Cyber attacks, Cybercrime, Cyber warfare and Cyber threats exposed!
2-1/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFORMATION WARFARE Part 2:...
-
Upload
adam-schwartz -
Category
Documents
-
view
216 -
download
1
Transcript of 2-1/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25 INFORMATION WARFARE Part 2:...
2-1/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
INFORMATION WARFARE
Part 2: TheoryAdvanced Course in Engineering
2005 Cyber Security Boot CampAir Force Research Laboratory Information Directorate, Rome, NY
M. E. Kabay, PhD, CISSP-ISSMPAssoc. Prof. Information Assurance
Program Direction, MSIA & BSIADivision of Business & Management, Norwich University
Northfield, Vermont mailto:[email protected] V: 802.479.7937
2-2/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Topics
08:00-08:15 Introductions & Overview08:15-09:00 Fundamental Concepts09:05-10:25 INFOWAR Theory10:35-11:55 Case Histories & Scenarios
2-3/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Topics
What is INFOWAR?Schwartau’s Levels of INFOWARExamples of IW levelsMilitary Approaches to IW
2-4/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
What is INFOWAR?
Use of or attacks on information and information infrastructure to achieve strategic objectives
Tools in hostilities among NationsTrans-national groups (companies, NGOs,
associations, interest groups, terrorists)Corporate entities (corporations,
companies, government agencies)Individuals
2-5/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Dorothy Denning’s Nutshell
Information Warfare and Security (1999). ACM Press (ISBN 0-201-43303-6).
Offensive information warfare operations alter availability and integrity of information resourcesBenefit of offense & detriment to defenseOffense acquires greater access to infoDefense loses all or partial access to infoIntegrity of information diminished
2-6/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Denning’s Theory of INFOWAR
Information resources include people & toolsContainersTransportersSensorsRecordersProcessors
Value of resource differsOver timeTo different people
2-7/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Schwartau’s Levels of INFOWAR I: Against individuals
Theft, impersonationExtortion, blackmailDefamation, racism
II: Against organizationsIndustrial espionageSabotageCompetitive & stock manipulation
III: Against nationsDisinformation, destabilizationInfrastructure destabilizationEconomic collapse
2-8/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Military Approaches to IW
HUMINT INTELCOINTEL
SIGINTCOMINTELINTFISINT
MASINT IMINT TECHNINT OSINT
Human intelligence IntelligenceCounterintelligence
Signals intelligenceCommunicationsElectronicForeign Instrumentation
Measurement & signals Imagery Technical information Open source intelligence
2-9/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Information Warfare: Chaos on the Electronic Superhighway (1996.05)Winn Schwartau, The Security Awareness Co.OverviewMilitary Model Must Reflect Changes in WarfareWhat Is War?
2-10/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Schwartau’s View (1996.05)
OverviewNational economies increasingly virtual
Most money no longer tangibleEspionage increasing for economic benefits
14% increase in espionage according to FBIMust resolve problem of defending against
powerful technology not limited to military use Should define defensive posture against
potential enemies’ capabilities, not perceived motivations
2-11/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Schwartau’s View (1996.05)
Military Model & Changes in WarfareMilitary systems are not necessarily the prime
targets of attackPsyops increasingly important: manipulation
of perceived reality using the gullibility of the mass media
Attacks on software: increasing the failure rates of systems even when people are trying to reduce errors
Denial of service increasing: airports, phone systems, banks
2-12/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Schwartau’s View (1996.05)
What Is War?Physical attacks are no longer the only basis
for defining acts of warWhat will military and civil response be to
concerted attack on civilian / industrial infrastructure?taking down the banksinterfering with air-traffic controldamaging productivity of major industries
…and if this is war, what is the response?
2-13/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Schwartau’s View (1996.05)
Destruction vs Reducing CompetitivenessQuestion: in a free-market world, not
necessary to destroy enemy; need merely render less competitive
Response from Schwartau:US govt must defend country, yet military
limited to physical warfareClassifying EW threats is foolish; should
educate civilian sectorShould define conditions for termination of
hostilities
2-14/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Schwartau’s View (1996.05)
How do we know who is attacking?Anonymity pervasive throughout cyberspaceStealth attacks natural consequence of
Internet architectureAgents can be hired without knowing their
handlersConventional intelligence services must wake
up to electronic threatsSee Information Warfare 1st Edition online
http://www.thesecurityawarenesscompany.com/chez/IW1-1.pdf
2-15/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
RAND on INFOWAR (1999.01)Strategic Information Warfare Rising
— The RAND Corporationmid-1998 (reported in press 1999.01)
Debate within the Pentagonwisdom of offensive information warfarecyberattacks on critical infrastructure worse
for US4 basic scenarios
U.S. supremacy in offense and defensive strategic IW
strategic IW elites — no first useglobal defensive dominance — arms controlmarket-based diversity — defend well,
recover fast
2-16/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
INFOWAR @ AAAS (1999.02)American Association for Advancement Science
(AAAS) panelists government private industry
INFOWAR real threatNeed better cooperation among law enforcement
officials around world catch culprits responsible for attacks
Changes international law extradiction suspects
Sceptics (e.g., Kevin Poulson) scoffedno electricity by now if IW threat so bad
2-17/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Kosovo Cyberwar (1999.03)
Attacks on US government & military agencies began 1999.03
Serbian hackersRetaliation for war against SerbsAs NATO bombing began in Serbia"Black Hand" hacker group"Serbian Angel" hackersWhite house Web site defaced
Red letters"Hackerz wuz Here“
2-18/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
European Basketball Contest (1999)
2-19/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Asymmetric INFOWAR (1999.04)Countering New Terrorism
by I.O. Lesser B. Hoffman J. Arquilla D.F. Ronfeldt M. Zanini & B.M. Jenkins
New terrorism more diverse sources motivations tactics
More lethal global reachAsymmetric strategy
less-capable adversariespolitical violence
2-20/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
INFOWAR? Nonsense, says Christy (1999.09)
US has never been target of information warfareJames Christy Defense-wide Information Assurance
Program (DIAP)Cybercriminals not cyberwarriorsFundamental difficulties responding
military has expertise computer crime butcannot help law enforcement agencies
without presidential directive
2-21/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
INFOWAR? Nonsense. (cont’d)Civilian sector ignorant of computer crime
countermeasuresCan’t tell cyberattacks under way
most victims keep information secretdon’t help law enforcement investigators
Precise attribution & blame extremely difficult in cyberspace — anonymity
Public favors privacy over cybercrime prevention & law enforcement — ignorance
Jurisdiction over cyberspace crimes confused — competing geographical claims
2-22/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
INFOWAR in Oz? (1999.10)
Foreign (US?) military site attacked Stock Exchange late 1998?
Richard Humphrey Managing Director Australian Stock Exchange implied attacking site was in USA
“Foreign government” denied any possibility such attack from military site
Urged changes to Australian lawsmake it easier to try hackers present laws require criminal hackers be
apprehended in act of hacking
2-23/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
INFOWAR / China (1999.11)
Importance of INFOWAR grows in PRCChinese military newspaper Jiefangjun
Baoauthors Leng Binglin, Wang Ylin, Zhao
WenxiangFor maximum war role, must integrate
INFOWAR with other combat actionsCybersuperiority necessary but not sufficient
for military victory today
2-24/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
INFOWAR / China (2000.02)
Taiwan Research InstituteGird itself against information warfare
People's Republic China Elements IW:
disruption critical infrastructure disruption military C3I opsmisinformation campaigns damage economic activity lower morale on island before initiating
conventional warfare
2-25/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
INFOWARGAMES (1999.11)
Institute for Security Intelligence's Center for Technology Terrorism & Jane's Publications
War-game simulation (did not really hack) IRS primary targetFalse information, denial of serviceHack into IRS audit systemSend out millions audit & tax-due noticesTap into immigration control (Dept State) to
issue visas to known terroristsCreate fake documents — IRS investigating
personal lives members CongressLeak fakes to media + send fake compromising
photographs
2-26/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Critical Infrastructure Protection (1999.11)Information Technology Association of America
(ITAA) Statement of Principles Importance protecting national information
infrastructure Private industry: primary authorityLowest possible government regulation in critical
infrastructure protection Call for distinctions among cyber-mischief,
cybercrime, cyberwar Appropriate law enforcement agencies take
charge specific casesminimal jurisdictional confusionassurance clear legal basis for prosecution
2-27/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
German Government Plans Net Defenses
German plans for early-warning of hacker attacks (2001.05)
Build Computer Emergency Response Teams throughout country
Increased cooperation should permit rapid response to hacker attacks
2-28/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Republic of Korea Warns of Cyber Attacks
ROK Ministry of Information and Communication issues warnings (2001.05)
Concern about US & (PRC) Chinese hackers using Korea as staging ground for INFOWAR
KISA launched special task force against US and Chinese attacks
Instructed Korean Internet-site operators to report unusual traffic at any time
2-29/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
US Warns of Military Response to Cyberattacks
Richard Clarke tells Senate Judiciary Committee of plans for retaliation (2002.02)
White House Technology Advisor says that cyberattack would be met “in any appropriate way: through covert action, through military action, any one of the tools available to the president.”*
In 2003.02, President Bush signed an order authorizing development of guidelines on unilateral or retaliatory cyberattacks against foreign computers and networks
*Question: HOW DO YOU KNOW FOR SURE WHO IS ATTACKING YOU?
2-30/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
STRATCOM focuses on Cyberwar (2003.02)
U.S. Strategic Command (Stratcom) will focus on computer network attack
Stratcom now in charge of global command, control, communications, computer, intelligence, surveillance and reconnaissance (C4ISR) capabilities
“All pieces of the enemy's system of systems that are valid military targets [are] on the table as we go about war planning.”
“…Unimportant whether we take out a computer center with a bomb or a denial-of-service program. If it's critical to the enemy and we go to war, it will be in our sights.”
2-31/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Cyberattack Implications StudiedCyberterror impact, defense under
scrutiny (2004.08)Coordinated cyberattack against U.S.
could topple parts of Internet, silence communications and
commerce,paralyze federal agencies and
businessesdisrupt $M in financial transactions,
Cont’d
2-32/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Cyberattack Implications (cont’d)
hang up air traffic control systems, deny access to emergency 911
services, shut down water supplies and interrupt power supplies to millions
of homesMore than 2 dozen countries have
“asymmetrical warfare” strategies
2-33/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
North Korea Ready for Cyberwar?
North Korea ready to launch cyber war
North Korea has trained more than 500 computer hackers capable of launching cyber warfare against the United States, South Korea's defense ministry says. In a report to the National Assembly's National Defense Committee, the ministry said that hackers from North Korea were among the best in the world.
--Agence France Presse, 2004.10
2-34/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Cyberterrorism by 2006?Cyberterrorism a possibility in two years
Cyberterrorism could become a reality in 2006, a leading UK information security expert has said. Speaking at the SC Magazine Conference in London on Thursday, October 21, director of information security for Royal Mail David Lacey said that that the world would witness cyberterrorism within two years. Lacey said, “there is a lot of consistency in research that shows many of the real risks won't come to a crescendo until then. We know a lot about some of the trends coming. Real terrorists have not had the capability to carry out threats. But that will change as the stakes get higher.“
--ZDNet (UK), 2004.10
2-35/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
New Cyberwar Command Center
Cyber warriors anticipate center
Personnel in the military's new cyberdefense organization hope to operate a new command center by late spring. The facility will include new hardware and software to help workers of the Joint Task Force-Global Network Operations (JTF-GNO) operate, manage and defend the military's 10 computer networks. "It will be a state-of-the-art facility," said Army Brig. Gen. Dennis Via, deputy commander of the JTF-GNO. He spoke Wednesday, February 23 at the Department of Defense Global Information Grid Enterprise Services conference held by the Association for Enterprise Integration, an industry trade group. The opening of the new command center coincides with JTF-GNO becoming fully operational.
--Federal Computer Week, 2005.02
2-36/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Chinese Cyberwar From South America?
U.S. officials warn of Chinese intelligence and cyberwarfare roles in Latin America
U.S. officials … warned about Chinese intentions to establish an intelligence and cyberwarfare beachhead in the [S. America]. Roger Noriega, assistant secretary of state for Latin America, and Rogelio Pardo−Maurer, the top Defense Department official for the Western Hemisphere, testified before a House panel [and] said China's interests in Latin America were mostly on the economic side, but warned that Beijing could also have an intelligence agenda as it increased trade with Latin America. Pardo−Maurer said that “we need to be alert to rapidly advancing Chinese capabilities, particularly in the fields of intelligence, communications and cyberwarfare, and their possible application in the region.”
--Miami Herald, 2005.04
2-37/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
US Army on Lookout for Sensitive Info Online
Army officials have said they will take a closer look at blogs and Web sites maintained by soldiers. Many such blogs and Web sites include photographs or other information that inadvertently exposes classified or sensitive information to anyone with access to the Internet. Gen. Peter Schoomaker, the Army’s chief of staff, noted that soldiers routinely post pictures online that include "tactics, techniques, and procedures" for weapons systems. According to Richard Cody, Army vice chief of staff, "The enemy is actively searching the unclassified networks for information, especially sensitive photos." Schoomaker issued a memo saying that the Army will work to closely monitor Web sites and blogs to avoid operational security violations, which "needlessly place lives at risk and degrade the effectiveness of our operations."
--Federal Computer Week, 2005.08
2-38/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Hacker Attacks In U.S. Linked To Chinese Military
A systematic effort by hackers to penetrate U.S. government and industry computer networks stems most likely from the Chinese military, the head of a leading security institute said. The attacks have been traced to the Chinese province of Guangdong, and the techniques used make it appear unlikely to come from any other source than the military, said Alan Paller, the director of the SANS Institute, an education and research organization focusing on cybersecurity. In the attacks, Paller said, the perpetrators "were in and out with no keystroke errors and left no fingerprints, and created a backdoor in less than 30 minutes. How can this be done by anyone other than a military organization?" Paller said that despite what appears to be a systematic effort to target government agencies and defense contractors, defenses have remained weak in many areas. Security among private-sector Pentagon contractors may not be as robust, said Paller, because "they are less willing to make it hard for mobile people to get their work done." The U.S. military has code-named the recent hacker effort "Titan Rain" and has made some strides in counter-hacking to identify the attackers, Paller said.
-- DSH IAIP Daily 2005.12.13
2-39/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Insidious AttacksDIGITAL DOOMSDAY CAN BE AVOIDED WITH PREPARATION
A common nightmare scenario in the business world is that a hacker will crack a company's digital defenses, steal sensitive data or disable the network. Scott Borg, director and chief economist at the U.S. Cyber Consequences Unit (US-CCU), an independent organization that churns out information security data on behalf of the government, says enterprises face a darker possibility. Online outlaws could quietly penetrate the network and, over six to eight months, alter critical data so that it's no longer accurate. For instance, an attacker could access a health insurance company's patient records and modify information on a person's prescriptions or surgical history. Or an attacker could access an automotive company's database and tamper with specifications on various car parts.
--Bill Brenner, SearchSecurity 2006.05.03
2-40/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Psyops in Cyberspace – and SocietyDigital “photographs” may not be photographsAudio “recordings” may not be recordingsLog files may be fictionOpinion polls may be nonsenseElection results may be fixedConspiracy theories may be trueReferences may be nonexistentFacts may be illusory History may be fictionEnemies may be inventedThreats may be propaganda
2-41/41 Copyright © 2006 M. E. Kabay. All rights reserved. 09:05-10:25
Class Resumes at
10:35:07