CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War

Cyber War

hacking-detected-shutterstock_188832089The study of cyberwar is more important now than it has ever been. Over the last 20 years we have witnessed cyberwar evolve from an obtuse but prescient concept to a theoretical possibility to a world of constant cyber attacks to today, where all war has cyber components. All war today is cyber war, and all conflict is cyber conflict.

Sign Up To Receive The CTOvision Daily

Cyberwar is a state of conflict. It is related to the technological environment and to cybersecurity, but cyber conflict comprehends those and many other topics into a greater national security construct. Today our nation faces constant adversary action and conflict in cyberspace. Meeting the challenges this adversary action causes requires an understanding of what people and companies and governments can proactively do to bring the fight to adversaries. It also involves deep understanding of adversary tactics and capabilities so we can really understand The Cyber Threat.
We track the the history of cyber conflict, the cutting edge concept being implemented in government, the technological dimensions of cyber war, and, most importantly, the key actions you should take to help protect your personal and business information in cyber conflict. We do that by capturing the thoughts of national security experts and cyber warriors with direct experience in this very serious domain. Our thought leaders take positions, but provide you with the insights you need to evaluate whether or not you support those positions. For example, see: What If This Is The Most Important Thing The Government Can Do To Enhance Our Cybersecurity? where we advocate for the intelligence community to provide compelling insights on the cyber threat to the American people. We also encourage everyone to consider that: Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases For a primer on strategic topics associated with cyberwar see: Twelve Principles of DoD Cyber Conflict

Lessons Learned: Are you one of the Fortune 500’s Unfortunate 221?

The Recorded Future Special Intelligence Desk has just released a new Threat Intelligence Report we found to be full of important context and actionable information for enterprise cyber defenders.

The report, titled The Fortune 500’s Unfortunate 221, is available for download here.

This report is important for two key reasons:

  1. It shows a clear example of the strategic benefit of cyber intelligence to enterprise cyber defense. This is information from outside the enterprise that should drive some key internal decisions and actions.
  2. The report contributes to the strategic situational awareness of a growing problem, the exposure of account credentials in ways enabling adversaries to gain unauthorized access to enterprise resources.

More on the report:

The frequency of corporate data breaches is increasing, with many of the attacks beginning when employees inadvertently disclose sensitive information. This method is commonly referred to as spear phishing. A good way for an adversary to start a spear phishing campaign is to know something about the person they are emailing. A better way is to log into your enterprise and send an email as someone who is known by the target. Stolen credentials allow this to happen.

According to information gathered from open Internet sources (especially pastebin-type sites), 44% of Fortune 500 companies have employees with leaked credentials on the open web.
fortune500

The report provide insights into:

  • How Recorded Future identified these exposed credentials on the open web.
  • Which industries in the Fortune 500 are most impacted.
  • Recommendations to improve your organization’s security.

One thing strategic situational awareness like this can do is motivate change. For this reason we recommend you read it and share with others.

Download the report here.

Sources of cyber intelligence from governments and academia

Cyber intelligence is a growing discipline in the cybersecurity community, providing important information for cyber defenders in enterprises large and small. This post reviews key sources of cyber intelligence provided free from governments and academia.

Most every enterprise with a mature understanding of the importance of protecting their digital assets has a cyber intelligence program underway. This very likely includes an array of external information sources that will include threat news, listings of IP addresses that are known to be associated with malicious sites, information on malicious code, and a variety of other threat information feeds.

What many do not realize, however, is that there are some fantastic sources of cyber threat information available for free from the government and academia.

We regard the following as the most important government sources of Cyber Threat Intelligence:

  • The Defense Cyber Crime Center (DC3): Providing daily context on the cyber threat and incidents via newsletter and their Twitter feed. This report is human readable and digests important news and incident reports that can inform an organization’s strategic decision-making.
  • US Computer Emergency Response Team (US-CERT): Responds to major incidents and analyzes threats. Shares information on vulnerabilities via alerts and announcements. Large body of tips and awareness items useful to your cyber threat intelligence program.  Many of these reports are directly relevant for operational, day-to-day decision-making.
  • European Union Agency for Network and Information Security (ENISA): Tremendous references, publications, media.  Most of the reports provided by ENISA are supportive of operational level decisions, and all are of the highest quality.
  • FBI Cyber Crime: News on latest cases plus testimony of FBI seniors to Congress on cybercrime topics. When the FBI provides information it has been vetted and is of the highest reliability.
  • StopThinkConnect: Not much operational, but good background for the workforce. Striving to make cyber security understandable by people. Good tips for corporate and personal awareness programs.  We strongly recommend this be part of any cyber threat intelligence program because it provides information that can be understood by anyone in the workforce.
  • CERIAS Blog: This is from the Center for Education and Research in Information Assurance and Security. The CERIAS Blog provides context from highly regarded strategic thinkers like Gene Spafford and Sam Liles. Informative on threat potential, belongs on the reading list of cyber defenders in any enterprise.

We believe these six sources can contribute to your organization’s cyber intelligence program and will be supportive of your efforts to enhance your cyber security posture. There are many many other sources provided by governments and academia. Which others do you think we should review here? We would value your thoughts.

 

Other Resources:

Challenges and Opportunities in Big Data From Industry and Academia Panel(Opens in a new browser tab)

The Insight From Red Teams That Revolutionized Cyber Defense

The testing of enterprise security conducted by red teams, groups of talented professionals skilled in evaluating security, has long been an important verification of security compliance and a way to prioritize what area security teams should focus on. But insights from this community have given rise to a concept that is now transforming the security industry: Red teams have taught us that to thwart threats we must at times think like our adversaries.  Offense must inform defense.

This insight is now informing technical approaches to defense, concepts of operation and strategies for collaboration across industries. Consider, for example, these lessons learned from the attack side of the security community:

  1. When a motivated adversary wants to get in they will keep trying till they find a way.  Assume you will be breached. Plan to detect, respond, restore while containing damage.
  2. When an adversary gets it they will seek to remain undetected, but in a well instrumented enterprise no adversary can remain invisible. All leave traces and well-instrumented systems will find them.
  3. Adversaries leave tools, including malware and rootkits to make their continued exploitation easier.
  4. Integration of all defense related information gives insights that leads better actions.
  5. Adversaries are automating and operating in-line. Defenses must automate and operate in-line.
  6. Smart defenders can target defense the way smart attackers target attack. With automation there is no need for a sledgehammer approach. Progressive mitigation approaches allow users to still do their work while only the needed countermeasure is deployed and it does not need to interrupt IT functionality or the workforce use of their tools.

If you agree with these insights here are some considerations that can help you put them into practice in your enterprise:

  • Establish a goal of continuous monitoring of all available, instrumentable components of enterprise IT.
  • Architect for the closely related but different goal of automation of in-line response and containment. When the system detects a problem, it should automatically provides a response to contain and limit the impact without requiring human intervention.
  • Remember to extend your monitoring and automated response into RAM. Adversaries are moving to any reachable part of the IT system, including storing code in volatile memory. So RAM must also be searched and monitored, continuously.
  • Architect in ways that enhance integration of data. Architecting smartly and choosing systems designed with integration in mind are key.
  • Build your solution to scale.  Old RDBMS approaches do not work on this class of computer science problems.

Are these thoughts consistent with your modernization plans? We would love to know what you are thinking.

Fortinet, Palo Alto Networks, McAfee and Symantec Found the Cyber Threat Alliance

In what could be a very virtuous trend, four of the cyber security industry’s leading tech vendors (Fortinet, Palo Alto Networks, McAfee and Symantec) have established a consortium focused on the furtherance of the art and science of cyber threat intelligence. This alliance, started in May and expanded in September, aims to help industry entities coordinate and collaborate in new ways against the high end adversaries attacking the corporate world.

The consortium is focused on sharing of threat intelligence, including indicators of compromise, according to a release.

We believe this will be a significant new source of information that contributes to the overall cyber threat intelligence capability of industry.

The mission of the Cyber Threat Alliance is to drive a coordinated industry effort against cyber adversaries through deep collaboration on threat intelligence and sharing indicators of compromise.

While past industry efforts have often been limited to the exchange of malware samples, this new alliance will provide more actionable threat intelligence from contributing members, including information on zero-day vulnerabilities, botnet command and control (C&C) server information, mobile threats, and indicators of compromise (IoCs) related to advanced persistent threats (APTs), as well as the commonly-shared malware samples. By raising the industry’s collective actionable intelligence, alliance participants will be able to deliver greater security for individual customers and organizations.

“We must match our adversaries’ aggressive drive to innovate with our own deeper commitment to collaborate. It’s no longer enough to share and compare yesterday’s malware samples. As an industry, we need to understand and be poised to react to the latest complex and multidimensional attacks of today and tomorrow. This cyber alliance provides a critical framework for educating each other on the infrastructure and evolving tactics behind these attacks.”
– Vincent Weafer, senior vice president for McAfee Labs, part of Intel Security

For more information on the cyber alliance and its members, visit:
cyberthreatalliance.org

This is a continuation of and very supportive of the trend we have been reporting on towards automation. This type of alliance will eventually be able to produce indicators that can be acted on in automated ways, giving a leg up to enterprise defenders.

SecDef Says World is Exploding All Over: Some thoughts for technologists

We have to assume all our readers, being the savvy connected people you are, are tracking the many concerning global events that appear to be happening with much more frequency. Humanity has a history of violence and some have postulated that what we are seeing now is just do to better coverage of events. Personally I don’t buy that. I believe Secretary of Defense Chuck Hagel captured the situation eloquently when he said “The world is exploding all over.” There are hot spots and potentially massive force on force war-starting situations in the South China Sea and East China Sea, North Korea, the Ukraine, Iran, Iraq, Syria, Libya and Gaza. When you consider that the climate is most definitely changing and coming resource shortages can precipitate or escalate conflict things are even more deadly serious for humanity.

In this chaotic world where things are exploding all over, our national security community has been put under even more pressure because of deep insights into our capabilities given to adversaries because of traitorous leaks. This makes it especially hard but also serves as an important reminder that all IT needs to be fielded with end to end security in mind.

Another continuous pressure most enterprise technologists feel is coming from budgets. IT efficiency and ways to optimize spend are incredibly important in and out of government.

Government technologists have been especially stressed with support to global military and intelligence operations in an age of heightened global chaos. That remains true, of course, but there are broader points to make, including the fact that we technologists can help in shaping better outcomes in all these areas. Never has there been a greater need for the input of technologists to national security policy. There is also a need for new innovation to get more done for lower cost and to do so securely. And there is a huge need for innovation in support of national security and climate activities.

This need will continue to shape our reporting at CTOvision. We would also like to ask for your inputs. If you have topics you can shed light on that will help the broader community understand emerging requirements for solutions or if you have solutions that you need to bring to the attention of national security decision-makers please get in touch and consider submitting a guest post to the site.  Posts that are written to serve our readers have a very high chance of being approved for posting.

Related Posts:

Changing Government Requirement For Market Research to Continuous Market Assessment

Thoughts on the Government Shutdown: from a technologist perspective

Enterprise Technologists From Every Sector: Get The Real Truth About NSA From A Trusted Insider

 

You And Everyone You Know Should Study This Report On The Cyber Threat

Michael Riley and Jordan Robertson published an important piece for Bloomberg news titled:

UglyGorilla Hack of U.S. Utility Exposes Cyberwar Threat

This well researched piece provides context on the threat I believe all technologists should understand. In fact, it is so important, I think every citizen should read it and think about its implications.

A preview from the piece:

Somewhere in China, a man typed his user name, “ghost,” and password, “hijack,” and proceeded to rifle the computers of a utility in the Northeastern U.S.

He plucked schematics of its pipelines. He copied security-guard patrol memos. He sought access to systems that regulate the flow of natural gas. He cruised channels where keystrokes could cut off a city’s heat, or make a pipeline explode.

That didn’t appear to be his intention, and neither was economic espionage. While he was one of the Chinese officers the U.S. charged last month with infiltrating computers to steal corporate secrets, this raid was different. The hacker called UglyGorilla invaded the utility on what was probably a scouting mission, looking for information China could use to wage war.

UglyGorilla is one of many hackers the FBI has watched. Agents have recorded raids by other operatives in China and in Russia and Iran, all apparently looking for security weaknesses that could be employed to disrupt the delivery of water and electricity and impede other functions critical to the economy, according to former intelligence officials with knowledge of the investigation. The incursions spurred a debate in the Obama administration over whether and how to respond, and raised alarms among lawmakers briefed on the incidents.

Read more at: UglyGorilla Hack of U.S. Utility Exposes Cyberwar Threat


I’m reminded this is a perfect example of something Matt Devost has been talking about for years including at the first FedCyber Summit (http://www.fedcyber.com).  For additional context, check out this blog post discussing attacks against critical infrastructure:

http://www.oodaloop.com/technology/2012/09/27/statecyber/

That is totally spot-on, don’t you think?

We track these and many related issues in our CyberWar site.

 

For more on these topics see the CTOvision Guide to National Security Technology and

Spies Want Your Money: Look at this pinhole camera used to steal credit card numbers

Threats to our information are not only from malware or brute force hacks or social engineering. Criminals are motivated to look for every advantage. Sometimes we read about very sophisticated attacks against hardware that require advanced engineering. But attacks don’t really have to be sophisticated to be successful. Two relatively easy to execute attacks were recently highlighted by the New York City Metropolitan Transportation Authority.

Their press release is provided below. But first check out these incredible photos:

pin_hole_at_bottom_of_plug_adapter_mounted_to_cable_channel_located_above_mvm_contains_camera
This was placed above a machine used to buy transit authority tickets. When you pull our your credit card and prepare to insert it, the camera in the device records everything. Note how the fake plug looks old and dirty like the surroundings.

 

battery_pack_resting_on_top_of_cable_channel_with_wire_going_to_camera_2
From this view you can see a cable from the fake outlet. It runs to a battery pack.

 

battery_pack_resting_on_top_of_cable_channel_with_wire_going_to_camera (1)
This is a side view that shows the cable into battery pack.

 

battery_pack_with_wire_going_to_camera_inside_view_after_being_removed_from_mounting_area
After the device was removed the insides can be seen. This is really pretty low tech stuff.
skimmer_after_being_removed_from_mvm_door
This is a different kind of device. Also low tech. It is a skimmer that reads inserted cards.
skimming_device_that_was_removed_by_customer
Another view of the skimmer.
wires_and_battery_of_skimming_device (1)
If you were in a hurry would you have noticed this was a skimmer?

More from the MTA (10 April 2014):

MTA New York City Transit Reminds Customers to Watch for Scammers Who Target MetroCard Vending Machines

Card Skimming Device and Hidden Camera Uncovered at Machine at Columbus Circle
MTA New York City Transit is asking customers to be vigilant when purchasing MetroCards at MetroCard Vending Machines (MVMs) after a skimming device and hidden camera were uncovered at an MVM inside the 59 St-Columbus Circle station (see photos below). The device was discovered last night around 9:30 p.m. attached to an MVM located on the north end of the southbound 1 Subway Line Icon platform at Columbus Circle.
An unidentified customer noticed the device, removed it from the machine and brought it to the Station Agent on duty. The New York Police Department is investigating the device.
New York City Transit urges customers who have purchased a MetroCard at that location using a credit or debit card to immediately check with their bank or credit card company to determine if their accounts show any signs of unauthorized activity.
“We have already dispatched personnel to check all MVMs system-wide today for other devices,” said MTA New York City Transit President Carmen Bianco. “As was the case yesterday, we continue to ask our customers ‘If You See Something, Say Something,’ particularly if they notice any suspicious activity or device in our system.”
MTA New York City Transit will also develop a public information campaign to remind customers to be on guard when purchasing MetroCards at MVMs. The best way to avoid fraudulent activity is to sign up for the EasyPay MetroCard. The EasyPay MetroCard is linked to your credit or debit card, and refills automatically as you use it. EasyPay customers never have to make a purchase at a MVM and have the added convenience of using automated telephone service or www.easypaymetrocard.com to track their account 24/7.

 

Other Resources:

Spy Sites of New York: A Guide to the Region’s Secret History

Foreign Spies Make Recession Worse and Steal Part of Our Future

Who Is Spying On Me? A taxonomy of spies in the modern technology landscape

Advancing Genomics Through Big Data Studies: An Interview with Dr. Mark Guyer of NIH

Dangerous New Lows In NASA-Russian Collaboration: Will we cede the Space Station High Ground to Russia?

STS-134_International_Space_Station_after_undockingOn the Crimean Peninsula, Russia writes the rules because they control the territory. They control who goes in and who goes out. Anyone who wants access to the Crimea can only do so if Russia allows it. You might have a treaty that says it is not supposed to be that way, but the fact is, Russia is in charge because they control all access.

Now consider the International Space Station. Nations around the globe participated it creating this wonder, it is truly international. But as you can imagine, the US has a great investment in the ISS. But guess what, we don’t control access to the ISS. Who does? Russia. Russia can easily decide who goes up and who comes down. If they wanted to get brutal about it they could decide who lives and who dies. We might have treaty and agreement that spells out what is supposed to happen, but just like in the Ukraine, what will really happen there is what Russia wants to happen.

In all my military years I was taught that “hope is not a strategy.” But now we seem to be left with hope as the last option for the US role in space. We hope Russia will continue to support American space launches.  We hope they will allow us to return our astronauts safely. We hope they will keep the ISS an international platform vice declaring it unilaterally their territory. I hope I don’t sound too flippant here, but seems like they could send a few more Russians up and then take a vote of all onboard and declare the ISS is now a Russian territory.

Why am I hitting on this topic now?

The website SpaceRef.com just published a NASA memo spelling out a big downturn in relations with the Russians. It is quoted below:

From: O’Brien, Michael F (HQ-TA000)
Sent: Wednesday, April 02, 2014 9:33 AM
To: [Deleted]
Cc:  [Deleted]

Subject: Suspension of NASA contact with Russian entities

Dear Colleagues,

Given Russia’s ongoing violation of Ukraine’s sovereignty and territorial integrity, until further notice, the U.S. Government has determined that all NASA contacts with Russian Government representatives are suspended, unless the activity has been specifically excepted.  This suspension includes NASA travel to Russia and visits by Russian Government representatives to NASA facilities, bilateral meetings, email, and teleconferences or videoconferences.  At the present time, only operational International Space Station activities have been excepted.  In addition, multilateral meetings held outside of Russia that may include Russian participation are not precluded under the present guidance.  If desired, our office will assist in communication with Russian entities regarding this suspension of activities.  Specific questions regarding the implementation of this guidance can be directed to Ms. Meredith McKay, 202.358.1240 or meredith.mckay@nasa.gov, in our office.

We remain in close contact with the Department of State and other U.S. Government departments and agencies.  If the situation changes, further guidance will be disseminated.

Obie

Michael F. O’Brien

Associate Administrator for International and Interagency Relations

National Aeronautics and Space Administration

When pushed for clarification, NASA posted a short, pissy little note that drones on about how it is not their fault that we can’t launch people into space. That doesn’t give me a sense of confidence at all.

I do have a thought that does give some cause for optimism. Design spaces for the SpaceX “Dragon” indicate that it was designed for more than just cargo. It has a pressurized section that can be used for humans. Thank you Elon Musk for the foresight. With NASA seemingly abdicating all leadership in this area, we may need to turn to SpaceX to get Americans to the ISS (or perhaps to rescue them in a strategic retreat if the Russians decide to kick us off).

Related Posts:

An Assessment on the Cyber Threat

NASA discloses data breach

Potential Malicious Use Of IT By NASA Astronaut While On Orbit: Thought provoking but probably not hacking

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]