Sanity on Cyber War

ThreatsWatch.Org: PrincipalAnalysis: Sanity on Cyber War: "Much has been made about the electronic fight that occurred alongside the physical one between Russia and Georgia. Predictably, talk of “cyber war” and the dawn of a new age of conflict abounds. Never mind that we have seen this before: China vs. Taiwan over Taiwanese independence; China vs. the US over various issues; Islamist Groups vs. the US during operations IRAQI and ENDURING FREEDOM; Serbia vs. the US and NATO during ALLIED FORCE, and numerous other conflicts. Then, as now, we see that conflict in cyber space falls far short of apocalyptic.

To be sure, there are serious threats in cyber space. Chinese intrusions into government, military and commercial networks are legion, but this has been going on more or less unabated for years. Few remember that it was Russian intelligence that used German proxies to break into the networks at a national lab … in the 80s. Whether we are talking about state-sponsored activities or criminal practice, there is a common thread: the need to have the ‘Net up in order to make things happen. This is why cyber war, as many envision it, is a fantasy.

For the sake of argument though, let’s assume there was a threat actor that did want to destroy or degrade the ‘Net – or at least off of our portion of it – for military gain. A quick search online for an Internet traffic map illustrates the folly of the concept of cyber space sovereignty. Georgia’s status as a “cyber locked” country – only one way in and out electronically – is something of an anomaly; generally speaking you cannot just take country X off-line and leave innocents untouched. For some belligerents this might not be an issue, but unless you’re declaring war on the world it make sense to limit potential counter-attackers (true in both the virtual and actual worlds).

Recent discussions on the threat of an Electro Magnetic Pulse (EMP) cannot be ignored here, but some perspective is in order. If an adversary detonates a nuke in the atmosphere over the US, we’ve probably got one or two more issues to deal with before we get around to restoring everyone’s Facebook page. The equipment and power necessary to cause the same effect without a nuke would be, well, about as obvious as a large wooden horse parked outside your door. Not having the ‘Net during such a crisis would hinder recovery, as the ad hoc construction of support and recovery web sites after Hurricane Katrinia and other disasters demonstrated. But catastrophic electronic attack is still largely recoverable and bloodless, unlike the analog in meat space.

Serious analysts of these issues talk about an adversary’s capabilities and do not use “cyber” as an adjective in front of every physical-world equivalent. Why? Because the means isn’t as important as the impact.

Take terrorism for example. Who is terrorized when terrorists or their sympathizers take down a web site? No one. What threat does a terrorist group that launches attacks that were new five years ago pose? Not much. Terrorists do a lot of things online, but fight well is not one of them. Nation-states have much more significant capabilities, but going back to an earlier point about espionage, they are having much more success exfiltrating data to risk destroying the source of said data. Exploiting your adversary’s networks and systems is this age’s neutron bomb; all the pesky people (and potential insurgents) are gone, all the goodies are left to plunder.

There is a reason why few in the kinetic war business take cyber war seriously: people don’t die (that might change soon enough for some), property is easily recovered, territory is not lost, and sovereignty is not threatened. One could argue that in the Estonia example a mode of operation was threatened, but certainly not their way of life or culture. Radovan Karadzic is in the Hague to face charges of war crimes; Dragan Vasiljkovic, who reportedly led Serbian cyber attacks while his colleagues conducted more visceral ones, is not exactly on the fast track for the gallows. I am fairly sure the widows of Srebrenica would have loved to have suffered at the hands of e-brigands vice the real sort.

In fact it is precisely this attitude that “it’s just data” that is the greatest hindrance to success in defending digital assets and having related disciplines taken seriously in a military context. No government official or corporate executive will admit it, but bits play second fiddle to hard assets. No amount of arguing about the nexus of the two, or how you can hardly use the latter without the former makes headway. It is why NIPRnet is consistently owned by various adversaries; why external viruses penetrate internal networks, and why millions of dollars worth of data can be traded illicitly over the ether largely without consequence. When those at the top don’t get it, the best we can hope for is re-action (to the next attack or embarrassment).

As a practitioner in this field for many years it is interesting to note the cycle of hype, spending, work and stagnation that occurs about every ten years. In all that time there has been no great leap forward in defense or security though attacks have gotten more sophisticated, diverse and powerful. Debating the need for an e-weapons proliferation scheme - as if one could regulate computer code as one does fissile material – is what passes for serious thought. There is also a strive to make all of this “new,” when in reality I can pull a nearly 30-year-old book off of my library shelf that documents the same sorts of events we are witnessing today.

Cyber space is a dangerous place, and it always has been, but we need to be preparing for war: period. Every conflict will have a cyber component too it; the next war will not be exclusively electronic. To steal a phrase from the Infantry: If they’re not there, you don’t own it. The Russia-Georgia “cyber war” is only an issue because the Russian Army is physically sitting in Georgia. Absent that, cyber war to date is largely just nationally-motivated digital graffiti. "

Information Warfare: The Spawn of Storm Rides Again

Information Warfare: The Spawn of Storm Rides Again: "Are you one of those people who are getting several emails a day with 'Journalists shot in Georgia' in the subject line, and with a Georgia.zip file attachment? If so, don't open that that zip file, because you are being probed by the Spawn of Storm. That's as in the Storm computer virus, zombie computers and botherders.

We covered the Storm virus (the first one to use this kind of news hook) last year with There are several recent variants, like email alerts the appear to come from MSNBC or BBC, many recent ones including a link to some Georgia or Olympics related item. The original Storm virus was so named because the news hook was unusually harsh Winter storms in Europe.

Despite all the publicity Storm got, and efforts to shut it down, the criminal gangs that seek to grab control of your PC found that the Storm formula continued to work if you just changed the news item. And so it came to pass that the spawn of Storm mutated and continues to infect more PCs (usually with a trojan horse program, that is used for things like DDOS attacks to shut down web sites in Georgia.)"

Russia: Still Second Rate And Unloved

This talks about the fact that the Russians/Soviets have been in the planning stages for the war on Georgia for months and have incited the violence. They know they can get away with it because the UN is worthless and NATO has no teeth left. The US is the only country that can confront the Soviets and the American Left will do almost anything that their communist friends want them to. Traitors.

Of course, I have been called a traitor for thinking that America is great and should encourage the spread of Freedom as much as possible. It seems that the Left hates that kind of thinking. If you think that way, then you can piss off and leave my blog alone.

Russia: Still Second Rate And Unloved: "Still Second Rate And Unloved

August 20, 2008: The Russian military demonstrated great resourcefulness and innovation during its recent campaign in Georgia. This includes the strategic planning, because the war was a set up. Russia used only one infantry division for the invasion, and had held training exercises in July. The increased border violence by South Ossetian forces caused the Georgians think they could retake the lost (in 1991) province. Less than a day after the Georgian forces entered South Ossetia, the Russian force of over 20,000 troops (including combat experienced Chechen counter-terror units and North Ossetian militia groups) came in. The Georgians were not prepared for this, even though the Russians had been making a lot of noise, for weeks, on the Internet about the growing "crises" in South Ossetia. By August 8th, the Russian Cyber War preparations became evident, as most Georgian media and government web sites were shut down by Russian attacks. It was the Internet version of the blitzkrieg, and a blow to military and civilian morale in Georgia. But on the ground, the combat experience of the Russian troops quickly translated in defeats for inexperienced Georgian troops. Despite several years of training under the supervision of Israeli and American combat veterans, the Georgians were still not as effective as the Russians (who have been fighting in Chechnya for over a decade). Although the Georgian anti-aircraft units brought down some Russian jets, the Russians basically ruled the skies and used that to constantly pick apart Georgian units. It was Russian air power the prevented the Georgians from mounting an effective defense.

Russia told the UN that it would veto any UN attempt to pass resolutions urging Russia to hurry up and get out of Georgia. The Russian success in Georgia was very popular inside Russia, where there has been growing unhappiness over Russias loss of empire and superpower status in the early 1990s. Nationalist politicians are talking about rebuilding the empire. This could get tricky, and is one reason the Russians get so excited when another of their neighbors talks about joining NATO. That organization is designed for mutual defense. You attack one NATO member, you attack them all, and two of them (France left NATO in the 1960s, but is considered an associate member) have nuclear weapons. "

Cyber warfare: Examining the relationships

Good information about the cyberwar and how things need to change to help the US, and the world, adapt to it. I am not sure that all of this is possible in the current political climate, but all of it seems to make sense to me.

I will pray that our next government will actively work to provide the US and the world with more security. This President has worked towards it and lost his way in the constant slanders and attacks from the Left.

Cyber warfare: Examining the relationships: "...the concept of operations for computer network attack (CNA) needs to be broken out of the information operations (IO) hierarchy. It does not belong there. Much like the concepts of the use of armor to support troops in World War 1 was supplanted by new armor-cavalry concepts of operation, where the model changed towards infantry in support of armor, cyber operations take on new expanded roles beyond IO. CNA is but one element of cyber operations and kinetic effect through cyber operations. The highly hierarchical and brittle security models of command and control (C2) infrastructures in the military and corporate world reflect a target rich environment.

These brittle networks are reflected in the social and organizational structures, the physical and data communications, and the information dissemination and cognition models. Where defense has been studied, the offense task against these elements in societies where the asymmetric balance is against the United States, has not been truly considered. In general the third world is categorized as technologically inferior, the European and Pan Asian community as off limits, and domestic threats ignored. This would be great if everybody played their roles equally and allies didn’t spies on allies, and corporate espionage didn’t happen, and the world stage was a static environment. How much better to be prepared for cyber conflict before it happens."

Information Warfare: The Curious China Connection

I am getting more worried about the Chinese attacks and hackers! In a very real way, they might be more dangerous than the Muslim terrorists. If the terrorists need to be stopped, why not the hackers? I know that laws are scarce on line, but still, that means it is more open for actions to stop the hackers, too. Just send an EMP burst over China?

Information Warfare: The Curious China Connection: "The Curious China Connection

July 1, 2008: A recent analysis of web sites pushing malware (software that helps hackers steal data) revealed that half of them are connected with just ten ISPs (Internet Service Providers), and six of those ISPs are in China. This came as no surprise, as China has become the favorite hideout for Internet criminals.

There's just one catch. The Chinese Internet is highly policed by a special force of 30,000 secret police technicians. On the Chinese Internet, you don't do something the government does not want, at least not for long. So how do these criminals manage to survive on such a heavily policed portion of the Internet? It's no secret that a lot of Internet mischief comes out of China, with the tacit approval of the Chinese government. This includes vandalizing web sites of organizations that push democracy in China, or protest the restrictions on the Chinese Internet, or say anything the Chinese officials do not like. Whenever another country gets into a squabble with China, there's lots of hacking against that nations websites, particularly government. Most of the hackers can be traced back to China. The same pattern has been seen with numerous hacker attacks on government networks in Europe, India and North America. Apparently, if hackers are willing to "serve the state," they can find a safe haven in China.
"

Cold wars at sea - April 2008

China is a growing threat at sea and in Cyber space. A war with material might be forced by politics to be off the table, but why are they still allowed massive computers? Those super computers that the Clintons gave China back in the 1990s are being put to good use against our country! I hope they are proud.

ARMED FORCES JOURNAL - Cold wars at sea - April 2008: "It might be tempting to dismiss the U.S. Navy’s potential focus on China as a passing fad — part of the now-familiar phenomena of “China fever.” Another perspective holds that this focus can best be explained by a simple case of enemy deprivation syndrome. While there is a kernel of truth in both of these intellectual approaches, facts on, above and especially under the water increasingly belie these conclusions and demand serious attention from American strategists.

China has launched more than 36 new submarines since 1995 — far outpacing U.S. intelligence estimates from a decade ago. Additionally, supersonic indigenous cruise missiles, rumored development of an anti-ship ballistic missile, dynamic mine warfare and amphibious warfare programs, invigorated aerial maritime strike capabilities, as well as a variety of new, sleek and modern surface combatants, suggest a broad front effort by the People’s Liberation Army Navy.

The U.S. Navy, in partnership with the Marine Corps and Coast Guard, unveiled the new Maritime Strategy in October, but this document makes no mention of China and its dynamic naval development. This does not mean that the Navy can or should “set aside” the China question. Some informed critics have questioned whether the Navy was being honest with itself in considering the scope of"

Information Warfare: The Longer War Gets Worse

China. China. China.

Why is it that so many cyber attacks come from China? Why can't anyone do something about it? Why are the Media so quiet about this? This article is much longer than the snippet here. You need to whole thing if you want the bigger picture. It gets scary! I think I need a professional so sweep my computers for hidden nastiness...

Information Warfare: The Longer War Gets Worse: "Several U.S. legislators (from the House of Representatives) have complained that their computers were infected by eavesdropping software inserted by hackers traced back to China. There was a similar flap over two years ago. Back then, there was enough proof to know that China was behind the increasing number of Internet based attacks, but not enough to call China out on it."

FBI: China may use counterfeit Cisco routers to penetrate U.S. networks

More proof of the continuing CyberWar that China is waging against the world. What can we do about this threat? I would hate to lose my wonderful computers! As more information leaks out, I wonder if someone needs to set off an EMP burst high above China to set them back a little. In the meantime, I am trying to boycott anything from China.

World Tribune — FBI: China may use counterfeit Cisco routers to penetrate U.S. networks: "An FBI presentation states that China has counterfeited Cisco Systems network routers and may be using the equipment to penetrate U.S. government and private sector computer networks.

Federal authorities in February seized some 400 counterfeit Cisco Systems knockoffs worth $76 million. The equipment included routers, switches, gigabit interface converters and WAN interface cards.

Among the purchasers of the fake equipment were the U.S. Naval Academy, U.S. Naval Air Warfare Center, U.S. Naval Undersea Warfare Center, U.S. Air Base at Spangdahelm, Germany, the Bonneville Power Administration, General Services Administration, and the defense contractor Raytheon, which makes key missile and weapons systems."

Information Warfare: Belgium Hunts Chinese Oil Bandits

China is pretty much a leader in Cyber War and getting further ahead. I always wonder if amy of my computers are Chinese bots, and worry more every time I read stuff like this. Be safe!

Information Warfare: Belgium Hunts Chinese Oil Bandits: "Belgium Hunts Chinese Oil Bandits
May 15, 2008: Belgium is the latest country to alert its citizens of Cyber War attacks (or just criminal hacking attacks) coming out of China, and into Belgium. The most worrisome aspect of this are the targeted attacks against specific Belgian government officials, and key members of NATO and European Union (EU) in Brussels. The latter two organizations have their headquarters in Belgium. It was noted that some of these targeted attacks were further specialized in that they were looking for data on Belgian energy (usually oil) related projects in Africa. This sort of thing leaves investigators believing that the ultimate consumer of such information is the Chinese government. It's also possible that these are criminals stealing specific data for specific customers. That makes little difference to the victims, but is of interest to those trying to improve Internet security. You don't go after criminal hackers the same way to do a national Cyber War operation."

Information Warfare: Stealthy China Probes Alarmed India

China is conducting major probes of every country's cyber networks. When should Cyber Security be delegated to the diplomats and not to the security experts? If the Chinese shut down the world's networks, will the security experts or the politicians get the blame? I think I know.

Information Warfare: Stealthy China Probes Alarmed India: "Stealthy China Probes Alarmed India
May 10, 2008: Indian government and military Internet security officials have been comparing notes, and have raised the alarm about Internet based attacks, and suspicious activity, coming from China. Particularly worrying is the probing of India's Internet infrastructure. This is a sign that China is mapping the Indian Internet, a necessary prerequisite to taking it down in wartime, or tampering with it in peacetime.



Indian security experts are also alarmed by the Internet based attacks on Estonian business and government targets last year. Russia denied any responsibility, but the attacks did come from Russia, and they were successful. It's these 'undeclared war' attacks that are particularly worrying. It means a rather damaging Internet conflict could take place, as an undeclared war. As a result, there are proposals to shore up defenses, and develop some offensive capability.



The government has been reluctant to proceed, fearful of spoiling the improving relations with China. Moreover, much of the Internet mischief coming out of China is, by general acknowledgment, just criminals out to steal. But Internet security experts insist that, hidden among all the criminal operations, is military activity, that is setting India up to take a fall in any future Cyber War. For"

Information Warfare: It Doesn't Get Any Better Than This

Now that the terrorists have printed their strategy out, it is easy to see in print and other news sources. Unfortunately, it seems that almost every member of the Leftwing organizations is part of the disinformation campaign. CNN and the other major news services are also. I wonder if the "news" reporters who are following this strategy can be tried for treason for following the directives of the declared enemy? How about the politicians? In the US, that could end the Deomocrat Party! Something to think about...

Information Warfare: It Doesn't Get Any Better Than This: "It Doesn't Get Any Better Than This

March 22, 2007: Islamic terrorists are encouraging their supporters, who can write in English, to get on American web sites and pretend to be friends or family members of American soldiers or marines. The 'media jehadis' are instructed to tell stories in line with the anti-war tone of American and European media. Things like soldiers committing suicide because they were forced to take part in atrocities in Iraq. Or wounded soldiers suffering, or killing themselves, because of the poor care and abuse they have received from the army. The media jihadis are told to make it sound like they are simply passing on what a soldier said, not to pretend to be a soldier or marine. Media jihadis are told not to discuss anything from the Moslems side, and Moslems should only be referred to as innocent victims. Never mention the Sunni-Shia conflict or Islamic terrorism. Posters should not stick around for discussions, lest they be found out. Care should be taken to select screen names similar to other English speaking posters. Keep messages simple, so as not to betray the fact that you are not a native English speaker.



This is a clever strategy, and whoever started posting it openly on Arab language web sites, demonstrated a keen understanding of how the media works in the West"