Cyberwars

U.S. military carried out secret cyberstrike on Iran to prevent it from interfering with shipping

American military cyber forces in June knocked out a crucial database used by Iran’s elite paramilitary force to target oil tankers and shipping traffic in the Persian Gulf hours after that force shot down a U.S. surveillance drone, according to U.S. officials.

The retaliatory strike by U.S. Cyber Command against the system used by the Islamic Revolutionary Guard Corps was approved by President Trump, who that same day called off a military airstrike against Iran because killing Iranians would not be “proportionate to shooting down an unmanned drone.”

U.S. Cyber Command did not address questions on the secret operation. “As a matter of policy and for operational security, we do not discuss cyberspace operations, intelligence, or planning,” Elissa Smith, a Pentagon spokeswoman, said in a statement.

Cyberwars

WHAT A U.S. OPERATION AGAINST RUSSIAN TROLLS PREDICTS ABOUT ESCALATION IN CYBERSPACE

The Washington Post recently reported that U.S. Cyber Command conducted an offensive cyber operation in the fall to block the Internet Research Agency, a Russian troll farm, from carrying out a cyber-enabled influence operation against the 2018 U.S. midterm elections. This appeared to build on a previous cyber operation in which Cyber Command directly targeted Russian operations to warn them against meddling in the upcoming midterms. Senior U.S. leaders billed Cyber Command’s efforts as an example of the Department of Defense’s new “defend forward” strategy for cyberspace in action.

Since the public launch of that strategy, analysts have expressed concern about the risk that a more proactive and engaged U.S. cyber force will provoke dangerous escalation dynamics with rivals. What can this recent demonstration of the defend forward strategy tell us about the escalation risks of offensive cyber operations? To understand why concerns about cyber escalation may be less worrisome than many commentaries suggest, it’s important to put the operation in context. Notably, the United States does not appear to have targeted the much bigger fish here: the Main Intelligence Directorate of the General Staff (GRU), Russia’s military intelligence agency. Instead, the operation targeted the IRA, a Kremlin-affiliated company that conducts social media-based influence campaigns to sow public distrust in U.S. institutions. Why was this? Operational requirements and calculations about intelligence tradeoffs seem to have informed Cyber Command’s decision-making. A closer examination of likely U.S. motives suggests that offensive cyber operations are subject to many, if not more, of the same constraints that other military operations are: Planners may choose less ambitious targets because they’re easier to attack, to avoid revealing what they know, or because they want to prevent an escalatory spiral.

Cyberwars

UAE hack shows cyber weapons not just a tool for superpowers

Technology advances and the internet information explosion have leveled the global playing field over the last several decades.

Startups from Boston to Bangkok have leveraged technological innovation to create phenomenal new products and services, disrupt markets and industries and change our lives in ways we could not imagine. World-wide access to information on-demand has never been greater.

On the whole, this has been a very good thing.

Unfortunately, as we all know too well, the level playing field has also empowered bad actors — individuals, organizations and countries — to exploit new technologies in order to wreak havoc.

The depth and danger of the havoc — and the urgency for stepped-up efforts here in the U.S. to stop it — was evident in the recent disclosure of the United Arab Emirates’ success during 2015 and 2016 in using high-powered spying tool called Karma to hack into the iPhones of activists, diplomats and foreign rivals.

It has been reported that Apple discovered the vulnerability in mid-2016 and rendered Karma less effective.

Cyberwars

Israeli Media Expose Covert Cyberwarfare Firm Recruiting IDF Hackers

The firm, nicknamed after a deadly Amazon fish, was reportedly founded by the same man who was behind the establishment of NSO, the secretive Israeli cyberwarfare firm that sources say has sold spyware to the Saudi government.

Israeli tech companies producing equipment and software for cyber espionage made headlines two months ago after the murder of Saudi journalist Jamal Khashoggi. Haaretzbroke on Wednesday that there is yet another, stealthy firm, which offers offensive cyber capabilities for sale.

As per the report, the company in question is nicknamed Candiru after a deadly Amazon fish. It is said that the firm was originally registered under the name Grindavik Solutions in Tel Aviv in 2014, re-named to LDF Assoiates in 2017 and back to Grindavik last year. It is noteworthy that Candiru was reportedly set up by venture capitalist Isaac Zack, the same man who co-founded NSO Group Technologies.

Cyberwars

Lawmakers to Pentagon: Tell Us When You Use Cyber Weapons


Defense Department officials would be required to notify congressional overseers within 48 hours of launching any sensitive cyber operation under legislation introduced Thursday by top lawmakers on the House Armed Services Committee.

The law would apply to both offensive and defensive cyber operations that leave DOD networks and produce effects outside locations where the U.S. is engaged in a hot war.

The law would not apply to covert actions, which are typically conducted by intelligence agencies rather than the uniformed military.

That means the Stuxnet attack against Iran’s nuclear capability, which is among the best-known offensive cyber operations and widely believed to have been launched, in part, by U.S. intelligence agencies, would not fall under the law’s requirements.

The law would also require the Pentagon to notify the House and Senate Armed Services Committees about any reviews of cyber weapons to determine if they can be used under international law.

Cyberwars

Bletchley Park: Training the next the generation of cybersecurity codebreakers

Bletchley Park is set to make history once again by inviting top analytical minds to work and study at the legendary location. Things are a little different today though. The world they are preparing a new generation of cybersecurity codebreakers has changed remarkably since the second world world war …The sprawling Buckinghamshire estate populated by decaying huts is famous for having played a crucial role in the Allied Forces’ fight against Hitler. The wartime base for the Government Code and Cypher School (GCHQ) was deliberately chosen because it had good transport links to Oxford and Cambridge universities, whose brightest students it recruited.Its most famous alumnus is the mathematician Alan Turing, whose invention of the Bombe machine proved so crucial in decrypting the Enigma code, and is credited with shortening the war by two years and saving countless lives. Turing sadly died at the age of 41, decades before his work – and that of Bletchley more widely (dubbed ‘the best kept secret in Britain’) – was revealed in all its heroic glory to the public.

Cyberwars

Pair of Air Force Cyber Weapons Systems Ready for War

Late last year, the Air Force declared one of its newest cyber weapons tools initially operationally capable. The tool, the Automated Remediation Asset Discovery (ARAD), is a modification to the Air Force Cyber Security and Control System (CSCS), which was itself declared IOC by Air Force Space Command in 2014.

CSCS, according to an Air Force fact sheet, is a weapons system that is designed to provide 24/7 network operations and management functions enabling key enterprise services within both classified and unclassified Air Force networks as well as supporting defensive cyber operations on those networks.

Cyberwars

‘Groundless smear attempt’: China rejects hacking claims, urges US to explain own spying

On Friday the Ministry of National Defense vigorously denied that any hotels in the Haidian District of Beijing served as a base for any cyber-espionage operations.

“The Chinese military has never supported any hacking activities, and the Chinese government has always been firmly opposed to and cracking down on relevant criminal activities in accordance with law, including network attacks," China's Defence Ministry said.

“Relevant accusation is totally groundless and a bad act of smearing China,” the statement added, calling on Washington to stop making “groundless accusation against China.”

Instead of blaming China for spying, Beijing challenged Washington to “give a clear explanation on the Prism Gate incident, ” not just to China, but to the entire international community.

First revealed through the Edward Snowden leaks in 2013, PRISM is a code name of the NSA surveillance program used to gain access to the private communications of users of nine popular Internet services, including Verizon, Apple, Google, Yahoo, Microsoft and Facebook.

Cyberwars

Russia and America's Cyber Deterrence Dilemma

U.S. sanctions are unlikely to deter future Russian cyber attacks not only because of Washington’s limited ability to impose adequate costs on the senior Russian officials it believes have ordered the hacking, but because neither side appears prepared to accept mutual deterrence in the cyber domain. In the early 2000’s, the Russian side proposed negotiations towards a cyber arms control treaty, but at the time U.S. officials had little interest in constraining capabilities in which they expected to enjoy unrivaled dominance. Now, the Kremlin may view cyber attacks as an indispensable counterweight to U.S. and NATO dominance in the conventional military sphere, and thus the Russians may be less inclined to negotiate.

The simple truth is that if either side believes it can gain more by using cyber weapons than by preventing their use, deterrence will fail. So far, U.S. sanctions have underscored the urgency of the cyber threat, but they are not likely to reduce it.

Cyberwars

The US Military Launches “Hack the Army,” Its Most Ambitious Bug Bounty Yet

VIRTUALLY EVER BIG tech company offers cash rewards to hackers who find vulnerabilities in their software. Not to be left out, this year the Pentagon announced its first bug bounty to try to expand how the government defends its systems. Now the Army is joining in as well, with its inaugural “Hack the Army” bug bounty kicking off this month.

Announced by outgoing secretary of the Army Eric Fanning, the program asks hackers to vet and find flaws in the Army’s digital recruiting infrastructure. Unlike Hack the Pentagon, which only asked hackers to assess static websites, Hack the Army focuses on recruitment sites and databases of personal information about both new applicants and existing army personnel. The program isn’t open to everyone; it’s invite-only so hackers can be vetted. Any military and government personnel who want to participate, though, get automatic entry.

Cyberwars

Is the CIA Ready for the Age of Cyberwar?

When America goes to the polls on November 8, according to current and former U.S. intelligence officials, it will likely experience the culmination of a new form of information war. A months-long campaign backed by the Russian government to undermine the credibility of the U.S. presidential election—through hacking, cyberattacks, and disinformation campaigns—is likely to peak on voting day, the officials said.

Russian officials deny any such effort. But current and former U.S. officials warn that hackers could post fictional evidence online of widespread voter fraud, release a final tranche of embarrassing hacked emails, and slow the internet to a crawl through cyberattacks.

“Don’t underestimate what they can do or will do. We have to be prepared,” Leon Panetta, who served as Central Intelligence Agency director and defense secretary in President Barack Obama’s first term, told me. “In some ways, they are succeeding at disrupting our process. Until they pay a price, they will keep doing it.”

Cyberwars

THIS IS WHAT CYBER WARFARE BETWEEN NATIONS WOULD LOOK LIKE

Imagine you woke up to discover a massive cyber attack on your country. All government data has been destroyed, taking out health care records, birth certificates, social care records and so much more. The transport system isn’t working, traffic lights are blank, immigration is in chaos and all tax records have disappeared. The internet has been reduced to an error message and daily life as you know it has halted.

This might sound fanciful but don’t be so sure. When countries declare war on one another in future, this sort of disaster might be the opportunity the enemy is looking for. The internet has brought us many great things but it has made us more vulnerable. Protecting against such futuristic violence is one of the key challenges of the 21st century.

Strategists know that the most fragile part of internet infrastructure is the energy supply. The starting point in serious cyber warfare may well be to trip the power stations which power the data centres involved with the core routing elements of the network.

Cyberwars

U.S. could do more in cyber war against ISIS, experts say

The U.S. is likely conducting cyber operations similar to the one by an Israeli cyberintelligence company reported last week, but experts say the U.S. could still be doing more to take down the Islamic State online.

Intsights, an Israeli cyberintelligence firm, reportedly hacked into the Islamic State's Telegram internal communications group and found that the terrorist group was calling for followers to attack U.S. military bases in the Middle East, including Kuwait, Bahrain and Saudi Arabia, the Times of Israel reported.

Asked if the threats had changed U.S. force protection posture in the region, Capt. Jeff Davis, a Pentagon spokesman, said, "We already have very high security at all of our facilities there. We track many threats like this, most of them aspirational."

Cyberwars

When and how to respond to cyber acts of war

As cyberattacks become more sophisticated and in some cases more destructive, at what point should the U.S. flex its muscles and say enough is enough?

Members of two House Oversight and Government Reform subcommittees sought to answer that question during a July 13 hearing on what cyber incidents should be considered acts of war and how the U.S. should respond.

Rep. Robin Kelly, D-Ill., ranking member of the IT Subcommittee, pointed to the indictment of seven Iranian nationals in March who are charged with breaching the network of a dam in suburban New York. Fortunately, the compromised computers were not connected at the time to the slough that controls water flow. And, if it were, the dam in question is minor and couldn’t cause much damage.

Cyberwars

Could Online Presence Betray ISIS’ Intentions?

ISIS is well-known for its extensive use of technology and social media in the organisation’s efforts to fill its ranks. But have you ever wondered how the recruiting efforts of the jihadi army work online? So did a team of researchers from the University of Miami who have developed a model to identify behavioural patterns among online groups of ISIS supporters. These models, they hope, could help police and counter-terror agencies paint a clearer picture of their activity, including hints and indicators for when a real-world attack is imminent.

The team identified and analysed 196 pro-ISIS groups during the first eight months of 2015. They tracked second-by-second online activity and came to realise that even though most of the 108,000 members of these groups have likely never met, they were surprisingly adaptive and could extend the longevity of the groups, increase their number, quickly relaunch after being shut down, and inspire “lone wolf” attacks by people with no history of extremism.

Cyberwars

Cyberspace: A new front-line fight for NATO

NATO formally designated the cyber domain as a new front line, adding virtual attacks as an area that could demand a collective military response much like a conventional assault from land, air or sea, the alliance’s top official said Tuesday.

“We have decided that a cyber attack can trigger Article 5, meaning a cyber attack can trigger collective defense,” NATO Secretary-General Jens Stoltenberg said after the first of two days of top level talks in Brussels.

Article 5 serves as a linchpin for NATO, asserting a major attack on one member state demands a collective response from the 28-nation military alliance.

Cyberwars

Without solid training options, mysterious Cyber Command remains a work in progress

The military's demand for cyber capabilities is soaring. Defensive and offensive operations, including those targeting the Islamic State group, are occurring with greater frequency. There's talk of elevating U.S. Cyber Command's profile within the Defense Department. And yet six years after its creation, the organization does not have a training environment for large-scale exercises and to evaluate the readiness of its force.

Unlike other major military components, the mysterious CYBERCOM, which is headquartered at Fort Meade in Maryland, does not have a permanent interconnected range for units to practice new tactics, test new weaponry and fight hypothetical enemies in exercises designed to simulate real-world conflict. It's working to build one, officials say, suggesting — without offering much detail — that they're looking to engineer a network of facilities that replicates command-and-control systems and allows for large units to train with potentially catastrophic cyber weapons. Meanwhile, the definition of unit-level readiness remains a work in progress.

Cyberwars

NATO Weighs Making Cyber Wartime Domain

Regardless of what decision comes out of the Warsaw Summit, the NATO partners are increasingly focused on building cyber resiliency among the allied nations. While NATO may look to suggest general standards and tactics among the allies, the specifics of handling cybersecurity matters would still fall to the individual members for the foreseeable future.

However, some common operating standards, particularly when it comes to protecting classified information among the militaries, may be advisable. As nations become increasingly interoperable, the flow of data back and forth can create vulnerabilities in the back-ends of systems.

For example, officials for the F-35 joint strike fighter program have expressed concern about the ability to link up digital flight training systems among the operators, as some nations may not have the same levels of security that US systems do, providing a potential back door for hackers attempting to access US data.

Cyberwars

America is 'dropping cyberbombs'—but how do they work?

Recently, United States Deputy Defense Secretary Robert Work publicly confirmed that the Pentagon's Cyber Command was "dropping cyberbombs," taking its ongoing battle against the Islamic State group into the online world. Other American officials, including President Barack Obama, have discussed offensive cyber activities, too.

The American public has only glimpsed the country's alleged cyberattack abilities. In 2012 The New York Times revealed the first digital weapon, the Stuxnet attack against Iran's nuclear program. In 2013, former NSA contractor Edward Snowden released a classified presidential directive outlining America's approach to conducting Internet-based warfare.

The terms "cyberbomb" and "cyberweapon" create a simplistic, if not also sensational, frame of reference for the public. Real military or intelligence cyber activities are less exaggerated but much more complex. The most basic types are off-the-shelf commercial products used by companies and security consultants to test system and network security. The most advanced are specialized proprietary systems made for exclusive – and often classified – use by the defense, intelligence and law enforcement communities.

Cyberwars

US Wages First Official Cyber War Against ISIS

The United States is now engaged in its first ever official cyber war, according to US Secretary of Defence Ash Carter. The enemy? ISIS.

“I have given Cyber Command in the ISIL fight its first wartime assignment,” said Carter.

“Increasingly, I’ve brought Strategic Command and Cyber Command into these operations as well to leverage their unique capabilities in space and cyber to contribute to the defeat of ISIL. Beyond terrorism,” he said. “A couple of years ago, that would never have occurred to a secretary of defense.”

The decision by the Department of Defence (DoD) to unleash the full force of the Cyber Command against the jihadist organisation is largely “a result of ISIS’s own behavior and what the Defence Department perceives as the need to fight ISIS on the group’s own turf,” according to Defense one.

Cyber Command was established in 2010 under the US Strategic Command “for Army missions, actions and functions related to cyberspace, including the responsibility for planning, coordinating, integrating, synchronising, directing and conducting Army network operations and the defence of all Army networks.”