Risk
10/19/2009
10:45 AM
Fritz Nelson
Fritz Nelson
Commentary
Connect Directly
LinkedIn
Twitter
Facebook
Google+
RSS
E-Mail
50%
50%

Full Nelson: The Growing Threat Of Cyberwarfare

Many more casualities will pile up, but policy and agreements will prove meaningless against today's anonymous cyberwarrior.

Each F-35 Joint Strike Fighter contains several hundred chips, many of which aren't fabricated in the United States and which, according to some theorists, could be the target of trapdoors. A Wall Street Journal article reported that the F-35 program was recently compromised by an attack using Chinese Internet host systems, and the data stolen was encrypted. An AviationWeek story later downplayed the incident. Cyberthreats.

In 2007, Israel, suspecting a nuclear installation in Syria, sent an air raid to destroy the facility, bypassing Syria's vaunted radar systems. Many speculate that the radar had been tampered with. Cyberwarfare.

Because civilians allegedly drove the Russia-Georgia battle in cyberspace, many refuse to call it war. Likewise, in Estonia, a country was disrupted, money was lost, but no sovereignty was taken, no guns, no victory or defeat. The wars of history don't allow for engines of abstraction, only those of explosives.

Mike McConnell, former director of national intelligence, recently said: "The ability to threaten the U.S. money supply is the equivalent of today's nuclear weapon."

Despite the threats, some experts, including RAND Corp., suggest a slowdown in spending on cyberwar defenses, and there already have been substantial cuts, including the Air Force cybersecurity programs. The government has been mum on developing cyberoffensive capabilities, although many arm-chair pundits have suggested we're building our own trapdoors in the hardware and software we export.

There are, however, several initiatives under way, including building a replica of the Internet to test for vulnerabilities and a DARPA-funded initiative through MIT to test our own ability to examine chips for things like trapdoors (the program is called Trust in IC). Col. Charles Williamson III, the staff judge advocate for Air Force Intelligence, argued in the Air Force Journal for creating a .mil botnet using an army of discarded or aging computers, though he stopped short of calling for civilian zombies.

And then there's policy. Certainly, the rules will need some rewriting. The Geneva and Hague Conventions make civilian involvement in war illegal, but those agreements don't account for cyberwarfare. Melissa Hathaway, former senior director for cyberspace for the National Security Council and Homeland Security Council, made the case to take the discussion international given the widespread nature of these threats. "If we can bring it into some of the policies we're looking at, the synchronization, formulation, rules of engagement, and what is ethical behavior . . . that's one way to address it."

While policy and agreements are nice in theory, they will prove meaningless against today's cyberwarrior. The anonymity of attackers and the thick dossier of attack targets mean more casualties and a call for an ever-more-vigilant defense posture. The painful part is figuring out who may attack, how it will occur, and where it will begin. Indeed, it may have already begun. After all, on the Internet, nobody knows they're in a dogfight.

Fritz Nelson is the Editorial Director for InformationWeek and the Executive Producer of TechWebTV. Fritz writes about startups and established companies alike, but likes to exploit multiple forms of media into his writing.

Follow Fritz Nelson and InformationWeek on Twitter, Facebook, YouTube and LinkedIn:

Twitter @fnelson @InformationWeek @IWpremium

Facebook Fritz Nelson Facebook Page InformationWeek Facebook Page

YouTube TechWebTV

LinkedIn Fritz Nelson on LinkedIn InformationWeek

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4725
Published: 2014-07-27
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

CVE-2014-4726
Published: 2014-07-27
Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

CVE-2014-2363
Published: 2014-07-26
Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

CVE-2014-2625
Published: 2014-07-26
Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.

CVE-2014-2626
Published: 2014-07-26
Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.