Category Archives: Cyber Security

On Dutch Banking Woes and DDoS Attacks

  By Don | April 25, 2013 - 12:38 | Cyber Crime, Cyber Security, General, Security, The Netherlands
Leave a comment

DDOS-attackIf you don’t live in the Netherlands or don’t happen to have a Dutch bank account, you can certainly be forgiven for not having caught wind of the major banking woes that have been plaguing the Dutch. For weeks now, massive DDoS attacks (linked article in Dutch) have brought low the online services of several banks, interrupting mobile payments and slowing down overall online financial traffic. At the center of the digital storms is ING, which was hit first (Dutch) and is hit the most often (Dutch), but Rabobank, ABN AMRO and SNS Bank are also frequent targets. Dutch online payment system iDeal has also been attacked several times, impacting virtually all Dutch banks as well as the many online retailers that use it.

What the goal behind this wave of DDoS attacks is, is as yet unknown, but there are several possible motives at play. It could be simple vandalism, a rather hefty attempt at misdirection to cover up real hacking attempts, or it could have something to do with ING and ABN AMRO being implicated or involved with investigations into tax evasion through offshore banking by the ICIJ. The latter seems unlikely, as most of the DDoS traffic appears to be coming from Romania (according to hackers collective HacksIn – I had a link about that, but lost it somehow) and no motive has made itself known thus far. It was a matter of time until Anonymous came along to jump on the bandwagon, and indeed its Dutch chapter appears to have done so this week when someone posing as Anonymous posted a message on Pastebin. In it, they claim to know who is behind the DDoS attacks (a group of Muslim extremists called Izz al-Din al Qassam Cyber Fighters), and that the Dutch people should go out and collect their money from these banks because it is not safe there.

There are, however, some issues with this post on Pastebin. Firstly, the group they blame for the DDoS attacks is in fact the group responsible for attacks on US BANKS, and there is no discernible link between the US banks being hit or the Dutch banks currently under attack. The motive for the attack against US banks seems clear: Izz al-Din al Qassam demands the removal of the movie “Innocence of Muslims” from Youtube. Once the movie is removed the attacks will stop, they claim. To my knowledge, no such demands have been made here in the Netherlands.

The second issue is that the advice posed by Anonymous would, in fact, immediately collapse the Dutch financial market, as no Dutch bank is currently strong enough to survive such a proposed bank run. They simply don’t have sufficient cash in their vaults. In other words: this is a really bad idea.

So what now?
For starters, ING should hire someone who knows how to communicate during a crisis. Its obvious that they suck at it. They’ve finally stepped off their “Silence, Evade, Deny” strategy but its taken a while. All major companies should look into this, because they may very well be next. Second, major companies with a serious online presence should really start taking this stuff seriously. DDoS attacks are hardly new material to deal with, and proper impact negation tactics have been around for a while. If your income is dependant on online services and this income is significant, get a real ISP that understands this and has expertise in countering such digital vandalism such as Arbor Networks or Prolexic.

The bad news is that according to a recent Prolexic report, DDoS attacks are getting increasingly stronger. They have seen the first 130GB/s DDoS attack this year, and during the first quarter of this year the average attack bandwidth was 48.25GB/s, which signifies a whopping 718% increase over last year. The increase seems to come from a change of victims in the botnets (Dutch) they use. Apparently, they are now targeting web servers especially for their higher bandwidth capacity, which in turn increases overall attack bandwidth. On top of that, the DDoS attack seems to have regained its popularity because the targetlist is growing. Airlines such as KLM (Dutch) and Dutch authentication firm DigID (Dutch) have also recently been hit with massive attacks. In an effort to stave off this wave of disruptions, the Dutch National Cyber Security Center has been organising collective defense (Dutch) between Dutch banks, but it seems they may have to include firms from other walks of life as well. I think we can safely conclude that this avenue of attack is still very worthwhile and won’t be going away anytime soon.

In fact, things may get a lot worse if this newly discovered DDoS technique gets incorporated. Apparently Incapsula mitigated a small attack of 4GB/s recently, and they traced it back to a single source. Generating 8 million DNS queries per second, causing ALL of the 4 GB/s traffic by its lonesome, certainly qualifies it to be called a DDoS Cannon instead of a lowly bot. I don’t know if it is technically feasible, but imagine 100K+ systems doing this.

Wrapping up this piece, I would like to ask mainstream news reporters to please start learning some basic truths about information security. Stop referring to DDos attacks as “(sophisticated) cyber attacks”. They’re not. A DDoS attack is annoying, yes. But on the scale of sophistication they rate roughly as digital graffiti. Also, some major outages are caused by stupidity from the victim rather than an outside source. At least ONE major outage on april 4th of this year at ING was caused by someone messing up certain files that had to be read into a system. This caused a major outage and customers seeing the wrong amount on their bank accounts. This incident was also the most significant failure of ING’s webcare / crisis communication because they didn’t do anything until the problem was almost fixed (many hours later). Still, mainstream media fed the panic frenzy that it was an external “sophisticated cyber attack” until the absolute very end. Very poor reporting if you ask me. Proper reporting matters because your news is read by people who take it for immediate truth. You can, and do, cause panic and unrest when you blow things out of proportion, so please stop doing so. Thank you.

The Value of Secure Coding Procedures

  By Don | January 9, 2013 - 09:37 | Cyber Security, General, Security
Leave a comment

MatrixDigitalRainI recently had a very interesting conversation with Dave Hyman of Checkmarx, who asked me how I saw the future of cyber security (or information security, take your pick). Now, as I’m sure you´ll agree with me, that’s a fairly abstract question that can go a lot of ways. My friends will confirm that I enjoy waxing philosophical discussions like that, but given what Checkmarx does with code security, that is the direction this talk went. And there really is a lot to say about secure coding practices that I feel doesn’t quite getting the limelight it deserves. Any Information Security course or lesson in Security certification will stress that security should be part of the code design practice rather than being tacked on at a later stage; I couldn´t agree more. Unfortunately, security precautions made in the coding process, which turns a design into a working product, are often overlooked and that is a mistake.

(Before I continue: I should note that I am NOT a professional coder; if I make a mistake in my reasoning, please let me know.) In a paper I once wrote I referred to “industry standard” with regards to the amount of bugs per line of code. The argument being that as long as humans would keep writing software, the ´human element´ guarantees that we will always remain vulnerable to exploitable bugs and errors in code. Of course not all bugs lead to exploitable vulnerabilities, but a percentage will and that is a problem and a great risk. I dug up my source, a book called Code Complete by Steve McDonnell. The book points out that the Industry Average is about 15 – 50 errors per 1000 lines of code (The book was published by Microsoft Press, I am sure you won´t find it surprising that they mention that Microsoft applications have an average of 10 – 20 defects per 1000 lines of code). To put that in larger application perspective, Microsoft´s Windows 7 is estimated to have roughly 50 million lines of code; this means that if they adhered to the industry average, there are between roughly 750,000 to 2,500,000 defects in Windows 7!

Even if Microsoft´s code quality is well reviewed and above standard, we can estimate between 500,000 to 1,000,000 code errors in Windows 7! Any one of these could be mistakes that allow remote code execution, which is considered the jackpot for anyone trying to hack their way into the system. Mind you, these are just mistakes and mistakes will happen no matter what you do. A good quality control program should be able to detect and reduce this number of detected errors. Some/ Many of these code errors will lead to heavy security risks in the application and to the user. These coding errors are due to careless coding practice and inability to detect vulnerabilities. The code may function, but the code will be insecure. An excellent example of this is SQL Injection. SQL Injection is the ´art´ of being able to run SQL statements directly to the database backend of a website, either by using a form field or the URL box in the browser. By doing so, you can ask questions of the database that you really shouldn´t be allowed to ask, such as asking it to tell you all the usernames and passwords in the database. Or more commonly: all the credit card information of every customer in the database. This has been around since 2002 and there are several solutions available that prevent SQL Injection attacks. The fact that this technique is still responsible for the majority of major successful data breaches tells us that not everyone is aware of how proper coding technique can prevent SQL Injection attacks.

Many buffer overflow or buffer underrun vulnerabilities are also caused by not properly setting boundaries, which can be easily prevented by developers being more aware of secure coding techniques. Review of these techniques and code review solutions are what you can expect to learn at “secure coding” courses. We should seriously consider making these courses part of the norm for hiring programmers or developing programming talent. Many people will groan and protest at that statement, because it’s another burden on an already stressed industry. I agree that it is not the easiest way forward but courses and code review solutions may very well be the cheapest method to getting more secure software applications.

A secure coding class is one-off and relatively inexpensive, it beats having to actively hunt for and patch insecure code. Such an effort for secure coding must come from the software development industry itself. The end customer won´t ask secure coding because most look only at software ability cost. The customer trusts us that product is secure, and we as an industry, should accept our responsibility and enforce higher security standards on our products. This starts at practicing secure programming. At the rate we are adopting technology into our daily lives, we should start sooner rather than later.

The Dutch, the Yanks, the Cloud and YOU

  By Don | November 14, 2012 - 14:10 | Cyber Security, General, Government, Security, The Netherlands
Leave a comment

Recently a research project by the Amsterdam University [PDF Alert] revealed that US law allows for the US government to access information stored in the Cloud, by (ab)using the PATRIOT act. Multiple Dutch politicians have started asking questions from state secretary Teeven of the Justice department as to whether he knew about this before the research project, and whether he did anything to prevent this or to warn Dutch citizens about this potential breach of privacy. He has since sent in an official answer. Unsurprisingly, he confirms that the issue is real, but does not answer the question about whether he knew about this beforehand. He goes on to saying that it is up to each individual to be careful with any information they publish online, be it to a cloud-based service or anywhere else.

What surprises me, is that people still don’t seem to understand what the Cloud is, what it does and how it works. The effects of the PATRIOT act have long been known, and its effects have been hotly debated for years. How is this any surprise to anyone?

Please follow this logic:

The Cloud is the Internet. It really is that simple. Cloud Services are simply applications that run on clustered computer systems. Maybe on two, ten, a hundred or a thousand systems at a time, it doesn’t matter. Users –and data- are replicated to every system in this cloud regardless of where they are. There could be ten in your own country, twenty in the US and another fifty in Russia. This is (most often) invisible to the end user, and very often special effort is made to keep this invisible to the end user, and to make it one big system regardless of what server you are connecting to, or from where. To be on the safe side, you should assume that regardless of where you are located when you upload data, it is uploaded to the entire grid – not just the part in your country.

And it matters where these systems are located geographically, because that is the only factor in the question as to what country’s laws this system –and more importantly the data on that system- is subject to. For example: Google has servers dedicated to Google Docs in a lot of countries such as the Netherlands, Germany, Britain, the US and probably several countries in Asia. You upload a document to Google Docs while in the Netherlands. As soon as you do, it is replicated to either all the systems all over the globe, or replicated between central data storages all over the globe. It is generally safe to assume that your data will be everywhere, regardless of where you are. ANY country that has Google servers for Google Docs within its borders can in theory –this depends on what laws exist in said country- demand access to this data. The US is almost certainly not the only government that can do this, but even if no other country has such laws, you can rest assured that if the need ever arises (from a national security standpoint) to access your data, things tend to get very ‘flexible’ on very short notice in most countries. Therefore you should assume that you can not trust any online service with your data, regardless of its classification or nature.

As has always been the case, in the end you –and only you- remain the only person responsible for what happens to your data. If you absolutely do not want it leaked, don’t put it on the internet.

Correlating and Escalating Cyber

  By Don | October 2, 2012 - 17:58 | Cyber Crime, Cyber Security, Cyber Warfare, Government, The Netherlands
Leave a comment

On September 20th, CNet reported on a new wave of malware called ´Mirage´, embedded in PDF´s that were distributed through spear-phishing attacks against a multitude of targets, such as a Philippine oil company, a Taiwanese military organization and a Canadian energy firm. The attackers´ target set also included firms in Brazil, Israel, Egypt and Nigeria. Their report was based on the findings of Silas Cutler, a security researcher at Dell CTU. The researchers declined to comment on the origins of this new malware, but as we´ve seen before the characteristics of this digital crimewave are a dead match to the likes we´ve encountered during Night Dragon, Operation Aurora and pretty much everything we´ve seen coming out of China the last decade. Call me old-fashioned, but when I read attack characteristics such as these, I feel confident that a talk with the PRC is warranted:

  • Widespread – broad targeting of an entire industry, aiming for commercially sensitive data;
  • Not extremely sophisticated, just adequate to get in;
  • Supporting command and control network is highly active;
  • Attacks seem well-prepared and highly organized;
  • Some of the malware is made by the Honker Union (a well-known Chinese hacker group);
  • Command and control IP address belonging to China, as did three others that have been used in the Sin Digoo affair earlier;

Looking at this pretty much confirms that those talks US Secretary of Defense Leon Panetta had with the Chinese recently about exactly these kinds of cyber-attacks, had little effect. Considering how much American debt is held by the Chinese, you would have to ask yourself just how hard a line the US can draw against such practices, but other countries would probably do well to start talking more sternly through the diplomatic channel with China. Make no mistake: the economic damages of these attacks are so high that involvement is definitely required at the state level.

Getting out of Dodge first
So here we have a rather clear-cut case of attacker correlation which, as ever, is done pretty much after the fact by an international firm who investigated the malware. My question is: How do you deal with this as a nation, as it happens?

This one question breaks down into a number of smaller issues. First off, you´d have to establish at least somewhat formally who defends what network. And let’s be fair: if you´re a democracy, it’s unlikely to be just one entity. The second issue you have to tackle is detecting the actual attack as it happens. Some network administrators will be able to, others won´t. To be of any use on a national level, defenses on all networks should probably be somewhat similar. At least quality-wise, you´d need them to be similar otherwise you wouldn´t be able to determine the whole scope of each outbreak, even after the fact.  This begs the question as to how wise or desirable it would be to regulate information security measures in some way. In many companies, information security is still seen only as an expense and not as a requirement, even though we can cite countless examples of companies being severely damaged by successful cyber-attacks.

So let’s assume we know who defends every network, and assuming they can all detect a new wave of malware as they happen. Then what? This information is usually kept a secret (or ignored, but that’s another matter entirely) and no signals are exiting these defending parties. When is the last time you called your government after a major cyber-attack hit your company? If you can answer that question, you´re really in a minority and most likely operating in a heavily regulated industry such as Finance or Healthcare. The rest is pretty much left to fend for itself. Attacked entities need a local place to send information about these attacks. I would argue that for governments to be able to correlate various cyber-attacks, it must first have a central authority to which each entity can report attacks on their networks and systems. I haven´t heard of any country having this, but a while back a couple of my friends here in the Netherlands started talking about the lack of such an authority. This was thought up during a brainstorming session at the Dutch MoD and initially dubbed a Security Operation Center (SOC). Even though I feel this name is somewhat ambiguous, let’s keep it for now. Given its national scope, we should probably stick to the CERT naming convention and call it GOVSOC.

Alright, then what?
At the risk of becoming repetitive, let’s assume for now that such a GOVSOC is formed and operational. You´d then need to devise thresholds and escalation paths, along with policies to deal with all eventualities. You´d also need some pretty good agreements with law enforcement, the military and civil government. All three of these parties need some kind of mandate to be able to act on information. It would also need to be covered how each of these parties will act on given information. In case of an actual cyber-attack wave being detected, it would first need to be established on whether there is nation-state involvement or if it´s cybercrime. In case of nation-state involvement, what would you want your government to do? Even when you´re certain who did what, what are thresholds to acting on it? How big must the damage be before diplomatic relations deteriorate? Is this affected by how much you engage in these activities yourself?

Maybe I’m wrong, and I sure hope I am, but I haven´t heard of any country getting to this point yet. Many have been debating these and similar questions, but how about some action? For instance, in the Netherlands the National Cyber Security Center (NCSC) seems like a great candidate to embed that GOVSOC function in. Its government, but it’s a public-private collaboration. If you know of any such developments in your country, please share it with me.

The Dutch and the Dorifel

  By Don | August 27, 2012 - 13:08 | Cyber Crime, Cyber Security, General, Government, Microsoft, Security, The Netherlands
Leave a comment

Unless you happen to live in the Netherlands, chances are that you missed the outbreak of a ‘new’ piece of malware a few weeks ago called Dorifel, also known as XDocCrypt. With over 3000 infections in a matter of hours, of which 90% were systems in the Netherlands, this triggered the Dutch National Cyber Security Center almost instantly. XDocCrypt/Dorifel is a new trojan that encrypts executables, Excel- and Word files that it finds on USB drives and network disks, causing companies to come to a grinding halt almost immediately after infection. Later investigation by Digital Investigations turned up that it also distributes phishing banking websites for ING Bank, ABN AMRO and SNS Bank (all banks with a strong presence in the Netherlands). With such distinctive traits, you would expect that it would be ransomware, but it’s not. It doesn’t ask for money, and there are no real clues what the point is of encrypting those files. It may simply have been a trial run just to find out how good this technique works, but it’s all conjecture at this point.

As an aside, it should be mentioned that the malware’s efforts in encryption did uncover something I found interesting: it exploits the RTLO Unicode Hole, which uses a Windows standard Unicode “Right-to-left override” that are more commonly used in Arabic and Hebrew texts (meaning it’s a Feature, not a Bug). Through this use of the RTLO Unicode Hole, they make filenames such as testU+202Ecod.scr appear in the Windows Explorer as testrcs.doc, and effectively make a harmful executable look like a simple Word doc.

What worries me most, and this is the reason for this article, is the delivery vehicle used by this new piece of malware. You see, it doesn’t exploit some new weakness. Instead, it’s being delivered by systems previously infected with the Citadel/Zeus trojan. This means that over 3000 systems in the Netherlands –systems belonging mostly to ministries, local government and hospitals- already had active botnets inside their networks before getting infected with this new malware! Mind you, virtually all of these systems and networks had active antivirus and IDS systems, and NONE detected either the Citadel/Zeus botnet already in place, nor the new XDocCrypt/Dorifel malware. If anything should be a severe wake-up call for Dutch firms who still half-ass their security, this is it.

Major AV vendors such as Kaspersky and McAfee now address this piece of malware, but it does make you wonder: If this Trojan hadn’t gone through the trouble of encrypting all those files, would it ever have been caught? Clearly, with only a couple of thousand infections, it is not that big of an outbreak. Chances are good that Dorifel would have stayed below the “economic feasibility to fix” line that most antivirus corporations adhere to. With malware code mutation getting increasingly easier and more mature, will this be our future? No more large infections, but a lot more small ones to stay below the collective AV radar? It seems plausible. It certainly makes the dim future of the current AV Modus Operandi that much dimmer. When will we finally see a paradigm shift in our approach to defeating malware?

Cyber – Boundless Nonsense

  By Don | July 30, 2012 - 15:30 | Cyber Crime, Cyber Security, Cyber Warfare, General, Government
Leave a comment

In the Cyber industry, there is much to gripe about. We have a lot of very vocal experts out there, and roughly the same amount of opinions as there are experts. Most of the times, the differences of opinion are really just people being pedantic (or clueless) and while this is a detriment to the entire industry, we have bigger fish to fry. Some notions out there are just plain wrong, and they lead to really poor laws or national policies. If you’ve read any of my previous articles, you may know that when I go off on a tangent, my rants usually involve people who claim cyber warfare doesn’t exist. But the pundits have been strangely quiet on this topic lately, and so it leaves my hands free to chase another topic that’s been bothering me lately. Quite frankly I’m a bit surprised that I haven’t seen more articles on this subject, but here we go anyway:

Cyberspace is NOT without borders. Cyberspace DOES have boundaries.

As any IT person with a basic education in networks & systems will tell you, networks are made by connecting physical networking devices. These devices obviously occupy a physical space somewhere, making them susceptible to the national (and possibly international) laws of the country they are in. You can even configure most networking devices to only service a subset of internet traffic or, and this is especially relevant in this context, deny service to internet traffic involving certain geographic regions. In other words: if you run a country that is geographically wedged in between two countries that are at war with each other, you CAN opt to cease routing their internet traffic. It may not be easy, and it may not be politically useful, but it is certainly not impossible. Back in 2007 during the cyber attacks on Estonia, the responders actually mitigated much of the barrage of DDOS attacks arrayed against them by dropping large portions of international internet traffic.

The question is: What is neutral behavior in the context of cyber warfare? Are you, as a neutral country in the scenario described above, obliged to drop all traffic between these two nations that crosses your national networks? And if you’re not, are you obliged to make sure none of the cyber attacks are originating from compromised systems within your borders? Given the stakes involved, you may want to do that anyway. Simply dropping traffic might be easier though.  But what if dropping traffic from either side gives offense or is considered a hostile act? This can quickly develop into a political conundrum either way.  There is no official “right answer” yet, so for now governments will have to decide this on their own.

A more interesting question is: What constitutes our digital territory online? Our geographical borders are usually quite well defined, but 90% of the hardware on which the internet is built, is commercially owned and maintained. Would this mean that networks owned and operated by foreign companies are to be considered foreign territory? Does this automatically make them susceptible to the laws of the country that they originate from or registered at? But what about networks that aren’t owned by any official entity? And what about wireless networks? How would you treat areas that are covered by multiple wireless access points? If you look at the way territorial borders are handled by governments in physical space, I see no reason to treat cyberspace differently. In fact it’s probably a much easier approach to just declare the entire electromagnetic spectrum inside national borders as national territory than to figure out some new approach “just because it’s cyber”. You can even re-use the notion of Extraterritoriality or the special privileges as described in the Vienna Convention of Diplomatic Relations [PDF Alert].  Considering how international collaborations against cybercrime is currently being approached, we’re actually pretty much doing this anyway.

In conclusion, I would ask that experts and organizations such as RAND [PDF Alert],  Margaret Chon (Seattle University School of Law), NCCIC  and the Stanford Law Review (just a random grab) either develop a better understanding of cyberspace or be more clear about what they mean. In all fairness, I haven’t read the complete works of all these authors. They may actually understand what I just covered and if you read closely enough, they might not even be (technically) wrong. Nevertheless they give off the sense that cyberspace doesn’t have any borders and this is simply a poor representation of reality. The differences between Cyberspace and Physical space are not so big that we need to reinvent the wheel for every policy, law or process we have.  Let’s be sensible and re-use what we already have.

Taking the Crowbar to Cyber-Denying Eyes

  By Don | April 3, 2012 - 11:54 | Cyber Security, Cyber Warfare, Government
Leave a comment

I’ve been quiet with my blogposts lately. I know and I apologise. Between writing a lengthy article on Cyber Warfare for PenTest Magazine, writing papers for the MBA degree I am working on, and snowboarding the gorgeous slopes of Val Thorens (France), it’s been sort-of busy. I must say though, that when I sat down and went looking for a subject for a new article, the last thing I expected was that there are still actually people out there who flat-out deny the threat of Cyber Warfare. To be honest, I was dumbfounded. This next piece is, I’ll admit, a bit of a rant. Mostly because quite frankly I enjoy ranting occasionally. Consider it a brief post-holiday deviation from my usual style. Blame it on the cocktails if you must. I’ll give you a brief summary of Jerry Brito’s article. I’ll only do some minor paraphrasing, honest.

“Cyber Warfare doesn’t exist! Yes we’re being robbed blind through Cyber Espionage by nation states, but thats not Cyber Warfare. Cyber Warfare is kinetic cyber attacks! What do you mean Stuxnet? …DuQu? Yeah but those didn’t cost lives! The rest is just DDoS attacks! I can’t see any evidence to the contrary so it must be a hype. Did I mention im really comfortable here with my head resting in a hole in the ground? A bit sandy though.” 

Okay so that last sentence might have been a little less-than-true, but still. Whats worse is, is that this guy is the Technology Policy Program Director at George Mason University. When people wake up after he introduces himself (can someone please shorten that title?), people listen to this guy! Why do we let people like this represent our industry, or even anywhere near our young to educate them? It seems to me that making your own arbitrary (and apparently poor) definition of Cyber Warfare, and then discounting MOUNTAINS of evidence that undermine your point, isn’t very scholarly to say the least. It’s a bit like arguing against Darwin’s theory on Evolution by taping a bible to your forehead and plugging up your ears screaming “I CANT HEAR YOU” over and over.

Can we please stop giving a stage for these people who are obviously cherry-picking their way to an uninformed argument? I will grant you that there is still a lot of debate going on about the true definition of Cyber Warfare. There are many definitions and most are considered incomplete, too narrow or too broad. But we all agree that there is at least some element of Political Will involved, and computer systems and networks are the playground on which this assertion of said political will is taking place. Technically, Cyber Espionage often involves a pretty much equal amount of breaking-and-entering as it would be to shut down the targeted system. The difference is mostly in the intent, not the methodology. If this is committed by a nation state, or a non-state actor with political intent, then Yes: you could (and should) call it  Cyber Warfare. In this regard it is the same as a nation state sending a military airplane into enemy airspace. Whether its a spyplane, a fighter jet or a bomber, it is still politically motivated and thus could be called Air Warfare. You can’t run around yelling “DDoS don’t count!” or “It doesnt count ’till someone ends up dead!” because those aren’t relevant points in this debate. By the same token, not all traditional military operations require someone to die. You cannot discount entire swathes of activities and still expect your argument to hold water.

So that pretty much covers the faulty logic of his argument. But we’re not there yet. Even IF we would be foolish enough to accept his premise at face value, he is still factually incorrect, because he is basing his statement on two very critically wrong assumptions:

1. His own perceptions of reality and;
2. His limited understanding of the current situation.

First off, it is highly unlikely that every succesfull cyber attack is common knowledge. For a nation state to be severely compromised through cyber attacks is embarassing. These systems are supposed to be highly protected. So much embarassing, that it is unlikely that they would publicly come forward about it themselves. Iran didn’t publicly admit their Natanz site got hit with STUXNET until the attack code was discovered by (non-Iranian) security researchers. Aside from the embarassment, its also possible that admitting such weakness sends out an invitation to other would-be attackers. All things considered, I have more sympathy for governments staying quiet after a breach than I do for corporations, simply because the stakes are so much higher. In any case, Jerry’s “evidence” by which he measures his statement is almost certainly severely incomplete.

Secondly he is saying that Cyber Warfare is a hype based on his ‘evidence’ right now. But just because a cyber attack that fits his cherry-picked definitions hasnt happened yet, doesn’t automatically mean it never will! If there is one major certainty in Cyber Warfare, is that things change – and change FAST. Any information you receive is completely obsolete a second later. New attacks and even entirely new concepts of attack methodologies are developed daily. A few years ago, the US Air Force figured that there were roughly 120 countries developing Cyber Warfare capabilities. This was before major international debates on the subject started. I think its safe to assume that more countries have started a Cyber program since then, don’t you? Compared to the individual, these are all players with extremely deep pockets. Deep pockets capable of investing heavily into cyber attack research. Im sure that at least some of them managed to come up with an idea or two that hasn’t been field-tested yet, further eroding mr. Brito’s argument. Again I would ask that we stop giving airtime to these silly arguments and get back to the more important task of actually securing ourselves.

Real Bullets for Digital Attacks

  By Don | February 9, 2012 - 16:39 | Cyber Security, Cyber Warfare, Government, Security
Leave a comment

In May of last year, the US Government published its International Strategy for Cyberspace. The publication made some waves in the international community because in this document the US stated that military reprisals to cyber attacks were now officially on the table. More specifically, the US government stated that it ‘encouraged responsible behavior and oppose those who would seek to disrupt networks and systems, dissuading and deterring malicious actors and reserving the right to defend these national security and vital national assets as necessary and appropriate’ [emphasis mine]. This declaration of intent came after an ever increasing number of (detected) attacks on USG networks and systems. Development of cyber capabilities by governments worldwide are also likely to have influenced the situation.

Whatever the underlying political reasons of publishing such a loaded statement, the publication is clearly intended to deter would-be attackers and, as such, is more or less aligned with one of the RAND Corporation’s Monograph studies during Project Air Force on CyberDeterrence and Cyberwar (freely available PDF). In this lengthy publication by the hand of Martin C. Libicki, the subject of CyberDeterrence is extensively studied and described. He approaches the subject from so many angles that it would make you smile if it you didn’t have to read it all to get to the end. One especially important aspect of this discussion is the much-debated problem of attribution. Since retalliation and the threat thereof are a large part of deterrence, knowing who to strike is of paramount concern. Libicki describes various scenario’s such as striking back to the wrong target or not striking at all, and how every scenario has its own consequences. Suffice to say that if you, as an attacker, hide your tracks well enough (don’t forget the cyber intelligence aspect!), you won’t have much problems with retalliatory strikes. If you manage to implicate an innocent third party instead, you may even turn that into a distinct advantage. Considering that retalliation may now include kinetic attacks (bullets to bytes), it can be safely said that they have upped the proverbial ante.  

You might be wondering what the point is of declaring retalliatory (potentially kinetic) attacks when every player in this field knows what the score is: No attribution – No problem. So why make a public statement about how you’re going to strike back if everyone knows its highly unlikely? Well, Libicki covers that too by describing the effects of not striking back, striking back silently, striking back publicly as well as not striking back publicly. I won’t copy/paste his work here, but reading between the lines I found that even though such a public statement is mostly a bluff, it is somewhat of a deterrent and it wins out over the downsides. Besides, and here is the succint point of it all, even though you declare that you may use kinetic military options as a retalliatory measure doesn’t mean you are immediately obliged to actually do so.

In December of last year, the Dutch government was advised by the Advisory Council on International Affairs (AIV) (Dutch) to declare a similar statement with regards to cyber attacks. If the Dutch government decides to take up the advice, The Netherlands will be in the same boat as the US when it comes to cyberdeterrence strategy. It doesn’t worry me. I feel that making such a statement to the world has more upsides than downsides and it shows backbone. When I, along with friend and fellow NCDI council member Niels Groeneveld, was asked to provide input to some of the questions the AIV was looking to answer, I found the discussion so interesting that I wrote several articles about it. See the “Questions from .GOV” series. I was happy to see that some of my input had been used, but it also more-or-less automatically disqualifies me from judging this advice. So I ask you: How do you feel?

US vs The World – The Cyber Monroe Doctrine

  By Don | January 9, 2012 - 16:58 | Cyber Crime, Cyber Security, Cyber Warfare, Government
Leave a comment

On December 2nd in 1823, the US introduced the Monroe Doctrine. This article declared that the US would view further European interference in the Americas (the Western Hemisphere) as acts of aggression and reserved the right to an armed response. On march 10th, 2009 it was argued in front of a Homeland Security Subcommittee on “Emerging Threats, Cybersecurity and Science and Technology” by Mary Ann Davidson that this same piece of US doctrine would be a suitable candidate for application in cyberspace. You can find more information at Whitehouse.gov about this testimony, from where it has recently resurfaced on various discussion boards such as the Dutch Cyber Warfare Community group on LinkedIn (thank you Matthijs).

Not unlike other testimonies on the subject of Cyber Warfare and Cyber Doctrine coming from the US, we see a very ‘red-blooded American’ attitude seeping through, and quite frankly that’s not helping matters. Im generally a big fan of ‘re-using’ existing laws and policies when they apply well enough to Cyber, but Davidson demonstrates a lack of true understanding of the situation. It is possible that her testimony was misunderstood or misquoted by the person who wrote the testimony excerpt, but nevertheless I would like to address a few key issues I have with the testimony.

“We are in a conflict – some would say a war. Let’s call it what it is.”
In the very first segment of the testimony, Davidson asserts a number of things that are simply incorrect. The title of the paragraph is a clear giveaway, and sets the tone for the rest of the testimony. Davidson observes that the US is under constant attack in cyberspace, and that this amounts to war. What she does here is lump together all the cyber attacks that are recorded, and make it seem like this is all part of one big cyber war. But this is not the case. I would argue that 80% (if not more) of these attacks are merely ill-advised scriptkiddie attacks, maybe not even really aimed at government resources specifically. This is so common that many security people have come to call these attacks ‘internet white noise’. The remainder of the attacks might be more targetted, but their origins are at least as diverse as of the earlier 80%. They are perpetrated by cyber criminals, stalkers, curious college students putting their class material into practice, security pentesters who overstep their bounds, bored high school drop-outs, disgruntled administrators and many more potential attackers. You just don’t know. You can’t know. There are just too many attacks from too many sources to make it feasible to chase every one of them to find out. To lump all these attacks together and paint them as a constant barrage by one enemy is not just incorrect, its also dangerous and foolish. If anything, you’re not in one conflict, you’re in thousands.

Even if you consider all these attacks by all these different enemies conflicts, which implicates that there is some underlying plan or strategy to said attacks, its still a big leap in logic to call it a War. America’s habit of declaring war on abstract notions (the War on Drugs, War on Terror et cetera) may sometimes be necessary to get people to act, but in case of Cyberspace it just doesn’t work. Internet is everywhere and, considering the earlier clarification on the attacks, you’re attacked by thousands of enemies. What are they going to call it? “The War Against Everyone”? Actually, given the tone of the testimony I should probably refrain from giving Davidson any ideas. It is exactly this attitude that gives credence to people who claim that the war drums are being beaten unnecessarily to militarize the Internet and to reduce the rights and freedoms of netizens.  Language matters. Talk of war incites thoughts of war, and it should be used sparingly.

 Given the diversity of potentially hostile entities building cadres of cyberwarriors, probing our systems including our defense systems for weaknesses, infiltrating U.S. government networks and making similar attempts against American businesses and critical industries, is there any other conclusion to be reached? Whatever term we use, there are three obvious outgrowths from the above statement. One is that you do can’t win a “conflict” – or war if you don’t admit you are in one. The second is that nobody wins on defense. And the third is that we need a doctrine for how we intercede in cyberspace that covers both offense and defense and maps to existing legal and societal principles in the offline world.

Emphasis is mine. As previously stated, there are a multitude of conclusions you could draw from what is happening on your networks. The three points mentioned thereafter make even less sense, because she speaks about ‘winning’  the ‘war’. But what does that mean? The Monroe Doctrine referred to Military/Political consequences to Military/Political interference by foreign nations on US soil. Or rather the entire Western Hemisphere but I digress. I mention this with emphasis because the Internet and/or Cyberspace is a different animal altogether. The majority of the cyber equivalent of ‘US soil’ isn’t actually ‘US soil’, but is actually owned and operated completely and totally by third parties. To further complicate matters, a large portion of that is owned and operated by third parties who are distinctly not American such as foreign-owned corporations. Imposing a Cyber Monroe Doctrine would effectively militarize the entire US portion of cyberspace. That is, if they can ever decide on what parts of that cyberspace they could and could not call American. Davidson acknowledges this problem with the use of the term ‘turf’ but fails to grasp the severity of the problems it causes with her theory.

So that covers the underlying theory by Mary Ann Davidson, but the three ‘outgrowths’ don’t even make sense on their own. “You can’t win a war if you don’t admit that you’re in one.” Aside from the whole War statement…I mean…Really? This is a complete non-sequitur if you ask me. You could argue the exact reverse and it would be equally true (or untrue, of course). I might be piling on here, but someone should probably have told the US Senate this before the Vietnam war, which the US never formally admitted as being a War. Had they used Davidson’s logic, they would have known this was a war they could not win.

“The second is that nobody wins on defense.” This is another argument that doesn’t stand up to closer scrutiny. The Monroe Doctrine revolved mostly around defense. It was enacted to work as a deterrent to protect (not project) US interests in the Western Hemisphere. So what does Davidson envision with this statement? It seems to me that she’s calling for offensive cyber operations, which is something that isn’t covered by the Monroe Doctrine. Monroe wanted to defend his Home, while Davidson seems to want to cross the pond and kick some butt. She’s calling for a Sword to match the Shield, but doesn’t take into account that they are two entirely separate entities with entirely different properties, capabilities and logistics.

“And the third is that we need a doctrine for how we intercede in cyberspace that covers both offense and defense and maps to existing legal and societal principles in the offline world.” So if I read this correctly, Davidson argues the US needs a doctrine because….well, because! This last argument isn’t actually an argument. Its a possible answer to her first two statements and probably only included because she needed a third argument. Three arguments makes it sound nice and official. And why would the US need one doctrine to cover everything? It has been my understanding that the US Government has published various doctrinal documents that cover a variety of issues, such as the International Strategy for Cyberspace. The US Department of Defense has also published a number of documents on Cyberspace over the last few years, and these map to a number of existing legal and societal principles in the offline world. These can be easily found online.

So is Mary Ann Davidson correct in her assertion that the Monroe Doctrine would be a handy fit in Cyberspace? To be honest, I don’t know. Im not a politician and im not a military strategist. But her arguments are flawed and they didn’t sway me. Im usually a big fan of a common-sense approach to Cyber-anything, and in most cases we can apply existing legal and societal frameworks just fine. But in this particular case we simply cannot forget that the US already has an potentially undue influence over the proper functioning of the Internet, and any kind of overly agressive stance will foster more animosity between the US and the rest of the world. The Internet is, and should remain, an active demonstration of global cooperation. We would all be better off if we strived to make things safer for everyone.

Debating Cyber Warfare – Still more questions from .GOV (Part III)

  By Don | December 12, 2011 - 10:52 | Cyber Crime, Cyber Security, Cyber Warfare, Government, The Netherlands
Leave a comment

In this closing article, last in a set of three, I discuss some international treaties that may or may not apply to Cyber Security. Again I would like to note that the answers I give are merely my opinion on the matter. This article is comprised of two questions. Without further ado:

In how far can international codes of conduct in using the digital domain contribute to increase Cyber Security? Can we learn from experiences with existing codes of conduct such as in the area of non-proliferation?

Fading national borders and defacto international routing of data traffic are a property of cyberspace we can’t escape. This makes international relations and codes of conduct essential, especially when considering fighting cyber crime. This calls for Law Enforcement Agencies and Justice departments of multiple countries to work together to stop criminal enterprises in their tracks. International cooperation amongst law enforcement agencies in taking down cyber crime rings has been taking place for several years now, and although not nearly as successful as we’d hope, they did have some successes. For an excellent read on this subject, I recommend Joseph Menn’s Fatal System Error.

As for Cyber Warfare and Cyber Conflict, there are various internationally accepted legal frameworks and cooperative initiatives that can provide some help with increasing security in Cyberspace. Consider the Law of Armed Conflict or the Universal Human Rights, both of which have received wide adoption and have led (and still lead) to increased cooperation among nation states. Connecting to existing initiatives in this area is therefore highly recommended.

Although Non-Proliferation has a similarly high adoption rate, using this as an example may very well give off the wrong idea because of the emotional ‘weight’ associated with nuclear weapons. Cyber weapons are not currently anywhere near the immediate physical threat that nuclear weapons pose, nor is it feasible to attempt to restrict development or trade of cyber weapons. Cyber weapons consist of computer code and knowledge of the target system or application. Anyone with enough knowledge can create one, and all it takes is a computer. Connect that system to the internet and proliferation is both virtually immediate and unstoppable.  

How can NATO and the EU give substance to the principles of Common Defence, Deterrence and the Solidarity clause when considering cyber threats? How can NATO and the EU improve the information exchange with regards to threat analyses?

Existing initiatives within NATO and the EU offer excellent opportunities in this regard. For instance, a better connection to the NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, Estonia is a very good idea. The CCDCOE was founded and sponsored by a number of nations, but the Netherlands was not one of them. It is still possible to become a sponsoring nation by signing its Memorandum of Understanding and after looking at its Mission statement revolving around cooperation, I highly recommend our government does so. Aside from this centre, NATO’s own C3 agency has various endeavors with regards to Cyber Security that we here in the Netherlands might be able to get an advantage out of.

All in all, it’s safe to consider that our best bet lies in engaging in cooperation with other culturally similar nations. Most western nations are as connected to the Internet as we are, and they share our understanding of how critical cyberspace is to us and our economies. Together we simply have a much better chance of improving our situation online.