA [Environmental Science Services Administration] is also investigating the effect of cirrus clouds on the radiation budget of the atmosphere by studying aircraft-produced contrails which often spread into cirrus layers covering considerable fractions of the sky. One technique proposed for modifying lower cloud development has been the generation of a high level cirrus deck with jet aircraft. By intercepting solar radiation at high altitude it may be possible to influence larger scale cloud development elsewhere by reducing solar input and reducing convective cloud generation in areas where they are not needed.” This is essentially today’s geoengineering thesis.
A little later in that same report, it reads that their computer atmospheric simulations, or ‘models’ as they call them, might simulate, “…producing high-level cirrus cloud cover over an area by means of jet aircraft, inserting particulate matter into the upper atmosphere to alter the solar radiation balance and the like.”
***
In 1966, the Interdepartmental Committee on Atmospheric Sciences Select Panel on Weather Modification produced a document titled “Present and Future Plans of Federal Agencies in Weather-Climate Modification.” On page 17 of this report, it reads, “It is anticipated that there will be a few large-scale facilities funded for the testing of modification schemes. Typical schemes might be the suspension of a spray nozzle over a valley between two mountain peaks to produce cloud-sized droplets into which electrical charges can be introduced in either polarity, contaminants can be introduced, and the drop size spectrum can be adjusted to any reasonable distribution.” The Interdepartmental Committee on Atmospheric Sciences subsequently agreed to proceed with the development of a National Weather Modification Program along the lines of this report.
The now defunct Interdepartmental Committee for Atmospheric Sciences (ICAS) was created by the Federal Council for Science and Technology in 1959 in order to oversee and coordinate a wide range of basic atmospheric research originating from many previously disparate government offices. Their focus was weather modification. Members of the ICAS included the departments of Agriculture, Commerce, Defense, Interior, Transportation and State as well as the Environmental Protection Agency, the Energy Research and Development Administration, the National Aeronautics and Space Administration and the National Science Foundation. These are the government agencies which have been involved in weather modification all along.
The ICAS produced a series of semi-annual reports between 1960 and 1978. In these reports, ICAS member organizations’ weather related scientific activities and expenditures were recounted. The ICAS reports’ areas of study included: Earth’s natural geomagnetic energy, different ways clouds form and different ways they precipitate, lightning, hurricanes and other extreme weather, inadvertent weather modification, intentional weather modification and extra-planetary atmospheres. The ICAS is duly noted here because so much of the history of the New Manhattan Project is accounted for in the pages of their reports.
In the 1969 ICAS report, under the heading of “Cloud Electricity Modification,” it is written that the National Science Foundation is developing, “Means for injecting significant quantities of charge artificially into clouds…”
Again in this 1969 report, on page 37 it describes the Army’s intentions in the area of weather modification. It reads, “Studies will continue on upper atmospheric structure and dynamics, lasers and other electromagnetic propagation, and acoustic propagation. New approaches to atmospheric modification will be studied.”
On page 42 of the 1971 ICAS special report “A National Program for Accelerating Progress in Weather Modification,” the authors write of fog being cleared by airplanes releasing chemicals and ‘electrical methods’ of fog dissipation.
On page 79 of the 1973 ICAS report, it is written, “There is a great deal to be learned before we can with confidence say what effect can be produced by the injection of chemically active trace gasses and particulates into the lower stratosphere. New emphasis has been given to both dynamical and physical meteorological research relevant to this question.”
***
United States patent #5,003,186 “Stratospheric Welsbach Seeding for Reduction of Global Warming” was filed by the Hughes Aircraft Corporation in 1991. The patent describes a method for dispersing particulates into the upper atmosphere in order to save us from global warming. The author David B. Chang suggests that aluminum oxide be used for this purpose. Lab tests from around the world have shown aluminum to be the number one chemtrail ingredient.
“One proposed solution to the problem of global warming,” it reads, “involves the seeding of the atmosphere with metallic particles. One technique proposed to seed the metallic particles was to add the tiny particles to the fuel of jet airliners, so that the particles would be emitted from the jet engine exhaust while the airliner was at its cruising altitude.”
The first mention of aluminum occurs in this passage, “The method comprises the step of seeding the greenhouse gas layer with a quantity of tiny particles of materials characterized by wavelength-dependent emissivity or reflectivity, in that said materials have high emissivities in the visible and far infrared wavelength region. Such materials can include the class of materials known as Welsbach materials. The oxides of metal, e.g., aluminum oxide, are also suitable for the purpose.”
The second mention of aluminum occurs a little later. It reads, “Another class of materials having the desired property includes the oxides of metals. For example, aluminum oxide (Al2O3) is one metal oxide suitable for the purpose and which is relatively inexpensive.”
The Hughes Aircraft Corporation was acquired by and is now integrated into Raytheon.
***
A 1994 document produced by Stanford Research International called “Multiple Instrument Studies of Chemical Releases and Heating at Arecibo” details three barium releases of 48 kilograms each over Puerto Rico. The barium clouds produced by these rocket-borne explosions were subsequently hit with man-made electromagnetic energy from an ionospheric heater and thus turned into a plasma. Barium has been found to be the number two chemtrail ingredient.
***
In 1996 the Air Force produced a previously mentioned document called “Weather as a Force Multiplier: Owning the Weather in 2025.” The document was produced by the Department of Defense and written as ordered by the chief of staff of the Air Force, Ronald R. Fogleman. “Owning the Weather” was but one in a series of 39 documents speaking to a great overhaul of Air Force operations to be achieved by the year 2025. The larger set of documents is called “Air Force 2025.” “Owning the Weather” describes a system of weather modification combining atmospheric aerosols with electromagnetic energy.
On page 2 the document reads, “Prior to the attack, which is coordinated with forecasted weather conditions, the UAVs begin cloud generation and seeding operations. UAVs [unmanned aerial vehicles] disperse a cirrus shield to deny enemy visual and infrared (IR) surveillance. Simultaneously, microwave heaters create localized scintillation to disrupt active sensing via synthetic aperture radar (SAR) systems such as the commercially available Canadian search and rescue satellite-aided tracking (SARSAT) that will be widely available in 2025. Other cloud seeding operations cause a developing thunderstorm to intensify over the target, severely limiting the enemy’s capability to defend. The WFSE monitors the entire operation in real-time and notes the successful completion of another very important but routine weather-modification mission.”
The document mostly speaks to military combat applications, but there are some very interesting quotes. Here’s one, “In the United States, weather-modification will likely become a part of national security policy with both domestic and international applications.” Let’s hear more about those “domestic applications”
On page 34 the document reads, “The ability to modify the weather may be desirable both for economic and defense reasons.”
Also in 1996, as part of the same series containing “Owning the Weather,” the Air Force produced a document entitled “An Operational Analysis for Air Force 2025″ which briefly outlines something they call a “weather analysis and modification system.” This system is described as employing both particulate seeding and microwave energy for the purpose of weather modification.
Under the heading of “Weather Analysis and Modification System,” the document reads, “A global network of sensors provides ‘weather warriors’ with the means to monitor and accurately predict weather activities and their effects on military operations. A diverse set of weather modification tools allows manipulation of small-to-medium scale weather phenomena to enhance friendly force capabilities and degrade those of the adversary.”
***
In the mid-nineties, Lawrence Livermore Laboratories scientists Edward Teller, Lowell Wood and Roderick Hyde wrote a series of papers calling for the spraying of megatons of aluminum to save us from global warming. The mid-nineties was when reports of chemtrail spraying in American skies began pouring in. If you will recall, aluminum has been found to be the number one chemtrail ingredient.
In their 1997 paper “Global Warming and Ice Ages,” the Livermore Labs trio wrote, “It has been suggested that alumina injected into the stratosphere by the exhaust of solid-rocket motors might scatter non-negligible amounts of sunlight. We expect that introduction of scattering-optimized alumina particles into the stratosphere may well be overall competitive with use of sulfur oxides; alumina particles offer a distinctly different environmental impact profile.”
They continue to espouse the virtues of stratospheric alumina in the footnotes writing, “Alumina, like sulfate, is ubiquitous in the terrestrial biosphere, and its stratospheric injection seemingly poses no significant environment issues.”
In conclusion
So there you have an evolutionary history of a project employing sprayed particles and the electrification of clouds for the purpose of weather modification. Is this a coincidence? Are all these examples simply isolated, one-off events not a part of a larger overall plan? What are the odds of these data points evolving in a chronological order such as they have without being part of a coordinated effort? One may be looking at something like a quadrillion to one; and that is conservative.
For five days only, from Thursday, February 19 through Monday, February 23, my ebook Chemtrails Exposed will be available for free from Amazon.
Stay tuned. God willing, this article is only the first of many coming in this year; 2015. The heavy lifting (studying the history of weather modification) is complete. The next papers will come much easier because they involve smaller topics and half or more of the work on each is already done. Although the topic will remain secret until publication, you can expect the next article in a couple of months, possibly sooner. Until then, keep firing in the information war. Thank you.
Notes:
Adventure into the Unknown: the first 50 years of the General Electric Research Laboratory by Laurence A. Hawkins, published by William Morrow & Company, 1950

U.S. patent #4,686,605 “Method and Apparatus for Altering a Region in the Earth’s Atmosphere, Ionosphere and/or Magnetosphere,” 1987
“Weather as a Force Multiplier: Owning the Weather in 2025″ by Col. Tamzy J. House, Lt. Col. James B. Near, Jr., LTC William B. Shields (USA), Maj. Ronald J. Celentano, Maj. David M. Husband, Maj. Ann E. Mercer and Maj. James E. Pugh, published by the United States Air Force, 1996
The Smartest Guys in the Room by Bethany McLean and Peter Elkind, published by the Penguin Group, 2004
The Weather Changers by D.S. Halacy, Jr., published by Harper and Row, 1968
Fixing the Sky by James Roger Fleming, published by Columbia University Press, 2010
U.S. patent #787,412 “Art of Transmitting Electrical Energy Through the Natural Mediums,” 1905
U.S. patent #645,576 “System of Transmission of Electrical Energy,” 1900
Tesla: Man Out of Time by Margaret Cheney, published by Simon & Schuster, 1981
Early History of Cloud Seeding by Barrington S. Havens, published by the Langmuir Laboratory at the New Mexico Institute of Mining and Technology, the Atmospheric Sciences Research Center at the State University of New York at Albany and the Research and Development Center of the General Electric Company, 1978
Interdepartmental Committee for Atmospheric Sciences reports 1960-1978, published by the Federal Council for Science and Technology
“Department of the Interior Program in Precipitation Management for 1970″ by Dr. Clement J. Todd as it appeared in the “Proceedings of the Twelfth Interagency Conference on Weather Modification” 1970
U.S. patent #1,279,823 “Process and Apparatus for Causing Precipitation by Coalescence of Aqueous Particles Contained in the Atmosphere”
“Technique for Introducing Low-Density Space Charge into the Atmosphere” by B. Vonnegut, K. Maynard, W.G. Sykes and C.B. Moore, published by Arthur D. Little and the Journal of Geophysical Research, volume 66, number 3, March, 1961
“The Future” by Bernard Vonnegut, Vincent Schaefer, J. S. Barrows and Paul MacCready, published in the Final Report of the Advisory Committee on Weather Control, p201, 1958
Research in Electrical Phenomena Associated with Aerosols by Bernard Vonnegut, Arnold W. Doyle and D. Read Moffett, published by Arthur D. Little, 1961
Angels Don’t Play this HAARP: advances in Tesla technology by Jeane Manning and Dr. Nick Begich, published by Earthpulse Press, p78, 1995
1st National Science Foundation annual weather modification report, p14, 1960
“New Horizons of Naval Research and Development” by William Francis Raborn, published in U.S.Naval Institute Proceedings, January, 1963
“Ten Year Program in Oceanography: TENOC” by the U.S. Navy, March 13, 1961
9th National Science Foundation annual weather modification report, 1967
“Present and Future Plans of Federal Agencies in Weather-Climate Modification” by the Interdepartmental Committee on Atmospheric Sciences Select Panel on Weather Modification, 1966
Interdepartmental Committee on Atmospheric Sciences memorandum to Homer E. Newell dated June 21, 1966, as it appeared in the appendix to “Present and Future Plans of Federal Agencies in Weather-Climate Modification” by the Interdepartmental Committee on Atmospheric Sciences Select Panel on Weather Modification, 1966
“The Interdepartmental Committee on Atmospheric Sciences: A Case History” by Robert E. Morrison
U.S. patent #5,003,186 “Stratospheric Welsbach Seeding for Reduction of Global Warming,” 1991
“Multiple Instrument Studies of Chemical Releases and Heating at Arecibo” by Stanford Research International, published by Stanford Research International, 1994
“Air Force 2025″ by the U.S. Air Force, published by the U.S. Air Force, 1996
“An Operational Analysis for Air Force 2025″ by the U.S. Air Force, published by the U.S. Air Force as part of “Air Force 2025″ by the U.S. Air Force, published by the U.S. Air Force, 1996
Global Warming and Ice Ages by Edward Teller, Lowell Wood and Roderick Hyde, published by the Lawrence Livermore National Laboratory, 1997
via PeterKirby/ActivistPost