future of cyber warfare

3 questions about the future of cyber warfare

“We’re not creative enough when we imagine cyber warfare,” F-Secure Security Advisor Sean Sullivan recently told me. “It’s not kinetic explosions. It could be a guy whose crimeware business has dried up and is looking for new business.”

Over the last week, F-Secure Labs has taken a look at attacks from the “Energetic Bear” hacking group, Havex, which targets the energy sector, and now CosmicDuke, which is aimed at targets in Ukraine, Poland, Turkey, and Russia.

The goal of these attacks seems to be espionage or gathering information up for a buyer, which could be a government. But the methods don’t match the precision and massive investment of manhours that went into an attack like Stuxnet, which was designed to take down Iran’s nuclear capabilities.

“They rely on plausible deniability and using resources that don’t seem to be created specifically for the task,” Sean said. “It matches the modular methodology of what we conventionally think of as crimeware.”

“You look at one element and it looks like crimeware,” said F-Secure Senior Researcher Timo Hirvonen, who wrote the CosmicDuke analysis. “You look at it from a different angle and you say, ‘I’ve never seen it aimed like that before.'”

“The conventional wisdom is that anything related to cyber warfare will be shiny and new,” Sean said. These attacks instead suggest “semi-professionalism”.

Here are three questions Sean is pondering in the wake these attacks:

What do we mean when we say state-sponsored?

“Cyber warfare models real life,” Sean said.  “Some countries have a massive cyber intelligence infrastructure that works from the top down. Others seem to have a more grassroots origin, co-opting existing technologies that seem to be built on existing crimeware.”

He wonders if state-focused campaigns are using malware that isn’t necessarily state-sponsored. “Countries who use troops with black masks and no insignias standing on a peninsula may have the same kind of thing going online.”

Opportunistic and pragmatic governments may be paying people to co-opting technology that exist for international espionage purposes.

He suggests the goals of such attacks may fit into Sun Tzu’s advice from The Art of War: know your enemy.

Armed with information, countries can use soft power to turn allies against each other and dissuade retribution like economic sanctions.

What do we mean by APT — advanced persistent threat?

These attacks are not complex in the way Stuxnet was. And they don’t need to be.

CosmicDuke  — a variant of a malware family that has existed since 2001–  infects by tricking targets into opening either a PDF file which contains an exploit or a Windows executable whose filename makes it look like a document or image file.

Once the target opens the malicious file, CosmicDuke gains access starts collecting information with a keylogger, clipboard stealer, screenshotter, and password stealers for a variety of popular chat, e-mail and web browsing programs. CosmicDuke also collects information about the files on the system, and has the capability to export cryptographic certificates and their private keys. Once the information has been collected, it is sent out to remote servers via FTP. In addition to stealing information from the system, CosmicDuke allows the attacker to download and execute other malware on the system. Pretty standard stuff.

Is the war against crimeware driving criminals to cyber espionage? Or: Could be fighting cybercrime be counterproductive?

“Some of these guys may be working for the government and themselves,” Sean said.

A wave of successes in the international war on cybercrime may be driving criminals to new buyers.

“The talent developed on its own,” he said. “And now there’s a government taking advantage of talent in their borders. Law enforcement has been going after crimeware. But it doesn’t go away. It’s fungible. The talent’s still there it needs to make a buck.”

Sean believes there’s a message in these attacks for everyone.

“It’s not just the NSA that hunts system admins. If you have any sort of credentialed access to important systems, you are a target. Keep calm and secure your stuff.”

He hopes that businesses will recognize that prevention is always the best remedy.

“For IT managers: ask for the security budget you need – and fight for it. There is more evidence than ever that letting cost dictate security is bad management.”

If governments are willing to work with increasingly opportunistic malware authors, risks could grow exponentially.

“Is today’s crimeware botnet, tomorrow’s national security nightmare?” Sean asks. “What happens when these guys get out of jail? I’m sure they won’t let the talent go fallow.”

Cheers,

Sandra

More posts from this topic

Charlie

I really miss Benjamin Franklin!

January 7th was a sad day. The Charlie Hebdo shooting in Paris was both an attack on free speech and fuel for more aggression against Muslims. And controversially also fuel for even more attacks against free speech. The western society’s relation to free speech is very complicated nowadays. Officially it is still valued as a fundamental right. But it is also seen as a threat, even if politicians are very keen to masquerade free speech reductions as necessary security improvements. British PM Cameron’s recent debacle is an excellent example. In his opinion, there must not be any form of communication that the authorities can’t listen in to, which would mean restrictions on encryption. Non-digital metaphors are usually a good way to explain things like this. This is as smart as banning helmets because they make it harder to recognize criminals riding motorcycles. French president Francois Hollande wanted to join the party and proposed a law making internet providers responsible for users' content in their services. The idea was to make companies like Facebook and Twitter monitor all communication and call Paris as soon as someone talks terrorism. This goes even further than Cameron as it actually would force companies to do the police’s work. But should the phone company also be held responsible if it turns out that a terrorist has been allowed to place calls? And maybe even send mail delivered by the postal service? Hollande did of course not include those as they would help people understand how crazy the idea is. Anything can be misused for criminal purposes. But trying to make providers of things responsible is just madness and hurts the whole society and economy. The important point here is naturally that freedom of speech is a much broader concept than what Charlie Hebdo utilizes. The caricatures express our freedom to communicate publicly without censorship. But there is also another dimension of free speech. Everybody has the right to choose whom they communicate with and whom a message is intended for. This is not just about secrecy and privacy, it is really about being free to exchange opinions without worrying about them being used against you later by some third party. This dimension of free speech would of course not exist in Cameron’s ideal society. So no Cameron and Hollande, you are definitively not Charlie! It’s sad that the great “Je Suis Charlie” -movement has become a symbol for both freedom of speech and hypocrisy. Didn’t you really see anything wrong in first marching in support of Charlie Hebdo in Paris, and then immediately attack freedom of speech yourself? It takes courage to be a leader and balance between security and freedom. Today we really need leaders like Benjamin Franklin, who had guts and said things like “Freedom of speech is a principal pillar of a free government; when this support is taken away, the constitution of a free society is dissolved, and tyranny is erected on its ruins.” and “Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.”   Safe surfing, Micke   Image by Markus Winkler @ Flickr under CC BY-SA 2.0 via Wikimedia Commons Benjamin Franklin quotes from wikiquote.org

Jan 29, 2015
BY 
F-Secure shares tips to protect your data on Data Privacy Day

It’s Data Privacy Day, and Companies Know More About You Than Ever

Nowadays companies know more about you than ever. But do you know what they’re doing with all your data? Today's Data Privacy Day, and at F-Secure we usually talk a lot about defending your personal data from online criminals: the likes of hackers, scammers and WiFi snoops. But today we'd like to talk a little about how your privacy can be invaded completely legally - by private businesses who collect your data, and how you can protect yourself. We give companies unprecedented access to our personal info and shopping habits. We give knowingly, such as when we fill out a website form. We also give in ways we may not be aware of, in the case of online advertisers who track our clicks around the web and gain insight into our interests and preferences. These advertisers are building up detailed, extensive profiles about us so they can target us with online ads we'll be more likely to click on. The apps we install garner even more of our information. Not to mention what we give to social networks and our email providers. The result: a mass of digital data is spread around about each of us that's super difficult to control. An Adroit Digital study found that 58% of respondents aren't comfortable with the amount of information they have to give to get special offers or services from retailers, and 82% are uncomfortable with the amount of information online advertisers have about them. And according to a survey by SAS, more than 69% of respondents agree that recent news events have increased their concerns about their data in the hands of businesses. News events like all-too-common data breaches, no doubt. But there's also a skepticism of what businesses and organizations may do with the data they are entrusted with. Last week, for example, Americans were shocked to learn that their government’s healthcare website had been quietly funneling consumers’ personal details along to advertising and analytics companies. At F-Secure, we've always been extremely conscious about the responsibility we have to respect the privacy of our customers' data and content. We recently put our core privacy principles into a structured form and shared them with the world - and Micke delved into them in a recent 3-part series. We also are passionate about helping you protect your own privacy - which is why we've created privacy-centered products like Freedome, which keeps online advertisers out of your business by blocking tracking. At the very least, we hope to inspire you to be, if not already, a little more aware of your data trail. So in celebration of Data Privacy Day, here are a few tips for helping you keep from spreading your data too far: 6 Tips for Defending Your Personal Data Check before committing. If your relationship with a business means you’ll be giving up a lot of data to them, check for a privacy policy or principles that outline how they use customer data Choose privacy. Turn on Private or Incognito mode in your web browser so that websites can’t use cookies to identify you Check your settings. Use this handy list to check your privacy settings on all the most popular sites, from ecommerce to social media and more. Provided by the folks behind Data Privacy Day. Search carefree. Use F-Secure Search, our free search engine that makes sure your search history is not stored anywhere or linked to you Get informed. Use F-Secure App Permissions, our free app that lets you know what information you’re giving up to the apps you’ve installed on your phone Keep advertisers at arms' length. Use F-Secure Freedome, our privacy app that blocks third-party online advertisers from following you around the Web. Freedome is available for a free 14-day trial here.   Happy Data Privacy Day!   Image courtesy Philippe Teuwen, flickr.com  

Jan 28, 2015
BY