Thursday, October 14, 2010

Cyber Terrorism

I was recently requested to write an opinion piece for the Czech Republic's Prague Post on cyber terrorism:
"The risk is real for a malicious and intentional disruption of basic infrastructure but, unfortunately, the problem is poorly understood and too often the subject of hyperbole by both the media and security professionals with a "solution" to sell."

Virtual Hostage: Cyber Terrorism and Politically Motivate Computer Crime Are a Big Concern for the Real World

Tuesday, September 07, 2010

Recommended: Internet Use in Ukraine's Orange Revolution

Researchers Volodymyr Lysenko and Kevin Desouza have published an analysis of the effect and use of technology in Ukraine's Orange Revolution. The report provides an extensive review of the development of Internet and telecommunication based methods to disseminate information and organize political opposition.

Interestingly, the report discusses the fact that the free-flow of information can have a multiplying effect even when only a small portion of the population has direct access to the Internet:
"In the case of Ukraine we observed that, due to the two–step nature of the information communication process, the provision of alternative information to even a relatively small number of dissenters was apparently sufficient to initiate a network–related effect, when the information spreads exponentially, like an epidemic. We can therefore conclude that the Internet does not need to have a mass penetration rate in order to effectively help in the promotion of a major socio–political change. "
The authors go on to discuss some of the attributes required for successful online opposition:
"[An] important finding was the necessity of locating the oppositional Web sites beyond the reach of the repressive authorities by hosting them on servers located in strong democratic countries. Moreover, in order to protect them relatively robustly from the cyberattacks initiated by authoritarian regimes, the servers should be situated in countries with relatively strong technical defenses and a highly ramified Internet network..."
"Additional strength is achievable by the creation of several mirror sites situated at different servers in physically different parts of the Internet. It is also essential that the national Internet domain name registrars remain free from control by the non–democratic authorities to prevent the authorities from suspending registration of the oppositional Internet resources and thus switching them off."
The report also discusses how both traditional media (television, print and radio) as well as online information sources were used by both sides in the conflict to control messages, counter-messages and disinformation.

Overall, this report is an excellent analysis and case study of Internet based protest and opposition.

Role of Internet–based information flows and technologies in electoral revolutions: The case of Ukraine’s Orange Revolution

Saturday, July 03, 2010

North Korea Not Believed to Be Responible for 2009 Attacks

A series of attacks targeting U.S. government and South Korean web sites during early July of 2009 were initially blamed on North Korea:
"In the days after the fast-moving, widespread attack, analysis pointed to North Korea as the likely starting point because code used in the attack included Korean language and other indicators."
But according to unnamed "cybersecurity experts" in the article this no longer appears to be the case. Of course, with the same type of flawed analysis, the "experts" can now speculate who else might be involved:
"These officials point suspicions at South Koreans, possibly activists, who are concerned about the threat from North Korea and would be looking to ramp up antagonism toward their neighbor."
The article, as usual, provides little to no details that can be independently analyzed and appears to be confused about the exact nature of the attack, The article first describes the attacks as "...crippling strikes, known as "denial of service" attacks" but later says "...the attacks were largely restricted to vandalizing the public Web pages..." of the victims.

That confusion aside, this is another classic case of "cybersecurity experts" trying to use only technical analysis to determine motive. By itself, it just doesn't work (see Analyzing the Google Attacks - Plenty of Room for Mistakes). To assume that the use of the Korean language in attack code implies the source is North (or South) Korea is a very weak inference. It might be true but other explanations (such as a Korean national in San Francisco or a Korean speaker in Japan) are equally likely.

It requires more than a few technical indicators to develop a strong case showing source and motive.

US largely ruling out NKorea in 2009 cyberattacks

Friday, April 30, 2010

Applying International Law to Cyber Space

How well can existing international law map to cyber space? A recent article in The Legal Intelligencer looks at the legal concept of a "duty to assist" and how it might apply in cyberspace.
" law requires anyone receiving an SOS signal to "proceed with all possible speed" to render assistance. Today, similar legal duties abound -- what we might call "duties to assist" -- whether in response to a pilot's mayday call, distress signals, or emergency numbers."
However, this duty does not currently extend to the Internet. The article argues (rightly) that existing efforts (more technology and the militarization of cyber space) will not prevent large scale international cyber attacks:
"Technological prevention measures -- thicker security firewalls and better mechanisms to detect and repel attacks -- will undoubtedly be part of any effective counterattack strategy. Similar progress may come from efforts to reach agreement on how militaries should operate in cyberspace and increased transnational coordination among law enforcement agencies.

"But these measures will not be enough to solve the problem. Open networks will always be vulnerable to malicious attack as new security measures generate improved hacking techniques in an endless game of cat and mouse. The laws of war that govern military uses of force do not translate easily into cyberspace. Criminal laws, similarly, are a blunt instrument for protection. The difficulties inherent in trying to identify the precise location from which attacks arise and the identities of anonymous attackers stem from the basic structure of the global internet. Those difficulties make enforcement of criminal penalties (or the laws of war) difficult and at times impossible."
The authors give a brief description of how this duty might work to improve the situation:
"A duty to assist can work without identifying the attackers. It focuses instead on minimizing the attack's effects. A victim would send out a distress call... and all those in a position to provide assistance -- whether governments or private actors -- would have an obligation to respond. Help could come in many forms. If attackers denied service to a computer resource, internet service providers could provide additional bandwidth. If an attack crossed through a nation's territory, that nation's government would have to deny attackers further use of its information networks and help trace the attack to its true origins."

Do Cyber-Attacks Require a 'Duty to Assist'?

Monday, April 12, 2010

Increased Espionage against US Defense Contractors

The Counterintelligence Directorate of the U.S. Defense Security Office recently released a report on espionage against the U.S. defense industry. The study identified four broad methods of information gathering including the use and misuse of technology:
  1. Direct Request - Email requests for information, webcard purchase requests, price quote requests, phone calls, or marketing surveys
  2. Suspicious Internet Activity - Confirmed intrusion, attempted intrusion, computer network attack, potential pre-attack, or spam
  3. Solicitation and Seeking Employment - Offering technical and business services..., resume submissions, or sales offers
  4. Foreign Visits and Targeting - Suspicious activity at a convention, unannounced visit..., solicitations to attend a convention, offers of paid travel to a seminar, targeting of travelers, questions beyond scope, or overt search and seizure
The alleged sources of attacks are world wide including:
  • "East Asia and the Pacific and Near East entities remaining the most prolific collectors of United States technology or information"; and,
  • Europe and Eurasia
The largest growth in cyber activity was from East Asia and the Pacific:
"Suspicious Internet activity with IP addresses originating in the East Asia and the Pacific region represented 79 percent of the regional cyber collection effort, a significant increase over last year’s 52 percent. These apparent cyber operations mainly targeted cleared defense contractor networks used for research and development documentation, especially those related to information systems technology."
The report noted an interesting trend between Asian and Near East activity and that of Europe and Eurasia [emphasis added]:
"Europe and Eurasia collectors do not need to use high-profile collection techniques because their covert collection methodologies are already efficient and effective as to render the more blatant, overt requests largely supplemental to other collection competencies. It is noteworthy that even though their overt collection efforts have declined, European and Eurasian cyber actors remain some of the most active targeters of United States technology."
The report contains in-depth analysis of the types of information targets and regional statistics and analysis of activity. The report forecasts increased cyber activity in the future:
"Government and commercial collection entities worldwide are highly likely to continue the use of cyber collection activities against United States government and its CDCs. Cyber intrusion offers a relatively low-risk, high-gain technique giving illicit collectors the opportunity to acquire sensitive and proprietary information stored on United States computer networks. Cyber targeting may also be utilized as a collection planning tool to identify targets of opportunity not readily apparent to traditional collectors. This cyber reconnaissance allows foreign elements to design targeting plans employing the full range of collection techniques on focused targets."


Tuesday, April 06, 2010

Recommended Reading: Shadows in the Cloud

In a followup to the "Tracking GhostNet" report, a new analysis of attacks against Tibetan and Indian cyber targets has been released titled "Shadows in the Cloud: Investigating Cyber Espionage 2.0". I highly recommend this report.

The report is an excellent synopsis of an in-depth investigation into attacks and information thefts that:
"...documents a complex ecosystem of cyber espionage that systematically compromised government, business, academic, and other computer network systems in India, the Offices of the Dalai Lama, the United Nations, and several other countries. The report also contains an analysis of data which were stolen from politically sensitive targets and recovered during the course of the investigation. These include documents from the Offices of the Dalai Lama and agencies of the Indian national security establishment. Data containing sensitive information on citizens of numerous third-party countries, as well as personal, financial, and business information."
The analysis shows strong links to the People's Republic of China as the origin of the attacks.

I have not completed a detailed reading of the report but a first pass provides two immediate impressions:
  1. The strong similarities with investigations performed in the late 1980s involving espionage by the then Soviet Union using German nationals a proxies; and,

  2. The analysis, including attribution, appear to be sound.
The similarities described in this report to other, known cases of computer based espionage is striking. The only major difference between the Soviet espionage case of the 1980's and this one is that most of the techniques of infiltration, compromise and data theft are now automated. The patterns of behavior, use of proxies and movement and collection of information are very similar.

Furthermore, this analysis, at least on first reading, appears to be careful, methodical and does not suffer from some of the errors made by other technicians analyzing large-scale international cyber attacks (see Analyzing the Google Attacks - Plenty of Room for Mistakes).

This care of analysis is best summed up by the authors when discussing the attribution of the source of the attacks (emphasis added):
"Attribution concerning cyber espionage networks is a complex task, given the inherently obscure modus operandi of the agents or groups under investigation. Cyber criminals aim to mask their identities, and the networks investigated in this report are dispersed across multiple platforms and national jurisdictions. Complicating matters further is the politicization of attribution questions, particularly concerning Chinese intentions around information warfare. Clearly this investigation and our analysis tracks back directly to the PRC, and to known entities within the criminal underground of the PRC. There is also an obvious correlation to be drawn between the victims, the nature of the documents stolen, and the strategic interests of the Chinese state. But correlations do not equal causation. It is certainly possible that the attackers were directed in some manner — either by sub-contract or privateering — by agents of the Chinese state, but we have no evidence to prove that assertion. It is also possible that the agents behind the Shadow network are operating for motives other than political espionage, as our investigation and analysis only uncovered a slice of what is undoubtedly a larger set of networks. Even more remote, but still at least within the realm of possibility, is the false flag scenario, that another government altogether is masking a political espionage operation to appear as if it is coming from within the PRC. Drawing these different scenarios and alternative explanations together, the most plausible explanation, and the one supported by the evidence, is that the Shadow network is based out of the PRC by one or more individuals with strong connections to the Chinese criminal underground. Given the often murky relationships that can exist between this underground and elements of the state, the information collected by the Shadow network may end up in the possession of some entity of the Chinese government."

SHADOWS IN THE CLOUD: Investigating Cyber Espionage 2.0

North Korea Develops Its Own Operating System Aimed at User Monitoring

South Korea's Science and Technology Policy Institute has released information concerning a homegrown operating system developed by North Korea called Red Star. It appears to be based on Linux and Microsoft code and primarily developed to monitor and limit user activities.

The South Korean report also states:
"North Korea has launched a cyber-war unit that targets sites in South Korea and the US"
but no further details were provided in the BBC article.

North Korean Red Star operating system details emerge

Fine Line between Criminal Activity and National Security

NPR ran a lengthy report on cyber war centered around last month's congressional testimony by the Director of National Intelligence Dennis Blair citing cyber attacks as a top threat to U.S. security.

One important factor noted in the broadcast is the fine line between criminal activity and national security threats. The difference is not so much technique as motive:
"The difference between cybercrime, cyber-espionage, and cyberwar is a couple of keystrokes," says [Richard] Clarke [former Presidential cyber security adviser]. "The same technique that gets you in to steal money, patented blueprint information or chemical formulas is the same technique that a nation-state would use to get in and destroy things."

Cyber Insecurity: U.S. Struggles To Confront Threat

Wednesday, March 24, 2010

U.K. Internet Cafes Asked to Monitor Web Usage for Terrorism

After several terrorism related convictions in the U.K. where suspects were believed to have used Internet cafes, police are seeking cooperation for the cafe owners:
"The new initiative involves getting internet cafe owners to monitor the websites their customers view and to pass on any worries over suspicious activity to the police."
and additionally,
"The police want internet cafe owners to check the hard drives of their computers to help spot any suspicious activity."
It should probably go without having to say, there are critics of the program(me). One commentator is quoted::

"What is dangerous about this initiative is that it does not just focus on preventing access to illegal material but also material that is defined as 'extremist' without offering an objective definition of what that is.

"It thus potentially criminalises people for accessing material that is legal but which expresses religious and political opinions that police officers find unacceptable."

Anti-terror police seek help from internet cafes

Friday, March 12, 2010

Increasing Use of the Internet by Terrorist Groups

The LA Times reports on the extensive and effective use of the Internet by traditional terrorist organizations:
"From charismatic clerics who spout hate online, to thousands of extremist websites, chat rooms and social networking pages that raise money and spread radical propaganda, the Internet has become a crucial front in the ever-shifting war on terrorism."
The article also discusses using the Internet for terrorist training activities:
"The new militancy is driven by the Web," agreed Fawaz A. Gerges, a terrorism expert at the London School of Economics. "The terror training camps in Afghanistan and Pakistan are being replaced by virtual camps on the Web."

Internet making it easier to become a terrorist

Thursday, March 11, 2010

Report: Internet Controls Violate Human Rights

The U.S. Department of State's 2009 Human Rights Report highlights Internet censorship as a major human rights concern. The report's introduction included cyber monitoring and controls resulting in privacy violations and censorship:
"2009 also was a year in which more people gained greater access than ever before to more information about human rights through the Internet, cell phones, and other forms of connective technologies. Yet at the same time it was a year in which governments spent more time, money, and attention finding regulatory and technical means to curtail freedom of expression on the Internet and the flow of critical information and to infringe on the personal privacy rights of those who used these rapidly evolving technologies."
Most notable in the report were China and Iran:
"The government of China increased its efforts to monitor Internet use, control content, restrict information, block access to foreign and domestic Web sites, encourage self-censorship, and punish those who violated regulations. The government employed thousands of persons at the national, provincial, and local levels to monitor electronic communication ... The government at times blocked access to selected sites operated by major foreign news outlets, health organizations, foreign governments, educational institutions, and social networking sites, as well as search engines, that allow rapid communication or organization of users... The government also automatically censored e-mail and Web chats based on an ever-changing list of sensitive key words."
The report also notes that government interference is not always effective:
"Despite official monitoring and censorship, dissidents and political activists continued to use the Internet to advocate and call attention to political causes such as prisoner advocacy, political reform, ethnic discrimination, corruption, and foreign policy concerns."
The report cites Iran for cracking down on Internet access in the run-up to the June presidential election:
"...the government blocked access to Facebook, Twitter, and other social networking sites. After the June election, there was a major drop in bandwidth, which experts posited the government caused to prevent activists involved in the protests from accessing the Internet and uploading large video files."
Receiving honorable mentions were North Korea because:
"Internet access was limited to high-ranking officials and other elites..."
and Vietnam where:
"Bloggers were detained and arrested under vague national security provisions for criticizing the government and were prohibited from posting material the government saw as sensitive or critical. The government also monitored e-mail and regulated or suppressed Internet content, such as Facebook and other Web sites operated by overseas Vietnamese political groups."

2009 Human Rights Report: Introduction

Tuesday, March 09, 2010

Law Firms Increasingly the Victims of Espionage

Law firms are one of the latest targets of alleged cyber espionage from China and others interested in obtaining information on clients or litigation that involve their interests:
"Law firms are attractive targets for cyberattackers because they maintain sensitive client information on their systems, according to attorneys and technology consultants. Perpetrators may be digging for litigation strategies, negotiation tactics, details on pending deals, or other specific information that could aid governments, competitors, or other entities. The bulk of cyberattacks originate overseas, with China leading the pack..."
Law firms are at high risk because of both the sensitive nature of the information they possess and because they don't understand the threat or how to protect themselves. From an adversaries perspective, they are high value targets with a high potential for a successful attack and low risk of being caught.

Understanding the exact extent of law firm intrusions is difficult due to ignorance or fear of reputational damage:
"Often, law firms never figure out on their own that their networks have sustained serious breaches, largely because... attacks are designed to be difficult to detect. Most firms learn of network security problems from third parties, often law enforcement authorities..."

"Law firms often fear that disclosing such a breach may prompt their clients to take their business to a competing firm, even though that competing firm likely has no better capacity to protect the client's information..."

Firms Slow to Awaken to Cybersecurity Threat