Slashdot Mirror
US Prepares for Eventual Cyberwar
The New York Times is reporting on preparations in the works by the US government to prep for a 'cyberwar'. Precautionary measures are being taken to guard against concerted attacks by politically-minded (or well-paid) hackers looking to cause havoc. Though they outline scenarios where mass damage is the desired outcome (such as remotely opening a dam's gates to flood cities), most expect such conflicts to be more subtle. Parts of the internet, for example, may be unreachable or unreliable for certain countries. Regardless, the article suggests we've already seen our first low-level cyberwar in Estonia: "The cyberattacks in Estonia were apparently sparked by tensions over the country's plan to remove Soviet-era war memorials. Estonian officials initially blamed Russia for the attacks, suggesting that its state-run computer networks blocked online access to banks and government offices. The Kremlin denied the accusations. And Estonian officials ultimately accepted the idea that perhaps this attack was the work of tech-savvy activists, or 'hactivists,' who have been mounting similar attacks against just about everyone for several years."
I mean who the FUCK would be stupid enough to have the controls for a Dam connected to the internet?
"Make cyberlove, not cyberwar!"
don't connect the dam floodgate controller to the internet ?
$ strings FTP.EXE | grep Copyright
@(#) Copyright (c) 1983 The Regents of the University of California.
Now that would have made a good headline. It's directly from the article:
microchip-controlled Tickle Me Elmos will be transformed into unstoppable killing machines
(taken slightly out of context)
ccalam - acoustic versions of new songs.
As the government is getting ready for the upcoming cyberwar, the following ad was noticed in a local newspaper:
We're looking for a young man named John Connor, to lead our efforts in the war against the machines. We offer $1000 to anyone who has any substancial information in discovering his location. If you can help, please dial 1-800-ILL-BE-BACK.
- The Government (it's not Terminator this time, I swear)
Well, everyone needs a credible enemy to keep themselves in a job. I mean, what would all those government agencies do with their time? The whole thing is just playing peoples worst fears, and the scenarios they've got there are straight out of Die Hard......or that film Sandra Bullock was in, and of course the all have no basis in reality.
;-).
Bring back the Cold War, that's what I say, and it looks as though they are. This whole terrorism thing just isn't working out
In 2007, cyberwar was beginning.
Why is it that america is always preparing for a war? a war on 'terrer', a cyberwar, a war on drugs, a war on immigrants, a war on pirates, a war on guns. When is the last time america made peace?
I guess big budgets need big reasons
funny pics
Back in the late '90s I was infected by my first virus. I had never connected to the internet, I had just used the library and school computers. Somehow, I still managed to get a virus on my floppy diskette.
I don't think it is unlikely that there are people who hook their laptops up to their work network, and I suspect it is even more likely that people plug in a floppy/thumbdrive/cdrom from home. I don't doubt that it would be safer to stay disconnected from the Internet, but a handcrafted virus would be far more likely to avoid detection by most antivirus and probably accomplish just as much in a hacker war. It would have to be a targeted program, but that is really the point isn't it, that hackers could be targeting networks that are supposed to be secured. Of course, it probably doesn't help security that they probably assume their network is safe.
B) Eliminate all the stupid users. This is frowned upon by society.
***Isn't this blown out of proportion, again?***
Probably not out of proportion. The military has separate secure communications, but civil society doesn't. And many of our key networks aren't exactly robust. We've had incidents in the past of phone networks going down because of bad software upgrades to switches. And of power distribution networks going down for no very good reason and taking many hours to get back up. And satellites going out.
So what happens when a technically savvy bunch of folks with a point to make starts off by hijacking Microsoft Update to zombiate millions of PCs, uses other update services to brick all sorts of devices, then simultaneously goes after the DNS servers; North American power grid controls; and every satellite link they have previously found a vulnerability in? What if they can take down major parts of the cell phone network? Probably they can DOS the financial service network providers if they can't hack into them -- No functioning ATMs and likely no functioning banks and likely few functioning stores of any kind. And they reprogram a lot of the nation's traffic signals to turn all lights green permanently. They do the same for the railroads. And they turn off the natural gas distribution system -- in January. And they shut down the aquaduct pumping stations feeding Southern California. ... etc, etc, etc. And finally, they shut down as much of the phone system as they can get to.
A serious attack by a technically savvy attacker with significant resources and a good plan can very likely do most of those things and a great many more.
If an attacker can do even a quarter of that, it'd take any industrial country a week to get back up after a fashion, and months to really get things back under control. So, no, it's probably not blown out of proportion.
***I mean who the FUCK would be stupid enough to have the controls for a Dam connected to the internet?***
What is the cheapest and most cost effective way to control a remote power facility? And who says cyber attacks are limited to the Internet? If your dam is 300 miles away, you're going to need remote access -- at least for monitoring and quite likely for command and control. Seems to me like most, maybe all, of the technologies to do that -- internet, phone network, satellite, radio links, etc--are open to interception and attack. Even if you can't break into the control link, you likely can deny service in one way or another.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
That's right, because we all know that bullies only beat up other bullies. </sarcasm>>
I love that people assume that the US is a target because of it's actions. I wonder if these are the same people that assume that Microsoft gets hacked because it is an 'evil' company. Let me say it plainly: The US is a target because the US has a lot of money and influence. Microsoft is a target because they have a large number of users. There may be thousands of other reasons, but that is the real reason there is such a disparity in attacks against the two. I am not saying that MS shouldn't be a moral business or that the US shouldn't improve it's interactions in the world, I'm just saying that doing either one will not make a significant difference in the number of attacks.
Both have a need to do the same thing too, actually. They need to improve security and do it in such a way that it doesn't harm their base.
B) Eliminate all the stupid users. This is frowned upon by society.
Can we agree on a flag to wave so that, once the 3vi1 h4xx0rs have destroyed all the intarnets, we can signal to others in visual range 'willing to trade pr0n dvdroms via sneakernet'? Maybe any suitably encrusted piece of fabric?
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
Every US "Cybersecurity Czar" has quit in disgust. The Homeland Security agency can't even find someone to run the office, because it's a total joke.
Meanwhile, the US has already been under siege by China in a full-blown cyberwar for several years.
It's cheap to attack the US tech infrastructure, and expensive to defend against it. That's what asymmetric warfare, like terrorism, is all about. So 6 years into Bush's Terror War, and the government is still preparing to get started, while our enemies just surge around us.
--
make install -not war
"Hactivist" is a perfectly cromulent word, right? No, not really. I really despise this weird need everyone has to create new words. He already have perfectly good words, like "hacker", "activist" and "loser kids who want to feel powerful." Why anyone felt the need to create another buzz word is beyond me. This one is going right on the top of my list.
The summary says that Estonia wanted to "remove Soviet monuments", which is an excaggeration. The monument in question was moved to a less prominent place, which is kind of understandable since the Soviet era of Estonia isn't regarded much higher than, say the Nazi occupation of places like Denmark or The Netherlands ...
The important thing to remember here is that the monument is still visible for those who wish to pay their respect to their ancestors. The monument is not, and never was, removed.
send + more == money?
The only way to prevent war is to prevent the existence of more than one opinion.
So, a hive mind would end the wars.
But would this be really better?
This sig does not contain any SCO code.
Okay, this is serious, and the US could be in serious danger. Here's my plan for action to make sure we can come through a potential cyber-war victorious:
1. "Security through Conformity": Standardize on exactly one platform. Make sure everyone in government is using it. That way, if we discover a gaping security hole in that platform, we only have to patch one type of system. Homogeneity is the key.
2. We need to put our trust in professionals. That one platform should definitely be Microsoft Windows. Sure, having people from all over the world looking for bugs might be quicker and more effective, but that also means that people from all over the world have the potential to find a security hole, but we have no clear target to blame for that security hole. And don't forget that backdoor that was almost slipped into Linux (though, fortunately, caught before it got into source control because of all of the people able to look at it)! We wouldn't have to worry about that with Microsoft Windows
3. Don't leave computer decisions in the hands of long-haired computer geeks who spend all day working with technology. They tend to have decidedly leftist--if not communist!--leanings. All IT decisions for the US government should be made by the people best qualified to make them: Career bureaucrats.
"During that time, one of the nuclear reactors that shutdown was found to have numerous Windows based computers connected to the Internet." If: you discover the real causes of the event: http://en.wikipedia.org/wiki/Northeast_Blackout_of _2003#Causes.
Then: you might not post such an uninformed and leading statement that can be so easily dismissed by those of us who work in the industry.
....virtual goods.
/ 23/2055244
They can use the virtual taxes to pay for the virtual war (cyberwar) defense.
http://politics.slashdot.org/article.pl?sid=07/06
Can't they call it "Digital Warfare" or "Internet Warfare"?
"Cyber" is so 1990's... anything that inserts it into the language more often is a nuisance. Can you imagine if it gradually became a synonym for "good"?
Dude, that pizza was totally cyber!
Ugh...
In fact, I'd go so far as to say that "political correctness" only ever really existed as a convenient strawman caricature, useful for smearing anything remotely smacking of "liberal" or left wing views.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
Just fix the darn protocols, dammit. It's been a year since Blue Security was taken down by PharmaMaster and NOBODY has done ANYTHING to prevent any subsequent DNS amplification attacks from happening.
If ISPs at least blocked forged-ip packets from exiting them, then THAT would be a nice start.
I am a registered professional controls engineer. I design and manage a large SCADA system. I'm also a member of the SP-99 standards committee (the ISA standard for industrial control system security).
Industrial Control System Security is the subject of many books (with many more on the way), security committees, and even pending regulation. I could spend a long time trying to explain why things are the way they are. Here's an overview of the issue:
1) SCADA systems started out in isolation. Most were never designed for internet access and many were designed without any thought to security because there is a more important concern: Reliability and performance.
2) Office folks got wind of what information could be had from SCADA systems and the next thing that happened were a mass of people clamoring for the data. However, very few gave much thought to how that data could be extracted securely without affecting the reliability or performance of the system. As a result, there are many security compromises.
3) It's not easy to retrofit security in to an existing SCADA system. It would be like putting seat belts and air-bags on a Ford Model T. Such measures will help, but what is really needed is a re-engineering of the whole system.
4) Many of the protocols we use every day live in carefully validated embedded systems. You can't just "update" them without digging in to a morass of other embedded systems issues, in addition to the protocol itself, you have issues of performance and expected behavior. For this reason, updates of embedded firmware are rare.
5) SCADA systems live for a long time. Typical lifetimes are at least 10 years for the field devices and five years for the control room software and hardware. These configurations are carefully validated (a very tedious and expensive process), so companies are loath to upgrade them unless there is a very good reason to do so.
I can go on, but that's should give you a taste of what the situation is.
Now for the reality of interational red-teams. Yes, they exist. The US has them too. I don't design for a red team. First, that would require very frequent software upgrades, something which I've already explained is not feasible for most SCADA system operators. Second, we opt for defense in depth. We try to segment our systems so that they fail in to smaller peices which are semi-autonomous in themselves. They won't be as efficient, but they will continue to work. And finally, in case you hadn't noticed, we design our physical security to eliminate the casual vandal, not the determined para-military group. The cost of going fully secure is so high that nobody would be willing to pay for it.
At the utility where I work, we keep our SCADA system carefully shielded behind firewalls. Yet many other SCADA system managers do not understand the security issues because they're not IT savvy. Conversely, most IT staffers in utilities and manufacturing companies do not understand what a SCADA really is and does. This is not just another app. The notion of a real time or even a near real time system is alien to most. Furthermore, there is no such thing as "rebooting" in this business. In most IT applications, restarting the application or rebooting the machine is routine. Not so in SCADA. If we restart, we often lose track of many critical on-going processses. You see in most IT applications, they are the whole system. With SCADA, there is a physical world of things going on with or without them. If you're not up and running all the time, you're probably going to miss something critical.
Finally, opening dams by remote control isn't likely. We have dams where I work too. Even if we did open them by remote control (we open ours manually), the systems that we use are as far as possible from the internet, and even our office intranet. Yes, we can wash out parts of a town downstream if we're not careful. The operators of such dams are licensed and they must be very careful about how the
Nearly fifty percent of all graduates come from the bottom half of the class!
Seems to me like we're heading towards some distinctly neuromantic and ghost-in-the-shellish conflict scenarios. Makes sense, considering all the recent technology advancements. Japan is busy at work making their first Mech prototypes, MIT is busy making invisibility cloaks, Van-Eck phreaking devices have been around for ages, and the Russia mafia seems to be busy writing custom viruses. The thing to remember is that a 'cyberwar' would *not* simply be conducted by script-kiddie hackers in their moms basements. Sure, you might have to deal with botnet DDOS attacks, but that's probably the least worrisome scenario. To use the Dam floodgate scenario, consider a sneakernet type attack, where a special-ops actually *applies for a job* at said energy company which runs said Dam floodgates, and moles their way past the firewalls, so they can install a custom one-time virus. Afterwords, they get a nice million dollar bounty from the sponsoring enemy state. That's the espionage scenario. There are others. Toss in some helicopters, invisibility cloaks, van-eck phreaking devices, and emp pulse generators, and you've got yourself an arguably new class of special-ops. You might say, 'yeah, US enemies aren't ever going to get helicopters and those kind of forces onto US soil, so the US only needs to concern itself with remote attacks.' Granted, the US still has a big advantage of being relatively isolated here in North America, but I'm not so convinced. We do have embassies, consulates, and business partnerns all over the world, and most all of them have VPN connections outside the US. Networks make distances less relevant, so we could simply be attacked at one of our embassies or consulates. But I digress. The idea that I'm trying to communicate here, is that a 'cyberwar' isn't necessarily all digital, just as a computer isn't all digital (keyboards and monitors are analog). As such, there will be a sneakernet and analog element to any such 'cyberwars', which will probably involve special-ops using the latest technology to tap into networks, nab passwords, and cover their tracks, *in conjunction* with the crackers doing the cracking. All nicely laid out in neuromancer and ghost-in-the-shell. The specifics differ, but the general concept is spot on in both works. At least in my opinion.
Do you have ANY proof of that? That would be a violation of tech specs and as I recall that eastern brown out had nothing to do with a nuclear plant and everything to do with the way the grid was shabbily set up with bandaids.
even having someone without a license (nuclear not driving) cause a change in power by manipulating something like a valve is a violation. You can't just service something whenever you want. there are strict controls in place.
There are however systems connected to monitor certain things. They can in no way cause changes and yes even though i don't think it's such a good idea they are indirectly connected to the net. but remember that these systems can only monitor. They physically cannot cause changes
http://www.theregister.co.uk/2003/08/20/slammer_wOh Crap, I'm an optimist.....
I have put up a site a few months ago to start to track cyberattack related news, events, etc. I plan to build it out as I get more information, right now it's fairly basic. However, I hope that it will help someone who is looking for info. Cyber Attack Information Center -- podz
The Joker laughing out of every TV and Radio in Gotham city would be a powerful psychological win and a plausible goal for a determined enemy. What if part of a cyber war campaign was designed to replace Podcasts, Music streams, VOD Movie services, CNN Video or any internet delivered media with a message from our enemy? Could they commandeer Internet connected set-top boxes deployed by Cable providers and replace what we see and hear?
I was approached by some people recently who wanted to know exactly how someone could pull that off. By "some people", I mean someone who works with an unnamed National Security Agency of sorts. I shrugged it off at first, then thought of the potential impact. Eek. Does anyone in the media business even anticipate or have a strategy for combating such an attack?
Most of the stuff on
Flamebait? Sure. But badly-constructed flamebait- the only people who use the expression "politically correct" are those attacking the concept.
Very true.
In fact, I'd go so far as to say that "political correctness" only ever really existed as a convenient strawman caricature, useful for smearing anything remotely smacking of "liberal" or left wing views.
Heh, I don't know: I'd always considered myself reasonably to the left, but... I was surprised to run into a bunch of socially-acceptable racial bigotry during college, and the only way I can think to characterize it, is as having been "ok" because it was "politically correct." And this is the real point of my post.
What am I talking about? People complaining, over and over, about "rich white kids;" they'd use sneering language like "bastion of white privilege," repeat racial slurs like W.A.S.P. as though that was somehow acceptable (besides, at least get your facts straight: second-wave European immigrants were neither Anglo-Saxon nor Protestant), and harp on hundred-year-old European imperialism (as though they, going to an Ivy League school, were somehow victims thereof). This was insidious stuff, nothing more than socially-acceptable racism. And it wasn't just something that affected interactions with strangers; it infected friendships, sowing mistrust and contributing to the slow self-segregation that students settled into by senior year. Watching this happen was the saddest part of college for me.
An example:
I started out as good friends, my freshman year, with a Chinese-American girl, but by senior year this language had gotten even to her. In particular, she began to use the phrase "rich white kids" over and over -- never "spoiled rich kids" or "spoiled jerks;" always "rich white kids." In her case, there was irony written all over it, as (1) her father was a well-to-do doctor; (2) she had traveled all over the world at his expense; (3) I remember her being demonstrably shocked when one day I mentioned that I was responsible for paying for all of my own credit card bills ("What, you mean your parents don't pay them for you? Mine do!"); and (4) she'd had a number of important opportunities handed to her that she hadn't had to work for at all. It was a little infuriating to hear her, of all people, call someone else spoiled.
It got worse with time. I remember one incident in particular: I was walking down the sidewalk with her and an African-American (male) friend of hers (and so an acquaintance of mine), and she was complaining that Barak Obama wasn't dark enough: that the Caucasian part of his ancestry polluted him. She said that his skin looked "like mud." It was then that this other guy and I started exchanging meaningful glances, and I spoke our shared thought, "So, I'm not sure how to say this, [her name], but... look: You're standing between a dark black guy and a pale white guy *holds out arm with forearm up*, and... you're complaining that people with skin tones in-between are ugly? [(Implication: Look at yourself.)]" (I never understood how the racial ideas she'd begun to develop could withstand even a drop of sarcasm: You'd have thought that their self-contradictoriness would have caused them to annihilate each other at the tiniest hint of ironic illumination.)
A large part of the reason she was acting as she was at that time in particular was that she'd just broken up with another guy -- who, as always for her, was white. Now, the people you date are the people who get close to you and the people who cause you emotional pain, so it's easy to hate them and their groups -- hence the ubiquity of sexism -- so I understand, in part, how her anti-white sentiments had developed. But I don't think that this history of hers is the full explanation: I really think that the politically-correct norms on racial discourse had something to do with it too: She was using its language to justify her hate. Her pol