"The risk is real for a malicious and intentional disruption of basic infrastructure but, unfortunately, the problem is poorly understood and too often the subject of hyperbole by both the media and security professionals with a "solution" to sell."
"In the case of Ukraine we observed that, due to the two–step nature of the information communication process, the provision of alternative information to even a relatively small number of dissenters was apparently sufficient to initiate a network–related effect, when the information spreads exponentially, like an epidemic. We can therefore conclude that the Internet does not need to have a mass penetration rate in order to effectively help in the promotion of a major socio–political change. "The authors go on to discuss some of the attributes required for successful online opposition:
"[An] important finding was the necessity of locating the oppositional Web sites beyond the reach of the repressive authorities by hosting them on servers located in strong democratic countries. Moreover, in order to protect them relatively robustly from the cyberattacks initiated by authoritarian regimes, the servers should be situated in countries with relatively strong technical defenses and a highly ramified Internet network..."and...
"Additional strength is achievable by the creation of several mirror sites situated at different servers in physically different parts of the Internet. It is also essential that the national Internet domain name registrars remain free from control by the non–democratic authorities to prevent the authorities from suspending registration of the oppositional Internet resources and thus switching them off."The report also discusses how both traditional media (television, print and radio) as well as online information sources were used by both sides in the conflict to control messages, counter-messages and disinformation.
"In the days after the fast-moving, widespread attack, analysis pointed to North Korea as the likely starting point because code used in the attack included Korean language and other indicators."But according to unnamed "cybersecurity experts" in the article this no longer appears to be the case. Of course, with the same type of flawed analysis, the "experts" can now speculate who else might be involved:
"These officials point suspicions at South Koreans, possibly activists, who are concerned about the threat from North Korea and would be looking to ramp up antagonism toward their neighbor."The article, as usual, provides little to no details that can be independently analyzed and appears to be confused about the exact nature of the attack, The article first describes the attacks as "...crippling strikes, known as "denial of service" attacks" but later says "...the attacks were largely restricted to vandalizing the public Web pages..." of the victims.
"...international law requires anyone receiving an SOS signal to "proceed with all possible speed" to render assistance. Today, similar legal duties abound -- what we might call "duties to assist" -- whether in response to a pilot's mayday call, distress signals, or emergency numbers."However, this duty does not currently extend to the Internet. The article argues (rightly) that existing efforts (more technology and the militarization of cyber space) will not prevent large scale international cyber attacks:
"Technological prevention measures -- thicker security firewalls and better mechanisms to detect and repel attacks -- will undoubtedly be part of any effective counterattack strategy. Similar progress may come from efforts to reach agreement on how militaries should operate in cyberspace and increased transnational coordination among law enforcement agencies.The authors give a brief description of how this duty might work to improve the situation:
"But these measures will not be enough to solve the problem. Open networks will always be vulnerable to malicious attack as new security measures generate improved hacking techniques in an endless game of cat and mouse. The laws of war that govern military uses of force do not translate easily into cyberspace. Criminal laws, similarly, are a blunt instrument for protection. The difficulties inherent in trying to identify the precise location from which attacks arise and the identities of anonymous attackers stem from the basic structure of the global internet. Those difficulties make enforcement of criminal penalties (or the laws of war) difficult and at times impossible."
"A duty to assist can work without identifying the attackers. It focuses instead on minimizing the attack's effects. A victim would send out a distress call... and all those in a position to provide assistance -- whether governments or private actors -- would have an obligation to respond. Help could come in many forms. If attackers denied service to a computer resource, internet service providers could provide additional bandwidth. If an attack crossed through a nation's territory, that nation's government would have to deny attackers further use of its information networks and help trace the attack to its true origins."
"Suspicious Internet activity with IP addresses originating in the East Asia and the Pacific region represented 79 percent of the regional cyber collection effort, a significant increase over last year’s 52 percent. These apparent cyber operations mainly targeted cleared defense contractor networks used for research and development documentation, especially those related to information systems technology."The report noted an interesting trend between Asian and Near East activity and that of Europe and Eurasia [emphasis added]:
"Europe and Eurasia collectors do not need to use high-profile collection techniques because their covert collection methodologies are already efficient and effective as to render the more blatant, overt requests largely supplemental to other collection competencies. It is noteworthy that even though their overt collection efforts have declined, European and Eurasian cyber actors remain some of the most active targeters of United States technology."The report contains in-depth analysis of the types of information targets and regional statistics and analysis of activity. The report forecasts increased cyber activity in the future:
"Government and commercial collection entities worldwide are highly likely to continue the use of cyber collection activities against United States government and its CDCs. Cyber intrusion offers a relatively low-risk, high-gain technique giving illicit collectors the opportunity to acquire sensitive and proprietary information stored on United States computer networks. Cyber targeting may also be utilized as a collection planning tool to identify targets of opportunity not readily apparent to traditional collectors. This cyber reconnaissance allows foreign elements to design targeting plans employing the full range of collection techniques on focused targets."
"...documents a complex ecosystem of cyber espionage that systematically compromised government, business, academic, and other computer network systems in India, the Offices of the Dalai Lama, the United Nations, and several other countries. The report also contains an analysis of data which were stolen from politically sensitive targets and recovered during the course of the investigation. These include documents from the Offices of the Dalai Lama and agencies of the Indian national security establishment. Data containing sensitive information on citizens of numerous third-party countries, as well as personal, financial, and business information."The analysis shows strong links to the People's Republic of China as the origin of the attacks.
"Attribution concerning cyber espionage networks is a complex task, given the inherently obscure modus operandi of the agents or groups under investigation. Cyber criminals aim to mask their identities, and the networks investigated in this report are dispersed across multiple platforms and national jurisdictions. Complicating matters further is the politicization of attribution questions, particularly concerning Chinese intentions around information warfare. Clearly this investigation and our analysis tracks back directly to the PRC, and to known entities within the criminal underground of the PRC. There is also an obvious correlation to be drawn between the victims, the nature of the documents stolen, and the strategic interests of the Chinese state. But correlations do not equal causation. It is certainly possible that the attackers were directed in some manner — either by sub-contract or privateering — by agents of the Chinese state, but we have no evidence to prove that assertion. It is also possible that the agents behind the Shadow network are operating for motives other than political espionage, as our investigation and analysis only uncovered a slice of what is undoubtedly a larger set of networks. Even more remote, but still at least within the realm of possibility, is the false flag scenario, that another government altogether is masking a political espionage operation to appear as if it is coming from within the PRC. Drawing these different scenarios and alternative explanations together, the most plausible explanation, and the one supported by the evidence, is that the Shadow network is based out of the PRC by one or more individuals with strong connections to the Chinese criminal underground. Given the often murky relationships that can exist between this underground and elements of the state, the information collected by the Shadow network may end up in the possession of some entity of the Chinese government."
"North Korea has launched a cyber-war unit that targets sites in South Korea and the US"but no further details were provided in the BBC article.
"The difference between cybercrime, cyber-espionage, and cyberwar is a couple of keystrokes," says [Richard] Clarke [former Presidential cyber security adviser]. "The same technique that gets you in to steal money, patented blueprint information or chemical formulas is the same technique that a nation-state would use to get in and destroy things."
"The new initiative involves getting internet cafe owners to monitor the websites their customers view and to pass on any worries over suspicious activity to the police."and additionally,
"The police want internet cafe owners to check the hard drives of their computers to help spot any suspicious activity."It should probably go without having to say, there are critics of the program(me). One commentator is quoted::
"What is dangerous about this initiative is that it does not just focus on preventing access to illegal material but also material that is defined as 'extremist' without offering an objective definition of what that is.
"It thus potentially criminalises people for accessing material that is legal but which expresses religious and political opinions that police officers find unacceptable."
"From charismatic clerics who spout hate online, to thousands of extremist websites, chat rooms and social networking pages that raise money and spread radical propaganda, the Internet has become a crucial front in the ever-shifting war on terrorism."The article also discusses using the Internet for terrorist training activities:
"The new militancy is driven by the Web," agreed Fawaz A. Gerges, a terrorism expert at the London School of Economics. "The terror training camps in Afghanistan and Pakistan are being replaced by virtual camps on the Web."
"2009 also was a year in which more people gained greater access than ever before to more information about human rights through the Internet, cell phones, and other forms of connective technologies. Yet at the same time it was a year in which governments spent more time, money, and attention finding regulatory and technical means to curtail freedom of expression on the Internet and the flow of critical information and to infringe on the personal privacy rights of those who used these rapidly evolving technologies."Most notable in the report were China and Iran:
"The government of China increased its efforts to monitor Internet use, control content, restrict information, block access to foreign and domestic Web sites, encourage self-censorship, and punish those who violated regulations. The government employed thousands of persons at the national, provincial, and local levels to monitor electronic communication ... The government at times blocked access to selected sites operated by major foreign news outlets, health organizations, foreign governments, educational institutions, and social networking sites, as well as search engines, that allow rapid communication or organization of users... The government also automatically censored e-mail and Web chats based on an ever-changing list of sensitive key words."The report also notes that government interference is not always effective:
"Despite official monitoring and censorship, dissidents and political activists continued to use the Internet to advocate and call attention to political causes such as prisoner advocacy, political reform, ethnic discrimination, corruption, and foreign policy concerns."The report cites Iran for cracking down on Internet access in the run-up to the June presidential election:
"...the government blocked access to Facebook, Twitter, and other social networking sites. After the June election, there was a major drop in bandwidth, which experts posited the government caused to prevent activists involved in the protests from accessing the Internet and uploading large video files."Receiving honorable mentions were North Korea because:
"Internet access was limited to high-ranking officials and other elites..."and Vietnam where:
"Bloggers were detained and arrested under vague national security provisions for criticizing the government and were prohibited from posting material the government saw as sensitive or critical. The government also monitored e-mail and regulated or suppressed Internet content, such as Facebook and other Web sites operated by overseas Vietnamese political groups."
"Law firms are attractive targets for cyberattackers because they maintain sensitive client information on their systems, according to attorneys and technology consultants. Perpetrators may be digging for litigation strategies, negotiation tactics, details on pending deals, or other specific information that could aid governments, competitors, or other entities. The bulk of cyberattacks originate overseas, with China leading the pack..."Law firms are at high risk because of both the sensitive nature of the information they possess and because they don't understand the threat or how to protect themselves. From an adversaries perspective, they are high value targets with a high potential for a successful attack and low risk of being caught.
"Often, law firms never figure out on their own that their networks have sustained serious breaches, largely because... attacks are designed to be difficult to detect. Most firms learn of network security problems from third parties, often law enforcement authorities..."
"Law firms often fear that disclosing such a breach may prompt their clients to take their business to a competing firm, even though that competing firm likely has no better capacity to protect the client's information..."
"While monetary gains are certainly a big motivator for cybercrime, increasingly cyber-criminals are acting out of political interests."The article blames much of this on security vendors hyping specific threats that their products are designed to protect against. I agree: I see it every day when advising my clients.
- "...put up the best defenses you can. Make sure that you are putting the resources you already have, such as log files, to the best possible use";
- "...implement the best people-processes you can"; and,
- prepare to be "hacked".
"It's really a broad range of threats. There are many actors in cyberspace, and we have to develop a capacity to protect ourselves against those attacks," [said Secretary-General Anders] Fogh Rasmussen."Swedish Foreign Minister Carl Bildt also commented at the same meeting on the threat saying:
"There are terrorists, spies, subversive attempts, ongoing attacks as well as preparations for much more disruptive and destructive operations... There will be no security for our societies if we can't secure both our cyberspace and our orbital space."
"The judges said the data storage was not secure enough and that it was not sufficiently clear what it would be used for."The law was implemented to follow an EU Directive aimed at fighting terrorism but the court ordered the suspension until new rules for the storage and use of the data could be implemented:
"The court demanded that stricter conditions be attached to the use and storage of the data, saying it needed to be encoded and that there should be "transparent control" of what the information was used for."The court additionally ordered all data stored to date to be deleted.
"Critics of Mr. Berlusconi say the measures go beyond routine copyright questions and are a way to stave off competition from the Web to public television stations and his own private channels — and to keep a tighter grip on public debate."Specifically, the accusation is that those who control the broadcast media in Italy want to control the Internet as well:
"Paolo Gentiloni, a leading opposition member and a former communications minister, said Internet regulation was inevitably political. Today in Italy, he said, “political power is in the hands of people who do TV, not the Internet."The Italian government denies any such motivation for the courts ruling or recently proposed measures by the Italian legislature to regulate Internet activities:
"Paolo Romani, a deputy communications minister who sponsored the measure, said the issue was copyright protection. “It has nothing to do with the fact that our prime minister also owns television stations,” he said. “It’s in Berlusconi’s interest not to be accused of conflict of interest.”
We are "...under attack every day, losing every day vital secrets. We can not wait," [James Lewis, Center for Strategic and International Studies] said. "We need a new framework for cybersecurity and this bill helps provide that.Lewis went on to add that "...[t]he cyberattack is mainly espionage, some crime".
"The group consists of "a few thousand people" based all over the world Coldblood said."Coldblood is a psydonym for an individual claiming to be a spokesperson for the group. The spokesperson also claimed responsibility for other hacktivist attacks protesting other forms of censorship:
"They staged cyber attacks on Iran following the election protests and have publicly protested against the Scientology movement. "
"We're looking at these issues from the standpoint of espionage, from governments, from different individuals, whether they be hackers or terrorist organizations," Brennan said.
"National security is something that is at risk. That's why what we're trying to do is to ensure that our networks, our government networks, our private sector networks have the ability to withstand these attempts to hack in."
"UK defence, energy, communications and manufacturing companies in a concerted hacking campaign. It claims China has also gone much further, targeting the computer networks and email accounts of public relations companies and international law firms."
Several methods are mentioned in the article including "sexual entrapment" knowledge of "illegal activities to pressurise individuals to co-operate with them", bugging hotel rooms in China and other countries, and:
An important point, left to the end of the article, provides some insight into the seriousness that the UK government gives the problem:"...that undercover intelligence officers from the People’s Liberation Army and the Ministry of Public Security have also approached UK businessmen at trade fairs and exhibitions with the offer of “gifts” and “lavish hospitality”.
"The gifts — cameras and memory sticks — have been found to contain electronic Trojan bugs which provide the Chinese with remote access to users’ computers."
"The growing threat from China has led [Jonathan] Evans [Jonathan Evans, the director-general of MI5] to complain that his agency is being forced to divert manpower and resources away from the fight against Al-Qaeda."
"...outside of the fact that PRC IP addresses have been used as control servers in the attacks, there is no "hard evidence" of involvement of the PRC or any agents thereof."It is great to see such caution in analysis but it needs to go a little further: How do we know the PRC (People's Republic of China) IP addresses "prove" any involvement by anyone in China or their agents? It might be someone outside of China using a Chinese system. Until we know exactly who the perpetrators are, we don't know what their affiliation with the PRC is. Therefore, we would say that to infer that the perpetrator is Chinese based solely on the use of a Chinese IP address is weak: It might be true but it might not.
"In a message posted in English and Turkish, a group calling itself the "Palestinian Mujaheeds" quotes from the Quran and attacks Jews in anti-Semitic terms."Associated Press articles attributed the attack to a recent dispute between Turkey and Israel:
"It comes a week after the eruption of a damaging diplomatic feud between Israel and Turkey. Ankara was outraged when Israel summoned its ambassador to express anger over a Turkish television drama that depicts Israeli agents kidnapping children and shooting old men."The Jerusalem Post attributes the attacks to Turkish "hackers" and provides some background on previous cyber attacks believed to have originated in Turkey:
"Turkish hackers are notorious for playing a major role in coordinated international Web attacks, which usually come in response to international incidents perceived as affronts by the hackers."and;
"After Operation Cast Lead in Gaza last year, Turkish hackers took part in a coordinated assault on Israeli and Western Web sites."
"People seem to be fairly sure it was the Chinese. It is difficult to find the exact source but this is the main suspicion. It seems well founded."
"We have every reason to believe they're coming out of China... We have solid indications. We can say the payloads of these Trojan e-mails were located within China and the ISP routing bears out the connections with China. But what we don't know is specifically who they were sent by, where they were sent from, and why they were sent."The spokesperson also noted the timing of the attack in relation to Google's announcement to stop censoring Internet searches in China:
"It is difficult to believe that the timing is merely coincidental."
