Risk
7/10/2008
11:34 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

EMP Risk Follow-Up: Blather O'Plenty, No Action

As we discussed yesterday, it's been four years since Congress was fully briefed on our nation's vulnerability to an Electromagnetic Pulse (EMP) Attack, and the debilitating impact it would have on our electro-dependent society.

As we discussed yesterday, it's been four years since Congress was fully briefed on our nation's vulnerability to an Electromagnetic Pulse (EMP) Attack, and the debilitating impact it would have on our electro-dependent society.And what steps have we taken to prepare against such an attack? You guessed it: None.

For a background on what we're talking about, and the nature of the threat, check out yesterday's post.

This afternoon, the House Armed Services Committee heard testimony on the threat of an EMP attack. But few congressmen showed up to listen. From today's DefenseNews coverage:

Only a handful of the 60 members of the House Armed Services Committee showed up for a hearing on the EMP threat July 10, and most didn't stick around for the whole two-hour session.

"It's obvious that there's not very much interest in it," said Rep. Roscoe Bartlett, R-Md., who asked for the hearing. "There are lots of seats vacant," he lamented.

While Congress may be horrendously complacent about this vulnerability to our high-tech society, the Iranians, apparently, are looking at this as if it is our Achilles' heel.

From today's Editorial & Opinion section in Investor's Business Daily:

Apparently the Iranians are aware of it [EMP threat], judging from articles in the Iranian press. For example, an analysis in the Iranian journal Siasat-e Defai (Farsi for defense policy) in March 2001 weighed the use of nuclear weapons against cities in the traditional manner, as "against Japan in World War II," vs. its use in "information warfare" that includes "electromagnetic pulse . . . for the destruction of integrated circuits."

Another article published in Nashriyeh-e Siasi Nezami (December 1998-January 1999) warned that "if the world's industrial countries fail to devise effective ways to defend themselves against dangerous electronic assaults, then they will disintegrate with a few years."

Today's Wall Street Journal addressed the threat of such a missile attack, and added to the EMP threat discussion:

Iran may already have the capability to target the U.S. with a short-range missile by launching it from a freighter off the East Coast. A few years ago it was observed practicing the launch of Scuds from a barge in the Caspian Sea.

This would be especially troubling if Tehran is developing EMP -- electromagnetic pulse -- technology. A nuclear weapon detonated a hundred miles over U.S. territory would create an electromagnetic pulse that would virtually shut down the U.S. economy by destroying electronic circuits on the ground.

The "electronic circuits" that would be affected range from the entire power grid, to medical devices, to the computer you're using to read this post, to your car's ignition. Kiss the power grid goodbye for a few months to a year; everything else is fried beyond repair.

Our advisories apparently see the cost benefit of a single-missile attack that would shut down the entire country's access to anything electronic for months to years.

It's time we -- and our leaders -- also take a closer look.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2004-2771
Published: 2014-12-24
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

CVE-2014-3569
Published: 2014-12-24
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshak...

CVE-2014-4322
Published: 2014-12-24
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or c...

CVE-2014-6132
Published: 2014-12-24
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML vi...

CVE-2014-6153
Published: 2014-12-24
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.