Cyber Cease-Fire: US v. China

100615-640x400

As published on Norse on October 6th, 2015

Interesting times indeed, now that the outcome of Chinese president Xi Jinping’s two-day visit to the White House last week has been made public. According to the White House press release, this is what was agreed:

  • The United States and China agree that timely responses should be provided to requests for information and assistance concerning malicious cyber activities.  Further, both sides agree to cooperate, in a manner consistent with their respective national laws and relevant international obligations, with requests to investigate cybercrimes, collect electronic evidence, and mitigate malicious cyber activity emanating from their territory.  Both sides also agree to provide updates on the status and results of those investigation to the other side, as appropriate.
  • The United States and China agree that neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.
  • Both sides are committed to making common effort to further identify and promote appropriate norms of state behavior in cyberspace within the international community.  The United States and China welcome the July 2015 report of the UN Group of Governmental Experts in the Field of Information and Telecommunications in the Context of International security, which addresses norms of behavior and other crucial issues for international security in cyberspace.  The two sides also agree to create a senior experts group for further discussions on this topic.
  • The United States and China agree to establish a high-level joint dialogue mechanism on fighting cybercrime and related issues.  China will designate an official at the ministerial level to be the lead and the Ministry of Public Security, Ministry of State Security, Ministry of Justice, and the State Internet and Information Office will participate in the dialogue.  The U.S. Secretary of Homeland Security and the U.S. Attorney General will co-chair the dialogue, with participation from representatives from the Federal Bureau of Investigation, the U.S. Intelligence Community and other agencies, for the United States.  This mechanism will be used to review the timeliness and quality of responses to requests for information and assistance with respect to malicious cyber activity of concern identified by either side.  As part of this mechanism, both sides agree to establish a hotline for the escalation of issues that may arise in the course of responding to such requests.  Finally, both sides agree that the first meeting of this dialogue will be held by the end of 2015, and will occur twice per year thereafter.

 

Second-guessing

At first glance this sounds wonderful, but it didn’t take long before the second-guessing started. With Barack Obama making statements such as “What I’ve said to President Xi, and what I say to the American people, [is] the question now is: ‘Are words followed by actions?’”.

It’s important to look at this meeting in the context in which it was held. As most people are aware, the US has been experiencing cyber-attacks almost non-stop for years now, on multiple fronts. The US criticizes China for attacking not only US government infrastructure, but commercial enterprises are suffering massive theft of intellectual property in almost every industry as well. The widely publicized OPM hackwas only the most recent event that made the American cup ‘runneth over’.

But the US is hardly the innocent victim that it portraits itself to be. Well-known whistleblower Edward Snowden revealed that the US has actively been attacking Chinese infrastructure as well, in order to ‘prepare the battlefield’ for any potential physical conflict. They have admitted doing so, but claim that no intelligence from the large cyber intelligence gathering ‘driftnet’ known mostly by its moniker PRISM is fed to American enterprises for their commercial benefit. Whether that is true, of course, remains to be seen. After all, accusations of unfair commercial advantages through government espionage have been shown to contain some substance in the past.

 

Limiting cyber-attacks

In this regard, it is not surprising that it is the US calling for an agreement on limiting the cyber-attacks between the two nations. When taking the theft of intellectual property into account, the US simply has more to lose. It should also not be forgotten that not long ago China signed a treaty with Russia that, among other things, contained a pledge that they would not hack each other. This same treaty also further solidified their efforts to influence global internet governance, about which I commented in an earlier article, giving the US all the more reason to try to calm the waters with China.

 

So what does this treaty mean?

Of the four points covered under Cybersecurity, only the first two are points with some meat to it. As also mentioned in my previous article, the Chinese are very unlikely to sign any treaty on internet norms of behavior that include a reference to the UN’s definition on human rights. The entire bullet point might as well not have been there. It is window dressing and was probably only agreed upon because it shows a willingness to ‘get along’, whether real or imagined. The last point about the ‘cyber hotline’ doesn’t actually say a whole lot at all, so let’s move on to the more salient points.

It should be noted that the US is trying to stop the attacks against American businesses while trying to keep the option of ‘battlefield preparation’ on the table. This isn’t guesswork, its public record; just look atwhat American politicians are saying on the subject. In other words, both countries now seemingly agree that attacks on government networks are more-or-less allowed, but commercial enterprises are considered off-limits. In the unlikely event that both parties actually honor the agreement, this would be a clear win for the US.

 

An unlikely agreement

And that the agreement will be honored does seem very unlikely. For one, the Chinese government has never acknowledged that it has any involvement in cyber-attacks against commercial enterprises, and it is highly unlikely that they ever will. If those attacks would now suddenly cease, it would be a tacit admission that it had such control in the first place and put the lie to every official statement the Chinese government has ever issued on this topic. Another important factor is the simple question of “Cui Bono?”. Who benefits? The Chinese would lose a very effective method for national advancement in many areas, and the only cost thus far has been (relatively light) international criticism. They would gain nothing, whereas the US would gain a stopgap in the massive IP drain.

In short: The agreement seems a bit one-sided and that does not bode well. It may well be that China agreed only to stave off the sanctions that the US has been casually dropping to the press recently. Whether China takes these sanctions seriously is debatable, because China still remains the greatest holder of US debt, which means it can give a considerable pushback. Then again, China not honoring the agreement is probably expected. Despite what some critics may say, the people involved in drafting this treaty are not fools. With this agreement on the table it makes the American case much stronger if Chinadoes violate it, as Jason Healey points out.

As always, time will tell.

 

The Right to Strike Back

pic3-640x400As published on Norse on June 26, 2015.

Last week, at the HiP Conference in Paris, there was a debate on whether or not it should be allowed to strike back when you are being hacked. Currently, criminal law in most countries does not allow it. But is this tenable in today’s’ highly digitized society rife with cybercrime?

My position in this matter is that we should create a legal recognition of the fact that we are in a social gray area where it concerns the Internet, even if it is only a temporary recognition, and allow for somecapability to strike back at cyber criminals. As I’ve said before, humanity is only now scratching the surface of what it means, socially and culturally, to have (largely) unrestricted access to the collective knowledge of Man at our fingertips, (almost) everywhere and (almost) anytime we desire.

In virtually every aspect of the human experience, it has made its’ impact felt. The number of human lives that remain completely unchanged through some kind of information technology is rapidly dwindling to zero as technology advances, and our adoption of them continues to rise.

Under the umbrella-term “Cyber”, that is similarly revered and reviled, we are inching our way through the various aspects of our daily lives to adapt our old notions of how we ‘did things’ to incorporate the new realities we face in the Information Age. Crime, international politics and armed conflicts are among the most hotly debated topics in this regard. What I am getting at, is that in a social and cultural sense, Cyberspace can (and in my opinion should) be considered terrain in the early stages of colonization. Think of it as the New Frontier or the Wild West, if you will.

We recognize that there is this huge new area that can be explored, colonized and exploited, but exactlybecause it is new and untamed, there should be only a limited expectation of Law and Order. Certainly, in most countries the national laws have been revised to incorporate the new realities of Cyberspace. But often these amendments or new laws are only rough first drafts because very few (if any) people understand exactly what Cyberspace means (culturally and socially).

What doesn’t help is the fact that as our technology continues to advance, our uses –and in turn the consequences- are changing with it. In other words: even if we manage to define proper laws for the circumstances right now, there is a good chance that they will be outdated due to technological advances in short order. But that is not really the core issue. Having properly defined, applicable and reasonable laws is only the first step. You have to be able to enforce a law if you expect people to follow it, otherwise it just becomes little more than an advisory note. A cute bauble that the criminally inclined can have a chuckle over while they continue making money off of these exact crimes you’re trying to prevent. And that, unfortunately, is largely where we are now.

Despite being a horrible analogy in every other sense, Cyberspace is the Wild West. Law and Order is reasonably established in some areas, but for the most part you can only depend on the occasional sheriff or Ranger. As was the case in the early years of the Wild West, there –on the whole- isn’t a whole lot of coordination between law enforcement, the government and the citizenry. This can be easily verified by looking at the figures. The number of successfully prosecuted cybercrime cases is very small indeed, when compared to the number of reported incidents. Also consider that we don’t see every incident, and even when incidentsare discovered, they are not always reported. Please don’t misunderstand what I am trying to say: This is not intended as a snipe against law enforcement or the government. They are trying to get a handle on these cases. But the fact of the matter is that we have a serious lack of expertise and experience across the board. There just aren’t enough people skilled and experienced enough to make a serious dent in the numbers. Or, for that matter, to faster develop an underlying framework that makes law enforcement of cybercrime any easier.

Frameworks containing (and hinging on) effective international agreements, laws and political policy to address cybercrime are also still being developed. The often-heard argument to forbid people from striking back at cyber criminals is that to do so is anoffensive act, and not a defensive one. In other words, striking back should be considered a weapon and not a shield. In the strictest sense of the definition this is indeed correct. However, just looking at the success rate of cyber-attacks alone will dissuade anyone from the notion that a “good defense” is enough to stave off a cyber-attacker.

Even the US military, with the highest defense budget in the world, can’t prevent some attacks from being successful. In very practical terms this tells us that we cannot count on being secure when we are only allowed to defend ourselves; something is clearly missing. Perhaps that missing element is the right to strike back. To stick to the earlier analogy of the Wild West, we are unarmed and criminals are not. Essentially we are telling people not to act when they are being attacked. To trust the Police to protect us against predators. To sit still and pray that the criminals don’t find the valuables we’ve buried in the proverbial shed. But clearly the Police are not capable of doing so right now, as can be easily deduced from the figures mentioned earlier.

In my opinion this is untenable, and quite frankly I find it unconscionable to leave the average citizen as such an easy prey. During the debate I therefore argued for at least a temporary recognition that allows for striking back at our assailants, with the express goal of halting an attack. It will be interesting to see how the other panelists view it, and I look forward to hearing if perhaps there is another solution to the problems we face today.

Enterprise Security vs. Nation State Threat Actors

enterprisevnationThe recently published Snowden/NSA/GCHQ slides regarding the Gemalto hack have caused quite a stir amongst security practitioners, board members and politicians alike. But the uproar is minor when considering that it is now more than clear that not only non-allied nations such as China, Russia and Iran are attacking commercial entities. Nation states that we are on good terms with are apparently equally willing and able to attack their allies, just to get ahead in the Intelligence and Battlefield Preparation game. Good friend and excellent analyst Richard Stiennon already acknowledged (allied) nation states as a threat actor for the commercial industry in his article “NSA Surveillance Extends the Threat” in 2013. He asserted that the NSA was leading the threat hierarchy and was advocating a global re-evaluation of ones’ security stance. From what has been unveiled recently this is due for a revision yet again, as it is clear that British GCHQ is following the same playbook. Given both their membership in the “Five Eyes” community (of which all nations in the Five Eyes are core participants) it is increasingly safer to assume that Australia, Canada and New Zealand follow the same methodology, but that is beside the point of this article.

What does this mean?

When comparing the slides and modus operandi concerning Gemalto with what was disclosed about the Belgacom hack, useful observations can be made regarding the tactics employed by GCHQ and the NSA. And that MO demonstrates quite clearly what the real problems for commercial entities are when faced with a nation state as an adversary.

First off, they are difficult to expect. That’s right: Expect, not Detect (although that is probably equally true). Nation states have considerably different motives and these may not always be obvious. Gemalto and Belgacom were targeted because they were gatekeepers to communication networks; in this case telecommunications. They in turn contained what the NSA and GCHQ were actually after: the communications (potentially) running over those networks. It seems like arguing semantics when we differentiate between the targeting the communications networks and the communications themselves, but it is quite relevant: Both the NSA and GCHQ have other legal recourses to obtain the communications they are looking for, but are actively and purposely choosing other avenues. In short, it is not usually obvious what governments are interested in, and even if they have other (legal) means to obtain their target, they might still attack you if that proves to be more useful or less of a hassle.

Second, they are nearly impossible to deter. Cyber criminals generally tend to pick the low-hanging fruit. This will probably remain true as long as there remains so much of it available. The other major category popular with cyber criminals is the ‘big score’, where the spoils of a successful heist are so rich high that attackers consider their time and resources a good investment. Naturally this last group has more staying power than the first group, but both will eventually bug out if the operation is found to be too difficult or risky. Corporate espionage can potentially stay in the game where a cyber-criminal would have given up, but that is very dependent on the level of resources and risk that a firm is willing to commit.  You can deter them by securing your infrastructure to such a degree that the reward of breaking in is not worth the effort. Governments have deeper pockets and thus far seem to be more-or-less immune to criminal prosecution. This significantly alters the equation for such parties. The local social environment of the attacker also plays a role. Corporate spies or criminals basically get told[1] “Get in there if you can”, while soldiers get told “Get in there [period]”. Government operatives don’t get deterred by tedious work or lack of funds. To keep them out it has to be made impossible to break in and, provided it can be done, the task will be Herculean and costly.

It should also be pointed out that governmental espionage is not solely about national security. Many intelligence services are tasked not only with security, but also so-called ‘Economic Intelligence’. To put it bluntly, they are also looking for anything that might give their national corporations an edge against foreign competitors. The reason is simple: successful corporations are a boon to any nation. Not just for the additional tax income they generate, but also for the additional jobs and innovation power they bring. Some intelligence agencies focus more on this than the others, but most do it to some degree. We have seen evidence of this before, during the Echelon program. Several high stake deals were won by American firms due to the intelligence provided to them by the American intelligence apparatus. We can only guess at what intelligence the NSA is currently feeding to American firms. Perhaps the tech firms that are under the NSA yoke are being rewarded sub-rosa as compensation for the multi-billion dollar loss they have incurred (or will incur) over lost trust.

Third, they have capabilities unique to this category of attacker. When looking at the Belgacom and Gemalto hack, it is clear that one major new factor in their approach is Intelligence. Highly trained government intelligence agents are tasked with scoping out the target. They will find key target personnel in short order. It is their job to do so, and even in small nations these operatives are trained and experienced to a degree that will never be matched by a corporate entity. This might be the most effective tool in their arsenal, and next to impossible to defend against. The average person working for a corporate entity will be completely unarmed against people professionally trained in disciplines such as surveillance and interrogation. Would they spot a tail when walking or driving? Would they realize they are being interrogated during a seemingly innocuous conversation with a stranger? Would their family? What is worse, is that nothing private is off-limits when gathering intelligence. Private emails, browsing history, social media, cellphone conversations and text messages are all scrutinized in the hopes of finding a way inside the target organization. They are not above infecting a staff member with a piece of custom-made malware if it furthers their goal. The more staff a company has, the bigger this attack vector is. The problem is exacerbated when dealing with technologically advanced nations, due to higher degrees of technological refinement in their attacks.

Fourth, that we know of their operations does not mean they have stopped. It sounds strange, but for some reason many people seem to think the threat is over now that we are aware of it. It is stating the obvious, but that is not the case. All that has really changed is that we now have some measure of tangible proof to something that was strongly suspected for a long time. The repeated wake-up calls are working to force a long overdue focus on security, but it still has to be acted upon and followed through on. The security industry finally has the clout to address the serious issues, and it can be done without overhyping the matter. Throw away old disparaging sayings such as “if they want to get in, they’ll get in” and do what can be done.

 

Naturally there is more to this issue than the points described above. What is clear is that the corporate world is faced with a potential adversarial class that it is not equipped to deal with. In this regard the world is not that different from the Dutch Golden Age in the 17th century. The Dutch VOC company had a large fleet of merchant ships that were regularly attacked by foreign ships of war belonging to nations that the Netherlands was at war with at the time. The naval frigates outclassed the often cumbersome trading vessels, and defending themselves to a sufficient degree simply wasn’t economically feasible. This problem grew to such an extent that valuable VOC convoys eventually received Dutch naval escorts for protection, even though they did have to help pay for them. What is worth wondering about, is whether we can find a similar common ground with Government and truly co-defend in a meaningful manner.

 

[1] Or conceive the notion themselves, naturally.

GCCS 2015: Battlefield for the Internet’s Multi-Stakeholder Coup (Part I)

GSSC2015Published on Norse Corp on Jan 21st, 2015

As you may already be aware, the next iteration of the Global Conference on CyberSpace will be held on April 16th and 17th in The Hague, the Netherlands this year. It is the worlds’ premier political conference on Cyberspace and this is its’ fourth edition.

Earlier conferences took place in London (2011), Budapest (2012) and Seoul (2013). During these events the worlds’ political elite gathered to discuss pressing matters concerning cyberspace; a subject that inches ever higher on political agendas worldwide.

No countries are excluded by default, making it a truly global event aimed at creating dialogue between nations that are both like minded as well as political opposites.

One of the key goals is the creation of a globally accepted baseline of online behaviors. It’s a tough issue to crack because each nation has different notions on what constitutes undesired behavior online, and even more hotly debated is what each behavior warrants as a response.

Because there are so many underlying political motivations, nothing has thus far been universally agreed upon. Rumor has it that not even the fight against the utterly reprehensible crime of child pornography turned out to be common ground.

The reason for this was more political than emotional; some nations considered a global ban on these practices to set a precedent that would later back them into a corner. This illustrates a considerable amount of distrust, and underscores exactly how difficult it will be to reach any truly substantial agreement.

The difference in culture, political environment and -more to the point- the views on human rights in countries such as China, Russia and Iran when compared to western nations explains quite well why they would be opposed to any treaty that directly or indirectly influences (or condemns) practices that are commonplace there.

For instance, the right to uncensored internet access for citizens, that we take for granted in the Netherlands, is virtually unthinkable in China.

And that is hardly the only example. China and Russia both have a considerable history of co-opting or coercing ‘uncontrolled’ organizations such as organized crime to execute politically motivated attacks.

Totalitarian regimes generally have much greater control over their populace than democratic societies, and this also extends to criminal elements inside its borders. To co-opt or coerce them into performing tasks that a government cannot be seen doing has the benefit of plausible deniability.

After all, an entire nation cannot be held accountable for its’ rogue elements, can it?

But that is far from the only hot topic on the table. Perhaps the most critical issue discussed there is the ongoing struggle for high-level control of the Internet. From a technical standpoint, part of that control currently lies with ICANN, the nonprofit (civilian) organization responsible for the management of Assigned Names and Numbers (or rather: DNS and global Top Level Domains such as .org, .com and .gov).

ICANN also steers IANA, which is responsible for assigning numbers (IP addresses) to names (DNS). Both of these organizations are American, though not formally controlled by the US government. So far, and with a few notable exceptions, they have been doing their work seemingly without undue governmental influence.

But, no doubt due to political pressure on the subject, the US government has relinquished stewardship of ICANN. As of this year, another steward will take the wheel.

And Governmental Influence is exactly the key issue. More on that in the next installment…

Using the Cyber Kill Chain to Map Cyber Defenses with Practical Reality

Cyber Kill ChainIn an effort to better understand the structure and approach of “APT Attacks”, which was at the time virtually a euphemism for cyber-attacks coming from China, researchers investigated hundreds of successful incursions into networks.  The professional air to the attacks that was long suspected was confirmed, as all attacks followed the same 7-step procedure: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control and finally Actions on Objectives. It was dubbed the ‘Cyber Kill Chain’, and it has since been all the rage.

Cyber Kill Chain

Figure 1: The Cyber Kill Chain

As an interesting side-note: Defense contractor Lockheed Martin claims it as their own work, first presented in 2011, but this claim is demonstrably incorrect. Jeffrey Carr, well known for running OSINT project Grey Goose, which gathered intelligence on the cyber-attacks against Georgia in 2008 and provided strong evidence of Russian involvement, coined the phrase in that same year. I personally attended a lecture at Hacker Halted in Miami around that same time where the Cyber Kill Chain was explained in great detail. While the contact details of the speaker in question have sadly faded from my memory, I can in fact confirm that both the term and the content of that term existed well before 2011, as claimed by Lockheed Martin.

 

The 7 phases, or steps, cover the following procedures:

Reconnaissance
During the Reconnaissance phase, the attacker (or attacking team) collects as much information on the target as possible. Some of this gathering is passive, meaning the target defender cannot detect this collection of data, but some are active and may be detected by someone looking for such signs. Active gathering attempts include gathering any valid email address belonging to the targeted organization, looking up which IP address blocks are registered to the target, what domains are registered by the target, who works for the company (through social media such as LinkedIn) et cetera. Active reconnaissance may include exploring weaknesses in the public-facing websites such as SQL Injection, or port scanning various systems (very cautiously, so as not to trip sensors) to obtain banner information that gives away exactly what kind of system is answering.

 

Weaponization
In this stage the information that was gathered earlier is turned into specialized weaponry. Malware that is effective against the systems of the target is wrapped into files that are most likely to be opened by the unsuspecting target, such as PDF or Word files.

 

Delivery
The customized weaponry is then sent to the target by the most practical and effective means, which can include sending it by email, placing it on a USB stick which is then dropped near a target employee who is likely to insert it into his or her system, or target employees are lured to a specially prepared malicious website from where the target employee will be infected.

 

Exploitation
Once delivered and opened by the target victim, the malware is executed. This exploits one or more weaknesses in the user system. The ‘payload’ of the malware is then deployed onto the system through this weakness. Most commonly the exploit used will yield the attacker the highest privileges on the system (Administrator or Root access), and clear the way to install various malicious tools.

 

Installation
The malware ‘payload’ can consist of a variety of malicious applications. What is installed on the target system is at the discretion of the attacker. Most deployed is a variant of a Remote Administration Tool (RAT) that gives the attacker the opportunity to take complete control of the target system. Also popular are keyloggers to log everything the user types, and ‘downloaders’ that then go on to download more elaborate malware onto the target system. Almost all attackers make use of ‘rootkits’, which has the express task of permanently burrowing into the target system and hiding its presence for defensive applications such as antivirus products. Once this is done, it is especially difficult to discover whether a system has been compromised, and the only reliable way to ensure its removal is a complete re-install of the target system.

 

Command & Control
Once the foothold has been created in the target network via the initial attack, the attacker will use that system to further explore the network around the compromised system. Because the target system is generally assumed to be ‘trusted’, the defenses inside the network tend to be much less stringent, and such exploration can yield an incredible amount of information. The attacker carefully selects other systems to compromise and ‘pivots’ his way through the target network from one compromised system to the next, until a solid Command & Control network is established through which the attacker can enter the network at will.

 

Actions on Objectives
At this final stage, the attacker executes any action that is required to reach their objectives. This can be stealing of data, corrupting of systems or even the simple act of listening in on what is going on in the network. It is at the sole discretion of the attacker until the compromise is detected. In many registered cases this has been anywhere between 6 months to 1.5 years.

 

Aside from being useful in gaining insight of how structured cyber-attacks generally work, it is also quite a useful tool for hammering patchwork security defenses into a sensible and practically effective whole. This becomes clear once we put the steps on a timeline, and show where the first point of active contact with the target network is; shown in Figure 2 as t0. Also shown is where defenders have reactive defenses, indicated by the marked area to the right.

Cyber Kill Chain Timeline internal-external

Figure 2: The Cyber Kill Chain on a timeline

 With this information we can map out what countermeasures are most effective against each of the 7 phases. Each phase can be taken as one layer of defenses. When done so, the countermeasures that are most effective against the actions undertaken by the attacker become part of a cohesive defensive strategy with very little overlap. It is also an excellent way to estimate whether a new defensive measure will add additional value to ones’ overall strategy. The strategy would then look like Figure 3 shown below.

Cyber Kill Chain versus Countermeasures

Figure 3 Defensive layers per phase

 Per phase in the Cyber Kill Chain the following defenses can be undertaken. Please note that this list is by no means exhaustive; the intent is to illustrate how countermeasures address the steps of the attack methodology.

Reconnaissance
Because this phase is all about gathering information about the target network, good countermeasures revolve around denying the attacker information, or to provide false information.

  • Applying “cyber hygiene” to websites (limit the amount of email addresses on external websites etc);
  • Obfuscating banner information of externally reachable servers and services so that attackers receive no –or false- information when probing;
  • ‘Anonymizing’ information on IP ranges owned by the company;
  • Running awareness programs to limit sensitive information posted on social media by the staff;
  • Request any running (or planned) penetration testing programs to scan especially for system-identifying information gained. The systems broadcasting this information can be modified to provide different (or no) information.

 

Weaponization
Large portions of this phase are passive, meaning they are executed on systems belonging to the attacker. This makes it difficult to directly influence, let alone counter-act. The countermeasures that are most effective for this phase are also part of the Delivery phase.

 

Delivery
Delivery is only successful when the recipient accepts. Successful countermeasures in this layer interrupt this process.

  • Security Awareness training for the staff focusing on not picking up USB devices they found, not blindly open any documents they did not expect or click links in emails or text messages (including WhatsApp or other mobile messaging);
  • Malware scanning on email;
  • Next-Generation Firewalls protecting the access to the network;
  • Use of security hardened applications for popular malware delivery vehicles such as the Fox-It Reader or, for internet browsing, secure browsers such as Google Chrome or its security-minded offspring Aviator;
  • Next-generation malware protection software;
  • Blocking the use of USB drives on user systems (physical, logical or both);
  • Proactive blocking user access to identified malicious URL’s.

 

Exploitation

  • Structural security updates and patch management to minimize attack surface;
  • System hardening in the area of reducing the number of running services, to reduce the attack surface;
  • Next-generation anti-virus or anti-malware software that runs applications in a secure sandbox before executing on the actual user system, such as Palo Alto Wildfire or FireEye;

 

Installation

  • System hardening in the area of privilege escalation prevention, which may include modifying settings in the system back-end infrastructure such as Microsoft Active Directory;
  • Specialized software to prevent further damage after malware infection such as Microsoft EMET;
  • System configuration detection mechanisms such as Tripwire;
  • Application whitelisting to block installation of non-approved software;
  • Removal of Local Administrator rights for the users.

 

Command & Control

Establishing Command & Control inside a network involves basic repeats of the previous steps until all useful systems are equally compromised and backdoor access can be guaranteed. This means that above countermeasures should be implemented across the board, not just at edge systems. On top of that, the following countermeasures provide additional value:

  • Internal network monitoring with anomaly detection or internal next-generation firewalls with DPI capability and a measure of network intelligence;
  • Network segmentation between security levels (VRF-like technology has preference over VLAN tagging);
  • 802.1x Network Access Control (preferably based on certificates) on all systems;
  • End-to-end encryption between all systems to prevent network sniffing (where feasible, with respect to performance).

 

Action on Objectives
Due to the fact that every foe has its own agenda, the countermeasures here must be especially tailored to the nature of the defending party. R&D-oriented firms generally focus on theft of intellectual property, where enterprises in the Critical Infrastructure sector tend to focus on service interruptions. Their countermeasures should be tuned to fit the defenders’ business concerns.

  • Scanning of outbound network traffic to detect data exfiltration and other anomalous traffic patterns;
  • Four-eyes principle programs embedded in critical operations;
  • Identity & Access management tooling with approval flows;
  • Data-at-rest encryption schemes;
  • Data Vaults for storing of critical data.

The list of countermeasures is already considerable in these examples, but many more can be found at each phase. Some are overlapping and some will provide added security to multiple phases; naturally it is up to the security strategist or architect to determine what set of security measures provides the most value to the organization.

Information Security, Post-Snowden

As published on Tripwire’s State of Security:

The revelations regarding the extensive digital intelligence gathering programs of the American National Security Agency by Edward Snowden won’t have escaped your notice. Since the first reports around June 5th of 2013, the hits have not stopped coming; each consecutive unveiling being of larger scale, depth and intensity than its predecessor.

It is interesting to note that Snowden was hardly the first whistleblower on the massive internet espionage operation by the US government. On January 20th 2006 an employee of AT&T approached the Electronic Frontier Foundation (EFF) with proof that AT&T was cooperating in an NSA intelligence program and on july 2nd 2012 three NSA employees shored up a lawsuit by that same organisation.

The facts are hard to ignore: wiretapping heads of state[1], allied or not[2], hacking telecom corporations[3], large scale internet wiretapping[4] and forcing American technology firms to provide access to customer information[5] or worse: building a backdoor into their products[6]. Summing matters up sometimes stretches the bounds of credibility.

As Jacob Appelbaum put it during his talk at the German CCC conference late last year, the NSA´s operations have really only been limited by Time. Had Snowden waited another year, chances are that we would have seen even bigger programs come to the surface. And perhaps we still might; if Snowden is to be believed we haven’t seen the last of his work.

The impact on our online privacy is consistently mentioned by the various news media. Organisations of all sizes and nationalities are asking themselves just how safe their data is. Do they have unwanted American visitors on their network? How are they going to keep out the NSA? Or other intelligence agencies? Cán you keep them out at all?

In my opinion, these questions aren´t simply valid, but due to the immensity and depth of these intelligence gathering programs and the long list of involved corporations, a considerable bit of research should be more than warranted.

Thanks to Snowden´s revelations we have enough material to make three assumptions:

  • Virtually all the internet traffic is tapped. Because it’s not just the NSA spying on internet traffic but –to varying degree- almost every national intelligence agency on the planet, there is a reasonable degree of certainty that all of our traffic is intercepted and looked at, regardless of where it´s going or where its´ coming from. In case you´re wondering, this certainly includes smartphone traffic.
  • American and British hardware (laptops, desktops, servers, USB devices, mice, keyboards, smartphones et cetera) are very likely all compromised by a backdoor through which remote access can be obtained. If it hasn´t been built in during fabrication, it could still be inserted during transportation, with the aid of transportation firms[7]. For safety sake it is reasonable to assume that Canadian, Australian and New Zealand firms are performing such tasks for their respective intelligence agencies as well, given that these countries are also part of the Five Eyes intelligence gathering pact between the US, UK, Canada, Australia and New Zealand.
  • We cannot trust American technology firms. It is unfortunate for those that haven´t been compromised, but due to American anti-terrorism laws you simply cannot trust them you’re your data. Whether they are paid or forced to cooperate is, in the end, unimportant for you; they willprovide the NSA with intelligence or build those backdoors into their products that are so prevalent and so desired. Your data simply isn´t safe with American online service providers, and thanks to the PATRIOT act it doesn´t even matter if the data itself is on US soil or not. It also doesn´t matter if you are not American. Or if you´re a citizen of an allied country. The American justice system pretty much completely ignores non-citizens and as such, virtually everything done to your data is considered legal. Your data can be reached and inspected regardless of where it resides, and they do it on a shockingly large scale. Here too, it would be wise to lump British, Australian, New Zealand and Canadian firms in on this.

And its not just US firms that have been exploited in such a fashion. Among the firms on the list below you will also see enterprises that have a lot to lose if banned from the American technology market, such as Samsung. Lets put some names to faces. Do you have products in your network or at home that are made by these companies?

Then you almost certainly have a backdoor into your network through which the NSA can enter your network unseen. Perhaps more than one. And now that it is public knowledge that these backdoors exist, it is highly likely that they are exploitable by other parties as well.

pic

The US is, thanks to strong representation in the Technology market, in a very comfortable position where gaining remote access is concerned. This doesn’t stop other nations from attempting the same level of access or intelligence, and quite successfully.

China, Russia and Iran also developed strong Cyber programs of which digital espionage is a substantial element. Closer to home the French DGSE was embarrassed by sudden publication of their own cyber espionage program, not a week after they publicly denounced such practices. Israel has also been known to have a very effective digital intelligence gathering program.

If you still have doubts about whether or not you might be compromised, the EFF has published an electronic file[8] containing exactly what vendors and their respective products give unwanted access to commercial networks. You will encounter the term “persistent backdoor” very often, which means that there is a built-in back door in the product through which unauthorised access to the network is easily attained.

They work virtually the same as the software companies install so that their employees can work from home, with the notable exception that your organisation doesn’t know, support or condone about this ‘feature’ of the products they installed and considered safe.

So why should companies care about this? You’ll often hear the argument that such programs revolve around national security, and is an affair between nation states, not commerce. And yet there have been several cases that show that this is certainly not always the case. Information obtained by national espionage programs can easily be used to great commercial advantage.

There are some prime examples in which national intelligence agencies provided firms with information that gave them a competitive advantage during critical moments while competing with foreign competitors, such as during the negotiations of lucrative contracts. On July 5th 2000 the European Parliament launched an investigation into contract negotiations taking place in Brasil in 1994.

In this case the French firm Thomson-CSF lost a contract to the American defence contractor Raytheon to a tune of $1.3 billion because Raytheon had received crucial information intercepted by an American intelligence agency. In 2000, aircraft manufacturer Airbus lost a Saudi contract worth $6 billion to American firms Boeing and McDonnell Douglas in equal fashion.

Both these incidents took place during the ECHELON program, an earlier iteration of the PRISM program that we have heard so much about in recent months. The amount of data that is being intercepted and monitored makes the ECHELON program pale in comparison.n

Whether you do business internationally or not, having intruders on your networks and mobile devices are almost certainly unwanted. There are ways to defend yourself, but depending on which hardware and software you are using, you may have to start looking for different vendors offering similar products.

This isn’t always practical. Imagine replacing Microsoft Windows with a Linux distribution on all of your systems. This may not be feasible due to lack of staff capable of supporting Linux. Replacing servers, desktops, laptops or networking equipment with equivalent products made by vendors of a different nationality can be difficult, but you could still take steps in the right direction.

For instance, if you are currently using remote access tokens by RSA[9], you may want to consider replacing them. By its very nature, remote access technology is an exceptionally critical service that can immediately defeat all of your network security measures. Whether you will be safe after a full overhaul of your network will likely always remain a mystery; Snowden or some other whistleblower might implicate yet more firms that are complicit with national intelligence agencies.

To have a realistic chance at securing your network, it must be capable of segmenting your various suppliers and vendors. Ideally your network architecture is designed in such a way that no single vendor or supplier can compromise the entire network by itself.

Outsourcing your data or network services to a cloud provider is equally a hazardous idea. You have to be absolutely assured that your provider does not store your data outside your nation’s borders, which would open up avenues for foreign entities to gain access. Most nations have laws in place for their intelligence and law enforcement agencies to obtaining access to systems within their sovereign territory with or without the consent of its owner.

If you have assured yourself that your cloud provider won’t suddenly change its policy. Be aware that most of the firms implicated by Snowden have kept -or have been forced to keep- silent about their assistance to the NSA. If your privacy has been violated, you may learn of it much too late or not at all.

Also, it is critical that you encrypt your data. This includes both data in transit and data at rest, so the smart move is to not leave any data unencrypted on online services such as Dropbox. Be sure to use encryption that is not commonly used on the Internet, or made by any of the implicated firms listed above.

The NSA, and more than likely many intelligence agencies with them, is especially capable of cracking the most used encryption methods such as SSL[10] (Secure HTTP, which ensures that well-known lock icon in front of a web address in your browser). Custom, strong and domestically made crypto technology is the best choice to protect both your network traffic as well as encrypting data storage devices[11].

Finally, it is important that you have a strong identity & access management program. None of the measures above amount to very much if an employee or supplier has access to your network and happily provides this access to a third party with bad intentions.

Protecting information today is more complex than before. To have a chance at keeping unwanted visitors off your network tomorrow, you must lay the foundation today. Although this can be a considerable undertaking, you can at least be assured that it will not get any easier. The time of leaning back casually without having to worry about security has certainly passed.

picAbout the Author:  Don Eijndhoven (@ArgentConsulting), Chief Executive Officer of Argent Consulting B.V, lead cyber security architect and guest lecturer Cyber Resillience at the Nyenrode Business University. Don can be reached at d.eijndhoven@argentconsulting.nl.

Argent Consulting buys B-Able Argent Consulting

PRESS STATEMENT

Monday, 26th May 2014. The Netherlands: Due to insurmountable differences among management, the joint effort between Argent Consulting and B-Able, dubbed “B-Able Argent Consulting” has been terminated. Argent Consulting has bought out the remaining shares and will fulfill existing contracts until their natural termination. The Argent Consulting brand will return to the field in full force; offering new and revised products and services in the global Cyber industry.

Argent Consulting’s CEO Don Eijndhoven had this to say: “The joint venture was entered into based on an estimation of overlap of skills and services between Cyber Security and the more established field of Information Security. We expected a much more receptive customer base but there wasn’t sufficient foundation to work on. In short, the alliance wasn’t as fruitful as we hoped it would be. While this is regrettable, there was also good news: In the Cyber realm we did, and continue to, perform excellently. Having landed several prestigious consultancy contracts with global NASDAQ-listed firms, our core business scores very well and we are going to keep advancing in this strategic direction under the Argent Consulting flag.”

PRISM: Tip of the Cyber Intel Iceberg

PRISM Slide 1When Edward Snowden published information on PRISM – a rather drastic intelligence gathering program in which several (assume All) government agencies such as the FBI and the NSA draw intelligence from major tech companies such as Microsoft, Skype and Facebook – he was immediately revered and reviled by the general populace. Especially within the US armed forces community, the general sentiment seems to be that he’s a traitor and someone needs to go fetch a rope. But really, how much of this is new or even unexpected?

Right after the 2nd World War in March of 1946, a multilateral agreement between the UK, the US, Canada, Australia and New Zealand was signed in which they agreed to cooperate and share intelligence. This was originally intended to be mostly Signals intelligence, but has long since been extended to include much more. This intelligence alliance between those five nations has become known as Five Eyes. It was a secret treaty (allegedly even kept from the Australian PM’s until ’73) but has been exposed for quite some time now. In fact, Canadian Brigadier-General James S. Cox (RET) wrote a rather salacious paper on this treaty, and to illustrate just how well this treaty is working out can be gleaned from the following paragraph in the executive summary of said paper (emphasis mine):

 “The Five Eyes intelligence community grew out of twentieth-century British-American intelligence cooperation. While not monolithic; the group is more cohesive than generally known. Rather than being centrally choreographed, the Five Eyes group is more of a cooperative, complex network of linked autonomous intelligence agencies, interacting with an affinity strengthened by a profound sense of confidence in each other and a degree of professional trust so strong as to be unique in the world.” – “Canada and the Five Eyes Intelligence Community” by Brig-Gen James S. Cox (RET).

This profound sense of confidence in each other likely stems from the fact that they’ve been doing this for over 60 years, and I would hazard that this partnership has had its strength tested a few times. Successfully, from the looks of it. Either way, I think it is a safe assumption that the UK, Canada, New Zealand and Australia are as much to blame for PRISM as the Americans. Funny how none of them have mentioned their unfettered access to this raw data, hmm?

What boggles my mind is how little people seem to care. Maybe the name ECHELON rings a bell? This was an expansion on collection and analysis in the 60’s to this same Five Eyes program. I should stress that the actual gathered (and shared) intelligence included much more than just signals intelligence. We’re talking raw internet data. Raw, meaning absolutely everything that passed through, without any kind of filter. If you said it through any kind of internet-connected medium, through any American provider, service or product, you have definitely been logged there. And even not using any of said American providers, services or products, your traffic could still have been routed through PRISM, depending on where you are, where the servers are that you connected with, or how traffic was routed. And that’s just assuming that this traffic was really only collected in the US, which may not be the case now that we’ve established that at least 4 other countries were actively in on this program.

Now that we’ve firmly established the “who” part of this whodunit –or at least establish who benefits-, its time to look a little closer at what happened.

So what happened with PRISM?
Simply put, since somewhere as early as 2007 the various US intelligence and Law Enforcement agencies used the law to gain access to information harvested by tech giants such as Microsoft, Google, Apple, Yahoo, Facebook, Skype and Youtube. This means that they had access to a multitude of heavily used social media sites such as Facebook, Skype, Twitter and Youtube, but also cloud services such as iCloud, Google Drive and Dropbox. This was all done legally under US laws. Their alleged goal was to monitor foreign communications that take place on US servers, but of course it couldn’t hurt that what they collected included everything under the virtual sun – including stuff on American citizens and US allies.

Edward Snowden brought to light just exactly what is going on, and how it’s done. For those of us who have an IT-technical background, it doesn’t take much imagination. It can be done easily, and not to my surprise, this is what they did. Snowden published a PowerPoint presentation containing 41 slides on this, but interestingly only 5 of those slides were published. The remaining slides are, apparently, so “hot” that nobody wants to burn themselves by publishing it. Both the Guardian’s Glenn Greenwald and the Post’s Barton Gellman have made it clear that the rest of the PowerPoint is dynamite stuff which we’re not going to be seeing any time soon. “If you saw all the slides you wouldn’t publish them,” wrote Gellman on Twitter, adding in a second tweet: “I know a few absolutists, but most people would want to defer judgment if they didn’t know the full contents.”. I think that I speak for most Europeans when I say that I disagree strongly with Gellman, and would very much like to see the remaining slides.

Although the slides that have been published can be easily found without my help, I would be remiss in not adding them here for your enjoyment. Much of the international outrage can be explained by these pictures. And by outrage, I mean by the people, not the other governments. Any outrage on their behalf is geopolitical theatre, because every government in the world is either doing this, or would very much like to. You only have to look at the recently unveiled DGSE (French secret service) surveillance program which operates in exactly the same vein as PRISM.

Without further ado, here are the slides that were published from Snowden’s originally 41 slides:

PRISM Slide 1

 

PRISM Slide 2

 

PRISM Slide 3

 

PRISM Slide 4

 

PRISM Slide 5

 

UPDATE
My apologies. Apparently I had missed the release of 4 more slides by Washington Post around July 1st. Unfortunately these slides don’t really do much but add to the confusion. Nevertheless I would like to share these with you too.

prism slide 6

 

 

prism slide 7

 

prism slide 8

 

prism slide 9

The Chilling State of Cyber Affairs

CWWith all the attention pointed towards PRISM, another interesting publication was virtually overlooked. Earlier last month, a taskforce belonging to the US DoD’s Defense Science Board (DSB) released a final report titled “Resilient Military Systems and the Advanced Cyber Threat” [PDF], that reports on the findings of an 18-month research project. The DSB is a committee of civilian experts that is to advise the US DoD on scientific and technical matters. I just threw that line in here to point out that this committee is staffed by individual civilians and not representatives of the industrial military complex. This is worth mentioning, because a good portion of the report is absolutely riveting in its description of how bad they think the situation is, and this is automatically bound to become a target for those people who still don’t believe in Cyber Warfare. The report starts off with a sentiment many of us will find reasonable, and applying to cyber security as a whole (as opposed to cyber warfare specifically):

Cyber is a complicated domain. There is no silver bullet that will eliminate the threats inherent to leveraging cyber as a force multiplier, and it is impossible to completely defend against the most sophisticated cyber attacks. However, solving this problem is analogous to complex national security and military strategy challenges of the past, such as the counter U-boat strategy in WWII and nuclear deterrence in the Cold War. The risks involved with these challenges were never driven to zero, but through broad systems engineering of a spectrum of techniques, the challenges were successfully contained and managed.”Mr. James R. Gosler & Mr. Lewis Von Thaer – Resilient Military Systems and the Advanced Cyber Threat.

In this same opening letter, some fairly damning statements are made. One of the most significant observations was that DoD Red Teams were defeating defending teams in exercises ‘with relative ease’ by hammering them with exploits and tools found on the internet. It also mentions that the DoD networks and systems have a weak cyber hygiene position, and even the Classified networks have experienced “staggering losses” in compromised data due to successful breaches (full quote to follow).

As an aside it is mentioned that in general, security practices have not kept up with adversarial tactics and capabilities. This statement is significant because of the context it is placed in. You see, the DoD security practices are fairly solid and, in general, followed quite well. These are the same (though possibly more stringent) security practices they teach infosec practitioners in certifications such as CISSP and apparently they don’t work anymore.

The report has a long list of very interesting little factoids, but the following list of bulletpoints is a direct quote from the report:

  • “The cyber threat is serious, with potential consequences similar in some ways to the nuclear threat of the Cold War
  • The cyber threat is also insidious, enabling adversaries to access vast new channels of intelligence about critical U.S. enablers (operational and technical; military and industrial) that can threaten our national and economic security
  • Current DoD actions, though numerous, are fragmented. Thus, DoD is not prepared to defend against this threat
  • DoD red teams, using cyber attack tools which can be downloaded from the Internet, are very successful at defeating our systems
  • U.S. networks are built on inherently insecure architectures with increasing use of foreign-built components
  • U.S. intelligence against peer threats targeting DoD systems is inadequate
  • With present capabilities and technology it is not possible to defend with confidence against the most sophisticated cyber attacks
  • It will take years for the Department to build an effective response to the cyber threat to include elements of deterrence, mission assurance and offensive cyber capabilities.” – Resilient Military Systems and the Advanced Cyber Threat.

One has to wonder how much of these observations are grounded in actual fact, and what is part of the disinformation operation that is almost certainly running in the background somewhere. Regardless, there has been sharp criticism about this level of public disclosure. Should the US be publishing this information so openly? Why and to what end? Truth be told, it is hard to argue that the experience of publication is merely a positive one. You can be certain that every other nation on the planet is carefully pouring over every word, analyzing if weaknesses can be discovered. If the following quote is to believed, the US found plenty on their own:

 The DoD, and its contractor base are high priority targets that have sustained staggering losses of system design information incorporating years of combat knowledge and experience. <…> Perhaps even more significant, they gained insight to operational concepts and system use (e.g., which processes are automated and which are person controlled) developed from decades of U.S. operational and developmental experience—the type of information that cannot simply be recreated in a laboratory or factory environment. Such information provides tremendous benefit to an adversary, shortening time for development of countermeasures by years.Resilient Military Systems and the Advanced Cyber Threat.

And of course, the US faces challenges in the Cyber arena that few other players will ever encounter because of the high costs associated with it. I am speaking, of course, of Supply Chain Security – also known as Hardware Hacking. In 2010, the 2nd International Conference on Information Engineering and Computer Science (ICIECS), published an article titled “Towards Hardware Trojan: Problem Analysis and Trojan Simulation” authored by members of the Zhengzhou Institute of Information Science and Technology in China, which outlined the technical approach elements for developing covertly modified hardware.

A successful corruption in an enemy’s supply chain which manages to insert malicious chips onto say, a desktop or server, would evade all security measures installed on said device. Only a particularly well tuned (and carefully looked at) network monitor would have a chance at picking up the phone-home signal or, in case of a successful intrusion, the data exfiltration itself. Given the costs associated with supply chain corruption, it would be a very safe bet that the utmost effort is done to hide any outbound traffic or to make it seem innocuous enough that you miss it when investigating. You would need a really excellent understanding of your network traffic to spot traffic that wants to stay hidden.

The entire DSB report contains so much interesting information that I couldn’t possibly put all of it in one article. One last tidbit that I would like to include here, is a quote that contains some of the ideas I wrote about in my very first article on Cyber Warfare (emphasis below is mine).

The benefits to an attacker using cyber exploits are potentially spectacular. Should the United States find itself in a full-scale conflict with a peer adversary, attacks would be expected to include denial of service, data corruption, supply chain corruption, traitorous insiders, kinetic and related non-kinetic attacks at all altitudes from underwater to space. U.S. guns, missiles, and bombs may not fire, or may be directed against our own troops. Resupply, including food, water, ammunition, and fuel may not arrive when or where needed. Military Commanders may rapidly lose trust in the information and ability to control U.S. systems and forces. Once lost, that trust is very difficult to regain.” 

The impact of a destructive cyber attack on the civilian population would be even greater with no electricity, money, communications, TV, radio, or fuel (electrically pumped). In a short time, food and medicine distribution systems would be ineffective; transportation would fail or become so chaotic as to be useless. Law enforcement, medical staff, and emergency personnel capabilities could be expected to be barely functional in the short term and dysfunctional over sustained periods. If the attack’s effects were reversible, damage could be limited to an impact equivalent to a power outage lasting a few days. If an attack’s effects cause physical damage to control systems, pumps, engines, generators, controllers, etc., the unavailability of parts and manufacturing capacity could mean months to years are required to rebuild and reestablish basic infrastructure operation“. – Resilient Military Systems and the Advanced Cyber Threat.

There really isn’t more I could add to this. I have no doubt that development on offensive cyber capabilities will continue and the next decade will bring about possibilities we can only dream of now. With this build-up of virtual arms between the worlds’ largest nations, a comparison with the Cold War is hard to avoid. Lets just hope cooler heads will prevail again.

On Iran and Pre-Emptive Cyber Attacks

irancyberEarly in February of 2013, many news outlets came out with articles about the US Government having a ‘secret legal review‘ on the use of its cyber-arsenal. This legal review concluded that the US government could launch a cyber attack against a threatening nation if the country needed to defend itself. Essentially it boils down to ‘legitimately’ having the power to order a pre-emptive cyber attack, even though only the President himself can authorise such an attack.  As many nations are developing their own Cyber program, and some nations are very actively using cyber attacks to get a definite leg up, nobody really expected any other outcome. A very damning report by Mandiant on “APT1” recently emphasised yet again how professional and broad-scoped China’s cyber espionage apparatus has become, and the United States finds itself a major target in these operations. Even though this same report is heavily criticized by experts for having critical analytical faults, it is hard to deny that Cyber is still increasing in overall popularity on the world’s geopolitical stage.

Some say that this ‘right to strike pre-emptively’ is a warning shot across the bow of China, but it cannot be said that it is a timely revelation in any respect. After all, not having formally asserted this right to strike pre-emptively did not deter the cyber attack against Iran’s nuclear enrichment facilities in Natanz, which was devised during the Bush Jr. administration but was executed under Obama. A cynical view might take that to mean that not one, but two separate administrations had already asserted that right years before. Also, even though it was never confirmed officially, the Washington Post published an article in 2012 that claimed Flame, a piece of malware dubbed the successor to Stuxnet, was also developed by the US government years before, and launched against Iran in roughly the same period of time, also with the intent of slowing down Iran’s nuclear enrichment program.

What makes this all especially interesting is the recent publication of the Tallinn Manual on the International Law Applicable to Cyber Warfare, as commissioned by NATO’s Cooperative Cyber Defence Center of Excellence in Estonia. It’s lead author, Michael D. Schmitt, is also a professor of international law at the US Naval War College in Newport. In a recent interview with the Washington Times professor Schmitt revealed that the collective of authors who worked on the Tallinn Manual were of the opinion that the Stuxnet attack was indeed an Act of Force. These are “Acts that kill or injure persons or destroy or damage objects are unambiguously uses of force”. This is significant because it means that by the opinion of the worlds leading legal minds on Cyber Law (lead by an American, no less), Iran has a legitimate legal reason to declare war against the United States. I should point out that the reverse is not the case, even ifIran is actively seeking nuclear weapons (which does seem likely, seeing as how it would level the geopolitical playing field for them).

Given the already volatile nature of the Middle East as a whole, you’d have to wonder if cyber weapons are a blessing or a curse. The threshold to their use seems to be significantly lower than kinetic means, but this –in turn- may quickly give legitimate claim to escalate matters into the kinetic spectrum. Whatever else may happen, on this front it will be a most interesting decade.