US Planning Response To a Cyber Attack

We've all heard of Google bombing; the US Government may be taking the expression rather literally. Planning is now underway across the government for the proper way to respond to a cyber attack, and options on the table include launching a cyber counterattack or even bombing the attack's source. The article makes clear that no settled plan is in place, and quotes one spokesman as saying "the preferred route would be warning the source to shut down the attack before a military response." That's assuming the source could be found. From the article: "If the United States found itself under a major cyberattack aimed at undermining the nations critical information infrastructure, the Department of Defense is prepared, based on the authority of the president, to launch a cyber counterattack or an actual bombing of an attack source."

Comments

Bombs? That's ok...

[Black Parrot]

I didn't want those zombied servers anyway.

Re:Bombs? That's ok...

[paeanblack]

If you keep a dangerous instrumentality on your property, and it causes damage to others, you are liable for that if the harm is foreseeable.

That is only true if all responsible parties are held to a reasonable level of accountability.

If you found out that your oven was, without your knowledge, part of a local arson ring, you'd be pretty upset a being held accountable for the neighborhood damages. You'd probably blame Kenmore for making such a thing remotely possibly in the first place, since it has no connection with how or why you bought the oven in the first place.

Until the hardware mfgrs, OS mfgrs, software mfgrs, and users are all held to roughly similar standards, you can't place all blame on the user.

To put things a different way:
-If 1% of your products cause widespread damage, then 1% of your users are idiots.
-If 5% of your products cause widespread damage, then 5% of your users need training.
-If 25% of your products cause widespread damage, then you are the idiot.

Re:Bombs? That's ok...

[Alligator427]

Along the same lines, it has always irked me that (the government) has never considered approaching Microsoft about the severe security flaws to which it's software is subject. Certainly if the most popular operating system in the world were less morbidly insecure, botnets and the like but be far fewer between. After all, these botnets aren't being built out of *NIX machines, so we're really talking about MS software.

I think a certain amount of responsibility lies on the endusers shoulders insofar as they should be expected not to compromise their own machines, but when you get your brand new windows PC it is vulnerable out of the box. It seems to me like microsoft is selling a consumer product that represents a great potential for illegal/malignant misuse, that most consumers are largely unaware of beyond "If I don't install virus-protection software I will get adware on my machine".

I've always found it wildly absurd that no real authority has ever stepped up to microsoft and made them do something about the woeful state of their OS in terms of security. It seems like one of the best responses that we could have to such attacks it to force Microsoft to mend its ways, if at all possible. If not, at the very least, produce some kind of government-issued label as used in cigarrete boxes to indicate to the consumer that "this product is wildly insecure and if you use it, small children will vomit on your shoes". At least in that case you could pass some of the responsibility on the end user.

Re:Bombs? That's ok...

[flyingfsck]

A Class Action lawsuit about knowingly selling defective goods, would certainly be a good idea and would be just as truly American a solution as bombing all houses with compromized Windows PCs...

Re:Bombs? That's ok...

[cryocide]

Your scenario is a little off, since your oven can't walk out of the house and burn someone else's house down. Let's try a more realistic scenario.

You buy a new drive-by-wire car. Then either of the following happens: You forego the option to park your car in a readily-available garage and a terrorist quietly breaks into it, or you simply take the car to a garage that you thought was reputable because of its professional-looking store front but was in fact a terrorist-run shop. Either way, they had their way with your car, installing hidden remote controls on the drive-by-wire system. Then they install a bomb using any available space, such as the empty body panels, inside the seats, etc. They can now damage or destroy any bridge they like, but you never knew what they did to your car, so you went on with life as usual. Then they did it to other owners' cars around town that were similarly vulnerable to compromise or social engineering.

Now for the best-case-scenario version of the outcome. We'll assume that the bridge is unoccupied, so there is no human life lost when they take your car and all the other zombie cars on their final joy ride, but the bridge is damaged and has to be closed while its structural integrity is assessed. Meanwhile, traffic has to be rerouted or stopped altogether. People can't get to work. Goods can't be delivered. The general population is afraid that there will be another attack, possibly trapping them in their neighborhood.

Now imagine that the cars were your computer and all the other zombie machines out there, the home garage was a simple NAT router or decent software firewall or the repair shop was a software package that contained malware, and the bridge was any major server or router that a decent-sized portion of the internet population relies on for day-to-day electronic transactions.

Do you really think it was the car manufacturer's fault that you left the car unprotected, or worse, you handed the keys to an untrustworthy mechanic because he had a professional-looking shop? While I don't think the car's owner should be held criminally responsible, I think they unknowingly forfeited the car when they ignored their responsibility to keep it reasonably secure. Don't be surprised if the government starts fragging driverless cars once they've identified them.

Military action is unlikely to be a solution

[Space cowboy]

In the event of a massive cyberattack against the country that was perceived as originating from a foreign source, the United States would consider launching a counterattack or bombing the source of the cyberattack, Hall said. But he noted the preferred route would be warning the source to shut down the attack before a military response

There's a lot wrong with this. Off the top of my head...

Any sustained attack on network infrastructure, on the scale that they're talking about, is almost certainly going to be a distributed attack. Botnets have no patriotic allegiance, their locality is a function of machine vulnerability (eg: N. Korea's dependence on Active-X), not politics.

If I'm crafting an attack, I don't have to even tell the truth about my IP address, TCP allows the sender to specify a (fake) IP address. Obviously I won't get any replies, but I don't care if I'm simply out to cause damage

Geolocation of IP addresses is pretty much a black art as well - there's far too much variability by IP address to try and localise to the precision needed for bombing the source. My hostip.infowebsite only attempted to locate to the /24 netblock, and even then only managed ~50% accuracy.

Not to mention that it's a pretty big precedent to set... At least they're talking about talking, before bombing; the problem is that if you make a threat to bomb someone, you have to be prepared to carry it out. Countries can't afford to be seen to be bluffing when it comes to things like this, the impact on future negotiations is too high.

Simon.

Re:Military action is unlikely to be a solution

[thePsychologist]

Let's also not forget that the general public understands much less about a cyberattack than a good ol' fashioned physical attack. Hence, it's much easier for the government to tell the public that they were in severe danger because "the internet was in danger" or whatever obfuscationt they'll use, when in reality they were pinged fifty more times than average. This is really just another reason to take out the guns, and we all know they're having a difficult time justifying military action these days.

tilte confusing, google has nothing to do with it.

[deft]

At first I thought the US government might be using it's PageRank power to make terms like "nuclear threat" bring up URL's like iran.gov (or whatever their whitehouse.gov correlary might be). In fact it was just a weak attempt to use the word bombing twice and mislead.

Instead, the US is just aknowledging that attacks on it's internet infrastructure can be responded to just like physical attacks.... by military attack.

Is anyone suprised that if one place was pinpointed as the source of the attack on any countries infrastructure it might be a target? I'm not. The net is more important than some buildings at this point.

The only thing I'm suprised is to expect any attack to be from one place... I'd expect it to be distributed. But thats ok, we have bombs for that too. ouch.

quicken the disolving of the union.

[Anonymous Coward]

I can't wait tilll some 13 yeare old makes us bomb a charity site in the ukraine.
You think this is a bad thing?
It all goes to hasten the secession of the northern states from the inbread war mongering oil states.

Instead of physical bombing

[gravesb]

I would rather see cyber counter attacks. Yes, a lot of the targets would be innocent bots, but the counter attack could be as simple as taking them off line. If you remove enough bots, the attackers either have to give up, or begin to use bots closer to their own computers, until eventually they would have to use their own computers. Taking that many computers off line through cyber attacks is not something to be undertaken lightly, but if the incoming attack is sufficient to have a significant negative impact on infrastructure, then its probably justified. And maybe, if we start having massive cyber battles that this seems to imply, maybe Joe Public will stop clicking install this now banner ads and allowing his computer to become a bot. But probably not.

Re:It doesn't matter where the attack in terms of

[Anonymous Coward]

No, North Korea won't get bombed. They have got nuclear weapons, but they haven't got any oil.

You can be quite sure, even now before the attack has started, that the intelligence will point to Iran being responsible. In fact, it is most likely that Iran will be have to be bombed before the cyber attack starts, in order to preempt it

I think....

[Derek Loev]

I think that we're all reading too much into this. The article is basically saying that if somebody is going to attack the US in a way that would be damaging to the country that US is prepared to retaliate...by any means necessary.
I'm not sure if I agree with everything in the article but it is the Government's job to protect this country and there are a lot of businesses and people that demand on the internet. If some outside source could mess with this it would be devastating to the economy and the country...

Re:botnet

[Nasarius]

http://en.wikipedia.org/wiki/ARPANET#The_ARPANET_a nd_nuclear_attacks really. But rather than a "cyber attack", I'd be much more concerned about a fairly easy, inexpensive coordinated attack on the physical network infrastructure.

Re:Hell Yeah

[EGSonikku]

I have a magical stone that protects me from tiger attacks. I have been using it for years and not one attack!

This proves it works.

Re:It doesn't matter where the attack in terms of

[Poppler]

I think we may have learned not to trust the "intelligence" coming out of this administration

Unfortunately, that doesn't seem to be the case.

NY Times - U.S. Presents Evidence of Iranian Weapons in Iraq

The article does mention that the claims about Iran "[are] bound to generate skepticism among those suspicious that the Bush administration is trying to find a scapegoat for its problems in Iraq and, some political analysts and White House critics believe, is looking for an excuse to attack Iran." Beyond that, it appears to be the same sort of echoing of administration propaganda (conveyed by unnamed intelligence officials) that we saw in the run-up to the invasion of Iraq.