Waiting For Cybergeddon

In the United States, the FBI (which is responsible for detecting and investigating Internet based crime) is warning that America is becoming ever more vulnerable to "cybergeddon" (a massive attack via the Internet that would cripple the economy, government and military.)

The FBI admits that it has a hard time getting more money for their Internet security efforts. And reason is because the threat is largely invisible. A picture of a nuclear bomb going off, or of enemy tanks and warships ready to attack, makes a much more effective impression on the politicians who dole out the money.

The FBI also wants to get the Department of Defense Internet defense operations more involved in national level defense against network based attacks. But the four services have a hard time agreeing to coordinate their efforts to defend military use of the Internet when under massive hacker attack. Thus the FBI plea for help sort of falls on distracted ears.

There hasn't been a proper, all-out Cyber War yet. There have been lots of skirmishes, but nothing approaching what an all out battle, via the Internet, would be. What would the first Cyber War be like? Let's be blunt, no one really knows. But based on the cyber weapons that are known to exist, and the ones that are theoretically possible, one can come up with a rough idea.

First, there are three kinds of Cyber War possible. Right now, we have limited stealth operations (LSO), as Chinese, Russian, and others, use Cyber War techniques to support espionage efforts. China is the biggest practitioner, or at least they have been caught most often.

Next comes Cyber War only (CWO). This is open use of a full range of Cyber War weapons. No one has done this yet, but it's potentially less dangerous than firing missiles and unleashing tank divisions. It is believed that Russia indulged in this in 2007, when Estonia infuriated the Russians by moving a World War II statute memorializing the Soviet "liberation" of Estonia (which didn't want to be liberated by the Soviet Union.) Russia denied responsibility for the massive Cyber War assaults on Estonia, which nearly shut down the nations Internet infrastructure. Estonia accused Russia of being responsible, and tried to invoke the NATO mutual-defense pact. NATO Cyber War experts went to Estonia, and shortly thereafter the attacks stopped. Apparently Russia got the message that this sort of thing could escalate in something more conventional, and deadly.

Then we have Cyber War in support of a conventional war. Technically, we have had this sort of thing for decades. It has been called "electronic warfare" and has been around since World War II. But the development of the Internet into a major part of the planets commercial infrastructure, takes "electronic warfare" to a whole other level. Cyber War goes after strategic targets, not just the electronic weapons and communications of the combat forces.

A successful Cyber War depends on two things; means and vulnerability. The "means" are the people, tools and cyberweapons available to the attacker. The vulnerability is the extent to which the enemy economy and military use the Internet and networks in general. We don't know who has what Cyber War capabilities exactly, although China and the U.S. have openly organized Cyber War units, and both nations have lots of skilled Internet experts.

Vulnerability is another matter. The United States is the most exposed to Cyber War attack because, as a nation, we use the Internet more than any other country. That's the bad news. The good news is that if an attacker ever tried to launch a Cyber War by assaulting the U.S., it could backfire. This risk has to be kept in mind when considering what a Cyber War might do. Recall military history. The Pearl Harbor attack in 1941 actually backfired on the Japanese, by enraging Americans and unleashing a bloodthirsty response that left Japan in ruins. The lesson of the original Pearl Harbor is, if you're going to hit someone this way, better make it count. If your opponent is bigger than you, and gets back up, you could be in some serious trouble.

The big problem with Cyber War is that there has not been a lot of experience with it. Without that, no one is really sure what will happen when someone attempts to use it at maximum strength. But unlike nuclear weapons, there is far less inhibition about going all-out with Cyber War weapons. That is the biggest danger. Cyber War is a weapon of growing might, and little restraint by those who wield it. Things are going to get a lot worse.

Hacked lawmaker calls for cyber briefings

Rep. Frank Wolf, R-Va., told House leaders Tuesday that few members of Congress have availed themselves of secret briefings meant to educate them about outsiders trying to penetrate lawmakers' computers and steal sensitive information.

Despite "repeated assurances" that the House leadership would inform members of Congress about threats to their computer systems and personal electronic devices, members are still at risk of being hacked by foreign and domestic sources, Wolf wrote in a letter sent to House Speaker Nancy Pelosi and other leaders. In September of last year, the Republican and Democratic caucuses held classified briefings for lawmakers about cyber risks, but "the meetings were sparsely attended," Wolf wrote. "I fear that Members are no better informed today than they were before."

Because so few members showed up, Wolf wants to require mandatory briefings. He has proposed including language to that effect in the rules package set to be adopted Tuesday during the first meeting of the new Congress. Wolf suggested that the meetings address "threats to House information security, threats to information security when members travel abroad, and measure being taken [to] secure House computer networks and electronic devices."

Last year, Wolf announced that his office's computers had been compromised by sources he believes reside in China. Seven other members' office computers, as well as those in eight committee offices, were infected with a virus designed to covertly remove files and track what a user writes in e-mail or text messages. After the electronic break-ins, Wolf said that few of his colleagues understood that sensitive information contained on their computers was accessible to outsiders.

"This is a serious issue, and we have got to have bipartisan participation," said Daniel Scandling, Wolf's chief of staff. "If someone physically broke into a member's office and took something, people would be up in arms. But we're turning a blind eye to information being swiped off of computers."

Lights Are Going Out All Over Europe

European nations are alarmed at the recent increase in probes, via the Internet, of public utilities (electricity, water, sewage, transportation). Cyber War experts are divided on whether this is just the next big thing in criminal activity (finding out how to shut down utilities via the Internet, then using the threat of that to extort money), or military Cyber War operations, scouting utilities in anticipation of damaging them in wartime or a time of crises.

A lot of these probes can be traced back to the usual sources (China, Eastern Europe and the Middle East), the places where many of the Internet based criminal gangs hide out. So far this year, there has been an increase in probes, but not attacks. At least as far as anyone knows. However, the most professional Internet attacks are unnoticed (as the intruder gets away with data, or a deep understanding of how the target site operates, and thus a good knowledge of how to take it down.) Utilities, and large corporations in general, are being urged (and sometimes ordered) to check, and double check, the adequacy of their Internet defenses.

Air Force suspends Cyber Command program

The Air Force on Monday suspended all efforts related to development of a program to become the dominant service in cyberspace, according to knowledgeable sources. Top Air Force officials put a halt to all activities related to the establishment of the Cyber Command, a provisional unit that is currently part of the 8th Air Force at Barksdale Air Force Base in Louisiana.

An internal Air Force e-mail said, “Transfers of manpower and resources, including activation and reassignment of units, shall be halted.”

Establishment of the Cyber Command will be delayed until new senior Air Force leaders, including Chief of Staff Norton Schwartz, sworn in today, have time to make a final decision on the scope and mission of the command.

The Cyber Command, headed by Maj. Gen. William Lord, touted on its Web site its capabilities to “secure our nation by employing world-class cyberspace capabilities” and had ambitious plans to have a cyber command presence in all 50 states.

The Cyber Command hyped its capabilities on TV, in Web video advertisements and in a series of high-profile presentations conducted by Lord.

The hard sell may have been the undoing of the Cyber Command, which seemed to be a grab by the Air Force to take the lead role in cyberspace. Both the Army and Navy have similar expertise in cyber operations, service sources said.

Philip Coyle, senior adviser with the Center for Defense Information, a security policy research group in Washington, said he believes the Navy’s Network Warfare Command and the Space and Naval Warfare Systems Center have led the way in cyberspace. The Army engages in cyberspace operations daily in Afghanistan and Iraq, said Coyle, who served as assistant secretary of Defense and director of its operational test and evaluation office from 1994 to 2001.

The decision to ratchet back the Cyber Command may have come from Adm. Mike Mullen, chairman of the Joint Chiefs of Staff, who wants to see a greater role for the Navy in cyberspace, said an Air Force source. Coyle speculated that the Air Force may have been too public in pushing the Cyber Command and is now suffering from its own hubris.

The decision to pull the plug on the Cyber Command – even temporarily – is just the latest in a string of bad news for the service, Coyle said. This includes Defense Secretary Robert Gates' request in June for the resignations of Air Force Chief of Staff T. Michael “Buzz” Moseley and Air Force Secretary Michael Wynne because of the service’s poor management of nuclear weapons. Also in June, the Government Accountability Office questioned the Air Force’s selection of Northrop Grumman over Boeing for a multibillion-dollar aerial refueling contract and recommended that the service reopen the competition. It did so in July.

Hoo-ah: 741st Network Warfare Battalion, U.S. Army

The U.S. Army has activated its first Network Warfare Battalion (741st Network Warfare Battalion). The unit will not operate together, but mostly as many detachments, supporting combat forces in Iraq and Afghanistan, counter-terror operations throughout the world, as well as in joint Cyber War operations with other services and foreign countries. The battalion belongs to the 704th Military Intelligence Brigade, which is in turn subordinate to INSCOM (the U.S. Army Intelligence and Security Command).

All the services are making a major effort to develop defensive and offensive Cyber War weapons. The U.S. Air Force has established a major command (involving over 20,000 specialists) for this, and is attempting to become the lead for all Department of Defense Cyber War activities. The other services oppose this attempt to take over, although they appreciate air force efforts to develop new tools and capabilities. The army and navy both have thousands of troops, in many different units, working on Cyber War activities. Creating major units (battalions and larger) dedicated to Cyber War, is a new development.

Hoo-ah: The 50-State Strategy to Sell Cyber Command

The 50-State Strategy
to Sell Cyber Command
BY BOB BREWN, BBREWIN@GOVEXEC.COM

One way to secure the Hill's backing -- and bucks -- for any new program is to spread it over as many states and congressional districts as possible. The new Air Force Cyber Command takes this approach to its ultimate limit: The service plans a cyber unit in every state, according to a briefing given in April by Maj. Gen. William Lord, the Cyber Command chief. The briefing was sent to me by a source who chooses to remain anonymous.

The very crowded slide of the 50 states that Lord presented at the Scope Warrior Spring Symposium, a gathering of top Air Force communications and information technology folks, looks like a bit of cyber-rebranding of the service's existing IT functions.

The majority of the sites, which will come under the Cyber Command umbrella, are designated as so-called network operations, a fancy way to describe the circuits and connections that already exist to serve those bases. While this is just putting a new name on old operations, it helps to include all 50 states in the count, which then bolsters the sales job.

The real centers of power, in what Lord called in his slides “AF Distributed Cyber Enterprise,” are eight bases located in the East, Midwest and South:

Networked Computer Operations:
Bolling Air Force Base, Washington

Theater Operations Integration:
Langley Air Force Base, Va.

Information Systems:
Rome Laboratory, N.Y.

Cyber Operations Integration:
Barksdale Air Force, La.

Information Operations:
Lackland Air Force Base, Texas

Space Operations Integration:
Peterson Air Force Base, Colo.

Global Operations Integration:
Offutt Air Force Base, Neb.

Global Networks:
Scott Air Force Base, Ill.

Then there’s the command's new headquarters, which has sparked a sweepstakes that at least 18 states have entered. The Air Force plans to announce in September 2009 its decision on where to locate the headquarters.

I guess the consolation prize will be one of the smaller, rebranded cyber units the command has decided to sprinkle around the country.

It’s About Network Attack

During the past year, the Air Force has made it clear that the primary focus of the new Cyber Command will be the ability to attack an enemy’s networks, and Lord’s presentation reinforces this point.

In a slide under the heading of "Global Power," network and electronic attack capabilities take precedence over cyber deterrence. Lord emphasized that the command’s mission is to “provide robust, survivable access to cyberspace, with offensive and defensive capabilities.”

I'm hopeful that the Cyber Command can work out a way to conduct these attack missions without knocking out the 6 million Web pages linked to Paris Hilton and the 2 million or so Web pages dedicated to tracking the ups and downs of Britney Spears.

New Jobs, New Slogan, New Badge

It’s hard to have a cyber command without cyber warriors. To that end, Lord disclosed that the Air Force plans to develop a cyber career field for officer, enlisted and civilian personnel that will subsume venerable specialties in the communications and electronics field under the new cyber brand.

Lord also floated what could be a new slogan for the Cyber Command: "Transforming Warfare . . . Byte By Byte." I love it. It's punchy, to the point and better than a mission statement.

But you can’t set up a new command without a new badge, and Lord unveiled the cyber operator badge, which has what looks like four satellite orbits spaced evenly around the globe on what is the original Air Force badge.

Cyberattack Gets Worse

Many U.S. legislators have complained that their computers were infected by eavesdropping software inserted by hackers traced back to China.

There was a similar flap over two years ago. Back then, there was enough proof to know that China was behind the increasing number of Internet based attacks, but not enough to call China out on it.

This all began about eight years ago, with an increasing number of very well executed Internet attacks hitting U.S. government (especially Department of Defense) computers. Analysis of these attacks indicated that the hackers appeared to be coming from China. At first, it was thought to be adventurous computer science students, or criminals out to steal something they could sell.

Then, in 2003, came the "Titan Rain" incident. This was a massive and well organized attack on American military networks. The people carrying out the attack really knew what they were doing, and thousands of military and industrial documents were sent back to China. The attackers were not able to cover their trail completely, and some of the attackers were traced back to a Chinese government facility in southern China. The Chinese government denied all, and the vast amounts of technical data American researchers had as proof was not considered compelling enough for the event to be turned into a major media or diplomatic episode.

In the wake of Titan Rain, governments around the world began to improve their Internet security. But not enough. The attacks kept coming. Out of China. And the attackers were getting better. In 2005, a well organized attack was made on the networks of the British parliament. This time, the defense won the battle. Mostly. The carefully prepared emails (with virus attached), would have fooled many recipients, because they were personalized, and this helped prevent network defenses from detecting the true nature of these messages. These targeted emails from hackers were very successful. If the recipient tried to open the attached file, their computer who have hacking software secretly installed. This software would basically give the hacker control of that PC, making it possible to monitor what the user does on the computer, and have access to whatever is on that machine.

While many recipients sense that the "spear fishing" (or "phishing") attack is just that, some don't, and it only takes a few compromised PCs to give someone access to a lot of secret information. This would be the case even if it is home PCs that are being infected. The recent complaints from American legislators is all about that, as they have discovered office and personal PCs of themselves and their staffers infected.

But many other attacks are only discovered when they are over, or nearly so. The attackers are very well prepared, and usually first make probes and trial run attacks on target systems. When the attackers come in force, they don't want to be interrupted. And usually they aren't. The Chinese attackers use techniques similar to those employed by criminal gangs trying to get into banks, brokerages and big businesses in general. Thus it is believed that the Chinese hackers try, as much as possible, to appear like just another gang of cyber criminals. But the Chinese have certain traits that appear more military than gangster.

The Chinese cyber army keeps getting better, and that includes covering their tracks. It may take a defector or three to make it definite that China is waging a stealthy war over the Internet. Meanwhile, the Chinese reap enormous economic and political benefits from their raids on economic and technical secrets in the West.

Info security chiefs weigh new approaches to looming threats

Info security chiefs
weigh new approaches to looming threats
BY TOM SHOOP 06/05/08

What federal agencies don’t know about protecting their data and computer systems could really hurt them, senior federal information security professionals said on Thursday.

“It’s like the days prior to Pearl Harbor and 9/11,” said Daniel Galik, chief information security officer at the Health and Human Services Department, at a breakfast seminar sponsored by Government Executive. “We have some very serious challenges. The attacker is several steps ahead of us across the board.”

Bruce McConnell, former chief of information and technology policy at the Office of Management and Budget who currently runs a consulting firm (and contributes to the Tech Insider blog at Nextgov), called the situation an “invisible crisis.” Agencies, he said, have long been operating in an “inherently insecure environment,” and “the sheriff has not shown up yet.”

“There’s so much we don’t know” about threats to federal systems, added Marian Cody, CISO at the Environmental Protection Agency. Cody added that at one point, her agency’s systems were taken offline for a week after an audit showed vulnerabilities. It took more than a year, she said, to completely restore the systems.

Galik said the 2002 Federal Information Security Management Act, under which agencies are issued grades based on their level of compliance with security directives, “set a good foundation,” but is “very labor-intensive on the administrative side.” He argued for the creation of a governmentwide operational security report card, detailing information on incidents across agencies to give an overall security picture.

Cody defended the FISMA process, saying, “we’ve got that part down pat. I don’t want to see it changed.” Her office, she said, has forged a strong working relationship with the agency’s inspector general, giving officials in the IG’s office open access to EPA’s security information system so they can work cooperatively with managers to assess threats and identify vulnerabilities.

But, Cody said, “I’m not a proponent of sending operational security reports to OMB.”

Both Cody and Galik expressed concern over user behavior that jeopardizes security. When it comes to weighing the threat inherent in actions such as clicking on links in e-mail messages, “many users are not wrestling with it at all,” Galik said.

Cody said many EPA employees assume that when they access the agency’s network, their actions are private. “That’s completely shocking to me,” she said.

Why is Oklahoma/Tinker NOT going after this Cyber Command Sweepstakes !

One has to ask why Oklahoma/Tinker is not going after this ?

Eighteen states are vying to become the home of the headquarters for the coveted Air Force Cyber Command. So, on May 15, William Anderson, assistant secretary of the Air Force for installations, environment and logistics, sent a letter to the governors, asking them to provide details that will help the service make its decision.

The letter, which a source was kind enough to send me, notes that the unique nature of the cyber domain dictates that the candidates have a complete understanding of the supporting capabilities of headquarters bases and their surrounding communities. Anderson included in the letter a checklist of requirements.

These included the ability of the new HQ to work easily with other Air Force commands near the Cyber Command that are engaged in activities such as intelligence and space operations. The new Cyber Command HQ also will require an extensive high-speed network, including state-of-art secure fiber networks and connections to unclassified and classified Defense networks.

The Air Force wants to locate the HQ in a low-threat environment that's close to new technology corridors and IT centers of excellence.

Anderson asked the governors to reply by July 1. The Air Force intends to tour cyber HQ sites this summer and to draw up a short list of locations by November. The process then will slow down (probably to hear from aggrieved members of Congress whose states did not make the short list), with a final selection made in September 2009.

States competing for the Cyber Command HQ are: Alabama, Arkansas, California, Colorado, Iowa, Louisiana, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, New Jersey, New Mexico, Ohio, Pennsylvania, Texas, Utah and Virginia.

It's About Cyber Attack,
Not Cyber Defend

The attachments to Anderson's letter make it clear that the key mission of the Cyber Command will be to cyber attack, not cyber defend -- a position the Air Force has emphasized during the past year. A paper, titled "Proposed Purpose and Need for Air Force Cyber Command," which Anderson sent to the governors, said the command will work to "influence, disrupt, corrupt or usurp adversarial human and automated decision-making while protecting our own."

You can't set up a new command without doing the vision thing, and the vision for the Cyber Command is to "help secure our nation by employing world-class cyber capabilities to dominate the cyberspace domain, [and] create effects worldwide," the paper noted.

And, if you're doing the vision thing, make sure it's "through a holistic, agile and evolutionary approach to science and technology, research and development, systems acquisition, operations, force structure" etc. etc. I could really score high on buzzword bingo with these two paragraphs.

Cyberattacks on Tibet groups

Malicious e-mail and other cyberattacks on Tibet advocacy groups in the United States are linked to Internet servers used in past hacker intrusions traced by U.S. law enforcement to China.

The link, made by security experts on the basis of publicly available data, is the first direct evidence the recently intensified attacks against the Tibet groups, reported by United Press International a week ago, were launched from China. But it remains unclear to what extent -- if any -- the Chinese government or military is implicated.

The news follows charges last week from the Save Darfur Coalition, a group opposing Chinese policy in Darfur, they had been the target of intrusion attempts "which appeared to originate in China and seemed intent on subversively monitoring, probing and disrupting coalition activities."

The recent cyberattacks on several Tibet groups were analyzed by a security researcher for the SANS Internet security organization, Maarten Van Horenbeeck, who followed cyberattacks against Tibet organizations, and advocates for other Chinese ethnic groups such as the Uighurs, for many years.

Van Horenbeeck told United Press International that the attacks used e-mails purporting to come from known associates of the victims with attachments containing malicious code -- so-called Trojan horse software -- that stole e-mail and contact data, passwords and other information and covertly sent it on the Internet to special command servers. One domain address that came up as the destination for data stolen from supporters of the Students for a Free Tibet group was familiar to him. Cvnxus.8800.org has been used by hackers "again and again" over the years, he said.

Since earlier this month, the domain has been "moving around," he said. But until March 8, it was based on a server previously identified by the FBI as the source for an e-mail attack aimed at U.S. defense contractors launched in August last year, according to a report from the Air Force Association.

The link, though a narrow one, is significant because of the well-acknowledged difficulty of attributing cyberattacks. Hackers can take control of computers, or even whole servers, without the knowledge of their owners and use them to launch attacks.

China has some of the world's tightest government restrictions on the use of the Internet, which makes many observers skeptical hacker gangs could operate from within China without government approval or acquiescence.

The attacks against the Tibet groups were "very professional and well-coordinated," Van Horenbeeck said, though he said no definitive evidence linked the Chinese government to the attacks.

Some of the e-mails used highly sophisticated "social engineering techniques" to trick their victims into opening the attachment, he said.

Rather than just faking the e-mail address of an associate as the sender of a general message, these e-mails would refer to discussions that the intended victim had conducted with that associate on open Internet bulletin boards or e-mail lists, Van Horenbeeck said, suggesting the hackers had done a great deal of research on individual targets.

"These were very sophisticated," he said, adding that unlike conventional hacker attacks, these were not aimed at defacing the group's Web site or driving it offline with a series of crude denial-of-service bombardments. "These attacks were designed to steal data," he said.

He said they might also be designed to "disrupt (the groups') operations by making people wary of using their e-mail, which is a vital tool for their coordination."

Some of the attacks did seem designed to undermine trust in e-mail. Last week a security professional working with one group posted a message to a Tibet discussion list warning people to expect an increase in e-mail and other attacks. The following day hackers sent another message, faked to look as if it came from the same address, containing a security document as a Word attachment. The attachment contained a Trojan horse malware package, Van Horenbeeck said.

Similarly sophisticated social engineering techniques were noted by security researchers at MessageLabs last month in e-mail malware sent to members of an Olympic committee.

"These are otherwise perfectly valid documents," Maksym Shipka, senior architect at MessageLabs, told SCMagazine, an IT security trade publication. "It's real information. It's a continuation of actual email conversations. Yet the document is bad."

Shipka said the e-mail was so convincing that recipients forwarded it to other members of the committee.

The Trojans and other malicious software used in the Tibet attacks are similar to those used in attacks against the unclassified computer networks of U.S. defense contractors, the Department of Energy's nuclear labs and other sensitive government agencies, but experts caution against reading too much into this, saying that the software is easily available on hacker Web sites.