Cyberspace has become a full-blown war zone as governments across the globe clash for digital supremacy in a new, mostly invisible theater of operations, according to an executive summary of a report released by FireEye at the weekend.
The report made available to Nigeria CommunicationsWeek said that, once limited to opportunistic criminals, cyber attacks are becoming a key weapon for governments seeking to defend national sovereignty and project national power.
From strategic cyber espionage campaigns, such as Moonlight Maze and Titan Rain, to the destructive, such as military cyber strikes on Georgia and Iran, human and international conflicts are entering a new phase in their long histories.
In this shadowy battlefield, victories are fought with bits instead of bullets, malware instead of militias, and botnets instead of bombs, the report contained.
A word of warning from the cyber security power house reiterated that the analytical waters surrounding cyber warfare are inherently murky, as these covert assaults are largely unseen by the public.
“Unlike the wars of yesteryear, this cyber war produces no dramatic images of exploding warheads, crumbled buildings, or fleeing civilians. But the list of casualties—which already includes some of the biggest names in technology, financial services, defense, and government —is growing larger by the day”.
A cyber attack is best understood not as an end in itself, but as a potentially powerful means to a wide variety of political, military, and economic goals.
“Serious cyber attacks are unlikely to be motiveless,” said Martin Libicki, Senior Scientist at RAND Corp. “Countries carry them out to achieve certain ends, which tend to reflect their broader strategic goals. The relationship between the means chosen and their goals will look rational and reasonable to them if not necessarily to us.”
Just as each country has a unique political system, history, and culture, state-sponsored attacks also have distinctive characteristics, which include everything from motivation to target to type of attack.
This report describes the unique characteristics of cyber attack campaigns waged by governments worldwide. We hope that, armed with this knowledge, security professionals can better identify their attackers and tailor their defenses accordingly.
A quick overview of the report painted Asia-Pacific as home to large, bureaucratic hacker groups such as the “Comment Crew” who pursue many goals and targets in high-frequency, brute-force attacks, while Russia/Eastern Europe, these cyber attacks are more technically advanced and highly effective at evading detection.
In the Middle East, the hackers are dynamic, often using creativity, deception, and social engineering to trick users into compromising their own computers and in the United States are the most complex, targeted, and rigorously engineered cyber attack campaigns to date.
FireEye noted that at the strategic level, governments desire to have a degree of plausible deniability.
“At the tactical level, military and intelligence organizations envelop such operations in layers of classification and secrecy. To be effective, information operations rely on deception—and the Internet offers an ideal venue for a spy’s smoke and mirrors.
“In practical terms, hackers often run their attacks through cyber terrain (such as compromised, third-party networks) that present investigators with technical and jurisdictional complications. And finally, cybercriminal tools, tactics, and procedures (TTPs) evolve so quickly that cyber defense, legislation, and law enforcement remain behind the attacker’s curve.
“The biggest challenge to deterring, defending against, or retaliating for cyber attacks is the problem of correctly identifying the perpetrator,” said Prof. John Arquilla, Naval Postgraduate School in an email interview with FireEye.®
“Ballistic missiles come with return addresses. But computer viruses, worms, and denial of service attacks often emanate from behind a veil of anonymity. The best chance to pierce this veil comes with the skillful blending of forensic back-hacking techniques with deep knowledge of others’ strategic cultures and their geopolitical aims.”
Cyber “attribution”—identifying a likely culprit, whether an individual, organization, or nation-state—is notoriously difficult, especially for any single attack. States are often mistakenly identified as non-state actors, and vice versa.
To make matters worse, ties between the two are increasing. First, a growing number of “patriotic cybercriminals” ostensibly wage cyber war on behalf of governments (examples include Chechnya and Kosovo in the 1990s, China in 2001, Estonia in 2007, Georgia in 2008, and every year in the Middle East).
“Second, cybercrime organizations offer anyone, including governments, cyber attack services to include denial-of-service attacks and access to previously compromised networks. FireEye researchers have even seen one nation-state develop and use a sophisticated Trojan, and later (after its own counter-Trojan defenses were in place) sell it to cybercriminals on the black market.
“Thus, some cyber attack campaigns may bear the hallmarks of both state and non-state actors, making positive attribution almost impossible. And finally, “false flag” cyber operations involve a hacker group behaving like another to mislead cyber defense researchers,” the report contained.