cyberelements

EXTRACTS FROM EYE SPY INTELLIGENCE MAGAZINE * images are presented in low-res screen shots for quicker loading

the elements of

CYBERespionage, warfWORLD are, intel igence FOR MORE INFORMATION SEE THE RESPECTIVE BACK-ISSUE DESCRIPTION

Since 2007, world cyber and intelligence authority, Eye Spy’s senior US Editor Kevin Coleman has given readers a gradual introduction into the world of cyber warfare, crime, espionage and other elements that engage in this invisible world. In between, he has warned about the various types of cyber attack [threat] programmes, and their increasing complexity. The dangers and implications for ordinary people once seemed tiny and so far away - but this is no longer is the case.

Eye Spy’s features on cyber attacks, countermeasures and an understanding of this most dangerous type of warfare, have been used in military and intelligence briefings throughout the world. These important features provide a deep-insight into the growing of cyber as a tradecraft tool...

PDF CONTENT PAGE

Page 03 Cyber Terrorism - learning and understandin - ISSUE 44 Page 04 e-Bombs - transient electronic pulse devices ISSUE 51 Page 04 Titan Rain and Moonlight Maze - cyber threats/programmes ISSUE 51 Page 05 Cyber Weapons Arms Race - ISSUE 54 Page 05 Cyber Warfare Doctrine - three compenent design - ISSUE 56 CONTINUED OVER ©

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

PAGE

2

PDF CONTENT PAGE - CONTINUED

Page 06 Advanced Cyber Weapons - evolving architecture - ISSUE 57 Page 06 Computer Espionage - ISSUE 58 Page 07 Cyber Warriors- job opportunities - ISSUE 61 Page 07 Cyber Espionage - countermeasures - ISSUE 63 Page 08 World Class Hackers - ISSUE 65 Page 09 Cyber Warfare - new mental models - ISSUE 67 Page 10 The Right to Bear Cyber Weapons - ISSUE 68 Page 10 Cyber Weapons - fifth domain of war - ISSUE 69

Š

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

PAGE

3

TITLE: CYBER TERRORISM SUB TITLE: INTELLIGENCE - LEARNING AND UNDERSTANDING ISSUE 44 Cyber-terrorism or attacks on telecommunications and computer networks have been called the invisible threat to national economies and security. Day after day, digital warriors defend our information systems and infrastructure against thousands of unseen attacks by criminals and terrorists. This intelligence brief will help you fully appreciate the growing threat of cyber terrorism, the offensive capabilities of cyber terrorists, and the defensive measures that can be taken in response to such dangers. Included in this brief are actual scenarios that pose a significant threat to our national information and telecommunications infrastructure. Plus a listing of all major cyber attacks, viruses and related incidents.

EXTRACT: Terrorism and information technology are related in two ways. First, the Internet has become a forum for both terrorist groups and individual terrorists to spread their

messages of hate and violence. The internet allows terrorists to communicate with one another and with sympathisers. Secondly, individuals and groups use the Internet to attack computer networks and systems via cyber-terrorism or cyber-warfare activities.

The term “cyber-terrorism” conjures up many different images.

The truth is, cyber terrorism has been around longer than most people think. Cyber terrorism did not evolve after the terror attacks on 11 September 2001. According to the Federal Bureau of Investigation, cyber terrorism is any premeditated, politically motivated attack against information, computer systems, computer programmes, networks and data, which results in violence, disruption or damage against non-combatant targets by sub-national groups or clandestine agents.

One of the first recorded cyber-terrorist attacks was in 1996. A computer hacker who was allegedly associated with the White Supremacist movement temporarily disabled a Massachusetts Internet Service Provider (ISP) and damaged part of the ISP’s record keeping system. The ISP had attempted to stop the hacker from sending out worldwide racist messages under the ISP’s name. The hacker signed off with the threat, “you have yet to see true electronic terrorism... this is a promise...”

Kevin Coleman ©

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

PAGE

TITLE: e-BOMBS

4

SUB TITLE: TRANSIENT ELECTROMAGNETIC PULSE DEVICES ISSUE 50 Intelligence analyst Kevin Coleman examines an emerging technological menace that threatens everyone... Transient Electronic Pulse Devices may sound like a phrase plucked out of the future - but TEDs launched against individuals and unprepared nations could prove more destructive than any terrorist weapon known today.

Eye Spy takes a look at this chilling and secret subject EXTRACT: There are an estimated 195 million computers in the United States alone. In 2006 cell phone shipments topped 1 billion. Almost all of our appliances contain electronics as well as our cars. The consumer electronics industry revenues reached an estimated $135.4 Billion in 2006.

The modern military is heavily dependent on electronics.

Smart bombs, net-centric warfare, fly-by-wire as well as our entire C4I depends on electronics. In fact, national security relies on electronics.

So imagine waking up to find that nothing works? While it won’t happen nationwide, local electronic outages are becoming a real threat and may prove very difficult to defend against.

Many people are familiar with the old term - electromagnetic pulse or EMP. The ElectroMagnetic Pulse effect was first observed during the early testing of high-altitude airburst nuclear weapons...

TITLE: TITAN RAIN SUB TITLE: MOONLIGHT MAZE ISSUE 51

A series of cyber attacks on the Defense Department and Defense contractors in the United States as well as the Ministry of Defense and Parliament in the UK have created significant cause for concern for computer security experts. An investigation into the attack signatures shows a significant level of sophistication. Most are “highly skilled professionals”. These cyber attacks are using new strains of computer viruses, logical bombs and other advanced techniques that can paralyse government agencies and communications.

In this specially commissioned report, intelligence analyst and world renowned computer expert Kevin Coleman, finds out who is behind the latest attacks, why they are occurring, and what countermeasure can be employed to stop them...

EXTRACT ONE: We are in a new era of conflict. It is a silent war. No gun fire, body-count, bombed buildings or other metrics and measure that have been used to report military progress will be of little relevance in the age of cyber warfare. Silent attacks are waged daily that threaten the electronic society we live in. The short-sightedness of governments and businesses has left all of us at significant risk. This is not a problem that will go away anytime soon!

©

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

PAGE

5

EXTRACT TWO: The threats we currently face represent a new way of thinking about conflict and warfare. Cyber attacks are particularly dangerous because of the world’s reliance on computers, networks and technology. These computers control critical systems that run power plants, telecommunications infrastructure, air traffic and more. Cyber attacks on banks, stock markets and other financial institutions could have a devastating economic effect on any country. With international law lagging in the area of cyber crime and cyber warfare, it resembles the early days of the “Wild-West” (untamed territory). ...

TITLE: CYBER WEAPONS ARMS RACE SUB TITLE: ISSUE 54 Kevin Coleman examines the underworld race to create, perfect and ultimately use a devastating cyber weapon... all from the comfort of an armchair EXTRACT: Let’s examine each of these advanced cyber weapon classifications more closely.

SELF MORPHING MALICIOUS CODE: A software programme that uses server polymorphism to automatically change its code whenever it is downloaded. This allows the malware to escape traditional signaturebased antivirus sensors.

ELECTRONIC CIRCUITRY DESTRUCTORS: Electromagnetic pulse (EMP) producing techniques uses electric current to damage the components of computers. Directed Energy Weapons (DEW) and Transient Electromagnetic Devices (TEDs) are two examples of electronic circuitry destructors.

SELF ENCRYPTING/DECRYPTING OF MALICIOUS CODE: A software programme with behavioural and structural properties that encrypt and decrypt the actual software code making the malicious programme with no syntactic signature thus defying detection.

TITLE: CYBER WEAPONS DOCTRINE SUB TITLE: THREE COMPONENT DESIGN ISSUE 56

Intelligence analyst Kevin Coleman argues that cyber warfare doctrine should be integrated into military doctrine as Internet attacks on government and military computer networks increase.

THREE COMPONENT DESIGN: 1. Weapon Delivery Vehicle 2. Security Breaching Component 3. Payload - Malicious Code The weapon delivery vehicle could be a web page, email, firmware, a software application or even a piece of hardware. Cyber weapons must be able to ©

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

PAGE

6

be deployed by exploiting any new or existing vulnerability that allows remote access. In 2007, over 70 percent of vulnerabilities discovered and reported fit into this category. This design allows any newly discovered vulnerability to be leveraged as the security breaching component for the cyber weapon. The cyber weapon must have viral characteristics and be self-replicating, self morphing and self defending so to elude traditional signature defences like anti-virus and rule based firewalls. An interesting point is the number of viruses, worms and Trojans in circulation has now topped the one million mark according to a security software provider.

...the number of viruses, worms and Trojans in circulation has now topped the one million mark according to a security software provider

TITLE: ADVANCED CYBER WEAPONS SUB TITLE: EVOLVING ARCHITECTURE ISSUE 57

Intelligence analyst KEVIN COLEMAN reveals why an advanced cyber weapon is as destructive as a primed missile... perhaps even more so EXTRACT: Definition: A cyber weapon is an instrument used to disrupt processing of information, computing activities or network communications, or the threat thereof, against microprocessors, computers and/or networks, with the intention to cause harm or further social, ideological, religious, political or similar objectives.

Cyber weapons are constructed with a specific mission in mind. Typical are intelligence scouting, espionage, destruction, and disruption.

INTELLIGENCE SCOUTING These weapons provide reconnaissance capabilities. Reconnaissance is an important component of military operations and is used to gather insight into a target’s computers, systems and networks defences and operations. This information is used to create exploitation capabilities and initiatives.

ESPIONAGE The SANS Institute has ranked cyber espionage number three on its ‘Top Ten Cyber Menaces for 2008’. Using cyber weapons to covertly collect sensitive technical, financial, economic and other data related to an enemy, enhances the ability of military planners or competitors to create competitive, offensive and defensive strategies and plans.

DISRUPTION These weapons have the ability to cause processing of computers or systems to stop. They can also slow or inhibit communications over a network; and finally, they have the ability to cause equipment with microprocessors or microcontrollers to malfunction.

TITLE: COMPUTER ESPIONAGE

Cyber weapons are software programmes that have an objective - to attack a target or targets.

SUB TITLE: CHINESE WHISPERS ISSUE 58 Tradecraft feature on China’s immense and successful drive to infiltrate computer systems around the world EXTRACT: Goodbye to stealing old manila folders containing classified information. The new age of espionage is centred on computers. An estimated 90% of all information generated is never printed. So if you’re a spy and you want to get at that information, you must ©

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

PAGE

7

now be computer savvy and be able to break into the computers. It seems there is a lot of this going on these days. Indeed, it has become an everyday occurrence - and is frequently covered by the media.

Cyber espionage is getting significant attention as new evidence surfaces of computer breakins at US and UK research labs and targeted phishing against corporations and government agencies and officials both here and abroad.

One country in particular seems more aggressive than any other...

TITLE: CYBER WARRIORS

SUB TITLE: JOB OPPORTUNITIES IN THE EMERGING CYBER COLD WAR ISSUE 61 Each and every day, each and every hour, cyber attacks are waged against a wide variety of targets on millions of computers and networks around the world. These battles rage twenty-four hours a day, seven days a week each and every day of the year. This has led to a flurry of new cyber units within the intelligence and military world, and with this, of course, comes job opportunities.

EXTRACT: The United States has a sophisticated information-warfare programme under the control of the Department of Defense (DoD) and growing cyber defences under the watchful eye of the Department of Homeland Security (DHS). Most military services in the country have focused on using cyber space for intelligence gathering and monitoring. The most advanced is the National Security Agency (NSA). Recently the focus has been expanded to more than intelligence collection and now includes offensive and defensive capabilities as well as for counter-intelligence activities.

As the cyber warfare threat environment evolves, new career opportunities are created. We have seen a very broad spectrum of positions in the cyber warfare domain. The top three (most frequent openings) are identified here:...

TITLE: CYBER ESPIONAGE COUNTERMEASURES SUB TITLE: ISSUE 63

KEVIN COLEMAN argues we live in an age of information... and Cyber Warfare has become our type of war. For this reason the US Intelligence Community and its defence associates, like many other services, including those in the UK, has placed great emphasis and priority on cyber security. With agencies and defence arms actively recruiting personnel for newly established counter-cyber attack departments, and millions of pounds being invested in high-end counter-measures, Coleman asks is it too little too late?

EXTRACT: Cyber attacks and cyber espionage are costing businesses a bundle each and every year and have now become so significant it really is a national security issue. In March 2009, Dennis Blair, United States Director of National Intelligence (DNI) stated in his Š

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

PAGE

8

testimony that intellectual property theft and data theft cost businesses $1 trillion dollars in 2008. National security and cyber security experts believe the US Government and its contractors are the targets of a growing cyber warfare effort that they suspect is being conducted by nation states and their proxies with the aim of stealing military and industrial secrets - high-end espionage in every sense of the word. Anywhere there is attractive intellectual property and anything that is valuable and useful to someone else is a target for cyber attack. This could include advanced technologies, defence and military...

TITLE: WORLD CLASS HACKERS SUB TITLE: A NEW GENERATION OF COMPUTER HACKERS ISSUE 65 Kevin Coleman examines crucial areas of computer security that are easily being circumnavigated by a new breed of hacker EXTRACT ONE: EVENT ANALYSIS: While engaged as a cyber security advisor a large multinational corporation with revenues in the billions of dollars asked for a recon/ scan. They believed that their web systems were secure but wanted to verify that fact. Within one hour of work they were notified of a serious issue. The recon/scan uncovered their entire storage area network (SAN) that contain all their corporate data, financial, as well as documents and reports from product development and research was completely exposed and viewable to anyone on the Internet. No hacking or system compromise was needed to view the sensitive data. An architectural oversight was to blame for this grave error. This event and others like it, while not common, do occur frequently. It clearly shows how just using the basics of the attack process can yield the results you desire. Š

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

PAGE

9

EXTRACT TWO: SYSTEM ACCESS: Within the context of cyber attacks, system access is a set of conditions that may lead to a compromise or security failure that impact the confidentiality, integrity, or availability of a computer system or network. Common causes that lead to unauthorised systems access include - easy passwords, programming errors, physical theft of documents, software vulnerabilities and the list goes on. Common causes of vulnerabilities are design flaws in software and hardware, inappropriate administrative processes, lack of user security awareness and education, or failure to keep up with routine maintenance, technological advancements, patches or improvements to current practices, all of which often result in real

TITLE: NEW MENTAL MODELS FOR CYBER WARFARE SUB TITLE: ISSUE 67 Eye Spy’s senior US editor discusses fears in London and Washington that both Britain and America are unprepared for the challenges that face both nations in respect to ‘cyber wars’...

EXTRACT: The United States and Britain both concluded they are unprepared for a cyber war. Those were very strong statements and government leaders in both countries appeared to take notice. Supporting these statements was a flurry of articles rating the overall cyber posture of several countries. In fact, one article went as far as to say North Korea would fare better in a cyber conflict than the United States. Claims like this are not new and numerous reasons have been given to substantiate the reasons for this dire situation. Funding the capacity to wage cyber war and defend against cyber attacks is always brought up in these conversations and it is accurate to state that the price tag will not be trivial....

©

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E

TITLE: THE RIGHT TO BEAR CYBER WEAPONS

PAGE

10

SUB TITLE: ISSUE 68 Eye Spy investigates the implications and legality of “returning fire” in the increasingly hostile world of cyber space EXTRACT: Military and intelligence services around the world are trying to monitor the development and sale of cyber weapons, as well as what group or groups that are actually behind cyber attacks. A number of government agencies are interested in learning the capabilities of cyber weapons and the intentions of activists and extremist for using such weapons.

KEY QUESTIONS REMAINS UNANSWERED The growth of cyber weapons has changed the rules of engagement. There are questions that must be addressed

by Congress and governmental departments as well as international law. For example, does knowingly allowing your (a US Citizen) computer to be used (Opt-In BotNet) as a bot in a botnet that attacks the critical infrastructure of the United States or any component of the government or military constitute taking up arms against the country?

Historically botnets are built on compromised, botinfected computers that are unwitting participants in an attack. It is this aspect of botnets that has fundamentally changed. The new participation model referred to as OptIn botnets raises new questions and concerns. The OptIn botnet model has the

TITLE: CYBER WEAPONS - 5th DOMAIN OF WAR SUB TITLE: ISSUE 69

Eye Spy examines compelling evidence that a secret cyber arms race has already begun EXTRACT: SIGNIFICANT ISSUES 1. The absence of an internationally accepted definition for a cyber weapon, cyber attack and most importantly act of cyber war creates ambiguity around what will actually be controlled.

2. The fact that in many cases the only difference between a security testing tool and a cyber weapon in the intent of the user.

3. The access to widely available freeware/open source software that could be used as a cyber weapon.

4. The growing use of third-parties (many of them in the private sector) to conduct cyber espionage and cyber attacks.

5. There are huge enforcement difficulties associated with cyber arms control not to mention the challenge of compliance verification calling into question the value of any treaty. ©

E

Y

E

S

P

Y

I

N

T

E

L

L

I

G

E

N

C

E

M

A

G

A

Z

I

N

E