The first global cyber war has begun

[Saurian Tail]

John Robb at Global Guerrillas has done a couple posts on cyberwar ... pointing out the chilling reality that anyone can participate.

Friday, 15 June 2012

The US Started a New Arms Race: Everyone is Invited to Join

Last week, I wrote about how with the release of Stuxnet and Flame (and the disclosure that the US was behind it), would open Pandora's box. How?

1. Proliferation. Every other country would see it as a green light to openly develop their own cyberweapons and USE them.

2. Accelerated pace. It would radically advance the state of the art in cyberweapons (both for other countries and any small group that was smart enough to do so) since the code would be available to nearly everyone for reverse engineering.

3. Accidents/failures. Since these weapons self-replicate, it makes it much more likely we'll see run-away disasters (small group/nation builds a weapon based on US/Indian/Chinese design with mods and no fail safe).

So, it was no surprise to read that India is now in the process of greenlighting offensive cyberweapon development and use.

Unfortunately, the opportunity to negotiate and push forward a global moratorium on cyberweapon development has been rejected.

Too bad.

However we should have expected this given how badly we screwed up in Iraq and Afghanistan, and our inability to learn from it. For example, the smart team of folks doing the yeoman's work to keep counter-insurgency theory alive in the DoD, to avoid another Iraq or Afghanistan in the future, is micro-scopic and about to get cut.

In this case, the attractiveness of a cyberweapon (seemingly low cost for meaningful results) overwhelmed any concerns about the negative effects. Why?

It's simple. The decision makers weren't warned about any negative effects, since the knowledge of open source warfare theory required to see negative effects doesn't exist in their advisor pool from the DoD/NSA/CIA.

In fact, these agencies don't even recognize "warfare" as a discipline worthy of study (which is kind of like a doctor rejecting biology as something useful). Instead, the advice they offer is from lawyers, political scientists, and technologists (cybersecurity types). See the disconnect? They don't even have military historian on hand.

What are the negative effects decision makers should have been apprised of?

The major one is that we have now launched a new global arms race. A race to build the perfect cyberweapon.

- A weapon that can hide, spoof, and mimic (check out the attributes of Storm)
- A weapon that can evolve. Weapons that are built to break specific, critical systems at a deep level.
- A weapon that has increasingly has the capacity to make decisions (the code will increasingly mimic nature -- insects/rats)
- To make it worse, this is an arms race that EVERYONE with the smarts and training required can participate in.

It's an open source arms race.

- An arms race where the basic plans for every new weapon is released to the public when the weapon is used.
- Plans that can be reverse engineered and shared with everyone on earth.
- Plans that can yield copies of the weapon that will be sold to everyone that wants to buy it.

It's going to an interesting decade.

http://globalguerrillas.typepad.com/glo ... eedfetcher

[seemslikeadream]

October 11, 2012, 9:47 PM ET
U.S. Defense Chief Warns of Digital 9/11
Rachael King
Reporter

The scale and speed of cyber attacks is escalating and companies face more risk than ever before. Armed with technology that can help attribute attacks, the United States now has the capacity to locate attackers and hold them responsible, said U.S. Secretary of Defense Leon Panetta, Thursday night, in his first policy speech on cybersecurity. The Department of Defense is also updating its rules of engagement and procedures that guide a potential military response to a cyber attack.

Senior defense officials say a sophisticated virus attack against Saudi Arabian state oil company ARAMCO in August is an example of this escalation. “All told, the Shamoon virus was probably the most destructive attack that the private sector has seen to date,” said Leon Panetta, U.S. Secretary of Defense in his first policy speech on cybersecurity. Secretary Panetta spoke Thursday night at a Business Executives for National Security dinner.

The Shamoon virus attacked 30,000 Saudi ARAMCO workstations and replaced crucial system files with an image of a burning U.S. flag. That virus added false information that overwrote all of the real data on those machines. The government declassified information to help the public understand the magnitude of the threat.

On August 26, Saudi ARAMCO said it had replaced those workstations but that as a precaution, had also restricted remote Internet access to the Web. Saudi Aramco said its primary corporate systems that handle hydrocarbon exploration and production operate on isolated network systems so they weren’t impacted.

The attack on Saudi ARAMCO is just one of a number of attacks in recent months. Days after the ARAMCO incident, Ras Gas, a major energy company in Qatar, experienced a similar attack.

Here in the U.S., attacks on large financial institutions during the last two months have delayed or disrupted services on customer Web sites. Secretary Panetta said the scale and speed of those attacks was “unprecedented.”

Cyber attacks against companies are on the rise. In 2012, organizations have experienced an average of 102 successful attacks per week, compared to 72 attacks per week in 2011 and 50 attacks in 2010, according to the new 2012 Cost of Cyber Crime Study from the Ponemon Institute and H-P. The average annualized cost of cybercrime to U.S. organizations is now $8.9 million, up 6% from last year.

While recent attacks concern defense officials, the worry is that there could be even more destructive scenarios. “We know that foreign cyber actors are probing America’s critical infrastructure networks,” said Secretary Panetta. Those hackers are trying to access computer control systems that operate chemical, electricity and water plants as well as those that guide transportation systems, he said. “We know of specific instances where intruders have successfully gained access to these control systems,” he said.

Secretary Panetta said the Department of Defense is finalizing the most comprehensive change to the rules of engagement in cyberspace in seven years. “The new rules will make clear that the Department has a responsibility not only to defend DoD’s networks, but also to be prepared to defend the nation and our national interests against an attack in or through cyberspace,” he said.

[slimmouse]

Hes probably referring to those dastardly encryption and proxy provider terrorists who allow people to build a website exposing charlatans such as Panetta for just what they are, without having access to their site blocked, or their email, and stuff like that.

After all if enough people knew the truth, then peace might break out, and that would never do now, would it ?

[Ben D]

Seems someone is trying to point the finger at Iran for these Gulf cyber attacks...

http://www.haaretz.com/news/middle-east/former-u-s-official-iranians-believed-to-be-responsible-for-persian-gulf-cyber-attacks-1.469625

[Forgetting2]

Seems someone is trying to point the finger at Iran for these Gulf cyber attacks...

http://www.haaretz.com/news/middle-east/former-u-s-official-iranians-believed-to-be-responsible-for-persian-gulf-cyber-attacks-1.469625

The US is always pointing it's finger at Iran and everyone is always looking at the finger.

[Ben D]

Seems someone is trying to point the finger at Iran for these Gulf cyber attacks...
http://www.haaretz.com/news/middle-east/former-u-s-official-iranians-believed-to-be-responsible-for-persian-gulf-cyber-attacks-1.469625

The US is always pointing it's finger at Iran and everyone is always looking at the finger.

Yes, and it's not as though everyone isn't aware of the incessant news of cyber attacks against Iran nuclear facilities and other infrastructure, so even if they were developing the skills, it shouldn't surprise anyone, global cyber war has begun as far they're concerned.

[elfismiles]

Report: French officials accuse US of hacking Sarkozy's computers
By Julian Pecquet - 11/20/12 05:59 PM ET

The United States used U.S.-Israeli spy software to hack into the French presidential office earlier this year, the French cyberwarfare agency has concluded, according to the newsmagazine l'Express.

The magazine reported late Tuesday that the computers of several close advisers to then-president Nicolas Sarkozy – including Chief of Staff Xavier Musca – were compromised in May by a computer virus that bears the hallmarks of Flame, which was allegedly created by a U.S.-Israeli team to target Iran's nuclear program. Anonymous French officials pointed the finger at the United States.

“You can be on very good terms with a 'friendly' country and still want to guarantee their unwavering support – especially during a transition period,” an official told the magazine. The alleged spying attack took place a few days before the second round of the French presidential elections, which Sarkozy lost to Francois Hollande, a socialist.

Homeland Security Secretary Janet Napolitano reportedly did not deny the allegations when asked point-blank about them.

“We have no greater partner than France, we have no greater ally than France,” Napolitano reportedly answered, at the opening of an interview with l'Express. “We cooperate in many security-related areas. I am here to further reinforce those ties and create new ones.”

In the interview, Napolitano also said that the Flame and Stuxnet viruses had “never been linked to the U.S. government.”

The White House did not return a request for comment from The Hill.

Parts of this article have been translated from the French.

http://thehill.com/blogs/global-affairs ... -computers

[Luther Blissett]

This thread needs to be tied to some of the fine data collected on Aaron Swartz's thread.

[JackRiddler]

There's also the new thread about Anonymous supposedly declaring war on the US over Swartz and hacking into Fedwire, also apparently releasing 4000 bankers' contacts. See cross-post below.

And unexpectedly for RI no one's posted here or started a new one about the NY Times allegations that Chinese hackers have been attacking it for many months. Which is feeding into an MSM frenzy on China and ongoing or imminent cyberwar. (Such as has been previewed and promoted since the 1990s with Richard Clarke in the lead, of course.) And the announcement today that federal government wants to reserve the right of preemptive cyberattack to prevent cyberattacks!

Also, sister thread bumped with story comparing EU to US data privacy and disclosure regulations:

Threats to Internet Freedoms (consolidation thread)
viewtopic.php?f=8&t=32101&p=491168#p491168

Rumor: Fedwire Hacked?
posting.php?mode=quote&f=8&p=491155
Thanks to seemslikeadream

OP:

Rumor: Fedwire Hacked?

I got a rumble on this over the weekend, but now I have a second source saying the same thing, and it's important enough to report -- although I must emphasize that this is a rumor at this point.

The claim is that "someone" hacked Fedwire.

That, for those who don't follow such things, is how money clears in the wire market. It's the central circulatory system for, well, basically everything. This one didn't come from China, I suspect, since they'd be out of their minds to want to disrupt the circulatory system that feeds their trade engine.

Remember that recently Anonymous "declared war" on the United States over Schwartz's suicide. If this is an opening salvo things are about to get rather interesting -- and the multiple warnings that I and a number of others have raised about the "ho-hum" approach to security that an awful lot of firms and government agencies have indulged themselves in over the last couple of decades may be coming home to roost.

Note: There is a (thus far small) pickup in the media on this. Watch this one closely...

Anonymous posts over 4000 U.S. bank executive credentials
Summary: Anonymous appears to have published login and private information from over 4000 American bank executive credentials its Operation Last Resort, demanding US computer crime law reform.


By Violet Blue for Zero Day | February 4, 2013 -- 07:28 GMT (23:28 PST)

Following attacks on U.S. government websites last weekend, Anonymous seems to have made a new "Operation Last Resort" .gov website strike Sunday night.

Anonymous appears to have published login and private information from over 4,000 American bank executive accounts in the name of its new Operation Last Resort campaign, demanding U.S. computer crime law reform.


A spreadsheet has been published on a .gov website allegedly containing login information and credentials, IP addresses, and contact information of American bank executives.

If true, it could be that Anonymous has released banker information that could be connected to Federal Reserve computers, including contact information and cell phone numbers for U.S. bank Presidents, Vice Presidents, COO's Branch Managers, VP's and more.

The website used in this attack belongs to the Alabama Criminal Justice Information Center (ACJIC). The page extension URL is titled, "oops-we-did-it-again."


The spreadsheet document contains usernames, names of individuals and their titles at banks across the U.S., hashed passwords (not passwords in plain text). It was placed on a .gov website and on Pastebin, and publicized via various Anonymous accounts on Twitter and Facebook.

A Reddit member called the numbers and commented,

OK, I called a few of them. What must be so problematic for the Federal Reserve is not the information so much as this file was stolen from their computers at all.

The ramifications of that kind of loss of control is severe.
Banks listed on the document claim credentials from management at community banks, community credit unions, and more, across the United States.

A visit to the bank websites on the document shows that these are current employees at each of the banks.

Anonymous stated in its first Operation Last Resort defacement last friday (ussc.gov) it had infiltrated multiple federal websites over a period of time. The hacktivist entity dropped enough technical details to make it clear that its tracks were covered and that Anonymous still had access to .gov websites.

Significance of Monday, February 4?

While today in the United States it is the day of a major American sporting event (the Superbowl), this Sunday night's timing of Anon's document release coincides with another event more important to the new Anonymous campaign Operation Last Resort - a campaign anchored on the Swartz tragedy.

After the Anonymous OpLastResort hacks last weekend, last Monday a House panel issued a letter to Attorney General Eric Holder (.pdf link) with seven specific questions, and demanding answers regarding the Swartz prosecution.

Tomorrow, Monday February 4, is the deadline for Attorney General Eric Holder to answer specific questions regarding the Aaron Swartz prosecution.

Anonymous may be focusing on that deadline, as well.

Previously on the defaced ussc.gov website Anonymous cited the recent suicide of hacktivist Aaron Swartz as a "line that has been crossed."

The statement suggested retaliation for Swartz's tragic suicide, which many - including the family - believe was a result of overzealous prosecution by the Department of Justice and what the family deemed a "bullying" use of outdated computer crime laws.

With the letter to Holder, the House Oversight and Government Reform Committee requests a briefing with the Justice Department. CNET writes,

"Many questions have been raised about the appropriate level of punishment sought by prosecutors for Mr. Swartz's alleged offenses, and how the Computer Fraud and Abuse Act, cited in 11 of 13 counts against Mr. Swartz, should apply under similar circumstances," [Reps. Issa and Cummings] say in the letter, which requests a briefing no later than February 4.
The letter is another voice from the Federal side of the discussion, joining a chorus led by Democratic congresswoman Rep. Zoe Lofgren who has authored a bill called "Aaron's Law" that aims to change the 1984 Computer Fraud and Abuse Act (with which Swartz was being prosecuted).

Last friday February 1, Lofgren submitted a draft of the bill to be reviewed on Reddit. Ars Technica reported that after its online critique, a revised version of the bill was published today, with more far-reaching reforms.

Read more: Feds stumbling after Anonymous launches 'Operation Last Resort'
Last weekend Anonymous commandeered the US Sentencing website to launch Operation Last Resort "warheads" (encrypted files suggested by Anonymous to be sensitive US government documents).

The defacement demanded reform on US computer crime laws, citing the January 11 tragic suicide of young hacker and digital rights activist Aaron Swartz.

See also: Anonymous hacks US Sentencing Commission, distributes files
Tragedy cited as cause behind the attacks: Hacker, Activist Aaron Swartz Commits Suicide
Anonymous spent last weekend playing cat-and-mouse with the Department of Justice after taking over the ussc.gov website (still decimated and now "under construction" over a week later).

After the US government regained control of the .gov website used in the hacks and defacements, Anonymous regained control of two .gov sites and turned the sites into a mocking video game of Asteroids.

Public interest in Sunday's Asteroids game created a crowdsourced DDoS, downing the websites for days.

It is possible that banks and user information on tonight's new "oops we did it again" document may be connected to accounts at The Fed (The Federal Reserve Bank).

The Fed has a collection of services called Fedline, which operates at highly critical junctures across the U.S. banking system.

For instance, one of the services offered by Fedline is money and funding transfers via the U.S. Federal Reserve.

It enables financial institutions to transfer funds between member participants. These participants are estimated to be around more than 9,000 financial entities (such as banks).

Fedline is the primary U.S. network for high value, time-critical and international payments.

In 2007 the estimated average daily value of funds transferred via Fedline products was 2.7 trillion (an estimated 537,000 payments daily, the average was over $5 million per transaction).

At this point, the information on the document is unverified and exactly what banking systems the information may affect is not known. ZDNet will update this article with new information as it becomes known.

The Operation Last Resort video, posted Friday on the U.S. Sentencing Commission website now has 1,183,000 views.

It is interesting to note that this second "official" #OpLastResort salvo does not cite AntiSec, as seen in the Asteroids game.

Anonymous appears intent to influence federal action - one way or another.

2nd post:

Anonymous Claims It Hacked Fed, Releases Confidential Banker Information
Submitted by Tyler Durden on 02/04/2013

A year and a half ago, when the hacker group Anonymous launched its anti-Bernanke, anti-Fed campaign dubbed Operation Empire State Rebellion (or OpESR), we stated, rhetorically and jokingly, that "perhaps in the aftermath of the IMF "very major breach" by anonymous hackers, it is really time to make sure all external access points to FedWire and FedLine are truly safe and sound. It will be very sad if it is uncovered that this source of externally accessible portal to hundreds of billions in emergency Fed funding has been somehow compromised. Just imagine the loss of confidence in the system... Why, a global distributed attack would really stretch the Fed's 1,200-strong police force quite thin." It appears that either FedWire or FedLine may not have been "truly safe and sound" after all.

Recall that a week ago in retribution for the suicide of Aaron Swartz, Anonymous launched yet another "operation" this time titled "Last Resort", as a result of which it hacked the Department of Justice and released a 1.3 GB folder of still encrypted "warhead" data containing files each named for Supreme Court Justices. And while there has been no additional disclosure on this latest operation, Anonymous may have reverted to the mothballed OpESR, by hacking none other than the Fed.

As ZD reports, last night Anonymous once again hacked a .gov site, this time the Alabama Criminal Justice Information Center (ACJIC). But it was not the site hacked that was material, but rather what was posted on it. What was posted is an extended data dump sheet, titled "oops we did it again" which lists some 4,606 rows of confidential credential data including titles, names, addresses, emails, phone numbers, logins, password hashes, and much more. The spreadsheet can be found at this link.

And while the data contains primarily B-grade information, with no New York bank disclosure at least on a cursory check, a more important question is where was this data sources. Anonymous itself provides a clue in a tweet from last night:

====

In other words, to Anonymous this is merely an escalation of its Anti-DOJ campaign demanding structural changes (good luck) as retribution for the Swartz death. It is unlikely it will get them.

What is curious, however, is if Anonymous really did penetrate one of the Fed's critical money clearing networks, and if indeed it has access to key financial data at the granular, regional bank level. A bigger question then is just how much more Fed-level access does Anonymous have, and will it resort to it as its demands are unmet by the DOJ in the coming days. Or in other words, what else can and will Anonymous release?
-
http://www.zerohedge.com/news/2013-02-0 ... nformation

[slimmouse]

I think what might really worry these guys is that if anonymous can get this kind of information, then is the account information about everyday bank transactions, records, balances, etc really safe?

That would offer some real bargaining power against the monsters.

[dqueue]

And unexpectedly for RI no one's posted here or started a new one about the NY Times allegations that Chinese hackers have been attacking it for many months. Which is feeding into an MSM frenzy on China and ongoing or imminent cyberwar and the announcement today that federal government . (Such as has been previewed and promoted since the 1990s with Richard Clarke in the lead, of course.) And stories today about how the admin wants to reserve the right of preemptive cyberattack to prevent cyberattacks.

Add to that Wall Street Journal, and Washington Post. Both publications followed with the New York Times coverage, indicating, they, too, were targets of sophisticated attacks.

[JackRiddler]

http://arstechnica.com/tech-policy/2013 ... r-attacks/

President given “broad authority” to order cyber attacks
All he needs is credible evidence of a pending attack.

by Sean Gallagher - Feb 4 2013, 12:10pm EST

The New York Times reports that a secret White House legal review has cleared the way for preemptive cyber attacks if the president determines there is credible evidence of a pending attack. Officials who had been involved in the review told The Times' David Sanger and Thom Shanker that the new rules give the president "broad power" to order computer-based attacks on adversaries that disrupt or destroy their systems, without requiring a declaration of war from Congress. The rules also govern how intelligence agencies can monitor networks for early warnings of imminent attacks, and when the Department of Defense can become involved in dealing with domestic network-based attacks.

The rules will leave the Department of Homeland Security and FBI responsible for defending US government and commercial networks from attack up to a certain threshold—the exact nature of which is being kept secret—after which the Department of Defense would become involved. The DoD would only be allowed to take offensive action with direct presidential approval.

News of the ruling comes on the heels of reports of major computer-based attacks on the New York Times, the Wall Street Journal, and the Washington Post, all of which were attributed to state-sponsored hackers in China.

So far, the only software-based attack that has been attributed to the US (though never officially acknowledged by the US government) has been the Stuxnet virus, which was reportedly codeveloped with Israeli intelligence to disable production equipment in an Iranian nuclear facility. Other sophisticated malware attacks, such as Flame, Duqu, and Gauss have not been definitively tied to the US, but analysts at Kaspersky Labs and other antivirus and network security firms have described them as "state-sponsored."

I suspect this is one of those legalizations of Shit They've Done Forever. So now they can pretend they didn't before. Kind of like broadbased warantless wiretapping prior to 9/11, Echelon, Carnivore, etc.

For reference, prior Stuxnet discussion
http://rigorousintuition.ca/board2/view ... =8&t=29540

[hanshan]

...


http://arstechnica.com/security/2013/03/for-first-time-us-military-says-it-would-use-offensive-cyberweapons/

For first time, US military says it would use offensive cyberweapons

The military is assembling 13 teams of programmers dedicated to offensive attacks.

by Dan Goodin - Mar 13 2013, 8:29am MDT

For the first time ever, the Obama administration has publicly admitted to developing offensive cyberweapons that could be aimed at foreign nations during wartime.

According to an article published Tuesday night by The New York Times, that admission came from General Keith Alexander, the chief of the military's newly created Cyber Command. He said officials are establishing 13 teams of programmers and computer experts who would focus on offensive capabilities. Previously, Alexander publicly emphasized defensive strategies in electronic warfare to the almost complete exclusion of offense.

"I would like to be clear that this team, this defend-the-nation team, is not a defensive team," Alexander, who runs both the National Security Agency and the new Cyber Command, told the House Armed Services Committee on Tuesday. "This is an offensive team that the Defense Department would use to defend the nation if it were attacked in cyberspace. Thirteen of the teams that we’re creating are for that mission alone."

Alexander's testimony came the same day the nation's top intelligence official, James R. Clapper Jr., told Congress that major computer attacks on the United States could so cripple the country's infrastructure that they represented the most dangerous immediate threat to the US. The risk rivaled attacks by global terrorist networks, he said. According to the NYT, it was the first time Clapper listed cyberattacks first in his presentation and the rare occasion since the September 11, 2001 attacks that intelligence officials didn't list international terrorists first among dangers facing the country. Clapper did go on to say spy agencies saw only a "remote chance" in the next two years of a major computer attack on the US.

Clapper specifically mentioned attacks waged last August on Saudi oil company Aramco, which took out more than 30,000 work stations. He also discussed persistent and powerful denial-of-service attacks on the websites of US-based banks, which anonymous US officials have said are the work of Iran.

"In some cases," Clapper said, "the world is applying digital technologies faster than our ability to understand the security implications and mitigate potential risks."

...

[seemslikeadream]

Spamhaus Hit With 'Largest Publicly Announced DDoS Attack' Ever, Affecting Internet Users Worldwide
AP / The Huffington Post | By By RAPHAEL SATTER
Posted: 03/27/2013 11:05 am EDT | Updated: 03/27/2013 2:19 pm EDT

Cyberbunker is based in a former Cold War-era NATO bunker in the Netherlands. (Wikimedia Commons)
LONDON (AP) -- An Internet watchdog group responsible for keeping ads for counterfeit Viagra and bogus weight-loss pills out of inboxes around the world has been hit by a huge cyberattack, a crushing electronic onslaught that one expert said had already had ripple effects across the Web.

Spam-fighting organization Spamhaus said Wednesday that it had been buffeted by a massive denial-of-service attack since mid-March, apparently from groups angry at being blacklisted by the Geneva-based group.

The BBC identifies one of those blacklisted groups as Cyberbunker, a a web hosting company in the Netherlands. Cyberbunker "offers dedicated server hosting that allow clients to stay online, no matter what," according to its website.

"It is a small miracle that we're still online," Spamhaus researcher Vincent Hanna said in an interview.

Denial-of-service attacks work by overwhelming target servers with traffic - like hundreds of letters being jammed through a mail slot at the same time. In a blog post, San Francisco-based CloudFlare, Inc. said the attackers were taking advantage of weaknesses in the Internet's infrastructure to trick servers from across the Internet into routing billions of bits of junk traffic to Spamhaus every second.

The attack could be bad news for email users, many of whose incoming messages are checked against Spamhaus's widely used and constantly updated blacklists.

Hanna said that his site had so far managed to stay on top of the spammers, but warned that being knocked offline could give them an opening to step up their mailings.

The sheer size of the attack has already affected Internet users elsewhere, according to Patrick Gilmore of Akamai Technologies.

He explained that colleagues at other Internet service providers had been in touch to say their services were affected by the attack. He declined to identify them - saying they had shared the information on a confidential basis - but said problems include sluggish access and dropped connections.

He added to the New York Times: "It is the largest publicly announced DDoS attack in the history of the Internet."

[DrEvil]

Could be a coincidence, but my connection has been a bit spotty last couple of days.