Slashdot Mirror
US Cyber Command Wants Greater Attack Mentality
superglaze writes "Lieutenant General Robert J Elder, Jr, a senior figure in US Air Force Cyber Command (AFCYBER), has told ZDNet UK that communication issues are hampering the division's co-ordination. 'IT people set up traditional IT networks with the idea of making them secure to operate and defend,' said Elder. 'The traditional security approach is to put up barriers, like firewalls — it's a defense thing — but everyone in an operations network is also part of the [attack] force. We're trying to move away from clandestine operations. We're looking for real physics — a bigger bang resulting in collateral damage.'"
I think they should start out small by going after spammers all over the world. Just think of the positive publicity!
I'm sorry, what? All I can picture is a pimply teenager sitting in front a flickering screen, typing "Wanna cyber????" into his chat field. I have no idea how to exploit cybering to achieve military objectives. Maybe they want to paralyze the target's networks by getting all lonely teenagers to respond to mass cyber requests?
Those who can, do. Those who can't, sue.
Could the US have any more of an "attack mentality" than it already does?
Glad to hear that they're bringing "cyber(please excuse the prefix ;)--attacks" out into the open. Hopefully this will lead to a cyber-Geneva Conventions, causing glorified hacking contests to replace bang-boom wars. Just that'd be a shame if some rogue nation hacked some nuclear plant's coolant pumps.
If I run nmap -A on the Cyber Command website, they want to be able to make my head explode in retaliation. With "cyber".
End of lesson. You may press the button.
Hello US Citizen,
Your ISP has identified you as subscribing to a connection with >1Mbs upload speed. A recent top-secret national security bill requires all citizens with such bandwidth to become part of the national defense infrastructure. Attached to this email you will find an application. Install it. It will self register with homeland defense and be available for defense of the homeland should the need arise.
Thank you for your cooperation.
ZZ
PS: you have 1 week to register or you will be added to the terrorism watch list and will be subject to extreme rendition if needed.
PPS: we can't show you the bill, this is top-secret national defense stuff.
PPPS: if you are thinking of decompiling or interfering with the operation of this software, see PS:
PPPPS: yes this is MS windows Vista only software. Don't have Vista, see PS:
Active heuristic-based IPS in lieu of firewalling would likely provide the flexibility for outgoing attacks and incoming responses without just blindly blocking important traffic. Ok, problem solved. My rate for providing advice to the military is $1.7m per second, which I believe falls into the regular GSA schedule. Payment due immediately.
-- http://www.criticalassets.com
They should be going after spammers and hiring them. Large, distributed, easily controllable botnets seem to fit their specifications perfectly.
This is just what we need. Perhaps if things had been properly defended in the first place there wouldn't be so much of a need for the "Cyber Command" in the first place. Or, here's another idea, perhaps critically important systems
shouldn't
be
connected
to
the
INTERNET!!!
perfect security is impossible, somehow "bringing the fight to the enemy" isn't a solution. Changing the way you think about the internet is.
I can't wait until it's "you're on our side of the internet or you're on their side!!"
Every time a government, or especially its military, does something stupid in regards to the internet, I feel the strong need to drink.
Happiness does not come from having much, but from being attached to little.
It's funny - usually the attack mentality gets shot down pretty quickly in the US. There was a thread a few years ago about using your IDS to go after people attacking your server...the consensus was it was a Bad Idea. It's pretty much illegal to do in the US anyway, but it also seen as bad karma.
OTOH, there's no technical reason not use snort + script kiddie tools to automatically detect intruders and try to whack them. You can identify botnet members pretty easily from the pattern of accesses (the probes tend to come in waves, as various parts of the swarm poke your boxes).
The US could just hide in that swarm of accesses, poking servers and doing slow scans to figure out what's where. It's pretty easy these days to do signature profiling on systems, and to just stash this info in a database somewhere. Update each entry every few weeks, and be able to update ranges on demand.
The only really hard part is getting your own botnet up and running. The US Government could, theoretically, tap into the search engines to do this for them, which would be pretty amusing. Nobody pays attention to web spiders, and well, if the spider does a slow port scan 'accidentally' who cares?
Ok, someone needs to get a hold of, or make up AFCYBER division shoulder patches.
US Air Force Cyber Command (AFCYBER)
http://en.wikipedia.org/wiki/Shoulder_patch
http://www.tioh.hqda.pentagon.mil/DUI_SSI_COA_page.htm
...when you really need him?
random quote from forgotten source:
"Most wars could be prevented with 1 motivated soldier in the right place at the right time and a well placed bullet"It ain't what they call you. It's what you answer to. http://mylyceum.us/
Tasked with basically securing the entire world, I don't see how they intend to succeed.
They don't go after hacker groups in poor developing nations,
they CANT go after state sponsored groups without escalating into
a full blown war (which they can't afford now, thanks Mr. Bulsh)
and their supply chain is basically everywhere in the world.
That's a lot of vectors.
All they can really do is cry for more funding and attention... and the best way to do that?
LET THE ATTACKERS HIT US.
Sounds like the MCP is getting bored.
If all you do is defense, then eventually the enemy is likely to figure out, how to break you.
Attack is the best defense. You have to be able to retaliate. In "cyber" world this would mean some of the "hacking back", identifying him, putting him to jail, confiscating his computer, fining him.
This "active defense", however, is full of legal (and ethical) pitfalls and thus it is now wonder, the private companies are mostly sticking to passive defense. Private sector is also the main source of professionals for the government institutions, so those are quite conservative too.
Now we are seeing the military waking up to the problem... Indeed, if it is Ok to destroy a building, from which somebody is trying to kill you, why should we hesitate putting to jail someone trying to steal secrets and/or money?
In Soviet Washington the swamp drains you.
"We're looking for real physics -- a bigger bang resulting in collateral damage."
That's what missiles are for. That's what special forces are for. I'm not sure how much "collateral damage" can be caused by hackers.
Then again, maybe General Elder has been reading the World Weekly News.
Bigger Bang? Windows! You're talkin' about Windows!
Yeah... I think this Lieutenant General might be the communication issue. All I can understand from his quote is that he really wants to "cyber" the enemy without being vulnerable to being "cybered" in return. Is this military jargon?
Too many of the people that they'd want who are freakishly good at networking probably have a criminal record long enough to deter them from ever holding a TS, let alone a TS/SCI.
I would hazard to guess that the reason that China is able to keep its black hats at bay is the ability of their government to make you disappear in the middle of the night and wake up the next day in a labor camp if they even suspect you of compromising government systems.
Sorry, but the U.S. military just isn't going to get the best hackers around. The biggest problem is that the entire U.S. educational system actively discourages this type of education, in a hostile manner. Big businesses also work with the educational system to discourage creating knowledgeable and skilled people.
Someone posted about a class of theirs on Security issues that got shut down by one big corporation, who threatened not to hire any of their departments' students if they insisted on teaching that class.
So, the bottom line is that our Education system isn't turning out the skilled people that the Military is looking to hire.
This is compounded by the fact that the ones who DO get this knowledge, and have the right attitude, are snapped up by the Bad Guys. Crime is increasingly playing a big part on the internet, and those folks WILL pay good money for the right talent which can deliver results.
I suppose the Military could consider subcontracting out to the Mafia. That's really their only option if they are serious. Otherwise, the best they can get will just be second-rate talent, and more likely third-rate talent.
Good luck attacking, or defending, with that. As a US citizen, I find this frightening, but I've been saying it for years. I'm glad someone is finally waking up to the matter. But I doubt anything serious will ever be done until it's too late.
Here.
Yours radioactively,
Dr. Abdul Qadeer Khan
P.S. Say Hi to my fellow gun-runner President-VICE Richard B. Cheney
,
I can see it now. Somewhere in China or Nigeria a hacker is trying to gain access to a U.S. government network and suddenly their own systems are attacked from hundreds of locations around the world bringing their network to it's knees! Revenge is sweet!
I'm not sure, but I think an EMP would be a pretty big bang
HACK THE WORLD!!!
The greatest right given is the right to be wrong...
The only problem I have with NPR classifying some of the horrible things the US has been doing lately as war crimes is that we're not officially at war, because the president wanted to avoid having to 1) get permission from congress and 2) obey the Geneva conventions. It's a pretty silly excuse, though, saying that the Geneva conventions don't apply because we're fighting terrorists, not a waging war.
That's like getting around anti-hate crime legislation by saying that you killed all those people because you liked them, not because you hated them. Stupid, stupid, rhetorical nonsense.
"I zero-index my hamsters" - Willtor (147206)
Shouldn't they be hiring Professor X?
I put on my robe and wizard hat...
Computer science is maths. There are no fucking "bangs" in maths - if there's no security holes the only thing you can do is DDoS it off the net. This is the sort of drivel I usually expect from Hollywood hacker films; I can just see this guy typing "access all the secret files" into a bash prompt and expecting it to work.
"It doesn't cost enough, and it makes too much sense."
Nik!
Seriously this just depicts how the Military/Cyber command doesn't understand operating inside domestic world. As some of the smartest commanders have advised politicians before: you basically don't want our military policing things; as they go in with the mentality of destroy/conquer/dominate.
If your saying IT staff should actively attack those who seek to do wrong to their infrastructure, how do you address the fact that most activities of those individuals are completely legal until they actually do the attack. What of root-kits and exploits used for commercial purposes? Should we attack them too? People who do operations within the legal confines of their governing body, but can potentially impact others who's government classifies it as illegal...attack them too? Or what about someone who actively goes out and fetches something not intended for them, but also causes harm...attack the person who made it available? What about legitimate patches that break IT infrastructure if applied...Should we go destroy IBM, Microsoft, or Cisco because they distributed something harmful? Or even more broad...what if one of these companies indirectly helps the 'enemy'...are they open to attack too? What a tangled web we weave.
Sorry but Attack mentalities are dangerous 'domestically', and require real tight constraints. Such an organization should have an understanding on how information travels and how IT works; and should therefor be very careful with what it says publicly. But in the go destroy/take-down/remove world of the military you just go attack the 'bad people' right?
Spammer sends viagra ad to .mil email address.
Cybercommand retaliates against forged sender address's domain.
China launches missile strikes against US targets to halt destruction of its telecommunications infrastructure.
World War III ensues.
Profit!
How about, instead of this whole "protecting our data from evil people" thing, we give the evil people the data, then bomb them for having it. Its a simple matter of using our talents alongside our weaknesses. That and we want to trim down our nuclear arsenal, well...here's the chance!
2 military actions?? 2 WARS perhaps, but military actions doesn't pass the laugh test.
Granted this is a mixed and incomplete list, these are also only the "actions" we know about:
http://en.wikipedia.org/wiki/List_of_United_States_military_history_events#2000-_present
Don't go telling me that the DoD maintains SEAL teams, Delta teams and other various special forces groups and their very expensive delivery methods (*cough*Virginiaclass*cough*) without an ongoing need to conduct "military actions against foreign powers".
Argue the right of the United States to do what they do all you want, that it is done is beyond question.
well we all used to be worried about the fallout from nuclear war .... just think what would happen on the 'net if these cowboys ever get unleashed .....
the good news I guess is that just like the spammers they'll all be going after the windows platforms because that's the biggest bang for the buck - the rest of us can watch the death of the internet from our linux bunkers
That's like getting around anti-hate crime legislation by saying that you killed all those people because you liked them, not because you hated them. Stupid, stupid, rhetorical nonsense. Well considering there have been exactly zero declared wars since the end of WW2 it sort of puts a point on the futility of the whole thing, doesn't it?
So.. overt operations? Such as with artillery?
I don't see how defense and attack in the IT world work that well together. If I'm setting up firewalls and VPN systems, it doesn't mean I'd know any more than the basics about launching my own DDoS or a man-in-the-middle attack.
On a related note, I wonder if the military would build their own botnet from scratch.
Expecting the typical admin of a commercial network or system to actively participate in an attack is like giving every middle-aged white collar civilian a machine gun and expecting them to attack enemy artillery emplacements.
The most we should expect of the civilian infrastructure is to secure their systems and go hide in the backyard bomb shelter. If I (a middle aged white collar civilian) start getting involved in DoS attacks against an enemy, I'm inviting reprisals by that enemy targeting my, or my employers systems. If the cyber comand folks start handing out the weaponry (toolkits) to just any civilian, how can they be sure that they won't be used against that person's neighbor (who keeps dumping grass clippings over the fence), competitor, ex-wives, etc. Or, worse yet, switch sides in the war and launch an attack against the friendly forces?
Have gnu, will travel.
An attack mentality from an organization called Cyber Defense Command can only mean bad things are about to happen
The organization is call Cyber Defense Command for a reason, because they know that they should be "defending". If they were honest in their naming then perhaps it would be call Cyber Attack Command. Hmmm, I wonder what other countries would think of that.... It's probably the same reason that our Department of Defense isn't call the Department of Preemptive Strikes. It was called The Department of War until 1947. I know some here will say "the best defense is a good offense", but when you have organizations with "an attack mentality" they will always find someone and some reason to attack. War without End.
We are all just people.
I am waiting for them to call me and my buddies.
First they need older hackers, not script kiddies.
Black hats, or at least former black hats.
Lot's of Jolt Cola, Cold Pizza and some dark dungeon supplied with what ever mind altering substances needed and a steady supply of nerdy Asian girls to look after them.
Also the boxed set of all Stargate, Star Wars, Star Trek, Battlestar Galactica and.. Na on second thought, we'll just grab them off Bit Torrent. Same for the HDTV, UPS delivery off some stolen credit card, old habits die hard.
Maybe more useful would be legal immunity/amnesty, from all of the collateral damage from relaxing hobbies like taking down the RIAA or Microsoft in the process, (oops).
But seriously, a License to hack anything domestic and foreign with total immunity as long at it's primarily against the enemy would be totally cool, I think a lot of us who had to give up the black hat because we have kids and just can't afford to go to prison, would be all over this.
Why domestic, I almost don't want to say this publicly but the best way to get in is start in.
http://www.c-program.com/kt/reflections-on-trusting.html
Anyhow you can't play by the rules, if they think you can launch and offensive attack without some pre-preparation your wrong.
Making an offensive toolkit is fantasy. By definition this is script kiddie and lame.
> where vulnerabilities are introduced into chipsets during manufacturing that an adversary can then exploit, and electronics vulnerabilities.
I have been told years ago that this is already being done at Taiwanese fabs to us.
Chips were designed to be resonant at some Ghz ranges and would be equivalent to an EMP when hit.
This is done at the fab without changes to the chip design but layer thicknesses that is something the fab has total control over.
These attacks should be in any OS, Router, or any other electronic devices that get sold and without the knowledge if it manufactures either. This would hackers the greatest flexibility to exploit them when needed. They key is to make sure it's not detectable or exploitable by other hackers.
An example would be to hack into Microsoft and muck with their distro before it goes out.
Of course with Microsoft and Apple, this would already seem to be unnecessary.
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
When Israel attacked Syria's nuclear facility their vaunted Anti-Aircraft missile system, latest and greatest from Russia, didn't see a thing. Rumor is that they had hacked into the system and neutered it.
Someday this guy will have a big component of his ships, missiles, and robot vehicles taken down by a friggin' virus spawned by two guys in a garage somewhere in Asia.
And he'll go "Oh my god! We were totally taken by surprise! Who could have ever imagined or prepared for something as astounding as this!", for about the 4,000th time in the history of this administration.
We know where leadership by an anti-intellectual "strongman" who scapegoats minorities and likes boisterous rallies goes
Flamebait.
what does US Cyber Command have to do with the NSA?
They're using their grammar skills there.
You people been reading too many bad sci-fi stories involving shadowrun adventures or some wierd cyberpunk crap.
Though there is this guy called bloodninja who could school you in the art of cyber chatting.
needs to research hive mind.
if they are having communication issues, just send them over to 4chan, they'll be flooding our enemies servers with "dick butt" and "the best" in no time.
Isn't collateral damage a euphemism for civilian deaths? These jackasses are in need of a full-metal enema.
Collateral damage, by definition, is unintentional. The contradiction aside, why would the most technologically advanced (arguably, I suppose) part of the US military seek to cause more than the necessary amount of damage?
-- What you do today will cost you a day of your life.
All this has me thinking about collateral damage. War, by definition, has collateral damage. What will we see here? Will it be several underwater cables being cut at the same time, shutting down businesses and people in entire countries? Will it be mass assaults such that the machine of innocents are pwned? Could the systematic and government driven exploitation of the open nature of the internet lead to the closing of virtual borders?
I don't doubt this is the right thing to do strategically: you exploit opportunities at war, but it seems that the collateral damage is inevitable, which begs the question: what will the internet look like after prolonged, intensified, government warfare?
Isn't it some kind of war crime to intentionally TRY to inflict collateral damage?
I thought there was an obligation to try to minimize collateral damage?
No one has a right to their *own* opinion. They have a right to the TRUTH.
Wow your comments are full of fail. Systematic deconstruction and demolition of them below:
"Attack is the best defense" did not work for Germany in the 2nd world war. One might observer that it didn't work for them in the long run, because they WERE NOT TRYING TO DEFEND when they started the war. Their goal was conquest, not defense. They perfected the tactic of the 'blitzkreig', which involves an aggressive drive to cripple you opponent's communication, organization, and logistics, which gave them overwhelming success in the early parts of the war. Their loss wasn't a strike against the attack strategy, so much as proof that you shouldn't attack EVERYONE at the same time.
It didn't work in Vietnam or Korea. It worked fine in Korea. The US was on the defensive at the beginning of the war, and after the Inchon landings, we pushed NK forces to the Yalu river. Only China engaging in a 'Attack' strategy prevented us from unifying Korea.
Vietnam was also another poorly chosen example. The US actively chose to not invade the north, and played a defensive game fighting NVA attacks and vietcong insurgencies. Even when nixon took the gloves off, we never tried to take Hanoi. We simply dumped silly ammounts of ordinance on them from 50,000 feet. Had we invaded the north in 1967, I suspect that things would have turned out like Korea. US crushes NVA, China jumps in and smacks US around until treaty is signed. An attack strategy might have prevented the massive loss of life of US servicemen and vietnamese civilians and shortend the war by 6 or 7 years.
It's certainly not working for the US at the moment. Um, technically, it did. For better or worse, Sadam's regime is gone. He cannot attack us now. (Not that I actually believe the WMB bullshit that president fucktard spewed, just making the point that if the goal was to prevent Sadam from attacking the US, we accomplished it very well.)
If you are speaking about the insurgency, that is another story. We know who is supplying them. It is quite easy to attack the manufacturing and logistics that supply them to disarm them at the source. The question about the wisdom of doing so is another discussion all together.
The point is, your facts aren't really supporting your argument. Aggression is a fantastic defensive strategy. If your opponent is dead before he can even draw a gun, you are *quite* safe. The only rule of war is 'win'.
HA! I just wasted some of your bandwidth with a frivolous sig!
A lot of them, anyway?
Who's to say they don't build some tricks into them before we get them? They could be monitoring everything we do and be able to shut us down at will for all we know.
-- Boycott Shell
It was NATO.
While the NSA might get the best cryptographers, they don't get the best hackers. Or crackers. Anyone who confuses crypto with crackers doesn't know what they're talking about.
The best crackers don't work for the NSA. They are extremely good at what they do, breathtakingly so.
The NSA might get a better group than the military, but if you think they are the best, you are absolutely kidding yourself.
Oh, and the NSA doesn't even get the best crypto guys anymore, either. Google has been outcompeting them there lately.
Well, since the "insightful" war-artist managed to get us off-topic, let's continue. I think, you are too rash in granting him this assertion. The tactics is, in fact, working for US "recently" — in Iraq and Afghanistan. We took the war to the enemy and had no attacks on the American soil since. The assholes are fighting our military in the remote lands, while American civilians are able to continue to enjoy their lifestyles (almost) without changes.
The only sign, that the country is at war, are the yellow-stickers on bumpers. I say it worked, even if it could've been even better — some mistakes of the early stages of occupation are truly regrettable and lead to unneeded bloodshed and expense...
In Soviet Washington the swamp drains you.
Give it 5 years, folks.
Just disrupt the deflector shield with a tachyon burst.
If your statement had any truth to it whatsoever, then the US could pull out of both Iraq and Afghanistan today and just let "NATO" take over.
They should make a program that gives internet worms to ex-girlfriends. ;-)
The title and summary are incorrect.
TFA is not about the US Cyber Command. There is no such thing. It is about the Air Force Cyber Command (AFCYBER) which is a new organization that doesn't even have a home yet.
A "US * Command" is our uppermost echelon and they are called Unified Commands. US Strategic Command is the closest Unified Command to anything Cyber since they are responsible for the Cyber mission in addition to lots of other stuff.
Lt Gen Elder doesn't even work there. He works at US Strategic Command's Joint Functional Component Command for Global Strike and Integration. A big reason he was at the conference is that he is also in charge of Eigth Air Force which currently hosts AFCYBER. The guy in charge of AFCYBER is Maj Gen Lord. You may recall that Gen Lord participated in a Slashdot interview recently. Here is the link: http://interviews.slashdot.org/article.pl?sid=08/03/12/1427252
"Could the US have any more of an "attack mentality" than it already does?" - by Anonymous Coward on Wednesday April 02, @01:50PM (#22942088) ---
Just what Mr. Elder wants to see in fact, is in THIS thread (vs. "RBN" for example):
HOW TO SECURE Windows 2000/XP/Server 2003 & VISTA + make it "fun" to do, via CIS Tool Guidance:
http://www.thenewtech.com/forums/operating-systems/how-secure-windows-2000-xp-server-2003-vista-3550/
Doing MY part being 'patriotic', in "kill-mode", vs. "RBN"... not just defensive stuff is in THAT post, despite its title.
APK
P.S.=> Take a GOOD READ, Mr. Elder... hope it's what you're looking for! apk
lol wut
-- arstchnca
--
>Robert J Elder, Jr, a senior figure
Which one does that 'Jr' cancel out? Elder or Senior?