Is the Cyberterror Threat Credible?

Scott Pinzon writes "Is the idea that cyber terrorists might take down US networks or utilities realistic, or over-hyped? One of the authors of the Patriot Act and several Black Hat 2005 speakers debated the issue informally at WatchGuard's "Security and Beer Roundtable." Participants include Dan Kaminsky, Johnny "Google Hacker" Long, Tim Mullen, Sensepost penetration testers, a guy from Microsoft's ISA team, and others."

Comments

Agreed

[lheal]

Cyberterrorism is a stupid word.

But beyond that, there are easier targets.

Railroads carry tanks full of lovely chemicals like SO4 and HCl. For commercial efficiency, they often put all the tank cars together. For historical reasons, the railroads, state highways, and interstates often run close together and intersect. Not far from where I am now is an intersection of two interstate highways, two state highways, two US routes, and a railroad.

Take out the tank cars and drive away in any direction.

Re:Agreed

[BoneFlower]

About a year and a half ago, a tanker truck exploded on a bridge in Bridgeport CT on the I-95.

The bridge was out of action completely for about a week. It didn't collapse, but the damage was severe enough to basically destroy it. The northbound lanes were out of action for another week after that. And this was with an extremely huge effort to get it running again, they expected even temporary repairs to take about a month. I don't think they've gotten it properly replaced even now.

The shit really hit the fan when this happened. That stretch of I-95 was(and still is) undergoing heavy construction as it was, so it was backed up already. Traffic got really screwed up, there were lots of detours onto the 15 and the local roads. Commercial traffic was even sent on the 15, that NEVER happens, it is normalyl outright banned.

This was a single, smallish tanker truck that got winged by a passenger car. Early morning too, so traffic was light. A deliberate attack using a larger truck during rush hour... I don't want to imagine. Dozens(for this bridge, potentially hundereds with the right bridge) would be killed and there would be serious economic disruption. That bridge is probably one of the most important in Fairfield County, especially the coastal region.

They did have some antiterrorist type people on scene... it was obviously an accident, but they went there to get a better idea of just what would happen if terrorists did go after a major bridge and how to best recover quickly. Good thing they got a demonstration like that without the death toll an actual attack would have caused.

Re:Are critical systems on the internet?

[Mawbid]

Are critical systems on the internet?

If I'm reading this correctly, yes.

Mullen: I once had grid resources through a Web application anonymously for a power company. Grid resource control, OK? SQL injection, hit that through an anonymous connection and I had grid resources for the State.

The fact that an idea is really dumb doesn't mean it's never been implemented.

The Nightmare worm

[3ryon]

I don't know if it will happen from what we think of as terrorists, but I'll go on record saying that we'll eventually have a Nightmare worm.

It could have already happened, but perhaps the worm writers had a conscious. There will be a worm that 0-day exploit that compromises a common MS Windows service and isn't so polite as SQL-Slammer. Slammer infected almost every vulnerable host in the world within 10 minutes. I would call Slammer a 'polite' worm as it did no harm other than flooding networks.

It's certainly possible to write an impolite worm. One that doesn't just spread itself, but after 20 minutes of attempting to spread itself decides to stop all of your services and then wipe the data off your hard drive. If a computer isn't directly affected, it will probably be affected downstream by the network traffic or reliance on Windows network services. Those that managed to survive may have a hard time finding other surviving resources.

Hopefully the business world has backups, but can you imagine the global disaster that would follow? In 30 minutes almost every computer in the world is down. Airlines will be grounded, you may lose electricity, you might not be able to order a mocha frappancino(tm) at your favorite fourbucks.

(Not to be judgemental, but in today's world if it doesn't target Windows it's not the Nightmare worm)

You're right, but not quite on-point.

[clark625]

Yes, I know that deaths due to terrorism is low statistically-speaking. Honestly, it's not something that I spend awake nights worried about. Overall, I'm probably a lot like you in feelings about the terrorist threat. Statistically speaking, it's so far into the noise that maybe it should be ignored.

The problem with this way of thinking, though, is that most ordinary people believe that terrorism is not an act of God, and that it is, in some way, a preventable issue. When it comes to auto accidents, ordinary folks want to put controls on those items that can lower the risk of death (preventing DUIs, speed limits, mandatory seat belt laws, etc). It's the same with other deadly issues--like how people want McD's to have healthy choices on their menus because heart disease is so prevalent (now, whether people make good choices is another issue...). Or smoking--how much energy/money has been spent on getting people to stop?

People can accept deaths. It's a normal fact of life, and it sucks when it hits close to home. It sucks even more when those deaths could have been prevented with simple measures. If a party got out of control and a guy that was totally blitzed got behind the wheel and kills your wife/husband/mom/sis/friend/etc, you'd be pretty darned pissed and that incident would leave a hole inside you that might not ever heal completely. That's reality. Also, you, being a responsible citizen and registered voter, would be so upset and hurt that you just might demand more steps be taken to prevent others from feeling how you do. So, you call your local politian.

Economically speaking, no deaths are without consequenses. If it's preventable, then it can be calculated how much the solution would cost and how many deaths it would prevent. Those "non-dead" people earn incomes and pay taxes. If those expected taxes are greater than the proposed solution, then we have a winner. Of course, not all decisions are made based on pure economics. Many people are simply willing to pay higher taxes in favor of more safety, just because we like not having to go to our loved one's funerals.

I do understand what you're saying, and the rational part of my brain agrees. The part that hates going to funerals, though, tells me that if a death can be prevented, maybe we should go out of our way a bit to prevent it.

Re:Better safe than sorry

[Trigun]

No, staying technologically superior makes a lot of sense. Even if it is to fight an enemy that does not exist yet.

Staying technologically superior is also a form of corporate welfare. Same with war. Without going into the obvious politics of war, was the $30 Billion Shock and Awe phase of the war needed? We could have done just as much damage dropping $10 million worth of diesel fuel and nitrate in 50 gallon drums from cargo planes. But who would that have helped out? Not GE, Lockheed, Boeing, or anyone else who makes high precision implements of death.

Call me an idealist, call me a purist, but if we rewarded technology for the sake of technology, not for how many people it can accurately kill, then maybe people wouldn't want to attack the U.S. Don't believe that "They hate our freedom" line, it's a lot more complicated than that. If a country acted benevolent, didn't cowtow to corporate interests, and took a leadership role, both in its own society as well as in global matters, as well as (and not just) a moral compass, then do you think that country would be the target of attacks? If the U.S. said that they were going to develop a cure for aids, paid for that, and then licensed out the manufacture of the pharmaceuticals, then do you think that there would be a pissing match with African nations over patent controls?

Everyone says that technology is not a panacea, but even still, we've yet given an honest attempt to prove them right. We're still all stuck on that greed thing.