US, China Face Mutually Assured Destruction In Cyberwar

chicksdaddy writes with a tidbit from the RSA conference. From the article: "A panel of security and policy experts speaking at the RSA Conference in San Francisco on Wednesday said that, despite dire warnings about the information warfare capabilities of China and other developing nations, the risk of an all-out cyberwar is remote, and that the U.S. still holds many of the cards. Rather than trying to deliver a knock-out cyberwar capability, the U.S. should embrace the Cold War notions of containment and mutually assured destruction with advanced nations like China and Russia. Tried and true methods to win security from cyberattacks include international diplomacy, multilateral agreements that clarify the parameters for peaceful and hostile cyberactions and — of course — a strong offensive capability."

Comments

In My Opinion, One Horrible Analogy

[eldavojohn]

Cyber-war and cyber-security and cyber-whatever you want to call it is not like nuclear war. Cyber-warfare is happening now and governments responsible for it (and I'm sorry for sounding so biased but this is largely the Chinese) are denying they're attacking anyone. And they can do this because a large number of attacks don't cause immediate harm to the victims. Nobody was launching nuclear missiles (or allowing another nation to launch nuclear missiles on their soil) during the cold war and then saying "Wow, *cough* *cough* I have no idea who launched those missiles!" But time and time again we see "attacks" from Chinese IP addresses and the Chinese government saying "Help us catch these criminals, *snicker*, they are too wily for we, the stupid Chinese who manage to control our populace with a giant firewall but can neither detect nor trace these attacks from within our borders."

Old fashioned diplomatic horse trading will also be a critical tool for avoiding conflict and stemming the kinds of economic and military espionage that have become common in recent years.

As I stated above, I feel that the "economic and military espionage" is largely coming from one or two perpetrators. China will simply agree to everything, take the bargaining chip (whatever it is) from the US and then continue to play dumb.

In fact, the country's leaders are anxious to hear the opinions of U.S. policy experts on what an effective cyber war doctrine and policy should look like.

Right, right, "Excuse me, what are the rules so I know how to toe the line but still remain in good standing with the UN ... er, screw them, the WTO?"

This gem was really humorous:

"We as a nation know what steps we need to take to reduce our risk in cyber space," said Lewis of CSIS. "We may not want to, politically, but we know what those steps are."

A hot topic of conversation now within policy circles, cyber war is likely to end up as just another weapon in the arsenal of the U.S., China and other advanced nations, said Lewis. "People will figure out how to use it."

People will figure out how to use it? Now get off your lawn? Buddy if you can't take the time to pick up the paper or turn on CNN and watch 15-year olds downloading point'n'click bots to be a part of Anonymous, you don't deserve the title of "Senior Fellow at the Center for Strategic and International Studies." Let me assure you, people do know how to use it. Ragtag groups of teenagers roving the globe can band together and effectively use it. I'm sure governments aren't as ignorantly bumbling to catch up like they want us to believe.

Re:In My Opinion, One Horrible Analogy

[GameboyRMH]

The other problem is that in "cyber war" there are no laws of physics to ensure that the rules of kinetic destruction apply. Certain targets can be practically indestructible. Basically MAD only works if both parties are horribly incompetent at computer security and plan to keep it that way.

Re:In My Opinion, One Horrible Analogy

[Bengie]

I envision ping -t attacks and Minecraft griefing. Possibly a World of Warcraft arena team to take out pesky Chinese farmers. Maybe the US government is going to get into EveOnline and is going to all out attack the Chinese players.

Really.. wtf is "mutual destruction" in relation to a "Cyber-war"?

Re:In My Opinion, One Horrible Analogy

[tomhath]

Cyber-warfare is happening now...

You seem to be confusing cyber-espionage (which is happening) with cyber-war (which would involve disrupting most financial transactions, journalism, etc.). You wouldn't get a tweet that cyber-war started because that would be one of the first sites taken down.

The closest we've seen to cyber-warfare is the STUXNET virus; it want far beyond the capabilities of script kiddies running downloadable bots.

Re:In My Opinion, One Horrible Analogy

[Kamiza Ikioi]

Not only that, but with a nuclear bomb, you can see it coming. You can see where it came from. You know who sent it. And you can fire back appropriately. Chinese hackers can attend American colleges, and attack from our own soil, and we have no way of knowing where or who it came from, if they're really good at it, that is.

So only the US and China get Cyber-Destructed?

[PolygamousRanchKid]

Something makes me think that they will take the rest of us with them . . .

I don't agree

[s.petry]

Part of the problem with outsourcing all of our IT manufacturing is that we don't know what foreign agencies can kill with a single switch. It's only a part mind you, but enough that we in the US should be severely concerned with. No matter how good our hacking staff is, if the hardware they are hacking on is killed from a remote location.. well.. that pretty much ends the game.

Re:I don't agree

[SuricouRaven]

If I were a Chinese intelligence expert tasked with meeting this challenge, I'd place my killswitch in the offload engine of network interfaces. Just have to get the chip fabs in China to switch their masks for slightly modified ones, with a tiny bit of extra circuitry on the silicon. It'd look for a specific sequence of 16 bytes in the packet (Putting it in the offload engine ensures it won't inadvertantly break routers en route - at worst you'd knock out a web proxy instead) and, upon detecting them, short every data line on the PCIe interface to ground (or +5v) in the hope of frying the northbridge, or at least crashing the system. Now you've got a simple but effective killswitch. Good for exactly one major use before it's discovered and the trigger blocked, but one use should be quite enough - when the war goes serious, the ability to crash half the US internet will provide many hours of disruption. Enough to cover a first strike. Alternatively, it could be used to quietly fry the webservers of dissidents or proxies - so long as you don't try to hit too many at once, it'd look like nothing more than a failed mainboard and never be detected as a deliberate attack.

You could use it as an ECM system - respond to hacking attempts with a packet containing the kill-code - but if you do that consistantly they'll eventually realise something is going on and start replaying packet dumps until they find the cause.

Turn off the pipes

[Skapare]

If an attack does come from overseas, just turn off the pipes (power off whatever devices the physical undersea fibers connect to). The problem with this is that they are likely setting up a massive botnet within the target country that cannot be blocked by such a method. And we do see that the government tends to not care to shut down botnets, even now.

So what does MAD mean in this context?

[roc97007]

Trivially, an attack can be stopped or at least contained by simply pulling the network plug. I can't envision a scenario where we'd "lose the internet". We might lose connectivity to some areas for awhile, but it's not like there's some timed self-destruct code buried in Cisco firmware that could be activated en-masse.

...Is there?