Cyber attack, the new form of warfare

THE HINDU. http://www.upscportal.com Iran Nuclear Plant and a recently revealed 2008 incident at a U.S. Base show the spread of cyber weapons. 1. The memory sticks were scattered in a washroom at a U.S. military base in the Middle East that was providing support for the Iraq war. 2. They were deliberately infected with a computer worm, and the undisclosed foreign intelligence agency behind the operation was counting on the fallibility of human nature. According to those familiar with the events, it calculated that a soldier would pick up one of the memory sticks, pocket it and against regulations eventually plug it into a military laptop. It was correct. 3. The result was the delivery of a self-propagating malicious worm into the computer system of the U.S. militarys central command Centcom which would take 14 months to eradicate. 4. That attack took place in 2008 and was acknowledged by the Pentagon only this August. It was strikingly similar to the recently disclosed cyber attack on Irans nuclear facilities using the Stuxnet worm, which also appears to have used contaminated hardware in an attempt to cripple Irans nuclear programme. 5. Like the attack on Centcoms computers, the Stuxnet worm, which Iran admits has affected 30,000 of its computers, was a sophisticated attack almost certainly orchestrated by a state. It also appears that intelligence operatives were used to deliver the worm to its goal. The primary target 6. Its primary target, computer security experts say, was a control system manufactured by Siemens and used widely by Iran, not least in its nuclear facilities. 7. On September 29, Iran confirmed that the worm had been found on laptops at the Bushehr nuclear reactor, which had been due to go online next month [October] but has now been delayed. It denied the worm had infected the main operating system or caused the delay. 8. I say firmly that enemies have failed so far to damage our nuclear systems through computer worms, despite all of their measures, and we have cleaned our systems, Ali Akbar Salehi, the head of Irans atomic energy agency, told the Iranian Students News Agency. Peter Beaumont Courtesy: - The Hindu 4, October, 2010 Cyber attack, the new form of warfare If the Stuxnet attack on Iran was a limited act of cyber sabotage, on September 28 the U.S. attempted to imagine what an all-out cyber war might look like and whether it was equipped to deal with it. Cyber Storm III 9. In an exercise named Cyber Storm III, involving government agencies and 60 private sector organizations including the banking, chemical, nuclear energy and IT sectors, it presented a scenario where America was hit by a co-ordinate cyber shock-and-awe campaign, hitting 1,500 different targets. The results of the exercise have not been released. 10. One of those who believes that cyber war has finally come of age is James Lewis of the Centre for Strategic and International Studies in Washington. Lewis said that while previous large-scale hacking attacks had been an annoyance, Stuxnet and the attack on Centcom Represented the use of malicious programmes as significant weapons. Cyber war is already here, said Lewis. We are in the same place as we were after the invention of the aeroplane. It was inevitable someone would work out how to use planes to drop bombs. Militaries will now have a cyber-war capability in their arsenals. There are five already that have that capacity, Including Russia and China. Of those, Lewis said he believed only three had the motivation and capability to mount the Stuxnet attack on Iran: the U.S., Israel and the

U.K. 11. He added that a deliberate hack of an electric generator at the Idaho National Laboratory, via the internet, had previously demonstrated that infrastructure could be persuaded to destroy itself. 12. There is growing concern that there has already been hostile reconnaissance of the U.S. electricity grid, he said. Just a matter of time 13. Last year, the Wall Street Journal quoted U.S. intelligence officials describing how cyber spies had charted the on-off controls for large sections of the U.S. grid and its vulnerability to hacking. 14. The head of the Pentagons newly inaugurated U.S. Cyber Command, General Keith Alexander, has recently said that it is only a matter of time before America is attacked by something like the Stuxnet worm. 15. In recent testimony to Congress, Alexander underlined how the cyber war threat had rapidly evolved in the past three years, describing two of the most highGuardian Newspaper Limited 2010 Profile attacks on countries: A 2007 assault on Estonia, and a 2008 attack on Georgia during its war with Russia, both blamed on Moscow. 16. Those were denial of service attacks that disabled computer networks. But it is destructive attacks such as Stuxnet that frighten Alexander the most. Agreements needed 17. He favours agreements similar to nuclear weapons treaties with countries such as Russia to limit the retention and use of cyber-war technology. 18. One of the problems that will confront states in this new era is identifying who is behind an attack. Some analysts believe Israel is the most likely culprit in the Stuxnet attack on Iran perhaps through its cyber war unit 8200, which has been given greater resources. They point to a file in the worm called Myrtus perhaps an oblique reference to the book of Esther and Jewish pre-emption of a plot to kill them. But it could also be a red herring designed to put investigators off the scent. 19. Dave Clemente, a researcher into conflict and technology at the Royal United Services Institute at Chatham House in London, argues that where once the threat from cyber war was hyped ... reality has quickly caught up. 20. You look at the Stuxnet worm. It is of such complexity it could only be a state behind it, he said. 21. Clemente points to the fact that the attack used four separate, unpublicized flaws in the operating system of the Bushehr plant to infect it. Other experts note that Stuxnet used genuine verification code stolen from a Taiwanese company, and that the worms designers built in safeguards to limit the amount of collateral damage it would cause. 22. The U.S. and the U.K. are now putting large amounts of resources into cyber warfare, in particular defence against it, said Clemente, pointing out that there is now a cyber security operations centre in GCHQ (British government communications headquarters) and a new Office of cyber security in the Cabinet Office. He added: What I think you can say about Stuxnet is that cyber war is now very real. This appears to be the first instance Of a destructive use of a cyber war weapon. Guardian Newspapers Limited, 2010 SOURCE LINK: - http://www.thehindu.com/opinion/op-ed/article811322.ece