Slashdot Mirror
Cyberterror Not Yet a Credible Threat, Says Policy Thinktank
Trailrunner7 writes "A new report by a Washington policy think tank dismisses out of hand the idea that terrorist groups are currently launching cyber attacks and says that the recent attacks against US and South Korean networks were not damaging enough to be considered serious incidents. The report, written by James Lewis of the Center for Strategic and International Studies, looks at cyberwar through the prism of the Korean attacks, and calls the idea that terrorists have attack capabilities and just aren't using them 'nonsensical.' 'A very rough estimate would say that there is a lag of three and eight years between the capabilities developed by advanced intelligence agencies and the capabilities available for purchase or rental in the cybercrime black market. The evidence for this is partial and anecdotal, but the trend has been consistent for more two decades,' Lewis writes."
cyberterror? someone posted something about 'What If They Turned Off the Internet?'. now that's a threat!
let me share somethin' special with you, which i call perry's perspective..
You haven't seen the amount of probing foreign governments do to our defense networks. I'm amazed DoD networks function at all. The bulk of the attacks are, of course, script kiddies worldwide. However many national governments are putting very brilliant work into attacking our networks. Right now the focus is on extracting data, but given the compromised silicon I've seen, anything is possible.
anon for a reason.
I was having a hard time sleeping, waking up with cold sweats, worried sick.
Looks like i can finally get some rest.
Sent from my PDP-11
It seems to me that even if this report was accurate, we shouldn't be resting on our laurels until the threats become credible and too late to stop.
Its clear the best way to stop and prevent terrorism is at the point of planning or in the initial stages, not when the have assembled and planted the bomb. Cyberterrorism should be no different.
We wouldn't want the smoking gun to be a complete breach and shutdown of our networks would we. I favor a more proactive and preemptive approach. Attack them now before they can attack us. The best defense is a good offense.
Hy-Brasil is not sinking...nope, not happening. No need to panic, we are NOT sinking...
Funny may not give karma, but +5 Informative never made anyone snort coffee out their nose.
This is not a good attitude to take. As any decent sysadmin knows, there is a lot a blackhat who manages to obtain root or Administrator can do to damage a company:
There are the easy things an attacker can do. Trash files, copy off data to sell in the black market or competitors, use the boxes as a grounds for an attack, or for P2P servers for unsavory things.
Then, there are the more subtle things that can be done. Editing of E-mail, impersonation of people's identities in order to screw up sales, or cause lawsuits, even things that can get a company and its officers in deep trouble with the SEC. If a blackhat is good, there wouldn't be any evidence left behind of the intrusion, so people could face prison terms and juries are not going to believe "that email was forged" when it came from the right Exchange server and so on.
A good hacker can cause untold amounts of subtle damage, all it takes is taking time, learning how a target company might function, and what clients. Then, if there is a large bid being taken, perhaps edit the Word document and change the bid to be so low that it realistically cannot be done, or just high enough that the bidder doesn't take it.
Anyone who things "cyberterror" is not a credible threat is naiive, or completely clueless. Yes, terrorists use the Internet, and know how to get around being traced.
Sure, I agree that we might not see cyberterror attacks for years yet. Does that mean we should turn a blind eye to our infrastructure and ignore the issue of proper security?
my spambox is fullfilled with cyber terror
Privacy is terrorism.
To me, all that fearmongering of "terrorists" (that don't exist) is creating terror itself. So all the censorship and surveillance on the net would be the actual "cyberterror". If there were a point in adding "cyber-" in front of everything. It's just plain terrorizing the people. For the usual reasons: To gain control over them.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Once you start down that route then your hypothetical ideas go three places: people who do not care, government investigative agencies, and actual terrorist groups.
The people who don't really care are probably the people with which you discuss these things.
The government investigative agencies, depending upon the quality of your hypothetical ideas, may begin to monitor or make inquiries about you. Many people are not comfortable with vague gray fuzzy inquiries from vague gray fuzzy characters. Look for the conditions in your workplace and the public places which you frequent to become more and more odd, discomforting, or passively hostile. Additionally, once investigative agencies begin to take notice of you because of your hypothetical musings you may find that the number of speeding tickets you receive goes up, or applications/resumes for employment are ignored or denied with vague and meaningless responses, or applications for apartment or condo rentals are similarly ignored or denied with vague and meaningless responses. Consider that paranoia does not begin with full light of black helicopters and an entourage or marked police cars. It begins with vague fuzzy gray inquiries made to your HR department, your bank manager, your insurance company, the local police department, your ISPs cybercrime response department, etc. Those things add up to create a negative stress in your life.
If actual terrorist groups take notice of your musings then they might adapt your ideas and act on them. If you have been covertly monitored, as above, you may become the object of deeper and harsher scrutiny.
Unless you are deliberately and specifically sanctioned by the government and on someone's official payroll then being brilliant, creative, and novel is not welcome in today's society of thought police and preemptive military invasion. Iraq had some things that US leaders were uncomfortable with, therefore they deserve to be invaded. A particular citizen has ideas or musings which the local chamber of commerce members are uncomfortable with, therefore they deserve to lose their job, their home, and be forced to leave town.
It all follows along perfectly from having a big brother government with unlimited financial resource and unchecked under-the-table influence.
the NPG electrode was replaced with carbon blac
The main stream news STILL does not want to admit that cyber 'terror' (like the attacks on twitter, facebook and in S. Korea) were conducted via WINDOWS zombie computers, as part of a segment of the greater BOTNET.
There is only ONE reason why they may not want to admit Microsoft Windows allows BOTNETS and that is MONEY.
If the mainstream media where to announce that all of Microsoft Windows computers have a major security flaw that can only be fix properly by rewritting the Kernel and File system permission design, would potentially seriously hurt the Economy. Think about all the people that would stop shopping Online... it is actually better 'economically' to just let cyber criminals phish away and get all our credit card numbers and steal some poor souls identity, than to cause mass hysteria.
Why does it have to be Windows? There is at least one botnet on Macs.
"Terrorism" requires terror, not inconvenience or annoyance.
A few years back, we had an accidental shutdown of the power supply of most of the eastern North America. It was very inconvenient, and it cost a huge amount of money, and it even resulted in the loss of some lives. But it wasn't terrifying. It was just annoying.
It's not about the amount of damage, it's about the effect. A cyberterror event like a power or communications failure could result in hundreds of deaths, but there's nothing to focus on. A car exploding next to a bistro may only kill two or three people, but it is far more effective terrorism.
For terrorism to be effective, it has to produce terror. That's an emotional reaction, not an intellectual one. And to get that emotional reaction, there has to be real tangible threats, like flames, blood and gore, falling rocks, etc.
I hate it when I make a joke and I get modded "+5 insightful". Mod the stupid comments "funny", not "insightful", pleas
When a company detects an intrusion, instead of trying to prevent it, divert it ....
Send them to an area full of porn. That will disrupt their concentration and make the careless and easy to detect.
Remember, most of the cyber-terrorist are sexually frustrated people who are technology smart, but not common sense smart.
it makes for silly movies, and sillier reality. enough said.
This three to eight year lag is the spread of cyberweapons is supposed to reassure us? :-( What other weapons have three to eight year lags in being available to everyone?
We need to move beyond war, in part because it is too terrible to contemplate at this point:
http://educationanddemocracy.org/FSCfiles/C_CC2a_TripleRevolution.htm
We need to transition to "intrinsically secure" infrastructure:
http://en.wikipedia.org/wiki/Brittle_Power
that we protect by means of "mutual security":
http://www.beyondintractability.org/audio/morton_deutsch/?nid=2430
We need to move beyond current defense ideology in the USA based on competitive profit-maximizing centralized brittle infrastructure that we try to defend by unilateral dominance (at a cost of about a trillion dollars a year in the USA).
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
you simply dont understand.
Once the terrorists have taken down all their pr0n sites, we'll probably get red alert.
There are two rules for success:
1. Never tell everything you know.
Is this the Same Think tank that George Bush used when he announced that Iran had discontinued its Nuclear enrichment program in 2003?
I mean eve if this is a head-fake, its a pretty dumb one.
Sig Battery depleted. Reverting to safe mode.
Cyberterror could do some nasty things, such as stealing financial information; but as far as disrupting vital systems, we're pretty safe... because computers and software are so damn unreliable that nobody EXPECTS them to work all the time. Every business and organization should KNOW, from experience, that their computer system could go belly up at any time, and have backup methods and redundancies ready to go.
I'd wager that lots of cyber-terrorist attacks would just seem like a normal Monday. If a computer glitch could kill a million people... well, that's probably going to happy terrorist or not.
This is digg, not slashdot. Facts are not welcome here. Yes, I work for another such agency. Yup, we've even seen hostile code in silicon. The chinese are a real threat.
"Not yet?" Maybe "not ever." Cyber-sabotage? Sure. But people are pretty jaded about computers. Windows still has huge marketshare. Bring all of society crashing down and I'm still not sure it'll be "terror." People will be pissed, but will they feel the safe has become unsafe? Either they already think that, or they never will.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Isn't that what 4chan is for?
Okay, granted, I didn't read the article.
But, it seems to me, terrorism in America wasn't really taken seriously until 2 planes flew into the World Trade center. Up, until then, attacks on the Cole, WTC bombing 1, and even the Oklahoma city bombing were pretty much discounted as insignificant and manageable threats.
Now we have overkill/misdirected resources to combat bottled water.
Didn't I read, not too long ago in Slashdot, about some scientisty types that claimed a properly coordinated attack on key infrastructure powergrid systems could darken the west coast?
I'm just sayin', it'd be pretty foolish to discount a cyberattack just because uncle sam sez so.
Ok, it's an acronym, possibly not a real word. But SCADA (jfgi) is the most likely target we need to defend against in any cyberattack. SCADA systems measure voltages, control levels and flip switches on industrial and civil infrastructure systems such as those controlling water and sewerage systems, and running petrochemical plants.
Most of the truly scary scenarios are being looked at by security experts now (disclosure: the company I work for is involved in this sort of work) and a lot of SCADA systems have enjoyed for years the security of simply not being on the net, or are now the subject of isolation efforts as people realise the potential for malice. However, there are a number of SCADA networks that are connected to the Internet, for reasons of cost and convenience.
Not all these systems have been secured, and some are still vulnerable. I'd call that a scary scenario. And yes, you can do damage by fiddling with the settings, to the point of damaging water mains or (quite literally) spreading crap over the landscape. So, any security pros out there with a civil infrastructure page in your portfolio, start asking those embarrassing questions. It's important.
Do not mock my vision of impractical footwear
</sarcasm>
Comment removed based on user account deletion
5 years ago I and some friends of mine were "playing" and we seen the F.B.i.. I'm not trying to be nonsensical but this is LOL in teen-age terms. Really, feds, you NEED juice. daed
Isn't the whole issue here risk management? If a cyber threat exists, what is the response we can/ will take?
The ITU took the possibility of cyber-threats seriously enough to to form IMPACT - The International Multilateral Partnership Against Cyber-Terrorism.
It seems that cybersecurity is only as good as who is administering it. If we take the object lesson of British Hacker Gary McKinnon, who is actually now in the process of being extradited to the U.S. to face prosecution for hacking various Pentagon and other miltary computers, he claims that various "highly sensitive" systems (running Windows operatin systems at the time) where on the network with the then default password "Admin".
In fact Mr. McKinnon doesn't really consider himself to be a very accomplished hacker at all, but that the systems he infiltrated were simply easy to break into. Not only was he able to easily gain access, but while on these networks logged IPs from numerous other individuals from various other countries who were after the same "free candy". Having the capability to be totally secure and doing the proper "housekeeping" necessary to be and remain secure are often two different things.
It seems as though U.S. Cybersecurity may be mistaking the obvious fear of punishment for breaching sensitive systems, for a lack of ingenuity and skill on the part of potential troublemakers on its networks, which is a pretty big mistake. That is how it seems at least
Looking for a cyber-terrorist THREAT is a bit like looking for a needle in a haystack. Looking for VULNERABILITIES to a cyber-terrorist attack is like wading through mud in a swamp. You can't write tomes of complaints about security vulnerabilities in OSes, lame users getting cracked, and slack admin practices and then chimes in about how cyber-terrorism is no big deal?! We're sitting ducks.
Every rule has more than one consequence.
The speaker spent a good amount of time on China and it's history. What it boiled down to is China's cyberware abilities are kind of like militias. They're different local groups tied tightly to the government and to academia.
In contrast, the US seems to either be research associated with academia or action explicitly part of military groups, (like the cyber command thing). (The speaker indicated this was because the US had such strict laws against accessing other people's computers.) Russia seems to be heavily supported by organized crime and other countries have other motivations.
The point being that you really can't apply the US model to other countries. Thats why it's hard to nail down and say "China is doing evil" or "Russia is doing evil" or "the US is doing evil". Each country is multiple facets and different facets of each country are associated with cyberware.
I do security
It may have been designed that way, but in practice the bean-counters have said "why are we paying for all this redundancy?!" and we cannot even handle a simple hurricane-caused fiber sever.
Actually, the decision process went more like this: 1) Iraq deserves to be invaded. 2) How can we justify invading them? 3)I know, let's say they have nukes!
Oh, yeah, and 4) profit (for oil companies).
"Networked" != "accessible via the internet". While it's possible to break into some of these kinds of networks, it generally requires 1) physical access to a terminal (for wired networks) or 2) at least physical proximity to the system (for wireless networks).
I think it's highly, highly unlikely that bad guys in China or Pakistan or whatever are going to be able to break into systems controlling big, dangerous infrastructure like this. Your worst threat (as always) is almost certainly the disgruntled employee or former employee.
Isn't it true that the main threat from the Chinese, et al, is industrial espionage? I find it very, very difficult to believe that it's even possible to do things like bring down power plants, screw around with dams, etc, over the internet.
What's more, it probably wouldn't even become APPARENT that the event was caused by a "terrorist" until long after the fact. That really limits the utility of this kind of thing from the "terrorist's" standpoint - it's hard to terrorize people when they don't even realize you've done something.