1 / 29

Cyber Warfare and Malware: A Threat to National Security

Learn about government-built malware, cyber weapons, impacts of malware on security objectives, types of malware, complexities of cyber warfare, offensive IW operations, societal impact, USA cyber capabilities, major players in cyber warfare, and the definition and development of cyber weapons.

lauraaward
Download Presentation

Cyber Warfare and Malware: A Threat to National Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Malicious Code as Weapon

  2. Reading • Required: • Government-built malware and cyber weapons will run out of control, http://securityaffairs.co/wordpress/22677/malware/government-built-malware-cyber-weapons-will-run-control.html • Recommended: • Ukrainian computer systems attacked by sophisticated malware with "Russian roots,” Homeland Security News Wire, March 10, 2014, http://www.homelandsecuritynewswire.com/dr20140310-ukrainian-computer-systems-attacked-by-sophisticated-malware-with-russian-roots • NSA planted sleeper malware in 50,000 computer networks, Homeland Security News Wire, Dec. 11, 2013, http://www.homelandsecuritynewswire.com/dr20131211-nsa-planted-sleeper-malware-in-50-000-computer-networks

  3. Last Class • Malware • Malware taxonomy (payload, vector, obfuscation) • Countermeasures • Malware detection (signatures, code analysis, storage pattern) • User vigilance • Limitations of malware detections: • Polymorphic malware • Zero-day vulnerability

  4. Security Objectives and Malware How are there objectives impacted by malware? Confidentiality Integrity Availability Authentication Non-repudiation

  5. Aim of Malware • Multiple possibilities: • Unauthorized access • Unauthorized modification • Unavailability of resource for authorized users • False authorization • Fake signatures

  6. Malware and Information Warfare • McAfee report: 200 distinct new pieces of malware per minute • Harm from malware (payload) • Non-destructive • Destructive • Commercial or criminal intent • State sponsored

  7. Information Warfare Offensiv Which of these offensive IW operations are impacted by malware? • Open sources • Psyops and perception management • Seizing the signals • Computer break-ins and hacking • Masquerade

  8. State-level Activities • Disruption of the opponent’s services • All aspects of malware aims • Information gathering • Unauthorized disclosure and false authentication • Perception management • Data leakage, false information, psychological effects • …

  9. US Government Warfare domains: space, land, sea, and air Cyberspace: fifth domain Cyber warfare: “Actions by a nation-state to penetrate another nation's computers or networks for the purposes of causing damage or disruption” R.A. Clarke, Cyber War

  10. High-Valued Targets National Defense components Supporting industry Critical infrastructure Exploitation: individual system vulnerability + connectivity

  11. Societal Impact Safety of citizens Stability of government COL Thomas Goss, chief of the command’s Strategic Initiatives Group: “While technology plays an important role in the cyberspace domain, it is not technology that will win on the 21st century’s cyber battlefields […] Time after time, in operations and in exercises, it is the people that will make the difference.”

  12. USA Cyber Capabilities • 2009: President Obama • Declared America’s digital infrastructure to be a “strategic national asset” • 2010:  establishment of U.S. Cyber Command (USCYBERCOM) for defending American military networks and conduct full spectrum military cyberspace operations • 2013: Executive Order on Improving Critical Infrastructure Cybersecurity • 2015: Cybersecurity Legislative Proposal for information sharing

  13. Major Players • At least 140 countries are developing cyber weapons • USA • Russian Federation • People’s Republic of China • Others: Germany, India, Iran, South Korea, UK, etc.

  14. What is a Cyber Weapon? There is no formal and legal definition DoD The Dictionary of Military and Associated Terms: no definition for cyber weapon Nonlethal weapon: “A weapon that is explicitly designed and primarily employed so as to incapacitate personnel or materiel, while minimizing fatalities, permanent injury to personnel, and undesired damage to property and the environment.” Also called NLW.Source: JP 3-28

  15. Cyber Weapon • Stefano Mele, Italian Lawyer: “A cyber weapon is [an] appliance, device or any set of computer instructions designed to unlawfully damage a computer or telecommunications system having the nature of critical infrastructure, its information, data or programs contained therein or pertaining there to, or to facilitate the interruption, total or partial, or alteration of its operation.” • Other definition: “An appliance, device or any set of computer instructions designed to offend the person through cyberspace.”

  16. Impact of No Definition Impossible to distinguish a cyber weapon and its proper use Impossible to evaluate the legal and political responsibility of the aggressor and the real level of threat

  17. Development of Cyber Weapon • Cost effective • Origin of the attack not obvious • Easy to hide the development • Complements traditional military strikes: • Destroy enemy defense infrastructures • Probe the technological capabilities of the enemy

  18. IW Attacks against USA • Titan Rain (2003-on): form China • Target: US military intelligence • Sensitive military networks (Lockheed Martin and Sandia) infiltrated by hackers • Moonlight Maze (1998-2000): from Russia • Target: Military maps and schematics, U.S. troop configurations • Hacked computers at Pentagon, NASA, the Department of Energy and even from universities and research labs

  19. IW Attacks against USA • China's "750,000 American zombies“ (2007) • Target: U.S. computer networks, all levels • "The Most Serious Breach“ (2008) in Pentagon history from ? • Target: U.S. military computer network • A corrupt flash drive. Inserted into a military laptop

  20. IW Attacks against Russia • The Original Logic Bomb (1982): From USA • Target: Siberian gas pipeline in Soviet Russia • CIA’s "logic bomb" caused a Soviet gas pipeline in Siberia to explode

  21. IW Attacks against Estonia • The Estonian Cyberwar (2007), The Nashi, a pro-Kremlin youth group in Transnistria • Target: Estonia • Took down key government websites, news sites and generally flooded the Estonian network to a point that it was useless • Other targets of Russia: Georgia, Azerbaijani

  22. IW Attack against Iran • Stuxnet (2010): suspected from USA, Israel • Target: nuclear facility in Natan • Destroyed nuclear centrifuges and threw back the Iranian atomic program by 2 years • Flame (2012): suspected from USAand Israel • Target: Iran • Collect intelligence to prepare cyber warfare campaign

  23. Warfare or Espionage • Motivation for “warfare” • National attention • Additional defense funding • Justify government control of cyber space

  24. New Use of Malware • Espionage – old story • DOS attacks using spyware • Application-level vulnerability combined with malware exploitation • E.g., SQL Injection (gain control)  malware (run functions to exhaust resources)

  25. Malware DOS Attacks Buffer overflows Raise unexpected exceptions Create race conditions SQL Injection  recursive CPU-intensive queries Overly-complex regular expressions within search queries Excessively large files uploaded to the server Etc.

  26. How about Twitter? • Is it only a “tool of the self-absorbed”? • Real time reporting service • 2008: Mumbai terrorist attack • 2009: Iranian protest against President Ahmadinejad’s reelection • Distribute attack information • Link to attack tools • Link to target identity

  27. Twitter as Perception Management • 2009: Israeli military attack on the Gaza • Large number of civilian casualties • International criticism of Israel • Israeli Air Force counteractions on YouTube and Twitter: • Showed Hamas using civilians as cover • Downloaded sensor imagery onto YouTube • Tweets warned of rocket attacks • 'help-us-win.com' blog was used to gain public support • http://www.independent.co.uk/news/media/online/twitter-is-a-weapon-in-cyber-warfare-1900535.html

  28. Twitter Tunisian Revolution • 2010-2011: Tunisian revolution (Jasmine Revolution) • Intensive campaign of civil resistance • Ousting of longtime President Zine El Abidine Ben Ali in January 2011 What are the positive and negative aspects of social media wrt. Social movements?

  29. Next Class Computer Break-ins

More Related