2 Dec 2014
Perhaps it's only in the skirmish phase, but many large conflicts begin with relatively small encounters. After years of maneuvering to get hackers and defensive programming into position, the First Cyber War is under way.
It seems increasingly likely that the hack of Sony Pictures was a cyber-war action. The malware used to perpetrate the attack turns out to be written in Korean, and the North Koreans aren't issuing any blanket denials of responsibility. (The fun thing about North Korean diplomacy is that they can simultaneously imply that they're behind an action like this, and castigate the world for believing they're responsible. Kim Jong Un certainly seems to enjoy having his cake and eating it too...)
The headline-grabbing result of the Sony hack was the theft of several unreleased movies, plus one already in theaters, leading to a torrent of BitTorrent downloads, but that's not all the hackers did. They also took down the corporate computer network and filched some business data, including a spreadsheet with the salaries of over 6,000 Sony employees, including the executives. This information was passed along to the media, evidently with the goal of embarrassing the company. (Is three million bucks a year in salary really all that excessive for a top CEO, especially given how much movie stars and directors pull down?)
The Norks are hacked off at Sony because of an upcoming movie called "The Interview," which satirizes the CIA using dimwitted journalists to assassinate the North Korean dictator. The Russians have been frisky online as well, apparently in a snit over the application of Western sanctions following their adventure in Ukraine. At the end of October, the White House revealed its computer systems had been under sustained attack for weeks - a far more serious cyber-threat than a few thrill-seeking freebooters could be expected to manage. Two weeks ago, the State Department had to shut down its unclassified email system to install security upgrades and deal with the effects of a suspected cyber-attack. Microsoft just discovered a security flaw in the latter editions of its Windows operating system that allowed Russian hackers to spy on NATO for the past five years.
Russian gangs are the suspects behind recent high-profile attacks on the financial industry and retail giants, including Target and Home Depot. Whether or not these gangsters are agents of the Russian government, they've taken pains to portray their crimes as retaliation for the sanctions.
Not to be left out of the cybernetic scrum, the Chinese are thought to be behind the recent U.S. Postal Service hack, plus an attack on the Chinese servers for Apple's iCloud online storage service. Chinese hackers have been fairly frequent pests in Western corporate networks, although a security firm's warning to the FBI this week about hackers infiltrating Wall Street networks specifically mentioned that the mischief was more specific and aggressive than China's normal level of skulduggery. The new wave of Wall Street attacks involve such tactics as hackers getting into an executive's email accounts and sending messages to their co-workers, in an effort to trick them into divulging sensitive information.
Cyber-war is a series of skirmishes fought by ninja in the pitch darkness of the Internet. It's difficult to tell who's shooting, or what the real targets were. A good deal of the forensic work involves studying software tools, hacking methods, and the proclivities of certain governments. It requires not a shred of sympathy for the monstrous North Korean regime to acknowledge that hitting the studio they excoriated for producing "The Interview" with malware written in Korean would be one of the easiest frame-up jobs in the world. On the other hand, any intelligence service worth its salt should have little difficulty arranging cyber-attacks behind several layers of plausible deniability, especially since unlike the espionage agents of old, online operatives based on foreign soil probably won't be taken into custody by Western counter-espionage forces and grilled under hot lights.
Most government actions in the Cyber War to date could be described asreconnaissance. They're probes and feints, tests of defensive capability in which relatively little damage is done, compared to the havoc that could have been wreaked. The attackers don't want to provoke a major response, or put all of their cards on the table. This leads many to speculate that powder is being kept dry for more destructive actions to come. Two years ago, then-Defense Secretary Leon Panetta mused about the danger of a "cyber Pearl Harbor" attack on U.S. transportation or utility systems. (Imagine the blackout that hit Detroit today, replicated simultaneously in cities across the country, perhaps during an ice storm.) Two weeks ago, President Obama told the audience at one of his fundraisers that he worried about a "doomsday scenario" in which hackers would take down major financial or government systems, potentially erasing millions of transactions, or even millions of personal identities.
Saboteurs could do a lot of damage without actually damaging anything, if they can destroy the atmosphere of trust that allows the modern online economy to function. Not very long ago, analysts thought consumers would never develop the trust necessary to make ideas such as m-commerce, cloud storage, or even online shopping work, but today we accept such services as a standard feature of life. It's particularly impressive how quickly consumers accepted cloud storage, when the notion of allowing an outside service to handle sensitive personal and business data across the Internet seemed hair-raising when it was first mooted. Cloud storage services have been rocked by some high-profile hacking attacks over the past year. Will continued mischief damage the public confidence necessary to make them viable? What if the public becomes convinced that government and financial systems are unsafe? Every economy depends on trust to flourish; confidence in secure transactions, privacy, property rights, and honest commerce was important long before computers were invented. The Internet moves faster than any previous form of commerce, so if trust is destroyed, it will crash harder.
The Internet as we know it today is incredibly powerful, integrated with every aspect of our lives... and perhaps a bit more fragile than we'd like to believe. There hasn't been a major exchange of artillery in the Cyber War yet. It's not something to look forward to.
No comments:
Post a Comment