Archive for October 2008
First Internet Worm is 20 years old Sunday
In 1988, the computer world faced a new cyber menace that is still very well alive today. The first computer worm, written by a student called Robert Tappan Morris.
From Wikipedia:
“The original intent, according to him, was to gauge the size of the Internet. He released the worm from the Massachusetts Institute of Technology (MIT) to conceal the fact that it actually originated from Cornell. The worm was designed to count how many machines were connected to the Internet. Unknown to Morris, the worm had a design flaw. The worm was programmed to check each computer it found to determine if the infection was already present. However, Morris believed that some administrators might try to defeat his worm by instructing the computer to report a false positive. To compensate for this possibility, Morris directed the worm to copy itself anyway, fourteen percent of the time, no matter the response to the infection-status interrogation.”
Infection Map of the Code Red Worm
Nowadays, worms are notorious for spreading malicious payloads across the entire Internet. It also known as an extremely efficient cyber weapon to mass exploit vulnerabilities on a large scale. Popular worms include Code Red, in 2001, which infected up to 359 000 machines[1], Klez, Blaster, Sasser are also notorious computer worms. Here is a table of notorious worms from the last decade:
Worm |
Year |
Damage ($US) |
| CIH | 1998 | $20 to $80 million |
| Melissa | 1999 | $1 billion |
| ILoveYou | 2000 | $5.5 billion to $8.7 billion in damages; ten percent of all Internet-connected computers hit |
| Code Red | 2001 | $2 billion; a rate of $200 million in damages per day |
| SQL Slammer | 2003 | Shut down South Korea’s online capacity for 12 hours; affected 500,000 servers worldwide |
| Blaster | 2003 | between $2 and $10 billion; hundreds of thousands of infected PCs |
| Sobig | 2003 | 500,000 computers worldwide; as much as $1 billion in lost productivity |
| Sasser | 2004 | tens of millions of dollars; shut down the satellite communications for some French news agencies; several Delta airline flights were cancelled; shut down numerous companies’ systems worldwide |
| MyDoom | 2004 | Slowed global Internet performance by 10 percent and Web load times by up to 50 percent |
| Bagle | 2004 | Tens of millions of dollars |
|
Table 1.0 – Top 10 Computer Worms[2] |
||
See also:
“Morris worm turns 20: Look what it’s done“, Carolyn Duffy Marsan, Network World, October 30, 2008, http://www.networkworld.com/news/2008/103008-morris-worm.html?page=1 (accessed October 31, 2008)
“Morris Worm To Turn 20 – How Far Things Have Come“, Darknet, October 31, 2008, http://www.darknet.org.uk/2008/10/morris-worm-to-turn-20-how-far-things-have-come/ (accessed October 31, 2008)
[1] “The Spread of the Code-Red Worm (CRv2)”, David Moore, Colleen Shannon, CAIDA, September 14, 2007, http://www.caida.org/research/security/code-red/coderedv2_analysis.xml (accessed October 31, 2008)
[2] “Top 10 worst computer viruses”, George Garza, Catalogs.com, February 17, 2008, http://www.catalogs.com/info/travel-vacations/top-10-worst-computer-viruses.html (accessed October 31, 2008)
Dept. of Homeland Security Thinks Blogs is Key to IEDs
The Department of Homeland Security seeks ideas on how to retrieve information in blogs and forums about the potential use and fabrication of Improvised Explosive Devices (IEDs). The DHS thinks that by analyzing information posted on blogs and forums in real time, it may be able to counter the use of IEDs on the field. They are therefore looking for “Indicators of Intent to Use Improvised Explosives (IEDs) available in Blogs to support the Counter-Improvised Explosive Devices (C-IED) Program.[1]“
Any potential person interested would have to:
“2) developing objective, systematic data collection and retrieval techniques to gather data on a near real-time basis from blogs and message boards. Data will be collected at multiple, pre-determined times to evaluate the transmission of information over time, and should include metrics for determining the impact factor and usage patterns of the blogs and message boards. 3) identifying blogs and message boards utilized or favored by groups that engage in violent or terrorist activity to include in the study. Blogs and message boards must be representative of various characteristics of the larger populations of interest. and 4) collecting quantitative and qualitative data from the bloggers to evaluate such issues relating to knowledge of the preparation and execution of violent activities, including IED attacks.[2]“
Now, I can think of so many ways to defeat this kind of surveillance. Encryption for one. Second, don’t use blogs or forums from the Internet to show where you will plan your next attack. Use a virtual private network (VPN). Maybe by looking for blogs or forums, they may find the stupidest insurgents/terrorists or teenagers that think they are cool, but the vast majority of them know how to use technology and have learned about encryption. A private web server would do the job also…Imagination is the limit!
See also:
“DHS: Scour Blogs to Stop Bombs”, Noah Shachtman, October 31, 2008, http://blog.wired.com/defense/2008/10/dhs-scour-blogs.html (accessed on October 31, 2008)
[1] “Counter-Improved Explosive Devices Blogging”, Department of Homeland Security, Sollicitation Number: HSHQDC-09-R-00004, October 28, 2008
[2] Idem.
Cybercrime Rose by 9% in Britain
The BBC reports that cybercrime rose by 9% in Britain[1]. This is according to Online Identity firm Garlik which release its 2008 Cybercrime Report. The report contains interesting statistics. Among others, identity theft drop from 92 000 offenses in 2006 to 84 700, a 8% drop[2]. Financial fraud rose by 24% and is expected to increase for 2008-2009, mainly due to the financial crisis going on. The report cites the leaked letter from the Home Office indicating a possible rise in crime[3]. This is really no surprise.
Always according to the report, the top three stolen documents for identity theft were non-UK passports, utility bills and UK passports[4]. As for financial cybercrimes, losses from UK victims amounted to £535million (1 billion $CAN, 869 millions $US), up 25% from 2006. The reports further states this interesting bit of information:
“… personal details and identity information are traded online with the 15 Research conducted by Garlik’s team of researchers investigating the presence of illegal trading networks on the Internet, number of trading networks more than doubling (from 27 to 57) over the past nine months. In a typical day, around 520 individual information traders are identified with 19,217 traders being identified this year. Of these, around 700 are ‘long term’ traders …[5]“
Cybercrime in the UK rose by more than 9% in 2007
That’s 57 trading network and around 20 000 traders, which, at least for me, is a big number. But the report doesn’t specify how those traders were identified though. The 700 “long-term” traders are seemed to be identified only with their online alias. Therefore if the “20 000 traders” is counted using aliases, this number might be higher than the actual number of traders.
The reports do not goes into great details on how the criminals get the information, but it does mention Trojans, phishing and SQL injections as a way to retrieve the information. As for the damage caused by these for UK companies, 830 000 companies report a computer-related incident last year. Viruses accounted for 21% of those incidents and are on the decline.
Fortunately, the report also mention lack of data protection from the government but fail to give any number, since it’s outside the scope of the document. But shouldn’t it be considered so? Shouldn’t this be considered as criminal negligence? After all, lost data impact lives and can lead to disaster for the victims of this negligence…
Garlik also describe interesting statistics about online harassment. The complete report can be found here: http://www.garlik.com/static_pdfs/cybercrime_report_2008.pdf
[1] “Cybercrime wave sweeping Britain”, BBC News, October 30, 2008, http://news.bbc.co.uk/2/hi/technology/7697704.stm (accessed October 30, 2008)
[2] “UK Cybercrime Report 2008”, Stefan Fafinski, Neshan Minassian, Garlik, September 2008, p. 5
[3] “Leaked letter predicts crime rise”, BBC News, September 1, 2008, http://news.bbc.co.uk/2/hi/uk_news/politics/7591072.stm (accessed on October 30, 2008)
[4] “UK Cybercrime Report 2008”, Stefan Fafinski, Neshan Minassian, Garlik, September 2008, p. 12
[5] Idem, p. 16
Quebec Launches Campaign Against Identity Theft
Yesterday the ISIQ (Institut de la Sécurité de l’Information du Québec) launched its new campaign to educate citizens computer security and protection of personal information over the Internet. The ISIQ launched a new portal, MonIdentité (in French) containing lots of information for users on how to protect their identity and to identify risks such as phishing, spyware, Trojans and weak passwords. The campaign has been launch by Pierre Arcand, deputy of the Mont-Royal district in Montreal.
“We want the citizens to become their own artisans of their security on the Internet, by adopting a secure behavior.” said M. Pierre Arcand.
The campaign comes amid a declaration from the Chaire de recherche du Canada sur la sécurité, identité et technologie (in French) who reports that in the last 3 years, 314 millions personal files where lost in 976 incidents in Canada and in the United States. Half of them were due to the incompetence of the owning corporation or organization.[1]
This is exactly the kind of initiative we need. Humans are always the weakest link in any security network, therefore educating the population about security is essential. My only fear is that this campaign will largely be ignored by the media and the population, since elections are looming in the province and economic news are still the main topic.
Je Protège Mon Identité - ISIQ Portal
[1] “Pour naviguer sans tracas”, Radio-Canada, October 27, 2008, http://www.radio-canada.ca/nouvelles/societe/2008/10/27/003-securite-informatique.shtml (accessed on October 28, 2008)
A Brief Overview of the Cyber Command
As more and more of the infrastructure of modern societies gets inter networked, the more the authorities are taking notice of the possible disasters that ought to happen if those networks would be attacked and controlled by malicious individuals. Based on that, the U.S Secretary of the Air Force announced the creation of the AFCYBER, the Air Force Cyber Command, whose mission “will be to provide combat ready forces trained and equipped to conduct sustained global operations in and through cyberspace, fully integrated with air and space operations[1]“. Let’s go deeper into that interesting new agency and try to see if it can actually matches the challenges of this century.
Origins
U.S Air Force Cyber Command Shield
The United States government released in February 2003 a 76 pages document titled “The National Strategy to Secure Cyberspace”. This document recommended numerous solutions and actions to better protect the American cyberspace. Among these actions, one of them recommends to “Improve coordination for responding to cyber attacks within the U.S. national security community”[2]. Based on that recommendation, the former U.S Secretary of the Air Force, Michael W. Wynne decided to establish a cyberspace command. He also stated:
“The aim is to develop a major command that stands alongside Air Force Space Command and Air Combat Command as the provider of forces that the President, combatant commanders and the American people can rely on for preserving the freedom of access and commerce, in air, space and now cyberspace[3]“
It then has been decided that the 67th Network Warfare Wing and some elements of the 8th Air Force would serves as the core of the new command. It’s interesting to note that the goal of the 67th is “organizes, trains, and equips cyberspace forces to conduct network defense, attack, and exploitation.” Therefore, the Air Force already had an unit trained to conduct cyberspace operations, and more interestingly, this unit was also train to conduct attacks, not only defensive operations. Thus, in 2006 the Air Force Cyberspace Command (Provisional) unit was put into place. but faced many difficulties. The first came as to define the term “cyberspace”, define the command’s operations, find a location to base the unit, then find the personnel and define all their functions, train them and organize the unit. Those challenges were perfectly summarized when Maj. Gen. William T. Lord answered a Slashdot user about the location of the new command:
“I would hope that no matter where it was located, we would still be able to attract the talent needed to work in this exciting command and that all communities see the need to protect this domain[4].”
Attracting specialists and talented individuals is getting harder and harder. The private sector in technology is still offering, for now at least, good opportunities for graduated students. Maybe that’s why the AFCYBER touted is creation and development with TV ads and advertisement all over the web. A great mistake, as it opened it to greater scrutiny from the public and observers, which would now be able to witness the success or the failure of the new command…
And not only did it have difficulties organizing itself, it was in competition with other similar services of the military, with the Navy (Naval Network Warfare) and Army already having such organizations, without forgetting about organizations such as the National Security Agency (NSA).
Even with the fore mentioned difficulties, “We’ve figured all that out” said General Lord in October this year, “We’ve outlined how to organize cyber forces, i.e., what capabilities fall into, or not into, a cyber organization[5]“.
Dismay
The optimism expressed in Lord’s comment was hard to share. One month earlier, the establishment of the Cyber Command was suspended and the transfers of units were halted[6]. In June, different actors were still discussing if the command should concentrate on defense and protection or if it should also conduct offensive operations[7]. The ever growing size of the command and the confusion about which operations of the unit was to conduct were slowing any progress and all this amid numerous other Air Force scandals about nuclear management, which later caused Wynne to resign from his post.
As by October 8, 2008, the Air Force decided that the Cyber Command will finally be a numbered unit under the Air Force Space Command as told by Staff Gen. Norton A. Schwartz (see previous post “U.S Air Force Cyber Command is Working on a new Roadmap“, October 24, 2008). After 2 years, it seems that very little has been accomplish. We still have no idea of the structure, the size and not even the mission of the unit. Although Colorado Springs[8] is apparently the preferred location, still no official location have been designated.
Will it work?
To be successful any cyber unit must first emphasize on constant research of new vulnerabilities in order to take the lead. It’s not just about looking at logs and waiting for an attack to occur. Any
U.S Navy Network Warfare Logo
serious cyber warfare unit must cooperate with every actor of the computer security field, not only corporations or universities, but also with hobbyist groups, hackers and phreakers in order to always have the initiative. As information is always distributed at blazing speed through out the net, and that nothing stays secret for long, constant research is needed to discover new vulnerabilities and detailed analysis. Yet, all those actors have been, as far as I know, ignored or forgotten.
Also, offensive is the best defense. Why should a military organization concentrate only on defensive operations? It even goes against American principles of war, as it ignores the “Offensive” principle, letting the initiative to the enemy. This is clearly not a sound decision. It ignores the basic concepts or warfare. I believe this is mostly due to a certain mentality in the military leadership, which still regards technology as support for troops instead of a fully fledge battlefield. This reasoning needs to change if we are to develop real cyber warfare operations. This is certainly something the Chinese understood.
I believe it will, if this unit becomes reality, become an administration bloated unit that will miss the point. Quantity is never a remedy to the lack of quality. A small but highly trained and skilled unit of hackers can do a lot more than a legion of technicians. The important part of cyber warfare is always to stay ahead, since that as soon as a hole or exploit is found, the enemy will patch it thus making it obsolete. and therefore, the need to find the next security vulnerability. Therefore, we don’t need a bigger bureaucracy, but more research, more cooperation with existing similar units and agencies and to develop a strong offensive capacity as the Chinese government seemed to have developed. The 67th Network Warfare unit and the Naval Network Warfare Command would be able to implement those capacities with the appropriate funding and support.
This command, which seemed like an important toward cyber warfare, now seems to have become a botched concept that will unlikely be of any use, except for other to look upon and learn from their mistakes. As the U.S Navy also has plans for a Naval Cyber Command[9], they have been a lot quieter about their project, maybe so they won’t suffer the same humiliation as their colleagues.
Conclusion
As governments are realizing the potential threats from a cyber war, agencies are organizing themselves to protect and defend their cyberspace. The U.S Air Force was based on this premise and would have been a good idea…if anyone had any idea of what they were talking about. Instead, it became or will become an administrative burden that failed and that will give no ror little results. In the end, the “Cyber Command” or what’s left of it, will be another organization which goals will be the same as the other agencies already in place, with no new value or innovative ideas…While western nations are struggling to grasp the concept of cyber warfare, others are developing a very well organized and effective effort to disrupt our systems. Cyber war is won by being a step ahead…and we’re not…
[1] Lt. Col. Paul Berg, “AFCYBER: What it will do and why we need it”, March 26, 2008, http://www.afcyber.af.mil/news/commentaries/story.asp?id=123091666 (accessed on October 24, 2008)
[2] The National Strategy to Secure Cyberspace, February 2003, U.S. Department of Homeland Security, p.13
[3] Staff Sgt. C. Todd Lopez, “8th Air Force to become new cyber command”, November 3, 2006, http://www.af.mil/news/story.asp?id=123030505 (accessed on October 24, 2008)
[4] “Air Force Cyber Command General Answers Slashdot Questions”, March 12, 2008, http://interviews.slashdot.org/article.pl?sid=08/03/12/1427252 (accessed on October 26, 2008)
[5] Karen Petitt, “One year later: Provisional team lays groundwork for Air Force cyber mission assurance”, October 1, 2008, http://www.afcyber.af.mil/news/story.asp?id=123117666 (accessed on October 24, 2008)
[6] Bob Brewin, “Air Force suspends Cyber Command program”, August 12, 2008, http://www.nextgov.com/nextgov/ng_20080812_7995.php (accessed on October 24, 2008)
[7] Noah Shachtman, “Air Force Suspends Controversial Cyber Command”, August 13, 2008, http://blog.wired.com/defense/2008/08/air-force-suspe.html (accessed on October 24, 2008)
[8] Tom Roeder, “ Air Force regroups command’s duties”, October 7, 2008, http://www.gazette.com/articles/command_41568___article.html/air_force.html (accessed on October 26, 2008)
[9] Lewis Page, “US Navy also planning Cyberwar Command”, October 14, 2008, http://www.theregister.co.uk/2008/10/14/us_navy_cyber_too/ (accessed on October 24, 2008)
U.S Air Force Cyber Command is Working on a new Roadmap
A new roadmap will be written for the reorganization of what was once the U.S Cyber Command. The project was downgraded from a major command to a numbered unit on October 8 by Staff Gen. Norton A. Schwartz. The cyberspace mission of the Air Force will be part of the Air Force Space Command. Both organizations are now working at ways of working together to fulfill the Air Force commitment to protect the cyberspace.
“This is not an additional duty for us,” General Kehler said. “We are in this 100 percent, and we will dedicate the manpower and resources needed to make this transition work. This is not just building a cyber numbered Air Force. This is establishing a robust cyberspace capability for our Air Force, and there won’t be a huge difference in what was being presented originally — cyber being its own command — with what will be done under Air Force Space Command’s umbrella.[1]
There more I read about the Air Force Cyber Command, the more I believe it’s going to end up as it started. In the end, this is about the 67th Network Warfare unit transferring under the Air Force Space Command from the 8th Air Force. This is a wasted opportunity from the Air Force.
[1] “Air Force leaders work to develop cyberspace roadmap”, October 24, 2008, http://www.af.mil/news/story.asp?id=123121153 (accessed on October 25, 2008)
Cyberwarfare Magazine – Introduction
For anyone reading the news on a daily basis and being careful to the state of world affairs, one can’t help but feel some kind of tension between world nations. Whether it’s for resources, land, religious or ideological beliefs, these tensions are transforming or will transform into conflicts one day or another.
For centuries these conflicts, crisis and wars have been fought on the battlefield: warriors of two or more factions were crossing the blade until a victorious side emerged. This has been true for ages and will probably go on for a long time, as human nature doesn’t evolve easily. What will change thought is the battlefield, and we are currently witnessing a new and fast-paced battlefield, which isn’t on land, air or sea, but rather on copper wires, in air and computer networks. With the emergence of the Internet, the cyberspace has now become a new world were a new generation of soldiers and warriors will fight.
Previous events, although few, are a clear sign that more and more militaries are becoming aware of the new possibilities of exploring the cyberspace as a new field where battles can and will be fought. Whether our enemies are terrorists, criminals or opposing nations, we can see that more and more interest is put toward cyber warfare. Recent events are all pointing to that fact. Some may be familiar with the recent conflict in Georgia, where Russia is suspected of having used denial-of service attacks against Georgian servers[1] and against Estonia[2] also. The U.S announced the creation of the Air Force Cyber Command; an unit entirely devoted to cyber warfare. Let’s not forget previously suspected Chinese attacks on various western nations in 2005 and 2007[3].
Let it be clear though. This magazine is about cyber warfare, not electronic warfare (EW), although cyber warfare is usually considered part of the EW field, the inverse is not true. EW is fairly well documented, but it’s not the case for cyber warfare. This magazine intends to cover the following topics:
Cyberspace will become the first battlefield
- Government Cyber Defence
- Cyber crime
- Cyber terrorism
- Cyber espionage
- Case studies
- New technologies
- Attacks, defence and tactics
- New products
- Opinions
- Book reviews
- Computer security
- Events analysis
- Cyber warfare across world militaries
- Etc…
In our days and age, we can’t forget about terrorism and counter-insurgency. Therefore it would be unbelievable not discussing about cyber-terrorism and cyber-crime. All those topics are going to be covered in future articles.
Our time offers us a great new aspect of war to study and explore. Among information, psychological and economical warfare, cyber warfare is one of the most fasting growing and fascinating method of conducting war. More research and analysis needs to be conduct on this kind of war, and this is what this magazine will achieve.
[1] Thomas Claburn, “Under Cyberattack, Georgia Finds ‘Bullet-Proof’ Hosting With Google And Elsewhere“, Information Week, August 18, 2008, http://www.informationweek.com/news/security/attacks/showArticle.jhtml?articleID=210002702 (accessed on October 23, 2008)
[2] Ian Traynor, “Russia Accused of Unleashing Cyberwar to Disable Estonia”, The Guardian, May 17, 2007, http://www.guardian.co.uk/world/2007/may/17/topstories3.russia (accessed on October 23, 2008)
[3] Joël-Denis Bellavance, “Cyberattaque à Ottawa” (in french), Cyberpresse, June 9, 2008, http://technaute.cyberpresse.ca/nouvelles/internet/200806/09/01-18725-cyberattaque-a-ottawa.php (accessed on October 23, 2008)
Cyberwarfare Magazine 