Turkish journalist jailed for terrorism 'was framed'
Baris Pehlivan, a Turkish investigative journalist, spent 19 months in jail in 2011 after having being accused of terrorism based on documents found on his work computer. However, following a digital forensics examination on his PC, experts discovered that those files were put there by someone who removed the hard drive from the case, copied the documents, and then reinstalled the hard drive. One of the experts said that they "had never seen a computer attacked as ferociously as Baris's. The attackers seemed to pull everything out of their bag of tricks". 

The attackers also attempted to control the journalist's machine remotely, trying to infect it using malicious email attachments and thumb drives. Among the viruses detected in his computer was an extremely rare trojan called Ahtapot, in one of the only times it's been seen in the wild.

Turkish investigative journalist Barış Pehlivan spent 19 months in jail, accused of terrorism based on documents found on his work computer. But when digital forensics experts examined his PC, they discovered that those files were put there by someone who removed the hard drive from the case, copied the documents, and then reinstalled the hard drive.

"We are not guilty," Barış Pehlivan told me. "The files were put into our computers by a virus and by [attackers] entering the OdaTV office secretly. None of us has seen those documents before the prosecutor showed them to us."

The website Pehlivan works for, OdaTV , has often been critical of the government and the Gülen Movement , which was accused by Turkish president Recep Tayyip Erdoğan of orchestrating the recent attempted coup. The journalists were released from prison on September 14, 2012, but the terrorism trial continues.

It is not clear who perpetrated the attack, but the sophistication of the malware used, the tightly-targeted way Ahtapot works, and the timing of Pehlivan's arrest suggests a highly-coordinated, well-funded attack. The incident is a pivotal one for both the infosecurity field and for press freedom in a country where, as one human rights group put it , there's currently a "witch hunt against journalists." At least 78 journalists, media workers and owners have been jailed in Turkey since the coup attempt that took place on July 15.

Pehlivan went to jail in February of 2011, along with six of his colleagues, after electronic evidence seized during a police raid in 2011 appeared to connect all of them to Ergenekon , an alleged armed group accused of terrorism in Turkey.

"We have never seen a computer attacked as ferociously as Barış's. The attackers seemed to pull everything out of their bag of tricks," Mark Spencer, digital forensics expert at Arsenal Consulting, said.

A paper recently published by computer expert Mark Spencer in Digital Forensics Magazine sheds light into the case after several other reports have acknowledged the presence of malware.

Spencer called Gabor Szappanos, principal researcher at Sophos, who has been analyzing computer viruses for over two decades. They worked together to find out what happened.

What baffled Spencer the most during the investigation was an unusual malware, one he hasn't seen before. It was installed on Pehlivan's computer on the evening of February 11, 2011, a Friday. The police raid took place on the following Monday morning.

"It takes an impressive level of conviction to locally attack a computer four times, and remotely attack it seven times [between January 1, 2011 and February 11, 2011], as well as a certain level of technical skill to set up the infrastructure for those attacks, which included document forgery and date and time manipulation".

"Yes, [the report] definitely raises eyebrows," Taneli Kaivola, senior security consultant at F-Secure, said.

Three infosec professionals from different companies have reviewed Spencer's paper for us, and said it is reliable and well-founded, provided the data acquired from the journalist's computer is accurate.

Spencer said no other forensics expert noticed the Ahtapot trojan in the OdaTV case , nor has determined accurately how those documents showed up on the journalist's computer. However, almost all the reports have concluded that the incriminating files were planted.

Prior to bringing in Ahtapot, the attackers relied on more common malware. First, they tried to infect Pehlivan's computer with the Turkojan RAT through a thumb drive. Email attachments were also used.

The attackers tried to copy Ahtapot onto Pehlivan's hard drive together with incriminating documents. However, the malware did not install properly. A vital component could not be created, as one file had the same name as a component from a previous RAT they used.

The Sophos researcher believes this Remote Access Trojan was rushed into use out of desperation, after several attacks failed to deliver expected results. "Looking at the code revealed some mistakes that are typical at the beginning of development processes [of a malware]," Gabor Szappanos said.

"Ahtapot was an outlier. We have never encountered Ahtapot apart from this incident," Szappanos said.

This RAT is now known as Ahtapot, the Turkish word for "octopus." There are clues to suggest the malware is Turkish in origin, including Turkish words in Ahtapot's code, yet security experts are almost always uncomfortable talking about attribution.

This malware appeared to be in unfinished beta development. It was a Remote Access Trojan (RAT), a malicious software that allows attackers to control a computer without having physical access.

Spencer, who also studied computers and other devices related to the Boston Marathon bombers , said he and his team at Arsenal Consulting examined Barış Pehlivan's computer using a technique they developed to deal with sophisticated tampering of evidence.

Arsenal thinks there's only one possible explanation: someone detached the hard drive, attached it to another computer, and copied the files.

Apparently, Spencer said, attackers copied both malware and incriminating documents to Pehlivan's hard drive the nights of February 9 and 11, to cover their bases in case they won't be able to control the computer remotely using the malware.

Then, attackers briefly booted the PC each night to confirm they reattached the hard drive correctly, and allow the malware they put in with the documents to be properly dropped.

The journalist's computer booted after 10 PM, only to shut down a minute after. Even stranger, the incriminating documents were created while the PC was turned off, right before it booted. Arsenal thinks there's only one possible explanation: someone detached the hard drive, attached it to another computer, and copied the files.

Spencer used the technique and saw an anomaly on the evenings of February 9 and 11. None of the OdaTV journalists was at the office at that time, according to Pehlivan.

It's called "Anchors in Relative Time," which means putting events logged by computers such as startups and shutdowns in chronological order, regardless of any associated dates and times that might had been altered by attackers. Forensics experts can then identify suspicious activity, even if someone has manipulated the dates and times when they happened.

They were smart enough to forge the dates associated with these documents, Spencer said. The key to his investigation was constructing the true timeline of the events.

He suspects the journalist's PC was attacked locally during those two evenings of February 9 and 11, because previous attempts to remotely infect it with malware failed.

"It was the last two local attacks that were successful in terms of delivering the incriminating documents used by the prosecution," he said.

Arsenal studied Pehlivan's computer after being contacted by the Turkish defense attorney. According to Mark Spencer, it was a pro bono case.

Spencer and Szappanos drew several conclusions after studying Barış Pehlivan's computer.

"There were about a dozen different malware samples found. Analyzing them in detail revealed that these were not independent incidents, we could find connection between them," Szappanos said.

He believes this was an expensive targeted attack, which used malware samples and command and control servers dedicated to this case alone.

"The data suggests that these Trojans and domains were used only in this incident, infecting only 1-2 computers. That is not a typical crimeware scenario, and even APT groups target a wider range of victims. The very narrow scope indicates an attacker with a very specific agenda," he said.