Officials Warn: Cyber War On the US Has Begun

snydeq writes "Security pros and government officials warn of a possible cyber 9/11 involving banks, utilities, other companies, or the Internet, InfoWorld reports. 'A cyber war has been brewing for at least the past year, and although you might view this battle as governments going head to head in a shadow fight, security experts say the battleground is shifting from government entities to the private sector, to civilian targets that provide many essential services to U.S. citizens. The cyber war has seen various attacks around the world, with incidents such as Stuxnet, Flame, and Red October garnering attention. Some attacks have been against government systems, but increasingly likely to attack civilian entities. U.S. banks and utilities have already been hit.'"

Comments

"Cyber 9/11"

[ShaunC]

Really? So we're going to see buildings destroyed, thousands murdered? The hyperbole is way out of hand on this one.

Re:"Cyber 9/11"

[binarylarry]

Don't you get man?!

The porn! They're going to be deleting all of our precious, precious porno!

It'll be like back in the dark ages again with cave drawings and domestic animals.

Game over man, GAME OVER!

Re:"Cyber 9/11"

[Anonymous Coward]

more like money disappearing and wall street execs jumping from the roofs of there pent houses. Unless they get into the power system and turn it off !! Now that would be a pain.

Re:"Cyber 9/11"

[Anonymous Coward]

The hyperbole is WAY out of hand on all of the "cyber war" discussions.

Re:"Cyber 9/11"

[dkleinsc]

Well, how else are you going to convince people that they should be spending huge sums of taxpayer money to help private industry do the computer security work they should have already done at their own expense?

But yes, it cheapens the meaning of the real 9/11 when you use it to scare people into responding to non-lethal threats. Apparently, banks and utilities have already been hit, and nobody outside of those organizations even noticed. That tells you how much of a non-threat it is.

Re:"Cyber 9/11"

[NFN_NLN]

Really? So we're going to see buildings destroyed, thousands murdered? The hyperbole is way out of hand on this one.

It's all about strategically timed loss of service to exacerbate tensions:

- Disable electricity during a heat wave in Atlanta = Riot
- Disable communications right after a white police officer is acquitted of beating a black suspect in LA = Riot & Looting
- Disable banking/credit card during Black Friday = Riot, people already riot and trample each other in Walmart without a loss of service.

Basically the US is a powder keg... all it takes is a spark :)

Re:"Cyber 9/11"

[Anonymous Coward]

Buildings destroyed, probably not... Thousands murdered, perhaps. Why? Because many public utilities run on computers. You hack that system, you can do things like shut off electricity for an extended period of time and very few people have things like a backup generator. That guy with an oxygen pump? Dead. The diabetic who over time has their insulin harden into a jelly like substance because it's not cold? Dead. That hospital that didn't have a proper backup system for power? Many dead.

It's not exactly hard to murder people with a cyber attack, you won't see buildings destroyed like a normal attack though. Cyber attack, you could take out the financial market, which while not of upmost importance to most people these days, if you shut down VISA and Mastercard, there's a good chunk of people that won't have access to their money so getting food and water becomes a problem.

Now do I think this is going to happen soon? Nah... I'm not a doomsday theorist. Can it happen? Sure.

Re:"Cyber 9/11"

[Jetra]

Fire Sale! I loved that movie.

Re:"Cyber 9/11"

[i kan reed]

Don't you see? If we don't get our pointless billions in wasted defense spending, everyone will die.

Re:"Cyber 9/11"

[Anonymous Coward]

Actually, I believe it might be even bigger. We could be talking about nuclear power plants in the hands of the wrong people. Or air traffic control towers.

Re:"Cyber 9/11"

[jellomizer]

If you hack a bank that causes them to say stop funding a hospital due to a "Computer Error" and people die because the hospital didn't get the resources they needed in time. The hacker is no less evil then a guy who just pushed the button to hit a bomb.

They justify their consciousness because it is just cleaner and they don't have the see the full effect.

Re:"Cyber 9/11"

[swb]

Well, if you can sabotage PLCs in a power plant and cause it to blow up, maybe.

Re:"Cyber 9/11"

[vlm]

They're talking about an attack on our civil rights, and they're almost certain to win, just like the bad guys won after 9/11.

Wait for the next innocent convenient disaster. Bank led by crooks and con men goes out of business? Oh you say one foreigner tried identity theft once back in '98? Well that cause and effect is obvious, we need to "temporarily" suspend the constitution until the threat is neutralized aka forever.

Re:"Cyber 9/11"

[davester666]

MY porn is in the cloud, and everybody knows, its pointless to attack a cloud.

Re:"Cyber 9/11"

[pitchpipe]

Well, to be fair, they did tone down the rhetoric a bit. Some of the phrases they were considering that were dropped in favor of "cyber 9/11":

• Cyber Apocalypse
• Cyber Armageddon
• Cyber Annihilation
• Cyber Holocaust
• Cyber Extinction

Personally I like "The Cyber Extinction". It just sounds awesome!

Re:"Cyber 9/11"

[cdrudge]

If a hospital can't keep the necessary supplies in inventory to operate should a "computer error" happen and can't be resolved immediately, they shouldn't be a hospital.

No major business is going to operate on a "just in time" basis for financing. They are all going to carry lines of credit or other equivalent with their major suppliers. They are going to have 15-, 30-, 60-, 90-day terms or whatnot for invoicing.

Re:"Cyber 9/11"

[vlm]

The problem is finding an area of the USA where a medium term power loss would not be business as usual, due to 3rd world infrastructure.

Hmm shutdown NYC's power, they'll collapse. Naah tried that short term back in the 00s and longer term last fall due to a mere rainstorm.

Hmm shutdown power in the south? Naah thats called a hurricane, they do that stuff couple times a year no problemo.

Hmm shutdown power in the west? Naah thats called a rolling california blackout, all part of a corrupt plan to increase prices and revenue. No problemo. Heck the crooks who run the place made more money, if anything thats encouraging them!

Hmm shutdown power in the midwest? Naah every time we get a wee windstorm or ice storm or blizzard or pretty much anything but still air, happens all the time. Oh yeah and the damn mississippi is either almost bone dry or flooding the land both causing power issues.

Is there anywhere left where power outages are unusual, maybe even dangerous?

Doesn't mean its not annoying, maybe even a little dangerous. In fact if there's even a hint that foreigners are behind it all, the biggest danger is attacking some other country. If saudi arabians fly jetliners into our skyscrapers we bomb afghanistan, so I assume if Venezuelans shut down the power in Florida for a little while we'd probably respond by bombing Iran.

Re:"Cyber 9/11"

[Anonymous Coward]

You don't get it, do you? If large scale cyberwarfare really happens, there will be no Internet, no power, no water, and finally no food supply in the US, for example. Even if some of you eat the rest of you, the deaths will be measured in numbers like 10^8, not 10^3.

Re:"Cyber 9/11"

[Anonymous Coward]

I don't know about "blow up" but could certainly cause damage.

Re:"Cyber 9/11"

[Anonymous Coward]

9/11 wasn't just about death and destruction. It was about showing that the U.S. could be sucker punched right in the economy.

Re:"Cyber 9/11"

[RoTNCoRE]

Really? There wasn't a human override anywhere in that chain of events, or a financial statement anywhere that could back up a hospital's account status? Or a supplier for a huge institution like a hospital would allow postpaid 30/60/90 days credit? That does any sort of risk analysis on the financial health of their key accounts that would clearly indicate that this is out of the norm?

You have taken the scare mongering hook, line, and sinker, and furthered it with hyperbole of your own. This is a grab for control of the internet, and advocating for the further erosion of individual rights that has been going on for a long time now.

As long as you have food, water, and heat, you'll be ok. Stop being so scared - you are allowing others to control you.

Re:"Cyber 9/11"

[Anonymous Coward]

If you spin your head around like an owl you are no less evil than that thing from Exorcist or whatever.

The hell fantasy world are you living in? Institutions don't get shut down unless they have been bankrupt for months, go through at least one lawsuit brought by their creditors. Furthermore, hospitals are legally required to provide at least enough care to keep a person alive if they are having an emergency regardless of the financual situation. Someone managing to disprupt the communications of a bank is going to cause, at most, a few hours headache for a systems-administrator who is supposed to be stopping those things before they happen anyway.

Assuming what you described were even possible, I'd be inclined to arrest the jerk who decided that "not enough money" was grounds to let someone die, especially on such a temporary basis.

Maybe, sometime in the future, a 'hacker' will break somebody's life support system directly, but if they do we could just as easily blame the ignoramus who decided to put such a device on the Internet in the first place. Your fear of 'hackers' is based on some pretty basic misconceptions about how the world works and what computers are capable of.

Re:"Cyber 9/11"

[Anonymous Coward]

Dont you mean trillions? :)

Re:"Cyber 9/11"

[hawguy]

Buildings destroyed, probably not... Thousands murdered, perhaps. Why? Because many public utilities run on computers. You hack that system, you can do things like shut off electricity for an extended period of time and very few people have things like a backup generator. That guy with an oxygen pump? Dead. The diabetic who over time has their insulin harden into a jelly like substance because it's not cold? Dead. That hospital that didn't have a proper backup system for power? Many dead.

It's not exactly hard to murder people with a cyber attack, you won't see buildings destroyed like a normal attack though. Cyber attack, you could take out the financial market, which while not of upmost importance to most people these days, if you shut down VISA and Mastercard, there's a good chunk of people that won't have access to their money so getting food and water becomes a problem.

Now do I think this is going to happen soon? Nah... I'm not a doomsday theorist. Can it happen? Sure.

Pretty much every area of the USA is subject to disasters than can cause power interruptions, and already have measures in place to help those that can't survive for an extended period without power. Unless there is wide spread physical damage to repair, a cyber attack power outage will be relatively short lived.

I certainly think that 10's may die, maybe even 100's, but thousands? That seems unlikely. Even Hurricane Sandy's death toll in New York City was only 41

Re:"Cyber 9/11"

[Warhawke]

My God, it will be 911 times 404: file not found! That's, like, 368,044!!

Re:"Cyber 9/11"

[hawguy]

If you hack a bank that causes them to say stop funding a hospital due to a "Computer Error" and people die because the hospital didn't get the resources they needed in time. The hacker is no less evil then a guy who just pushed the button to hit a bomb.

They justify their consciousness because it is just cleaner and they don't have the see the full effect.

Yeah, it would be the fault of the finance people at the bank that didn't have a manual process in place to secure operational funding.

Re:"Cyber 9/11"

[GT66]

I've been using the color copier at work to print my favorite pornos out one frame at a time on reams of company paper to turn into flip books.

Re:"Cyber 9/11"

[cant_get_a_good_nick]

But Hyperbole is like the best thing EVER

Re:"Cyber 9/11"

[eksith]

That's a very bleak assessment of us :/

Not completely disagreeing with you, but people are capable of other courses of action in dire situations. I was in New York when the power outage happened in 2003 when a lot of the Northeast was completely dark except for a few lights being kept on by generators. This was only two years after 9/11 and the first thought on everyone's mind was terrorism, but no one panicked or rioted except for a few burglaries (those are always to be expected). People were being helped from the subways by fellow passengers, others took care of each other as best they can.

Even after the 2001 attacks, there were people helping out and staying calm (as best they can).

There are instances where people act like they've lost their minds during emergencies, but then they have already lost their minds by the time the rioting starts. The riot is just the symptom of that.

Re:"Cyber 9/11"

[icebike]

Yes you might be able to cause a few deaths by killing all power. You could cause a few more by setting all intersections to ALL Ways Green.

But so what? People will quickly figure it out, cities will simply unplug the stop-lights reverting every intersection into take-your-turn.

You can't do any significant damage to a country, and render them in-capable of responding in kind, or with tomahawk missiles.
This is fear-mongering, plain and simple.

Re:"Cyber 9/11"

[icebike]

Hospitals have ways to deal with this. There are, after all, power outages and disasters frequent enough to cause them to plan ahead, and they can run for over a month with zero funding, and several months once the government steps in.

Re:"Cyber 9/11"

[megamerican]

It'll be more like, if you don't give the government insane controls over the internet there will be 100 Chernobyl's in the United States. The legislation is already written. They just need the right opportunity (real of manufactured) to invoke fear and pass it without any congressman being able to read said legislation.

Re:"Cyber 9/11"

[Anonymous Coward]

...and wall street execs jumping from the roofs of there pent houses.

That'd be a happy sight.

Re:"Cyber 9/11"

[Anonymous Coward]

If you hack a bank that causes them to say stop funding a hospital due to a "Computer Error" and people die because the hospital didn't get the resources they needed in time. The hacker is no less evil then a guy who just pushed the button to hit a bomb.

OH MY GOD! QUICKLY! EVERYONE GIVE UP YOUR PERSONAL FREEDOMS!

Re:"Cyber 9/11"

[Anonymous Coward]

Nope, we will see a plane flown into a major landmark that is in dire need of expensive upgrades and watch it pancake when it should have toppled and have it blamed on a hacked auto-pilot that locked out the controls, who actually did it?

No one will know for certain as the government will refuse to allow a third party investigation and before any investigation can be done we will sell the wreckage to an overseas recycling company at a loss compared to what a local one would pay and one of the investigators of the issue will turn up dead in a Georgia hotel and ruled a suicide only to have photos leaked online showing his neck bashed in before his arms were slit.

Re:"Cyber 9/11"

[Anonymous Coward]

the relationship is the 'false flag' component of both events.

Re:"Cyber 9/11"

[Anonymous Coward]

Really? So we're going to see buildings destroyed, thousands murdered? The hyperbole is way out of hand on this one.

Actually, you're thinking of the incorrect metaphor. It will be a "Cyber 9/11" in that the loss of freedoms of the American people will far exceed the scope of the security breakdown that occured.

Re:"Cyber 9/11"

[Anonymous Coward]

The salient point is, of course, is that IF there are any buildings destroyed or people dying, they have already established a storyline for us all to swallow.
The elephant in the room, is that we all know that you can't know WHO actually caused the supposed catastrophe that will be used to justify establishing full traceability on the internet. Those packets can be sent wirelessly without leaving a trace, and once the system's down, where's your evidence ?
And they can tell us they warned us.

Of course, I'm smoking crack too. Lend me an ear and I'll sing you a song and I'll try not to sing out of key.

Re:"Cyber 9/11"

[TimeandMaterials]

Great point! I hate these 'cyber' this and cyber that terms... Silly and confusing.

Re:"Cyber 9/11"

[bosef1]

Fuck... domestic animals.

Re:"Cyber 9/11"

[girlintraining]

Apparently, banks and utilities have already been hit, and nobody outside of those organizations even noticed. That tells you how much of a non-threat it is.

I can't reveal which financial institution I work for due to company policy regarding social networking, but I can say it is a major one in the United States. Nobody here noticed any "attacks" above and beyond the usual phishing and money laundering crap that comes through every day. Not a peep. Work proceeds as usual. I checked with a few of my friends who have contract gigs at Wall St., and at a nearby state university... none of them have reported anything unusual either.

I appreciate the sentiment, and truly do believe every organization could do to review and update their security and disaster recovery plans. I'm a professional in IT though, of course I'm going to say that; It's good business. However, implying that anything is happening on the networks I manage or that of many others in my profession that could equate to "the next 9/11" is complete hyperbole and, frankly, insulting.

Re:"Cyber 9/11"

[Kasar]

The BBC has a Pentagon announcement that they plan to quintuple their "Cyber Defense" staffing. Completely unrelated I'm sure.

Re:"Cyber 9/11"

[Anonymous Coward]

Agreed.

I mean, it's only the announcement for Service Pack 1 for Windows 8; how bad could it be?

Re:"Cyber 9/11"

[AK Marc]

What would happen if at 12:36:45, every computer-controlled elevator in the country went to the highest setting, disabled all safeties, and dropped. How about if traffic lights were set to change traffic flow, of subways crashed or anything else from that Die Hard movie? Personally, if I could control every computer in the US, I'd reassign all property (stocks, cars, real estate), anything with a computer record, split evenly and randomly assigned to someone with the last name Johnson, Williams, Smith, or Jones. Then notify everyone of the change. There are a number of states that manage "lost" property (https://txcpa.cpa.state.tx.us/up/Search.jsp for one), and often they put the money in the general fund and take the money out only when claimed. Well, if I had 10,000,000,000,000 lost in Texas, they'd pull that out of the general fund and give it to me. So modify those records and pay myself or someone else out enough to screw up cashflow for every state this is possible in.

But for deaths, try overloading devices until they blow. We did that with Stuxnet. Why couldn't someone do that with jet engines. A virus in a Boeing that caused 150% thrust 25 minutes after takeoff in all left engines and fuel cutoff on all right engines, causing flight problems at the same time as control issues (fuel burn rate, landing with power on and all that, while distracted by an inconvenient power imbalance). Dial every OnStar car and shut down 1% per minute for an hour - crashes everywhere and traffic ending at a dead stop - see stop lights. There are lots of good ways to cause problems. Just because you can't think of any doesn't mean that there aren't thousands of them.

Re:"Cyber 9/11"

[Anonymous Coward]

"Doesn't mean its not annoying, maybe even a little dangerous. In fact if there's even a hint that foreigners are behind it all, the biggest danger is attacking some other country. If saudi arabians fly jetliners into our skyscrapers we bomb afghanistan,"

So you would have preferrred we stayed out of the European war, and simply struck back at Japan in 1941?

The first part of your post shows you're not as stupid as your last paragraph would suggest. Why did you ruin a good thing?

Re:"Cyber 9/11"

[Anonymous Coward]

Well, sucks to be you when "the cloud" evaporates into thin air.

My porn is stored locally, backed up, and yes, technically I guess you could say that the copies the FBI holds on behalf of Megaupload count as off-site storage.

Re:"Cyber 9/11"

[Anonymous Coward]

Maybe we need a porn reset. It just keeps escalating, and it would be nice if I didn't need at least 3 Swedish dwarfs and a clown to get me off.

Re:"Cyber 9/11"

[Anonymous Coward]

I stopped reading after your first sentence. The safety systems in elevators work automatically anytime the thing is in free-fall. There is no way to "disable" them without physically tampering with them. I assume the rest of your nonsense is just that (nonsense).

Re:"Cyber 9/11"

[tlhIngan]

I appreciate the sentiment, and truly do believe every organization could do to review and update their security and disaster recovery plans. I'm a professional in IT though, of course I'm going to say that; It's good business. However, implying that anything is happening on the networks I manage or that of many others in my profession that could equate to "the next 9/11" is complete hyperbole and, frankly, insulting.

I think it's more a case of it's appropriations time, and with the looming new fiscal cliff, budget talks, and taxes and cuts, well, departments are going to inflate their needs with hyperbole to indicate that cutting their budget is a bad idea.

Cut DoD? Cyberwarfare! We've got another 9/11!
Cut DHS? Cyber 9/11!

etc.

Re:"Cyber 9/11"

[Scragglykat]

It's the clouds you have to worry about. http://www.youtube.com/watch?v=EmFKioFazho

Re:"Cyber 9/11"

[Anonymous Coward]

How do you get sound?

Re:"Cyber 9/11"

[guttentag]

It's all about strategically timed loss of service to exacerbate tensions.

How would people know to riot if the power is out and they can't access twitter or facebook? When the power goes out, people are more likely to sit and play cards with their family, or go outside and start talking to the next door neighbors they've never met.

If you want to get people worked up, selectively turn people's power back on, turning them against each other. See The Monsters Are Due On Maple Street

Re:"Cyber 9/11"

[Pieroxy]

IIRC Germany also declared war to the US.

Re:"Cyber 9/11"

[Pieroxy]

What about if you erased every US citizen's bank account? Or you decided that those cooling stuff in nuclear plants are to be stopped immediately (probably harder)?

Let's admit that a heck of a lot of things are run by computer these days. A LOT of stuff.

Re:"Cyber 9/11"

[buchner.johannes]

Yeah, the headline is kind of weird. It sounds like it goes like this:

> Oh, we detect cyber warfare! (a term we invented so I don't have to understand the difference between information and people/materials).
> More and more computers are attacked! (because we attack other nations and stifle their industry for our own security and economical interests).
> More attacks mean we need to be better prepared to attack more! (because we are not smart enough to make attacks pointless, and don't understand that a resourceful attacker can be rendered harmless by being defensive and smarter. No I must use old military strategy, attack the attackers, we need to have the best technology!)

Re:"Cyber 9/11"

[Anonymous Coward]

>I can't reveal which financial institution I work for due to company policy regarding social networking, but I can say it is a major one in the United States. Nobody here noticed any "attacks" above and beyond the usual phishing and...

That is proof they are successfully hacking into banks without the bank knowing! The gov't was right.

Re:"Cyber 9/11"

[Nyder]

Really? So we're going to see buildings destroyed, thousands murdered? The hyperbole is way out of hand on this one.

I think they mean they are going to use the situation to take away more of our freedoms, just like they did after the 9-11 event.

Re:"Cyber 9/11"

[jittles]

The problem is finding an area of the USA where a medium term power loss would not be business as usual, due to 3rd world infrastructure.

You have obviously not lived somewhere that truly has third world infrastructure. Try running water for an hour or two a day, tops. And sometimes going weeks without any running water at all. Or having the power go out a half a dozen times a day, for anywhere from 1 minute to 3 or 4 hours. And that's without any severe or unusual weather. That is standard operating procedure.

Re:"Cyber 9/11"

[Anonymous Coward]

Wait until you try Cyberhyperbole!

Re:"Cyber 9/11"

[The Archon V2.0]

Wow. Just when I thought that the Flash cartoons I once watched on Newgrounds couldn't possibly be relevant again, one shall get its nanosecond in the sun: There was one about bin Laden stealing pop music and porn that was just building up to a "Free Britney Spears, Porn" joke.

Re:"Cyber 9/11"

[Anonymous Coward]

Uhhhhhh really? NASDAQ was and is completely owned... CIA and FBI had to go in... remember that? CitiBank... also owned.. your not talking to the right people lol MASSIVE networks that have been patched together over the past decade and IT staffs that have been downsized, along with IT admins that think they are the shit... = bad. You ask any admin if his network is/has been hacked he'll prob say NO.. esp on wall street where they just patch it after the fact and cover their asses... they don't disclose anything.

No one you know has "noticed" any attacks because they are busy doing their jobs keeping the network going for business like everyone else. Why would they think any machines are "owned" by hackers when their "network" is running fine lol

You need to open your eyes.. it only takes ONE little machine to own a whole network/company From there you just do some quiet scans.. find more machines that haven't been patched... (pretty easy with 5,000+ employees)

http://yro.slashdot.org/story/11/11/25/0231224/fbi-scolds-nasdaq-over-out-of-date-patches

 

Re:"Cyber 9/11"

[gandhi_2]

...says an Iranian teenager, sitting in a Tehran cafe, posting as girlintraining, as logged in through an ssh tunnel to her employer's office.

"muhahaha!" says the Iranian. Posting submit, only slowed temporarily by the captcha: iRonY.

Re:"Cyber 9/11"

[icebike]

What about if you erased every US citizen's bank account?

Two words:

Backup Tapes

Re:"Cyber 9/11"

[Larryish]

Moan while wanking.

Re:"Cyber 9/11"

[Synerg1y]

I don't think you understand the people you're talking about: here's an obligatory xkcd: http://xkcd.com/705/ . Some people care more about downtime than others and security people are among the most... paranoid. Also, fear = job security, so :)

Re:"Cyber 9/11"

[Changa_MC]

Well, the terminology is dicey, since 1st world means USA/Europe, 2nd world means USSR/China, and third world means, everyone else...
I've lived in "third world" countries that had fully democratic elections, running water 24/7, electricity uptime to five nines...
Y'know: all stuff the USA simply does not have in most areas. But there was poverty too, and it was crippling bad.
Being poor in a developing country is deadly dangerous, but then again plenty of people freeze to death or starve to death in the USA every year as well, so the difference is more of percentages than type.

Re:"Cyber 9/11"

[Changa_MC]

This is the USA we're talking about.
Most of my food comes from local farmers who, yes, use banks for their money but no, would not stop selling if the banks closed their doors - in power outages they just switch to cash only, a cyber 9-11 is just a really big outage.
Power outages suck, but I get them all the time, so I'd continue to lug in logs of wood for heat (I guess I'd have to stop using propane to cook eventually if the trucks really stop coming because there's no internet).
My water supply is upstream from me, this town had water before it had power, it just means they stop clorinating by machine which means boiling your drinking water for safety, but I've done that before.

Folks will probably die if the grid completely fails, but then again, folks will probably die if a big enough meteor hits - not like we should spend money preparing for that either.

Re:"Cyber 9/11"

[Terrasque]

The first 10 minutes of this video (05:00 to ~10:00 to be exact) gives a pretty good explanation of "cyber" as used here, I think..

Re:"Cyber 9/11"

[Anonymous Coward]

Or it could be that you aren't that high a profile target as you pretend, or you aren't as good at detecting attempted intrusions.

Re:"Cyber 9/11"

[Anonymous Coward]

You just described California.

Re:"Cyber 9/11"

[Terrasque]

The first 10 minutes of this video (05:00 to ~10:00 to be exact) gives a pretty good explanation of "cyber" as used here, I think.. // sorry for double post - closing " missing in first :(

Re:"Cyber 9/11"

[NJRoadfan]

If you want to get people worked up, selectively turn people's power back on, turning them against each other. See The Monsters Are Due On Maple Street

You clearly weren't in the NYC metro area after Superstorm Sandy hit.

Re:"Cyber 9/11"

[NJRoadfan]

I'm willing to bet that country has cheap and fast internet connections too.

Re:"Cyber 9/11"

[Anonymous Coward]

You have obviously not lived somewhere that truly has third world infrastructure. Try running water for an hour or two a day, tops. And sometimes going weeks without any running water at all.

One of the reasons I am living in what could be considered a "2nd world" country... Much more survivability if the shit were to hit the fan.

Re:"Cyber 9/11"

[Anonymous Coward]

-Disable EBT Food befits cards for 1 weekend = riot

Re:"Cyber 9/11"

[10101001 10101001]

But yes, it cheapens the meaning of the real 9/11 when you use it to scare people into responding to non-lethal threats.

Funny. I thought that *was* the real meaning of 9/11. It didn't take any longer than 10/11 for that to hold.

Re:"Cyber 9/11"

[Anonymous Coward]

No communications, no live TV coverage, no rioting.

We consistently see police car chases occur more often in LA the more willing the TV news stations are willing to provide live coverage. When we cut off the live coverage, the incidence of people racing through the city at high speeds drops off dramatically.

Re:"Cyber 9/11"

[flyneye]

What if it turns to be only "partly cloudy"? Is your data corrupted or does it turn to softcore porn?
How about overcast? All your pr0n turns to goatse.cx

Re:"Cyber 9/11"

[CrimsonAvenger]

I certainly think that 10's may die, maybe even 100's, but thousands? That seems unlikely. Even Hurricane Sandy's death toll in New York City was only 41

Katrina caused 1833 deaths. Of course, Katrina was a bit more severe than Sandy, which most of us down N'Awlins way wouldn't even have considered evacuating for....

Re:"Cyber 9/11"

[Coppit]

You don't need reams of paper. Just do about 50 pages, and repeatedly flip through those 50.

Re:"Cyber 9/11"

[Anonymous Coward]

Oh no...not the porn! Do they still publish magazines like Playboy, Penthouse, and Hustler? Might be the only thing to save us from DHS goons.

Re:"Cyber 9/11"

[Anonymous Coward]

I know the one I'm in does. The locals don't think it is cheap, but I do.

Re:"Cyber 9/11"

[Anonymous Coward]

And the reality is that almost ALL of the time people react decently here. I've been in and seen several major disasters in the U.S. and every time people come together and help out.

Re:"Cyber 9/11"

[Anonymous Coward]

Can we stop referring to groups as "bad guys" or "good guys"? It's pretty idiotic and only fit for hollywood.

Re:"Cyber 9/11"

[Anonymous Coward]

I was in the Masai Mara in Kenya where we only had power for 3 hours a day and hot water for about 4. The weird thing is we could get a cell signal absolutely anywhere. Even in the middle of the bush. Would LOVE to know how they did that.

Re:"Cyber 9/11"

[Anonymous Coward]

Same AC, here's another one that just popped up on /. about security cameras.

Re:"Cyber 9/11"

[soundguy]

You're 12, aren't you?

Re:"Cyber 9/11"

[Lord Ender]

From the perspective of those in power, the impact on the economy is the largest factor to consider.

Re:"Cyber 9/11"

[girlintraining]

I think it's more a case of it's appropriations time, and with the looming new fiscal cliff, budget talks, and taxes and cuts, well, departments are going to inflate their needs with hyperbole to indicate that cutting their budget is a bad idea.

I'll buy that for a dollar. Just don't tell me and my peers we're incompetent from your arm chair deep in your mother's basement, that's all. You hit the nail on the head, unlike the previous poster, who apparently lives on a diet of Fox News conspiracy theories and trade magazines far removed from the realities of this industry.

Re:"Cyber 9/11"

[mjwx]

Personally I like "The Cyber Extinction". It just sounds awesome!

Starts whistling the Doctor Who theme song.

Dun de dun de dun de dun de dun de dun wOOOoooo Woo-oo-o

Re:"Cyber 9/11"

[Anonymous Coward]

Nobody here noticed any "attacks" above and beyond the usual

Well the obvious retort is that the attacks have become so sophisticated that we don't even notice them! MOAR BUDGETZ!!!!

Re:"Cyber 9/11"

[fonske]

fap fap fap
A Danish Clown or a Norwegian Clown?
fap fap...
In marketing they call this a niche product - pron talk "fetish" (originally from voodoo?).
Anyway, agreed, it is getting ridiculous.

Re:"Cyber 9/11"

[jellomizer]

How is breaking into someone's else's computer a freedom.

Re:"Cyber 9/11"

[jellomizer]

They can run. But they may not be able to run effectively. They may need to hire more doctors, or get that MRI fixed. For a short term period that is fine. However if your break into the banks account and mess up their funding. There is a slower long term drain.

Re:"Cyber 9/11"

[progician]

You know, once upon a time the USSR and co. was depicted as the evil big brother with extended network spies and micromanagement, that sustains a state of paranoia and thus crippling the life and freedom of all of its citizens. While it certainly wasn't true in this form never the less there was indeed a level of paranoia that pervaded the entire block, mostly the fear of foreign agents. I'm from one of these countries.

Today, it seems that the same measures updated with modern technologies are wide spread all over the world, including the Land of the Free, Western Europe and all justified by crime, terrorism. The image of the enemy: the criminal and the terrorist can be easily paralleled with the agent of the evil western forces in the state capitalist block.

There's a lot of idiot who are convinced that a few hundred domestic casualties is enough to justify the excessive security measures that run around the planet since the second half the 20th century. Borders were never so significant than today because never before was there any level of individual enforcement as there has been in the last 60 years. Every move must be documented (travelling, paying, calling, messaging, receiving any kind of service) in enormous detail. It is a leaned skill of management: just like as in a protest that is contained for its own safety, the "right to protest" is satisfied on paper, but the rest of the city doesn't encounter with the protesting crowds because the police isolates the crowd completely. Effective measure, not as bloody as it would have been 150 years ago, but at that time the government wasn't recognised as mediator, but as an outright enemy of the majority of the population, the working class and down. Today, all this detailed documentation is learned from the "worker state" USSR, which had to work under the image being the friend of the people, while doing exactly the same job as Bloody Code of England at the time. Terrorise, discipline, and coerce the population to the world of socialized production and minority benefit of capitalism.

Re:"Cyber 9/11"

[vlm]

Just put the neocons to work and we'll get up to that level.

Re:"Cyber 9/11"

[Anonymous Coward]

Unless you are the head of security you wouldn't necessarily know. We (at a utility) had an incident about a year ago, and our CEO didn't know. The stockholders didn't know. The media didn't know. The FBI was involved, but information to them was limited in scope. The employees didn't know save for a small group of 10 people. I only know because they wanted my insight on something they found (it was an APT). Not that I'm discounting the propensity for fear mongering by the government. It's not entirely BS though.

The game of malware detection has changed. Now days when you have something like an APT (Advanced Persistent Threat) it's not readily apparent. In fact, part of the persistent part is to avoid detection using hidden files, replacing known good files (like Symantec A/V) with malicious ones that perform the intended function as well as malicious functionality, blending in with allowed traffic on the network, and propogating to multiple systems so that if one is removed access remains in place. Even in network equipment there have been incidents where backdoor functionality was built into the hardware built in China. If you can get in at the hardware level you bypass logging, security, monitoring, and like a good little puppy it rolls over and exposes it's belly. Look at how long Stuxnet was on Iran's network before it was discovered. It wasn't even detected until it had done a significant amount of damage. It worked frighteningly well. You have entire departments in the military (both ours and our enemies) devoted to cyber warfare. Of course it's a concern.

You talk about updating dr plans. I just did that two days ago. We're starting to talk about recovery from a threat that's gone undetected over five years. In the six years I've been here we're not running the same OS, system software, third party software, not to mention the modeling changes. If we had to recover to five years ago we might as well just chuck it all and rebuild from the ground up. Now imagine if one of our enemies did that to every utility in the country. How long do you think it would take to rebuild your entire infrastructure at the financial institution where you work? Now multiply that by all of what we call critical infrastructure (electrical, water, sewer, traffic control, communications, financial) in the US. I wonder how long it would take us just to get hardware. I'm betting at least a month. How long would we have before society started to break down? All you need to do is look at what happened in some of the recent hurricanes to know. 3-4 days maybe. Certainly not enough time to bring everything back up. Worried yet? It keeps me up at night.

Re:"Cyber 9/11"

[i kan reed]

I was speaking with the voice of just one hypothetical defense contractor.

Re:"Cyber 9/11"

[Anonymous Coward]

Groan!!! The thing is attacks HAVE become more sophisticated and ignoring them probably won't make them go away. Now you're going to get no argument from me when it comes to provisioning more money for the government to waste, but industry itself needs to take this seriously.

Re:"Cyber 9/11"

[damien_kane]

MY porn is in the cloud, and everybody knows, its pointless to attack a cloud.

Unless you attack it with fire, as our sun does most fall and spring mornings.

Re:"Cyber 9/11"

[Anonymous Coward]

That guy with an oxygen pump?

You know people who need supplemental oxygen usually get it from pressurized canisters, right? Pressurized canisters that incredibly remain pressurized when the power goes out.

The diabetic who over time has their insulin harden into a jelly like substance because it's not cold?

That's a pretty long-term problem, especially considering this problem would leave them *plenty* of time to get to a hospital for assistance.

That hospital that didn't have a proper backup system for power?

I'm pretty sure that doesn't exist.

if you shut down VISA and Mastercard, there's a good chunk of people that won't have access to their money so getting food and water becomes a problem.

Except that we have, you know, emergency response agencies that would still be perfectly capable of distributing supplies.

Really, man. Even if somebody managed to take down power and communications to a large swath of the country emergency responders have these things called "radios" that run on these things called "batteries" that they can recharge using these things called "automobiles" and "generators." Would it suck? Yes. Would there be some looting and upticks in other crimes? Probably. Would people be dropping dead by the thousands in no time flat? No.

Re:"Cyber 9/11"

[Anonymous Coward]

You would do well to head the warning instead of being arrogant. You probably have rooted machines all over your network.

Re:"Cyber 9/11"

[Anonymous Coward]

And I guess if you're part of a terrorist organization it would be incomprehensible to think they might have someone who works on elevators on the inside to do that tampering?

Re:"Cyber 9/11"

[Anonymous Coward]

But it is only the weakest of us that would die during a power outage. This could strengthen us overall. No, I don't actually feel this way, but internet + anonymity.

Re:"Cyber 9/11"

[Khashishi]

You watch too many movies. None of this stuff is possible.

Re:"Cyber 9/11"

[AK Marc]

I've seen the air gap on an oil drilling platform. If not for that (And there are some without an air gap), someone could remotely cause total destruction of a drilling platform. I never said likely. But yes, at least some of that stuff is possible.

Or is damaging air-gapped centrifuges via malware not possible either?

Re:"Cyber 9/11"

[AK Marc]

Try this. Asssume the brakes on an elevator work like a parking brake on a car, triggered by gravity. Parking brakes on a rear-disc car are 100% independent (usually triggering a drum system, so drum cars often re-use the regular brakes). Pull your brake up to the first notch. Drive a day. Increase by one notch every day for a week. Then, pull the brake as hard as you can. It won't hold.

I was under the impression that the emergency brakes can be applied by electric signal, and will trigger by mechanical action in case of a sudden fall. So, you are stating that it's impossible through any electrical signal to cause wear or damage to the mechanical device that holds the emergency brakes. I'm sure the Iranians thought the same about their centrifuges.

Re:"Cyber 9/11"

[AK Marc]

People don't realize how much is computer controlled today. Programmers don't think about security. So, unless they are designed physically secure (expensive) most systems are insecure. Like the home camera systems that by default try hard to open themselves up to the world. The commercial systems aren't much better. I've used plenty that have no password, even commercial grade. If you didn't want it open to the world, you wouldn't have put it online.

Re:"Cyber 9/11"

[Anonymous Coward]

I appreciate the sentiment, and truly do believe every organization could do to review and update their security and disaster recovery plans. I'm a professional in IT though, of course I'm going to say that; It's good business. However, implying that anything is happening on the networks I manage or that of many others in my profession that could equate to "the next 9/11" is complete hyperbole and, frankly, insulting.

Like yourself I work in the Information Security field and don't see any out of "normal" attacks. This is all FUD to soak the taxpayer out of money and scare the average citizen into giving up more rights and set up more survaliance on the citizen.

The article also said:

incidents such as Stuxnet, Flame

and who built these? Oh the US so whos guilty on these attacks?

and yes like yourself I find this insulting.

Re:"Cyber 9/11"

[bkcallahan]

They hiring?

Re:"Cyber 9/11"

[Anonymous Coward]

The economy will collapse due to the sudden drop in demand for squeegees and keyboard skins!!!!!!!

Re:"Cyber 9/11"

[Gen_Music]

That can happen, but only when you truly believe that the cause of the threat is external to the people you are helping AND/OR that you lose nothing important by helping them.

Take the third point. If people were relying on that food for the next few weeks and are all of a sudden told they cannot buy it, they may be inclined to attempt to leave with those goods anyway, probably resulting an a scuffle. Multiply that by the tens or hundreds of people that would pass through Wal-Mart and don't really carry paper money and you have a riot in the making.

It's human nature, and if someone's trying to light a proverbial spark, they're well aware of human nature.

Re:"Cyber 9/11"

[Anonymous Coward]

Wow a box head on /. You really think wars can only be fought with guns and bombs...? You must be a Republican.. Learn to think outside of the box or this war will run you over... World War III is going to be a cyberwar...

Re:"Cyber 9/11"

[Anonymous Coward]

Tell that to Sony....

WAKE ME WHEN SOMEONE BRINGS OUT A GUN !!

[Anonymous Coward]

Otherwise, nothing new here !!

Idiots

[Anonymous Coward]

This cyberwarfare has been going on for more than five years now. Do you know how many banks, medical facilities, etc. as well as research institutions have been hit by the Chinese? I won't say whom, but a major US aerospace research corporation has been undergoing an almost constant stream of attacks since 2005...

Re:Idiots

[icebike]

This cyberwarfare has been going on for more than five years now. Do you know how many banks, medical facilities, etc. as well as research institutions have been hit by the Chinese? I won't say whom, but a major US aerospace research corporation has been undergoing an almost constant stream of attacks since 2005...

So has my ssh server. Except that has been going on for much longer.
And when I turn on logging in iptables I see a constant patter of attempts on common windows networking ports as well.

Is this is what constitutes an "attack" in these reports?

My guess is that with public news articles coming out daily and homeland security trying to convince every
little public utility of grave danger and stampede them to harden their system, that these script kiddie attempts, which are
almost universally unsuccessful, are exactly what is being touted as a cyber warfare attack.

Re:Idiots

[jedidiah]

Yeah. It sounds like we've been at war since the mid-90s.

Re:Idiots

[ThatsLoseNotLoose]

I won't say whom, but a major US aerospace research corporation has been undergoing an almost constant stream of attacks since 2005...

You don't have to say whom. They're all under attack. Have you never read a server log?

Re: Idiots

[Anonymous Coward]

Was it not one of the states in the US a few weeks ago that a USB data stick with a trojan caused issues for a utility company?

It boggles my mind that some companies in control of the grid haven't gotten it together yet. Especially as it potentially does not just affect them and their customers, but all of the tie-ins whom they purchase and sell power to.

(It also boggles my mind due to observing the measures taken to tighten security and harden operations of some of the Canadian provinces grids- yes, they make day-to-day work a pain in the ass, but considering most operators hired in the past 10 years have barely (if ever!) used anything other than SCADA for switching and would have little to no clue of what they were doing if they had to drive and manually switch circuits in and out...

(not an employee, 'just' a family member who was co-opted into typing reports for a parent due to better spelling and keyboarding at a very young age)

Re:Idiots

[AK Marc]

Every IP is under "constant attack" from script kiddies. The country that hosts the bots changes. But not he US and Russian owners of the botnets.

Re:Idiots

[Anonymous Coward]

It was by following back the IPs hitting my home router that we were able to tell the yanks where to find Osama.

Re:Idiots

[Khashishi]

We've always been at war with terrorists.

What a bunch of pansies!

[Anonymous Coward]

So, they put a bug in Russian oil pipeline controlling kit that blows up. They put a virus on Iranian nuclear power testing plants (could have blown up).

And everything was just "The Next Cyber War Could Be Deadly".

But now that the USA's banks are being attacked, "ITS THE NEXT 11/9!!!!!!!!!!"

Fucking drama queens.

Re:What a bunch of pansies!

[Joe_Dragon]

what about bugging the missiles so they fail wait they may just fail on there own.

Re:What a bunch of pansies!

[Anonymous Coward]

What does November 9th have to do with any of this?

Re:What a bunch of pansies!

[Anonymous Coward]

but but, we are only suposed to fight wars were only heathens get killed!

Rights attack

[JeffSh]

FUD to steal more of our rights away. "FOR YOUR PROTECTION, we need to monitor everything, sign on the dotted line and everything will be ok. You Can Trust US" MEH.

Anything to keep the masses fearful

[fredrated]

After all, what with fiscal responsibility looming, we need all the excuses we can get to keep the war funds flowing.

Re:Anything to keep the masses fearful

[clarkkent09]

As long as Democrats are opposed to any entitlement cuts and Republicans to any tax increases or defense cuts there is no imminent danger of fiscal responsibility. I prefer a different conspiracy theory. Since exaggerating the danger of physical terrorist attacks worked so well in limiting out physical privacy rights (see TSA, PATRIOT act etc) similar process will work in relieving us of our online privacy as well.

Re:Anything to keep the masses fearful

[CrimsonAvenger]

As long as Democrats are opposed to any entitlement cuts and Republicans to any tax increases or defense cuts there is no imminent danger of fiscal responsibility.

Note that if the DoD budget were zeroed, we'd still have a deficit.

Note, likewise, that if either Medicare or SSA were zeroed, we'd still have a deficit.

Tax increases? 30% across the board, and we'd still have a deficit. Tweak that so the "rich" pay more? Probably still a deficit, though if you could couple that with a Congress that wouldn't use the higher revenue as an excuse to spend more, you might have something. If your "rich" don't just leave the country to avoid the taxes.

Fiscal responsibility is only going to happen when our bond rating starts falling to the point that US T-bills are not considered a safe place to put your money.

9/11 times...

[Anonymous Coward]

Spottswoode: From what I.N.T.E.L.L.I.G.N.C.E has gathered, it would be 9/11 times 100.
Gary Johnston: 9/11 times a hundred? Jesus, that's...
Spottswoode: Yes, 91,100.

Re:9/11 times...

[Anonymous Coward]

Actually, it's 81.8181818181....

Re:9/11 times...

[Anonymous Coward]

Actually, by my math, it's about 81.8

Bad news on the horizon.

[doubledown00]

If even somewhat true, this is the kind of thing that will usher in a new era of network surveillance and the kind of restrictions that will kill a formerly free Internet. Governments will have much more incentive to get involved in the standards drafting process in order to ensure "proper adherence" to national security "requests" etc.

I hope I'm wrong, but having seen how people go apeshit with simple "point and click" technologies like guns.......let's see what happens when you get a bunch of old white guys with power trying to lock down things they *truly* don't understand.

Re:Bad news on the horizon.

[sjames]

Worse, the wall protecting Wall Street from the consequences of it's crimes is showing cracks. A new scary foreign bad guy must be invented fast!

Re:Bad news on the horizon.

[Kasar]

Utilities were given specifications to follow, but they've changed several times. From an isolated control and monitoring network to one connected to the internet for government access, the regulators can't decide if they want security or convenience. Being bureaucrats first and foremost, ease of use (monitoring) for the government will be the side it will always drift towards.

Re:Bad news on the horizon.

[Anonymous Coward]

If even somewhat true, this is the kind of thing that will usher in a new era of network surveillance and the kind of restrictions that will kill a formerly free Internet. Governments will have much more incentive to get involved in the standards drafting process in order to ensure "proper adherence" to national security "requests" etc.

You mean they're going to actually give a fuck about security and finally replace Windows with Linux for SCADA!? Hallelujah!

  (That's French for "Jihad").

Re:Bad news on the horizon.

[Anonymous Coward]

> a bunch of old white guys...

RACIST! You imply that a bunch of young Hispanic or black or Asian women would perform more competently if running the government. There's nothing about being old or white or being a man that makes a government employee bad...they can do a terrible job in all shapes, sizes, colors, sexes and ages.

Re:Bad news on the horizon.

[Changa_MC]

True, but it is still interesting to note that all the people in power are old and white and male. Especially odd considering all that "reverse racism" that's been apparently going on the last few decades.

Re:Bad news on the horizon.

[Anonymous Coward]

More diversity among our elected representatives would likely imply more diversity of life experiences which would likely lead to policies which were good for a larger proportion of the population. So, yes, it is important that they are nearly all old white guys.

Re:Bad news on the horizon.

[doubledown00]

You mean they're going to actually give a fuck about security and finally replace Windows with Linux for SCADA!? Hallelujah!

(That's French for "Jihad").

A "be careful what you wish for" statement if ever there were one.

Re:Bad news on the horizon.

[doubledown00]

> a bunch of old white guys...

RACIST! You imply that a bunch of young Hispanic or black or Asian women would perform more competently if running the government. There's nothing about being old or white or being a man that makes a government employee bad...they can do a terrible job in all shapes, sizes, colors, sexes and ages.

You're willing to sit there and argue that the overwhelming effects of policies coming out of Washington (at least until 2009, sorta) *don't* primarily serve the interests of rich old white men?

But, I'll play the racist game. Am I suggesting that a more minority split government would be at least a little hesitant to buy the wholesale claims of fear eminninating from government today? You bet your ass.

It is not racism to suggest that different ethnic groups in this country see authority in different ways. (And I'm a middle-upper class white dude lawyer!)

Re:Bad news on the horizon.

[Anonymous Coward]

I know, just look at all of those folks that come from white priviledge like Obama, Collin Powell, Condolisa Rice, Marco Rubio, Michael Steele, and the lot. All those old white guys. It's just not fair I tell you. And just walk into any government office like the post office, dmv, or welfare. All those old white men controlling the rest of us. Why Rosa Parks should have just sat down in the back of the bus and not made a fuss for all the difference it's made.

Re:Bad news on the horizon.

[Anonymous Coward]

No one has the same life experience, so there will always be a diversity of such. And assuming someone who is a different ethnic background from you is going to have some completely different viewpoint is fucking ridiculous.

Upper middle-class black people, upper middle-class white people, and upper middle-class hispanic people (etc.) are more similar to each other than any of them are to the poorer people in each of the respective (and artificial) groups.

When one has been overseas for some time and you just want to sit and shoot the shit with another american, you learn very quickly that the color of anyones skin means absolutely dick...we all have very similar "life experiences" by virtue of the fact that we're american.

Re:Bad news on the horizon.

[Anonymous Coward]

Marco Rubio isn't white? I guess we're going with the sound of his name, because have you seen any pictures of that guy? Meantime, Condolisa Rice and Colin Powell have no power (are they elected officials now?), and Obama is the exception that proves the rule - and he's half white which make him half tolerable to the crazies on your side of the fence.
But we're talking about congress, where both houses are pretty much just whites, men, and white men. There's one or two minorities, but it's not anything proportional to the talent or to the population, so stop kidding yourself.

Hyperbole

[Anonymous Coward]

It's going to be a cyber holocaust!

Re:Hyperbole

[Anonymous Coward]

are you a denier that this has already happened!!!! NARUS

Well now...

[maugle]

Can't say I'm surprised about how vulnerable our infrastructure is. TheDailyWTF is chock-full of stories about massive security holes in company networks, and the firing of anyone who tries to point them out and get them fixed.

Re:Well now...

[Grand Facade]

TheDailyWTF is chock-full of stories about massive security holes in company networks, and the persecution/prosecution of anyone who tries to point them out and get them fixed.

There I fixed that for you.

Re:Well now...

[Anonymous Coward]

d in a shadow fight, security experts say the battleground is shifting from government entities to the private sector, to civilian targets that provide many essential services to U.S. citizens. The cyber war has seen various attacks around the world, with incidents

Re:Well now...

[Anonymous Coward]

Don't mention that site here; we don't want the slashfags and fosstards coming over there with their BS and xkcd links.

Lawrence Lessig on the coming "i-Patriot Act"

[Anonymous Coward]

Lawrence Lessig on the coming "i-Patriot Act" - Boing Boing http://goo.gl/Zl0oq

unofficials say: Those who throw the first stone .

[burni2]

will be hit by the second stone

Some may call it a war, but I call it retaliation, for what ? .. Stuxnet, Flame, ..

Btw. there is an easy way how to prevent war .. well it includes NOT throwing the first stone .. and NOT presenting the first stone and playing a around and faking to through ..

Well it's like what israel does - not throwing the first stone not playing with one around - with it's nukes, they have them, everybody knows off, but they do not present them and they do not say that they have them.

Run to the Cyber Hills!

[Anonymous Coward]

I'm lucky in that I live in a cyber bunker with no outside cyber communic ***CARRIER LOST***

Our little green friend

[retaj]

Begun, the Cyber Wars have.

Re:Our little green friend

[mjwx]

What the hell has Kermit got to do with any of this?

Personally I'm more worried about Professor Bunsen and Beaker selling cheap meth to Fozzie Bear.

Re:Our little green friend

[coofercat]

Your little green friend being extracted from your pocket and given to the government? This is getting weird.

It has begun?

[KermodeBear]

What the heck is he smoking? China et al. have been attacking the US through computer systems for decades.

Re:It has begun?

[maxwell demon]

What the heck is he smoking?

I don't know. Whatever you smoke when you try to get more money, I guess. Maybe a cigar?

Re:It has begun?

[Anonymous Coward]

yes but this is not about an actual cyber war, but rather funding for retaliation to the the proposed "cyber 911" in which to start a war on (cyber)terror that can keep all the war profiteer's happy.

Re:It has begun?

[AK Marc]

And we've been doing the same to them and others. Yes, it's a war. Though in this one, we won't know who started it until the winner changes history to make it clear who we should have been rooting for.

US Agencies warning about other US Agencies?

[Spectre]

They are mentioning StuxNet and the like as a threat example? So, the US is in danger of malware created by the US ... perhaps loosing viral code on the world wasn't a good idea.

"We're finding espionage, advanced persistent threats (APTs), and other malware sitting in networks, often for more than a year before it's ever detected," Martinez says.

Now, to "protect" ourselves from our government we need to do what ... turn over more information and control to the people that created the problem? Why would I want to give more power to people that have already proven they can't be trusted with it?

This sounds like nothing more than multi-faceted spin control and manipulation.

What I hear being said:
Look, we need a larger budget to monitor this situation.
And more power to get the information we need without the red tape of actually getting warrants.
For your protection against what we've done, you should just give us all your info, all the time.

Re:US Agencies warning about other US Agencies?

[zlives]

well... at least its not for the children this time....

Re:US Agencies warning about other US Agencies?

[Anonymous Coward]

^ This :(

Re:US Agencies warning about other US Agencies?

[Anonymous Coward]

The psychopaths will force your incorporation, and your thankfulness.

Captcha: reselect

Re:US Agencies warning about other US Agencies?

[Anonymous Coward]

perhaps loosing viral code on the world wasn't a good idea.

+1 for using loosing - I've only seen it as a misspelling of losing. I'm still not sure it's a verb, but I like your style.

Re:US Agencies warning about other US Agencies?

[TwineLogic]

There are factions within the U.S. Government and they aren't always in coordination. What's more, Stuxnet was probably written by Mossad, not CIA.

Re:US Agencies warning about other US Agencies?

[Anonymous Coward]

Exactly this, if I could be bothered to log in I would mod up.

Re:US Agencies warning about other US Agencies?

[Anonymous Coward]

Wow. Only a 4-digit /. id could use the word "loosing" in a sentence and have it be correct!

Re:US Agencies warning about other US Agencies?

[slodan]

You are exactly right. This column by Glenn Greenwald is timely, and a far better source than "InfoWorld". Here are some select quotes:

This massive new expenditure of money is not primarily devoted to defending against cyber-aggressors. The US itself is the world's leading cyber-aggressor. A major purpose of this expansion is to strengthen the US's ability to destroy other nations with cyber-attacks. Indeed, even the Post report notes that a major component of this new expansion is to "conduct offensive computer operations against foreign adversaries".

As Wired's Ryan Singel wrote: "[McConnell is] talking about changing the internet to make everything anyone does on the net traceable and geo-located so the National Security Agency can pinpoint users and their computers for retaliation."

Don't forget that McConnell is the chode who got the telecoms retroactively immunized for their participation in the illegal NSA domestic spying program.

Re:US Agencies warning about other US Agencies?

[async8192]

For your protection against what we've done, you should just give us all your info, all the time.

I'd never give them all my info. I keep it safe. I uploaded it to the cloud..... uh, oh.

Re:US Agencies warning about other US Agencies?

[Anonymous Coward]

As Wired's Ryan Singel wrote: "[McConnell is] talking about changing the internet to make everything anyone does on the net traceable and geo-located so the National Security Agency can pinpoint users and their computers for retaliation."

Or so it says whoever we want to blame this month, as they tried to kill Daddy again.

Re:US Agencies warning about other US Agencies?

[Anonymous Coward]

The problem is the technology for targeted cyber attack is just better than for defense. If we believe that will be true for some time, then it's logical to assume our critical infrastructure will be (or has already been) owned.

At that point, the only thing stopping adversaries from escalating espionage into actual attacks is the threat of massive retaliation. Investing in offensive capabilities serves as a deterrent, much as our nuclear arsenal helped prevent the Cold War from turning nuclear.

Greenwald is right to point out the risks to privacy etc. that come with a government having such capabilities. But the technology isn't being developed just in the US, it's being developed globally as everyone can see the uses for cyber espionage and for deterrence against traditional military attacks. Arms races with disruptive technologies happen because strategically nations have little choice. It's unrealistic to expect a country not to prepare itself while its adversaries gain new capabilities.

The irony is that high-quality attribution technologies, which arguably are one the primary risks to civilian privacy, are also one of the main technologies that would help reduce the quantity and destabilizing potential of nation-state cyber activities. Pick your poison.

Re:US Agencies warning about other US Agencies?

[Anonymous Coward]

McConnell needs to die already

Security Pros say

[Anonymous Coward]

Security Pros say: We need more money for security! There is a war that has just begun, and we need to win it, but to win it we need money. Lots of money! Tons of money! Shitloads of tax-payer money!

Thank you very much.

Re:unofficials say: Those who throw the first ston

[Anonymous Coward]

Yeah, right. This works. Native americans where throwing stones, and they where just blown away by someone hitting them back. Like other conquired/occupied nations: they all started it.

Rules the one who has biggest stick. It was so, and it will be so.

I can see big business saying to the feds

[Grand Facade]

Oh! Noz! We need help to keep away the bad hackerz! (terrorists)

We need money to rebuild our infrastructure and a special prosecutor to chase the bad terrorists.

(even though they have been wandering around for the last 40 years with their pants down)

Stuxnet / Flame

[Anonymous Coward]

Wasn't it the US who helped MAKE that thing in the first place?
And they wonder why they are a target?

Yeah, I trust Iran as much as I trust a kid with a grenade, but fuck, I trust the USA considerably less than I do Iran.

[ just got put on the terrorist list, banned from USA ]
Like I care anyway, wouldn't want to go to that disgraceful place. Shame for the people there.
They are pretty much the privatised China.
I'm sorry China, don't hurt me. I love you guys. You get shit done. Even if it kills people.

Just started...

[Anonymous Coward]

Seriously!? wtf, it started a long long time ago my friends... (perhaps even in a galaxy far away)

Wrong date/place

[gmuslera]

Instead of cyber-pearlharbour or cyber-9/11, the right expression should be cyber-normandy. So far the main cyber attacking force comes from US in a lot of fronts, stuxnet/flame (is a nice point to show destructive weapons to scare population without naming that you are the one creating/using them), massive spying on private communications from all the world is being done by US agencies, and intrusive legal initatives are pushed to all governments of the world (SOPA/PIPA/derivates like Spain's Sinde/etc). So far has been a war against freedom, and some of the forces "attacking" US seem to be trying (in a good or bad way) to not lose that freedom.

Is a war of US against the World, and they put the world in front to make you believe that they are the victims.

Re:Wrong date/place

[Sir_Eptishous]

What about a Cyber-Kursk?

Re:Wrong date/place

[Anonymous Coward]

... cyber-normandy ...

While I like your thinking it doesn't have the 'fear factor'. Normandy was Americans dying while destroying an oppressive government, ironic really. The nine-eleven 'horror' was Americans dying because the enemy was smarter.

Re:Wrong date/place

[Anonymous Coward]

or the US was the only one that got caught publicly.

FTFA: "From Inquirer Wire Services"

[sl4shd0rk]

Seriously? why not just use an article from Fox news and be done with it? Banks get hit by attacks constantly. This is not news.

Gross mismanagement, corruption and negligence of companies which spend millions of tax dollars and fail to secure basic computing resources (like encrypted laptops)? Now that's something to call attention to.

They hacked my computer already

[eye_blinked]

I have a new startup sound. It's the sound of rubber gloves being snapped into place. The TSA wants to look down my trousers and inspect my transport layer.

Finding != Detecting ?

[joshcough]

How does this sentence make sense? "We're finding espionage, advanced persistent threats (APTs), and other malware sitting in networks, often for more than a year before it's ever detected," Martinez says. Isn't that the same as saying, "We detected it before it was detected?" Are they just leaving it there to let it bite others in the ass?

Re: Finding != Detecting ?

[Anonymous Coward]

I believe that the statement was referencing that the threats had been in the systems for a year or more before they were found / detected / discovered / dealt with

Only thing

[houghi]

The only thing we have to fear is fear itself.

Oh: and apparently you can fool enough people all the time.

Re:unofficials say: Those who throw the first ston

[Anonymous Coward]

then quit your bitching and take it up the ass like a man

And it started in?

[Anonymous Coward]

EVE Online? Amiright???? Just saying its a little *too* convenient.

RBS Citizens

[Anonymous Coward]

They basically shut down the Citizens bank web site for 3 days last week. It made it impossible to pay some bills on-time. The idiots at the bank called it "heavy traffic which is called a distributed denial of service". They would not call it an attack.

Good luck with that

[GT66]

" U.S. banks and utilities have already been hit.'"" I knew there was an up side to having no savings and owing shitloads of money to the utilities. Take that prudent financial management!

Linux/BSD ...kthxbye

[ilikenwf]

This wouldn't happen near as much if every corp, govt, person, and entity otherwise had a hardened multi-layer, stateful packet inspection firewall, with obscurity on the internal network, good policies, and Linux/BSD client machines. I blame Cisco and their crappy software on their great hardware, Microsoft for their substandard OS and applications, and Apple for their elitist "you can't touch this" attitude towards security on their OS.

Re:Linux/BSD ...kthxbye

[Anonymous Coward]

You might have a point if you had only said openbsd.... But, Linux has a hell of a lot of security holes. You can't patch them fast enough, and most people don't. The kernel alone is riddled with them. Windows security isn't all that bad with a proper antivirus / firewall in place, and UAC has reduced malware popups for the average consumer. There is absolutely nothing in place to stop a virus or popup on Linux, however. Sudo comes up so frequently that people just type there password into it without thinking. You could probably make a program that would trick them into thinking they were typing into a sudo box. And, considering that at any given time out of the thousands of software and services installed on a Linux box (do you really need that many?) there's bound to be a hole that'll run arbitrary code, you could easily get a virus on there to do that. So, ya...

Re:Linux/BSD ...kthxbye

[thoth]

Well, that's the free market in action. It doesn't optimize for the best results, it optimizes for profit, which may or may not produce a good result as a side effect.
It was more profitable for companies to ignore security issues.

Re:Linux/BSD ...kthxbye

[Anonymous Coward]

You are a knob who's read one too many wannabe enterprise network blogs.

It's not a War

[EmagGeek]

The government has simply decided to call it a War because with the wars on "drugs" and "terror" winding down, they need a new bogeyman to make everyone afraid of so they can get the next big round of taxpayer-funded defense grants.

Hacking has been going on since the birth of the Internet, and it will keep going on until global warming turns the Earth into a smoldering cinder.

Uh huh

[koan]

Oh look another "war" without a clear enemy or end in sight...

One that is super simple to avoid you have to wonder why they keep leaving critical infrastructure online.

Re:Uh huh

[Anonymous Coward]

"Oh look another "war" without a clear enemy..."
Oh the opponent is quite clear. "We have met the enemy, and it is us." ---Pogo

Re:Uh huh

[Anonymous Coward]

Because "they" are corporations who face big costs to move infrastructure offline, while facing no regulatory requirement or financial incentive to do so. If they do get hit big, odds are high they'll get "bailed out" like financial institutions were during the housing bubble.

And Congress is particularly captive to special interests right now, so the odds of imposing sane regulatory requirements for cyber hygiene are almost zero.

Shouldn't that be Cyber 00001001/00001011 ?

[Mister Liberty]

BITS we'll be blown to, all of us, after all.

Re:Shouldn't that be Cyber 00001001/00001011 ?

[mjwx]

BITS we'll be blown to, all of us, after all.

I hope this doesn't byte us in the arse.

Another excuse to get money is all

[Anonymous Coward]

Everytime an agencies cocaine bucket runs dry they drum up some hyperbole about how "america is under attack" and then "declare war on" said attacker in order to get bills passed and to get funding. Want a couple easy million? Say america is under attack and tadah, 20 million dollars in your pocket.

The war on terror, the war on drugs, the war on homelessness, the war on poverty, and so on. Americans love to think america is at war with something that somehow threatens americans. They get out their flag hats, flag tshirts, flag bumper stickers and start chanting about how awesome america is. But none of them ever notice that what we are declaring war on is ever actually fixed. A lot of money is spent, a lot of time is wasted but at the end of the day nothing has changed.

This one should be entertaining to say the least though. The war on terror was hillarious to me especially considering everyone lined up to get behind the president and chanted "support our troops" in order to protect our freedom. But none of them stopped to realize the only, and I mean only people who can take our freedom away is our own government. And we lost some freedoms in that war on terror and it was taken by our own government. So this whole cyber war should prove to be quite interesting from a spectators viewpoint.

Follow the money

[Anonymous Coward]

Who is warning us of this impending doom? "Security Pros". Who has the most to gain from security panic? "Security Pros".

Cyber incompetence

[Anonymous Coward]

Let's just call it a draw shall we?

SCADA vulnerabilities are quite real

[CFD339]

My understanding is that SCADA -- which allows the remote management of a great many infrastructure technologies like power substations and such -- is extremely vulnerable, to the extent that I read there is a manufacturer's back door in many (most?) that is easily determined if you know the mac address of the device, and that the mac addresses are fairly easy to come by.

Re:SCADA vulnerabilities are quite real

[Anonymous Coward]

A properly configured SCADA system allows multiple custom watchdog processes that can notify the HMI if the device operations deviate from it's normal functions.

Well...

[Rassleholic]

Considering that the private sector considers anything that doesn't "generate revenue" as a massive cost sink, it's no wonder that security and maintenance infrastructure has been gutted to the point where a stiff breeze could send it all crashing down and massive data theft is so common it's no longer newsworthy.

Fahrenheit 9/11

[MatrixCubed]

So... some rich dude will take out a huge insurance policy on a credit card database, just days before it's hacked and the information stolen?

Not a "War," a Money Grab

[EmagGeek]

The government and/or the powers that be have simply decided to call it a War because with the wars on "drugs" and "terror" winding down, they need a new bogeyman to make everyone afraid of so they can get the next big round of taxpayer-funded defense grants.

Hacking has been going on since the birth of the Internet, and it will keep going on until global warming turns the Earth into a smoldering cinder.

Someone's Pissed...

[jmd]

USSC.gov. was hacked. Sys Admins put it back online. USSC was hacked again. This time with keystrokes to play tetris and a nyan cat. As of this writing USSC is still down. Someone is pissed.

So........This is a great excuse to steal more money from taxpayers using fear. The fear instilled in us taxpayers (stuxnet etc) was created by..guess who??

The game is over .. Anonymous has called it right. This will be an interesting ride over the next few years.

Re:unofficials say: Those who throw the first ston

[icebike]

Great strategy. Its kept Israel out of so many wars.....
Oh, wait...

Nothing To See Here

[Scarletdown]

All in all, this is sounding like just another scare tactic to maintain a perpetual state of war, keeping the public paranoid and distrusting of anyone except our "benevolent leaders" who pretend to be looking after our best interests.

Don't forget the post-election attacks

[TwineLogic]

In fact, the November 15th United Airlines was a cyber attack. This was a retaliation for the severing of Russian civilian satellite control. In turn, that was a U.S. attack intended to silence Russian (RT.com) claims that the Petraeus scandal was the fall-out of a barely-discovered voting fraud "coup attempt," and that President Obama and Defense Secretary Panetta had fled the United States to Asia immediately after the coup was discovered.

lp0: on fire

[Anonymous Coward]

Next time, instead of writing "cyber-9/11", please consider setting yourself on fire instead. Thanks.

Governments declare war on the Internet

[WaffleMonster]

9/11 comparisons and DoD goons routinely discussing threat from cyber war in terms of parity with nuclear weapons is quite amusing like comparing getting detention with being sent off to a Nazi concentration camp.

Asserting the age old problem of "espionage" is now "cyber" and dreaming up of doomsday scenarios which leave even braindead zombies asking the obvious question how hard is it really to keep "critical infustructure" off the Internet?

I have little doubt real intent of this media blitz and TLA warnings are to create an atmosphere conducive to tolerating government overreach. Overreach which cannot possibly work to accomplish better security for anyone.

If the government really cared about US infustructure being hacked via Internet they would find a legal framework making hacking against every government/public target without any restriction legal by US citizens with some rules against lame attacks (ddos) and intentional non-collateral damage.

Penalize agencies that get 0wn3d. Make it a huge game (with cash prizes) focus on educational resources to help and encourage hacking. Not only do you get better infustructure you get more knowledgable peeps.

Re:Governments declare war on the Internet

[Anonymous Coward]

I've been saying for a long time now that we shouldn't have critical systems connected to the internet. The response is always that they have to be because there's too many of them and too few engineers to maintain them / too expensive, yada yada. My response to that is use one-way ethernet cables that let you monitor systems remotely, but require any changes to the system be local; in regards to SCADA systems (prison/water/energy/etc). To which I get, "But that's too hard and scary." etcetera etcetera ad nauseum..... You're dealing with group think, basically. They think they're right, and you're wrong regardless what the facts show. And, they'll keep thinking it until there's a disaster. And, maybe even then. *sad face*

Re:Governments declare war on the Internet

[joe_frisch]

I think that people focus too much on "critical" systems and cyber->physical attacks, and not enough on the value of privately held information. My personal information (photographs, writings, etc) are quite valuable to me. The loss of my personal copies of my financial and legal information would cost me a large amount of time to recover. The loss of my purchased media and software would represent a significant financial loss. I take normal steps to protect my information, but I'm sure it is not safe against a carefully planned attack by experts. Very conservatively this is thousands of dollars in value to me, possibly much higher. (here I am assuming that my backups are destroyed as well in this hypothetical attaci).

Multiply my loss by say 100 MILLION and the damage done is quite large - without a single photogenic explosion or train wreck. Think of how many people have their valuable information on insecure home computers.

An attack on insecure data can also cause a lot of disruption and financial chaos. Huge numbers of credit card and bank account numbers and passwords released, fake purchases made, etc.

Free and wealthy countries like the US are especially vulnerable as they have significant information assets, and a large and vulnerable computer infrastructure.

I think it was a serious strategic error when the US (through stuxnet) launched a cyber attack on a national nuclear facility. It demonstrated that we consider cyber attacks a very different issues from physical attacks, and made it very difficult for us to respond physically to such attacks. We have changed our battle ground from one where we have absolute superiority (conventional warfare) to one where we are quite weak (cyber warfare). Sun Tzu would not approve.

Re:Governments declare war on the Internet

[Anonymous Coward]

9/11 comparisons and DoD goons routinely discussing threat from cyber war in terms of parity with nuclear weapons is quite amusing like comparing getting detention with being sent off to a Nazi concentration camp.

By simple extrapolation of Godwin's Law we can prove the comparison correct in certain circumstances:
 

Any detention, given enough time, under any condition -- regardless of severity or locale -- inevitably bears striking resemblance to a concentration camp run by Hitler or the Nazis.

"Security pros and government officials"

[Alex Belits]

Security pros

Microsoft shills and antivirus software makers' PR departments.

and government officials

Propaganda workers and PR departments of military-industrial complex.

Re:unofficials say: Those who throw the first ston

[Anonymous Coward]

Tell that to the Vietnamese.

Infoworld is full of $hit

[Anonymous Coward]

I'm a security professional. I work for one of the largest banks in the world, in a role directly involving online security.

Putting it succinctly, Infoworld is full of shit.

Yes, there have been attacks. There were also attacks last year. And the year before. And pretty much every year going back to the day somebody first connected a modem to the serial port of a computer with access to the bank's internal network. I have no doubt whatsoever there will be attacks this year, next year, and every year to come.

This is NOT "Cyber 9-11". Not even fucking CLOSE to it. People fucking DIED on 9-11, including two guys I was friends with in college and used to drink, play videogames, and trade warez with all the time. I think one of them might have even jumped, and had to spend ~40 terrifying seconds deciding whether he'd prefer to be killed instantly, or live an extra millisecond or two in searing pain after getting shredded by the steel and glass atrium feet first.

It sucks having to tell your boss that there's a distributed denial of service attack in progress, or someone might have compromised an application and harvested usernames or email addresses (but as of yet, no passwords). It doesn't even come CLOSE to sucking as badly as falling a thousand feet to your death, or getting liquefied and burned alive by 400 million tons of flaming concrete.

Picture sitting at your desk, sipping a latte, checking out the morning's posts on Slashdot, and having a 767 crash into your office at 500mph. A chunk of wing hurls across the floor, tears off your legs, and sends you flying into a column or something solid. You have about a quarter of a second to think, "WTF" before getting engulfed in a fireball and dying more slowly than you'd have otherwise rationally preferred. Now, in that context, try to think of ANY conceivable computer hacking attempt or attack that either keeps people from accessing their accounts or creates fraudulent line items for the forensic bookkeeping team to try and sort out that you'd EVER classify as being worthy of being used in the same sentence as "9-11". Go ahead, I *dare* you.

Re:Infoworld is full of $hit

[Anonymous Coward]

I see your $hit and I'm calling you out on some of your own. First, you don't have an idea what you are talking about. I doubt you have a clue on secur`+'${`%&NO CARRIER

Re:Infoworld is full of $hit

[Anonymous Coward]

You have about a quarter of a second to think, "WTF" before getting engulfed in a fireball and dying more slowly than you'd have otherwise rationally preferred. Now, in that context, try to think of ANY conceivable computer hacking attempt or attack that either keeps people from accessing their accounts or creates fraudulent line items for the forensic bookkeeping team to try and sort out that you'd EVER classify as being worthy of being used in the same sentence as "9-11". Go ahead, I *dare* you.

Simple. You walk into the office and find hackers have rooted the systems, and remotely deleted your Linux/Apache server software then re-installed MS Windows ME and IIS.

If you disagree with me then I seriously call into question your claim of being a "Security Professional".

Re:Infoworld is full of $hit

[L4t3r4lu5]

This post should have started "Dear Congressman,"

Re:Infoworld is full of $hit

[Anonymous Coward]

Ehm, I don't know, for a lot of people the value of human life is very low. So for them, somebody stealing their money would be much worse than 911.

Re:Infoworld is full of $hit

[Anonymous Coward]

how do you know that the attacks you caught were the only attacks that occurred?

Oh yeah?!

[Anonymous Coward]

Well we just see what's what when all you WoW players are sitting in your Mom's dark cold basement when they hack the power grid! Yeah, we'll just see then!

One word...

[mars-nl]

*Yawn*

Glad I'm not a taxpayer in that country.

Re:Cyber 9/11?!?

[spazdor]

You mean, nine million one hundred and ten thousand? good lord.

The world vs US

[gmuslera]

"We need resources because the war is against us". In real terms, is US the one that is attacking all the others, putting things like they are the victims is intentionally deceptive. The cyberweapons named in the summary (flame/stuxnet) were done and used by US and allies. There are other kinds of cyberattacks going on, like surveillance on everyone no matter of country, and pushing laws limiting other countries population (like SOPA, PIPA or derivatives like spain's Sinde law). The motto of this one should be "the war against freedom"

The main attackers so far mostly are people, not countries, that right or wrong say that fight for their (or our) freedom, and odds are badly against them (unless you are anonymous, you will probably get caught despite international laws, no matter where you are). Is a war, and we all are in the hopeless side of it.

Re:The world vs US

[Anonymous Coward]

What freedom have you lost? Be specific. And keep in mind that being able to download unlimited music or movies without any associated cost is not a recognized freedom.

Re:The world vs US

[gmuslera]

You could live in a oppresive regime without being the target... for a time. Being free mean being able to do the good things, the bad, and the gray ones, without looking over your shoulder because what you did could be seen in another way by someone else. Internet is becoming a mined field, where a private joke could mean being deported, where warning people that have insecure sites could put you in jail, where sharing your daughter fotos with your family could have very bad consequences, or giving less fortunate others with censored internet access could be punished, or even expressing your opinion could mean being targetted by the justice using any excuse to sue you for thousands or put you in jail for years.

But maybe more important, specially related to the "keep in mind", is recognizing what are us, specially facing any communication media. Imitation, sharing, and showing what are us or what we like is part of our nature. Is the way we got here, without it we would be still in caves wondering what happened to the only person that managed to fire a torch. We got here because people stood over the shoulders of giants. Now we get a media that enables us to do it even better than before, and specifically that is not free, not just music, or movies, but ideas. And worse, they forbid you to have ideas, if are remotely similar in a small part to a section of an idea that "own" a corporation. The problem is bigger than just internet, but is the main battlefield today.

Re:The world vs US

[Anonymous Coward]

Couldn't come up with a specific "freedom" you have had taken away? And how in the hell does someone forbid your ideas? In the US the bleating herd is always bitching and moaning about the Patriot act but they cannot define exactly what rights have been taken away. Copyright restrictions have been re-defined as censorship by today's entitlement generation who fervently believe they have the right to free music, free movies, and any other electronic content accessible using the Internet.

Re:The world vs US

[GrahamJ]

How about the freedom to make a phone call without it being monitored without a warrant?

Re:The world vs US

[moeinvt]

"What freedom have you lost? Be specific"

How about. The Right to be secure in my person, house, papers and effects against unreasonable searches?

The government freely admitted that they were intercepting and searching huge amounts of data with no warrants. They then granted themselves and the telecom companies retroactive immunity for their illegal activity.

In case you didn't read the 2012 NDAA, the government is now legally authorized to kidnap you, hold you in prison indefinitely with no right to confront the evidence against you, no right to legal counsel and no right to a fair trial. The administration has also claimed that the president has the power to maintain a secret kill list and assassinate U.S. citizens, also without charge or trial.

Read the 4th, 5th and 6th Amendments of the U.S. Constitution for a detailed description of what freedoms we've lost.

Just because YOU haven't been individually subjected to abuse doesn't mean you haven't LOST your freedom. The laws destroying our freedom are in place and could be used anytime against anyone.

Re:The world vs US

[3.5 stripes]

The right to a trial with a jury of my peers, the right to be charged with a crime in order to be held in prison. The right to a trial before having your personal belongings forfeited. The right to privacy, the right to protest, the right bear arms, the right to free speech, the right to life, liberty, and pursuit of happiness?

That enough for you?

Re:The world vs US

[Anonymous Coward]

You are talking possibilities and generalities instead of specificss. Law enforcement has collected information sans warrants for a long time but the legality and admissibility of any information collected is determined by the judicial system. Name one case where an US citizen has been convicted using warrant less evidence. You still have the right to a jury trial. You can still get a lawyer for free if you cannot afford one on your own. Violating any one of your constitutional rights is the easiest way to get any charges dismissed. If your rights have been trampled on in a grievous manner there are remedies in place to confront the charging authority.

Re:You can't set traffic lights to always green

[Anonymous Coward]

Actually, you can't set traffic lights to always green and if you try then you will blow a special fuse put in place to prevent exactly that so the worst you could do is turn off all the traffic lights completely or make them all red.

Effective Subterfuge

[Anonymous Coward]

The government is not dumb, but plays dumb to achieve sneaky goals. The internet is nor more or less a danger than ever, but the red flag here is that now that the US government is making statements about it openly, it may want to declare war on it, and no one can argue against "terrorism" while they attempt to crack down on the zones of free speech and trade.

Shut the front door!

[The Grim Reefer]

"Security pros and government officials warn of a possible cyber 9/11 involving banks, utilities, other companies, or the Internet,"

Cyber anything involving the internet? Now that's original. Somebody should get a patent on that. Just who are these "security pros"? Mall rent-a-cops? I'm guessing that the government officials are from the FDA or some other unrelated agency.

'A cyber war has been brewing for at least the past year,'

Escalating, not brewing. Or was the original link from 1999? Oh wait, maybe it's because it's brewing that the FDA got involved. It all makes sense now.

How to Prevent Any and All Cyber War Attacks

[Anonymous Coward]

How to Prevent Any and All Cyber War Attacks

1 - Disconnect the RX network connection from critical control SCADA like systems from the internet/internal networks
(this was problem alerts can still be transmitted via TX, but all system intervention requires physical access)
2 - Physically remove USB, DVD-ROM, card readers, and other data transfer devices from these same control systems.
(this is to prevent casual access/infection, updates can be applied by opening the (locked) controller machine)

In Summary: No data is to be normally received by the controllers of critical infrastructure.

FINAL EXAM (3 hours):

Q1: Should data any be normally received by the controllers of critical infrastructure.?

Answers:

Q1: No - Marks 100%

Congratulations, you are now a fully trained PhD. of Cyberwar threat naturalisation.

Not unlike the thousands of 'terrorism experts' who popped up days after 9/11,
you are now free to work as a High paid military consultant in cyberwar prevention techniques.

If anyone asks you details not raised in the course material, please prepare a Powerpoint containing
interspersed clips of Stephen Kings Lawnmower Man, and Hackers, with an audio overlay of the screaming of children.

http://youtu.be/I33u7P-XokE?t=6m11s
http://youtu.be/Ql1uLyuWra8?t=1m9s

(it also helps if you can rollerblade)

Never let anyone tell you that your profession is complete horseshit.

"This is Serious Fucking Business" - Donald Rumsfeld
http://www.youtube.com/watch?v=FGhGHxw0mSo

critical systems

[Anonymous Coward]

shouldn't be connected to the internet in the first place.

also...

banks DONT NEED TO BE

utilities DONT NEED TO BE

etc..etc.. they do NOT NEED TO BE but are for convenience. we COULD GO BACK to the days before the internet for paying bills, transferring funds, etc. no big deal.

Genode - Capability Based Security

[Anonymous Coward]

The root cause of our vulnerability isn't the users, nor the administrators, etc... it's the model underlying the OSs we all use. It trusts code, which is foolish at best.

To really fix computer security, you need to implement Capability Based Security. The Genode project is doing that, Here is their road map for 2013 which includes being able to eat their own dog food. (Which they wanted to get done by this year, but when has a software project actually met schedule?

If we can start to secure the nodes of the internet with non-swiss-cheese based OSs, we can just kill off this "cyberwar" nonsense once and for all.

Distraction

[Anonymous Coward]

Obvious distraction to real issues at hand. i.e. Guns/Money.

*shrugs*

[lightknight]

During the fall of any great civilization, they tend to burn down the libraries. And what is the Internet, but the largest library on Earth? And who wishes to burn it down, but armed forces?

I imagine the Library of Alexandria faced a similar problem.

arrogant bankers

[decora]

this is why the banks are a perfect hacker target. they are full of arrogant, ignorant people whose main judgment on whether something is important or not, is what their buddies think. since their buddies are all bankers, they kind of have a myopic view of the world.

i used to work at a 'financial institution', and let me tell you, its running everything from DOS to WinNT to WinXP ---- everyone brings their cellphones and USB sticks and plugs them into their computers to charge, everyone visits any website that pops into their mind without thinking about security. machines are running all kinds of versions of IE, sometimes back to 6.0, often unpatched.

nobody understands even the basic principles of computer security - and despite the banks strong profits, it refuses to invest anything in training anyone. the bank branches are full of minimum wage employees who have something like 90% turnover for a year, and they have access to all of the vital systems. the apps where you can deposit checks now on your phone have been sent out - again, little or no discussion of security issues.

you get more training working for a call center cube farm for $10/hour than you do when you work at a bank moving around millions of dollars of negotiable instruments.

the real thing going on here is that since the banks watched themselves all get bailed out in 2008, why should they bother? the government will come bail them out again if they get in trouble. if there is a huge breach, it wont matter. if someone tries to bring up a HIPPAA style law from bank records, the banks will simply buy off congress and stop it.

Re:arrogant bankers

[pete6677]

Not to mention, banks are run by MBAs. MBAs pride themselves on ignorance when it comes to technology. Actually, they think of themselves as very tech-savvy just because they know how to make Excel pivot tables. But they see no need to upgrade 10 year old applications with tons of security holes.

Re:arrogant bankers

[girlintraining]

this is why the banks are a perfect hacker target. they are full of arrogant, ignorant people whose main judgment on whether something is important or not, is what their buddies think. since their buddies are all bankers, they kind of have a myopic view of the world.

I assure you, the people who do IT here know exactly what they're doing. You're talking to one of them right now. Besides a corporate culture and management that supports and leverages their IT resources, the lawyers and reams of federal laws governing the business simply won't allow what you're proposing to happen here or at any other major financial institution in this country. Again, I cannot comment directly on specific business practices, nor can I act as a spokesperson for the business I work for, but as an IT professional, I would stake my reputation on the security here being sufficient to prevent the kind of damage discussed in the article. Is it perfect security? Of course not. It is sufficient security.

i used to work at a 'financial institution', and let me tell you, its running everything from DOS to WinNT to WinXP ---- everyone brings their cellphones and USB sticks and plugs them into their computers to charge, everyone visits any website that pops into their mind without thinking about security. machines are running all kinds of versions of IE, sometimes back to 6.0, often unpatched.

You should call the government then and step forward to collect your million dollar whistleblower bonus then. Cell phones aren't connected to the network, and as to anything being plugged in via USB... I happen to know for a fact that any unrecognized devices that are connected to any workstation generates a security alert in realtime. The offender usually has a visit by security accompanied by his/her manager in a matter of minutes. And speaking as someone who works in software packaging and deployment, There is no "all kinds" of anything on the network. As soon as a new version is approved for use (the approval process is extensive, I admit) , it is deployed to all workstations as quickly as labor resources can handle it. There is no "IE6" running anywhere in production here.

everyone visits any website that pops into their mind without thinking about security.

Which is why there are numerous proxies and realtime scanners. I'm sorry if you've been living under a rock these past eight years or so, but google "Intrusion Detection System" sometime. Internet access is something any office worker demands, and worker morale is very negatively affected if it's unavailable. This is a happy medium for most corporations. You're right that an airgapped network would be "more secure" but then so would unplugging the computer and locking it in the closet. I work with security reality, not the security fantasy you're laboring under.

nobody understands even the basic principles of computer security - and despite the banks strong profits,

"Nobody" is standing right in front of you telling you that we not only understand them, we exceed them by leaps and bounds. And in a recent article, those "strong profits" only came about in the last few months. In Fantasy Security, a large business with over 130,000 workstations spread across over 5,000 retail locations can simply push a button and revamp their security because the money is now available, but in Realworld Security, the budget is approved in January, and the plans are made the year before. Everything we're doing now is based on last year's "profits". And by profits, I mean... in the red. Something about a subprime mortgage crisis we're just getting over, I suppose.

the bank branches are full of minimum wage employees who have something like 90% turnover for a year,

Dude, lay off the cheap $3 crack. It's

Re:arrogant bankers

[Anonymous Coward]

You wrote "i used to work at a 'financial institution' ... everyone brings their cellphones and USB sticks and plugs them into their computers to charge, everyone visits any website that pops into their mind without thinking about security.

I also worked in a bank - formerly the largest US bank.
There was an incident where an employee plugged in a USB stick, and transferred files (possibly to steal information).
This person was fired the same day.

Re:arrogant bankers

[Anonymous Coward]

Google citibank altered url hack and you will why no one has faith in the banking industry security protocols.

Re:arrogant bankers

[Anonymous Coward]

I've read plenty of your posts, and while I'd guess you're capable at your job the parent is right on the money about your arrogance and general attitude.

I happen to know for a fact that any unrecognized devices that are connected to any workstation generates a security alert in realtime.

I worked in Proof Operations for a large multi-state bank for about 10 years, and I assure you that there was absolutely NO monitoring of any kind on the computers we used for balancing blocks. I quit for a better job when I was passed over for a position in the Data Security department in favor of someone I know to be completely incompetent in regards to anything computer related. The USB ports were "locked down" on the workstations, by disabling them in the BIOS.... which did not have a password set. The chassis was not locked in any fashion, anybody with a few minutes and knowledge of how to reset the BIOS would be able to bypass it even if it was protected.

Not that it really would have mattered, mind you- there are so many verification steps which would catch altered transactions that it would be quickly spotted and corrected, and the "paper trail" is extremely long and detailed. The only systems that I worked with which could have caused actual damage are the Wire Transfer equipment, and those are locked down like Fort Knox and verified routinely by outside people the Feds send over.

The real worry is nothing like what the article talks about, I certainly agree with you there. My concern is with compromising individual user accounts. I discovered by accident a few months back that my bank ignores case for online passwords, which vastly reduces the strength of my password. I called and complained about it, and eventually they did fix the problem. But I never had to reset my password, which indicates that they are stored "in the clear" somewhere which is a pretty big concern regardless.

Re:arrogant bankers

[Anonymous Coward]

The lady doth protest too much, methinks.

Re:arrogant bankers

[Anonymous Coward]

Hard to take you seriously when, for example, my bank took decades to use multi-factor authentication (some in my area still don't), their home page has active links to more than 30 different web sites (most non-bank, low security advertising and the like) and their attempts to make sure their customer's PC's are secure for on-line banking (a major potential hole) are laughable at best. And as a bonus they keep changing the look-and-feel of all their on-line sites so you can never be sure whether you're talking to the real bank or a cheap imitation.

Re:arrogant bankers

[NickDB]

^ THIS Worked for numerous banks around the world, and doesn't matter how good their security guys are, the users don't listen and leave holes wide enough to drive a truck through in the security. Add to that lots of the security guys are cowboys at work and out of work and if I was so inclined have enough dirt on them to create security concerns too.

Re:arrogant bankers

[Anonymous Coward]

I think I worked at the same bank.... I could not believe the out of date OS's they still use and refuse to upgrade.

Re:arrogant bankers

[ToddInSF]

Hard to take you seriously for staying with the bank that you say is so incompetent.

Re:arrogant bankers

[Anonymous Coward]

No doubt all you said is true. Banks do have good security and I'm sure your good at your job but still the truth stands. You work for a den of theives.

Re:arrogant bankers

[Anonymous Coward]

I just wish any financial institution I've ever used would allow more than 8 characters for the account password. And allow non alphanumeric characters for better security. It is disgustingly easy to access most anyone's online bank account because of these arbitrary impediments.

O no

[Anonymous Coward]

Why wont somebody think of the gibsons?

Oh noes!

[letherial]

Its world cyber war 1, but instead of a dictator intent on conquering the world, like a real war, its a bunch of script kiddys thinking they are clever

everyone be afraid....be very afraid

Surprised?!

[ogdenk]

Gee, let's take EVERYTHING and connect it all on a giant, publicly accessible, open network that spans the entire world using a protocol suite designed in the 70's with no security in mind.

After that let's stack most everything on top of a protocol intended to serve up static text with some images and links to other text files thrown in. And then shoehorn it into becoming an application delivery platform. And pile kludges 10 layers deep to make it sort of usable.

Seriously, if you run critical infrastructure and you connect it to a public network, you're stupid. I saw this coming as a CHILD.

Now that everything with a data port practically has a CPU capable of running general purpose code and rewritable flash.... often running Linux.... it's only going to get worse from here.

No power could be ugly

[witherstaff]

I think it matters how long term the outage is. The Northeast cascade power failure in 2003 was partly due to a software bugand would have been devastating if it was below freezing. 55 million people without heat is a huge number. Even if there weren't many deaths the economic damage would be tremendous from just the water pipes freezing and bursting. Yeah we're used to small scale outages with heavy snows or ice but not anything on that scale. If an entire region could be shut down for say a week things would take a long time to be back to normal.

propaganda

[fazey]

lol propaganda nonsense. Stop running vulnerable wordpress apps and the chinese will stay away.

Some systems down could cause riots

[icemanwol]

Can you imagine the EBT food stamp card system going down for a few days and millions could not get their free food?

Cyber bullshit War on the US has Begun

[dgharmon]

"The cyber war has seen various attacks around the world, with incidents such as Stuxnet [Windows], Flame [Windows], and Red October[Windows] garnering attention. Some attacks have been against government systems, but increasingly likely to attack civilian entities. U.S. banks and utilities have already been hit [DDOS attacks run from compromised WINDOWS desktops]".

"Given the malicious actors that are out there and the development of the technology, in my mind, there's little doubt that some adversary is going to attempt a significant cyberattack on the United States at some point"

Only if you persist in running your infrastructure on that back-doored OS and connected directly to the Internet ...

At least this time it's obvious they did the 9/11

[Anonymous Coward]

Oh hai gaise, we the US are at cyber war because we put up Flame, Stuxnet and shit on our own to fuck with the rest of the world.

So as we attack anybody without a reason with huge weapons and they are all like very angry.

So now we have to prepare to defend agains our acts: duuuhr duuuhr 'murican warmongering, terrorists, dey took' our jobs !

Pandoras Box opened with Flame and Stuxnet

[Morpf]

And who was it who opened pandoras box? Who attacked infrastructure to destroy it? Who attacked a nation and said it with a straight face to the rest of the world? Tit for tat I would say.

flyncarnak

[flyneye]

I can see a future where government regulated software on everyones machine DDOSs Chinese and Russian targets in retaliation while their utilities, banks and institutions networks are raided, backdoored and looted.
Who says the morons in Washington didn't gain anything from ANONYMOUS?
In a perfect world the attacks would be made on spammers and phishers and their ilk.

Internet designed with no security in mind?

[dgharmon]

"Gee, let's take EVERYTHING and connect it all on a giant, publicly accessible, open network that spans the entire world using a protocol suite designed in the 70's with no security in mind".

I don't think so, Microsoft was selling Windows NT as the Internet platform for commerce, since at least 1995 ...

Re:Internet designed with no security in mind?

[ogdenk]

Judging by your lengthy UID I assume you haven't been in IT very long, you're trolling or trying to be funny....

TCP/IP has been with us since the late 1970's. Was the primary protocol in use on the Internet from the early 1980's on. Windows NT has also been the least secure enterprise OS in existence. It took a decade for Windows Security to be considered anything but laughable. Now it's just mildly amusing.

Get off my lawn.

Re:Internet designed with no security in mind?

[dgharmon]

"TCP/IP has been with us since the late 1970's. Was the primary protocol in use on the Internet from the early 1980's on"

As you so rightly pointed out, TCP/IP is a communication protocol, insecurity was provided at a higher level.

"Microsoft Internet Commerce Strategy"

"Server Foundation. A server and tools commerce foundation based on .. Microsoft Windows NT Server security".

Try this for cyberwar

[Anonymous Coward]

1. Turn off the router that connect to the internet
2. Go ahead, hack into my network at home

Oh - you can't connect ??

And so it should

[Anonymous Coward]

So the USA attack others with viruses, and complain about retaliation.

fuck the banks

[Anonymous Coward]

I hope the banks get hit hard, they deserve it.

Keeping us scared

[Anonymous Coward]

Or trying to.

The Nazis, North Koreans, Vietnamese, Communists, Soviets, nuclear war, just about every country in S.America, Al Qaeda, satanists..... These don't scare us all that much anymore. The Government now has to think up the Next Scary Thing.

Re:Keeping us scared

[Anonymous Coward]

The Government is the next scary thing!

LOL@THIS BS

[Anonymous Coward]

Stuxnet, Flame, and Red October were all US virii. Now they're crying that someone might attack US back? What a bunch of BS.

A "war" huh?

[Captain_Chaos]

Oh great, another "war on ". Terrorism and drugs don't scare people any more so American politicians need a new "war" to use as a front for trampling human rights all over the globe and enriching their military-industrial backers...

Be AFRAID!

[moeinvt]

How many times are the American people going to fall for this same BS? Government and the media spreading a constant message of fear in order to consolidate power.

I'm "afraid" that in the age of mass media, the government can afford to relentlessly bombard us with the message "Be AFRAID! Now, give more money and more power to government and sacrifice your civil liberties so that we can protect you!"

Some day we're going to wake up and discover that we're in a nice "safe" police state. Sadly, most of us deserve it.

Richard Clarke said ALL this in 2010 in his book

[DaveTheC]

See Cyber War: The Next Threat to National Security and What to Do About It [Paperback] Richard A. Clarke (Author), Robert Knake (Author)

No surprise except the hyperbole

[Danilushka]

Where ever an empire puts its assets, its adversaries will seek to capture, control, or disable them.That has been a standard strategy since before the Romans as any student of history would know. Why this is news is a good question since it should have been obvious from the beginning. Any of you folks ever read Sun Tzu? Sheesh. You sound like the "let's ban assault rifles" nannies when 3 to 1 pistols were used in mass shootings and only 323 people where killed with rifles in 2011 while 700+ were killed with fists and 1,700 were killed with knives while over 6,200 were killed with pistols which you'll never ban.

It's coming in the shape of a mushroom cloud.

[7-Vodka]

We know they have WMDs. We're just defending ourselves.

http://www.guardian.co.uk/commentisfree/2013/jan/28/pentagon-cyber-security-expansion-stuxnet
http://www.guardian.co.uk/commentisfree/2013/jan/29/obama-guantanamo-pentagon-cyber-yemen

shut the whole thing off for awhile...

[adamz_myth]

Who in their right mind actually bets on the internet anyway. I know a lot of folks do, but it's like signing a contract with someone that's also throwing up into a paper bag,..you're not quite sure of their own stability, but you want the money they say they are going to give you. Personally, I think it would be funny as hell if the internet just went down forever.

Glenn Greenwald

[7-Vodka]

http://www.youtube.com/watch?feature=player_embedded&v=Kp_8j13DiiY

Counterattack?

[billd10]

So why don't we counterattack? We're always playing defense on this issue. We call it a warlike act, it is sponsored by many governments whom our government laughingly refers to as allies, but all we do is try to put in defensive measures. I say lets shut down much of the internet in these countries and let the people start civil wars on twitter like they did in Egypt.