Hasta La Gadget!

It’s been over three years since the discovery of the Stuxnet worm, but new revelations continue to trickle out from the cybersecurity community. Actually, this latest one is more of a torrent than a trickle: Turns out Stuxnet had an evil secret twin.

Read more…

The latest national security related revelation to come from the documents leaked by Edward Snowden is an account of how offensive computer operations work, and how many there are. The Washington Post reports that in 2011, 231 took place with about three quarters of them against “top-priority” targets, which its sources indicate include Iran, Russia, China and North Korea. Also interesting are details of software and hardware implants designed to infiltrate network hardware, persist through upgrades and access other connected devices or networks. The effort to break into networks is codenamed Genie, while the “Tailored Access Operations” group custom-builds tools to execute the attacks. One document references a new system “Turbine” that automates control of “potentially millions of implants” to gather data or execute an attack. All of this access isn’t possible for free however, with a total cyber operations budget of $1.02 billion which includes $25.1 million spent this year to purchase software vulnerabilities from malware vendors. Get your fill of codenames and cloak-and-dagger from the article posted tonight, or check out the “Black Budget” breakdown of overall intelligence spending.

Filed under: Internet

Comments

Source: Washington Post (1), (2)

President Obama hasn’t been shy about engaging the public and other nations on digital issues, and that includes the idea of cyber warfare. While his administration has been pretty aggressive in building up our cyber defenses, our offensive capabilities have remained somewhat more mysterious. According to a leaked document obtained by the Guardian, the White House has made moves to seriously step up its digital arsenal. In fact, it appears that a Presidential Policy Directive issued in October (though, never released for public consumption) ordered that a list of over-seas targets be drawn up for potential future offensives. Offensive Cyber Effects Operations (or OCEOs) are cited in the directive as having “unique and unconventional capabilities to advance US national objectives around the world.” It then goes on to say that the government will, “identify potential targets of national importance where OCEO can offer a favorable balance of effectiveness and risk as compared with other instruments of national power.”

The more aggressive approach to battling foreign nations through the internet is likely to raise concerns in certain circles about the weaponization of the web. Of course, such fears about militarization aren’t completely unwarranted. But with countries like China posing serious digital threats, government officials will likely see the moves as necessary. The document also says that any operations must abide by US and international law, though, we doubt any suggestions that our government blatantly ignore such rules would ever be put down on paper. The leak of the document follows hot on the heels of the growing PRISM scandal, which has put the nations digital policies front and center in the public’s mind.

Filed under: Internet

Comments

Source: The Guardian

The advent of cyberwarfare raises any number of legal quandaries, let alone ethical ones: when it’s possible to do serious damage without crossing a border or firing a shot, where do you stop? NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE) is publishing the finished version of a non-binding guide, the Tallinn Manual, that could settle at least the legal disputes. For the most part, it demands a measured, one-for-one response and attempts to minimize collateral damage. Digital retaliation is appropriate if the state is a victim of a hacking attack, but bombs and guns should only come into play if virtual combat leads to real casualties. Any attacks should likewise steer clear of civilians, and simply having the capacity or desire for a hacking campaign doesn’t make someone a target — there has to be an “imminent” threat to justify a preemptive strike. NATO isn’t formally adopting the Tallinn Manual as policy, and it’s difficult to know whether the organization’s member nations (or any other country) would honor the guidelines when parties on all sides have been pushing the boundaries of cyberwarfare for years. Still, we’ll have to start somewhere if we want to draw a line in the silicon.

[Image credit: US Army, Flickr]

Filed under: Internet, Alt

Comments

Via: TechWeek Europe

Source: CCDCOE

Kaspersky Labs’ namesake Eugene Kaspersky is worried that widely distributed and potentially state-sponsored malware like Flame and Stuxnet pose dire threats to often lightly protected infrastructure like communication and power plants — whatever your nationality, it’s clearly bad for the civilian population of a given country to suffer even collateral damage from cyberattacks. To minimize future chaos and literally keep the trains running, Kaspersky and his company are expanding their ambitions beyond mere antivirus software to build their own, extra-secure operating system just for large-scale industry. The platform depends on a custom, minimalist core that refuses to run any software that isn’t baked in and has no code outside of its main purposes: there’ll be no water supply shutdowns after the night watch plays Solitaire from an infected drive. Any information shared from one of these systems should be completely trustworthy, Kaspersky says. He doesn’t have details as to when the OS will reach behind-the-scenes hardware, but he stresses that this is definitely not an open-source project: some parts of the OS will always remain confidential to keep ne’er-do-well terrorists (and governments) from undermining the technology we often take for granted.

Filed under: Software

Kaspersky Labs preps its own OS to guard vital industry against cyberwarfare originally appeared on Engadget on Tue, 16 Oct 2012 13:28:00 EDT. Please see our terms for use of feeds.

Permalink The Next Web  |  Eugene Kaspersky, Securelist  | Email this | Comments