Risk
10/19/2009
10:45 AM
Fritz Nelson
Fritz Nelson
Commentary
Connect Directly
Facebook
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Full Nelson: The Growing Threat Of Cyberwarfare

Many more casualities will pile up, but policy and agreements will prove meaningless against today's anonymous cyberwarrior.

In light of the growing concern related to Google cyber attack, we're re-posting this column, which originally ran October 19, 2009.

Gladiators and jousters, Wild West gunslingers and kamikaze pilots, are long retired to history books and celluloid epics, each a reminder of war tactics from a bygone era. They're supplanted today by anonymous warriors--pseudonyms sitting in virtual garrisons, spying, probing, and launching attacks from non-descript buildings all over the world. This is not your father's war. It's not even your older brother's war. In cyberwarfare, there may be no victors, no spoils, just havoc, theft, and assault.

Those who cling mindlessly to notions of war driven by sovereignty and territorial conquest through armed forces should look no further than the specter of current events, where warlords live in caves and their henchmen strap on home-made explosives. Take shock value and terror and layer in the Internet's abstraction and suddenly those who hate or feel disenfranchised or seek wealth or yearn for sanity, or whatever else, gain instant targets and instant audience, and an almost-impossible cave to find.

New wars call for new rules and new definitions. Kris Herrin, chief security officer of Heartland Payment Systems, recently riveted banking industry veterans, as he often does when he folds his company's disastrous security breach inside out. The Russian hackers who breached Heartland and stole its data late last year outsource their malware development to India, have customer service guarantees, offer a help desk, and provide a fully automated attack platform (you can select a target and an attack method, much as you would customize a hand bag online).

It would be easy enough to label this cybercrime, but Russian civilians have engaged in cyberattacks against neighboring Georgia. During Herrin's talk, a Bank of America executive reminded the audience that the Department of Homeland Security revealed that Al-Qaeda had attacked banks worldwide to the tune of hundreds of millions of dollars to fund its operations. Cybercrime, or cyberwarfare? The Russian outfit that attacked Heartland breached 300 financial institutions. If they marched into America as armed militia, or took out electric grids with guns and tanks, would that be crime or war? The lines blur.

Fear and outrage followed North Korea's alleged infiltration of the Department of Justice and Federal Trade Commission computer systems. The U.S. reportedly hacked into Iran's systems early this decade to monitor that country's nuclear program. The New York Times reported that U.S. soldiers lured Al-Qaeda into a death trap by hacking into a computer and falsifying information. There are numerous reports on persistent probes from Chinese hackers into U.S. systems, including network operators penetrating several electric grids. Some government officials suspect China of building trapdoors (hidden code or altered physical layers) into the chips that run many of our computer systems.

Well-known security researcher Marcus Ranum argues that cyberwarfare doesn't exist, that cyberattacks only accompany a vast military invasion. Besides, what right-minded military would tolerate a weapon that could be disabled with a push of a button. And yet unmanned fighter drones capable of surveillance and strikes fly non-stop miles above Iraq and Afghanistan and regularly fall into automated holding patterns when pilots thousands of miles away lose Internet connectivity to the aircraft, cyberflanks exposed.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4467
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site.

CVE-2014-4476
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4477
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4479
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4480
Published: 2015-01-30
Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.