Slashdot Mirror
Kaspersky Says Cyber Weapons "Cleaner" Than Traditional Weapons But "Much Worse"
DavidGilbert99 writes "Eugene Kaspersky and Mikko Hypponen have been watching the cyber security world every since happy hackers were writing viruses for nothing more than their own entertainment. Today however things are very much different. At the DLD 2013 conference, the pair debated the current state of cyber warfare and cyber weapons. Kaspersky said that while cyber weapons may be much 'cleaner' than traditional missiles, guns and bombs, they are 'much worse' as they can be used by just about anyone who has some level of computer proficiency. Both agreed that it was very difficult to protect against the highly-complex nation-state developed malware like Stuxnet, Flame and Gauss. Hypponen said that we are in the 'first stages of a cyber-arms race' warning: 'I think we've only seen the very beginning of these problems.'"
defacing websites? taking down SCADA systems of those stupid enough to internet connect them? who has died as direct result of cyber crime?
Excluding still-hypothetical malware which takes control of hardware that can decimate the human population or does something that causes a human to do the same, about the worst that malware can do is maybe knock a few planes out of the sky, disable a few cities' water supplies, etc. until we decide we no longer trust technology. At that point we'll be back to the 1950s, at worst.
We've had enough bombs to send the human race back to the per-industrial age if not to extinction for over 40 years now.
So, yeah, in practical terms of "arms" available to the average bad guy who has money, software may be a lot more damaging, but at its limit the current state of the art in bomb-type weapons is far worse than "malware"-type weapons: If China or Russia and the United States decide to nuke each other and take the world with it, bend over and kiss your rear end good-bye.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Yes much worse...
Corporations have insurance against physical attacks but cyber attacks cost them money.
I am not surprised by Kapersky saying what he does.
If you don't want your automation system attacked, then keep it off line and what is off line monitored and limited so it can't be accessed improperly and then treat your crew right...with supervision.
Life is not easy.
I'm a Golden Boy!
I do not think it means what you think it means....
Well, I guess it comes down to what criteria one means when one says 'worse'. In terms of ease of access or ability to defend against it might be 'worse'.. but worse in the same way that, say, pigeon crap is worse. Sure it might be everywhere and you can't do much about its absolute existence, but you can do a LOT against it actually doing harm.
One can not do much to 'defend' against cyber weapons on the whole, but one can do a lot to mitigate the impact of actual harmful attacks. Ok, attacks like Stuxnet are non-trivial to defend against, but even these sophisticated attacks did minimal actual damage, all they really did was mess up people's schedules. So the worst of the worst were still weapons of inconvenience and even in those cases there are things the defenders could do to stop future attacks.
Living on a planet affected by Kessler Syndrome (http://en.wikipedia.org/wiki/Kessler_syndrome) would suck for a number of reasons.
You mean those things that can attack Windows systems?
STOP USING MICROSOFT PRODUCTS!
Get free satoshi (Bitcoin) and Dogecoins
Either that or it would be awesome.
I'm keeping an eye on that!
OMG folks, the scenarios are far more dangerous than those involving nuclear and biological weapons!
Hoo-kay Mr Kaspersky.
About twenty years ago people were writing malware mostly because they could. I was working on a well known (at the time) product and one day someone joked that we write a virus that targeted our main competitor's product. This led to a serious discussion of what could happen if a team like ours of about 25 experienced professional programmers started writing viruses. It was not a pretty picture.
We now live in this world with Stuxnet/Flame/etc. It is even scarier now than it was tthen.
In meatspace war, the object was always to damage flesh. We first had blunt objects (stones, clubs) which gave way to sharp piercing weapons (spears, arrows) which gave way to propelled metal (flintlocks, rifles) which gave way to blast waves and shrapnel (shells, bombs) which evolved into directable versions (cruise missiles, armed drones). The next step is probably autocontrolled weapons v1.0, iRobots which scurry through the battlefield and club the enemy or some such.
I wonder where we are on that scale with weaponizable viruses. Are Stuxnet and its peers the equivalent of Predator drones or will we look back decades from now and think that they were the crude matchlock blunderbusses of their day?
If Slashdot were chemistry it would look like this:Cadaverine
they are 'much worse' as they can be used by just about anyone who has some level of computer proficiency. Both agreed that it was very difficult to protect against the highly-complex nation-state developed malware like Stuxnet, Flame and Gauss.
Um, nation-states are not "just about anyone". They actually tend to be the same people who have all those "dirty" traditional weapons too. Sure, in theory some rogue basement dweller could launch a massive cyber attack just before his mother calls him up for dinner, but in general such attacks build on information gathered by intelligence services and the State Department (you need to know what you are targeting to do it efficiently).
The fact that such dire warnings come from someone who just happens to profit from the existence and above all fear of malware makes it a little hard for me to take it as seriously as he apparently does.
Incidentally, if some basement dweller on the other side of the planet really does pose a threat to your national security, you need to fire the clowns who set up your IT infrastructure and hire some people who actually know wtf they are doing. Stay on top of exploits, keep your software and patchsets up-to-date, plug the holes in your firewalls, don't do stupid things like plaintext storage of passwords anywhere, force the use of keys where possible, etc... you know, all the basic stuff that gets discussed whenever security comes up. Most successful attacks that make the news are not examples of very clever attackers but rather abysmally unaware defenders.
Maybe I don't know what I'm talking about, but from here it looks like someone complaining that they're car might get stolen because they keep leaving it running with the doors open in a busy part of town with no police or cameras. "Omg auto theft is likely to go up and people will be run over by inexperienced/drunk/high drivers who shouldn't be behind the wheel, we must do something!" Yeah, park it in a better spot, turn of the engine, take the keys out of the ignition, lock the door, and come back to check on it at least once a day. Derp.
Kaspersky would certainly say that. They are one of the parties most benefited by general security related panic.
... it's just scare mongering to attempt to justify defense dollars.
If you're infrastructure (beyond just computers) is capable of being hacked then you're not designing your infrastructure properly, you'd use older non-hackable you have to be physically present to fuck with it stuff. This is where older non-electronic technology comes in handy
It's not just Internet-connected infrastructure. In many cases, people took the proper precautionary steps, but weren't actively paranoid. To protect your infrastructure today, you really do need to be paranoid. People bring in gadgets infected with malware, plug the malware-infected gadget into a PC, and the PC infects every system on the network. OK, so you ban people from bringing in gadgets, and now you remove all secretarial PCs from the main network. Maybe you even disable every USB port and force people to use PS/2 keyboards and mice. Well, the next infection comes in from a contractor who installs software directly from the manufacturer. If the hackers know that you use Flash and/or Java in your company's intranet, it's not inconceivable that they manage to infect Flash or Java. I mean, we're talking about nation states here. They can do whatever the fuck they want, and money is not much of an issue.
Somewhere along the line, people with resources a hundred times greater than yours will come up with a line of attack that you didn't defend against. And if you protect against everything obvious, who knows what the crazy fuckers will do? If I were on the Iranian nuclear power commission, I'd probably give the Americans and Israelis a semi-obvious backdoor to my network, just so that they don't send in black ops teams. I'm not saying that I think the Americans and Israelis would be so stupid, but, then again, these people probably grew up watching James Bond movies. They probably think that shit is exciting.
If you can't inspect the source code and the compiler then it could very well be suspect. A backdoor in the compiler itself is all it takes to put a backdoor on everything compiled with that compiler. How would you defend against that?
If mr. Kaspersky sold nuclear weapons, he would say that A-bombs are cleaner but more powerful than cyber weapons.
Unless you're, line by line, going through every line of code - code you're compiling yourself, having safely built the compiler yourself, you're not preventing anything.
"But everybody's looking at it! Open source man!"
Said everybody who failed to notice the numerous compromised repositories over the years.
Granted, having the ability to do that - despite how painful and unlikely it is anybody will do it, is a good thing.
Surprising eh- such a quote from someone who hangs with the FSB and is busy drumming up business for he and his ex? He's also argued this as the motivation behind his call for a complete lack of transparency and privacy for average citizens including the need for government provided authentication as a "protection". He's a self-serving corrupt ass using his money and influence to impose his and his friends will on anyone he can. He (along with the internet braintrust represented by Russia, the UAE, China, Saudi Arabia, Algeria, Sudan, and Egypt), wants the ITU to "take over" management of DNS. Don't buy his products he is, as much as anyone of influence in this circles, evil.
Hypponen added that what set cyber-weapons apart from traditional weapons was the fact that anyone could get their hands on one of these weapons, unlike a nuclear bomb, missiles or tanks which only armies would have access to.
Regular people can't get ahold of traditional weapons? What? Isn't that a large part of what most of the US (and the peanut gallery around the world) has been arguing about for the last month? That people can get their hands on the terrible traditional weapons?
So why don't "they" (go as far up the chain as need be) just outlaw cyber-weapons around the world. Seems like that would take care of the whole problem... or does that only apply to computers... or neither? And do you think "they" would be scared shitless of the prospect of trying "require" the cyberweapons of the US or Russia to be handed over. And do you think that the US, Russia, UK, Israel, Iran, Pakistan, any of them would be willing to give theirs up when there is even the slightest prospect that anyone else on that list had them? How'd that work out with nukes?
If you ban cyberweapons, only criminals will have cyberweapons.
My present is the activity I am currently engaged in with the purpose of turning the future into a better past.
Military uses packet sizes of 1500 bytes. We should limit the packet sizes for TCP to 768 bytes for civilian (non law-enforcement) use. Law-enforcement can use 1500 byte packets only after going through special training. This will help mitigate the threat posed by cyber warfare - and it makes as much sense as any other policy being proposed.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
Mikko Hypponen
Ahem...the other dude's name is Mikko Hyppönen.
(comicbookguy-voice) Worst, summary, ever.
Kaspersky really should stop pretending to know anything other than DOS and Windows malware. "Cyber weapons" exploit easily avoidable vulnerabilities, that exist because companies responsible for infrastructure-critical software are incompetent and greedy. Stop filling the market with overpriced hastily built crap, and there would be no "evil hackers" to speak about.
Contrary to the popular belief, there indeed is no God.
Sounds too much like the recent Battelstar Glactica reboot to me...
Anonymous evolved...and They Have No Plan
Spare me.