Cyberattacks aren’t just for James Bond movies anymore
BY MORGAN WRIGHT, OPINION CONTRIBUTORTWEET SHARE EMAIL
You can't see it. You can't smell it. You can't hear it. But you should fear it.
The internet has evolved beyond simply moving 1s and 0s around at the speed of light. On their own they can't hurt you. But when the bits and bytes are put into the right form and context, they can be lethal. It's no coincidence the Department of Defense has called cyberspace the "Fifth Domain" of modern warfare.
What many consider a scenario from the movies is now quite real.
In 2012, I was interviewed by CNN Entertainment about the James Bond film "Skyfall". I was asked "Would it be possible for a bad guy to hack into MI6 - or any infrastructure - to target it for destruction?"
I replied that "many critical infrastructures are connected to Supervisory Control and Data Acquisition systems, controlling our electricity grid, water, and sewers, and are therefore are a huge soft target for terrorism."
Last month the UK's National Cyber Security Centre (NCSC) warned that Britain will be hit by a life-threatening "Category 1" attack in the near future. According to the NCSC, a Category 1 incident is "an attack which causes 'sustained disruption' of essential services or affects national security, leading to severe economic or social consequences, or to loss of life."
We now have a major nation highlighting the consequences of a cyberattack with the same language normally reserved for a terrorist attack.
How did we get here?
Russia has already launched the first successful BlackEnergy attack. BlackEnergy was originally developed in 2007 as a distributed denial-of-service tool (DDoS). It evolved in 2014 to a full package that targeted Industrial Control Systems (ICS) and embedded espionage modules, with the ability to attack multiple types of operating systems and employ KillDisk, which erases files and destroys the ability to boot up computers.
We've done it too. As far back as 1982, the CIA tricked the then-Soviet Union to steal software that had been programmed with a logic bomb. The Soviets used the stolen software to operate their gas pipelines in Siberia. A logic bomb has a set of instructions secreted inside the computer code that - when the conditions or timing is right - executes a preprogrammed routine.
The CIA's logic bomb "was programmed to reset pump speeds and valve settings to produce pressures far beyond those acceptable to pipeline joints and welds." The result was the "largest non-nuclear explosion and fire ever seen from space." No fatalities were recorded, but the initial impact reportedly raised fears that a small nuclear device had exploded.
In the case of the Flame and Stuxnet attacks against Iran's centrifuges in 2009 and 2010, the code targeted a certain model of PLCs - programmable logic controllers - that controlled the interaction between Iran's computers and their uranium centrifuges. Stuxnet altered the PLC programming and caused the centrifuges to spin too quickly for too long a time. Simultaneously, it told the controlling computer everything was fine. The result was massive damage to delicate systems and instruments.
The Iranian uranium enrichment systems were air-gapped, meaning there was no physical connection to the Internet. An Iranian spying for Israel is reported to have introduced Stuxnet through a USB drive, which gave access to the rest of the computer network. The first attacks were launched in June and July of 2009.
BY MORGAN WRIGHT, OPINION CONTRIBUTORTWEET SHARE EMAIL
You can't see it. You can't smell it. You can't hear it. But you should fear it.
The internet has evolved beyond simply moving 1s and 0s around at the speed of light. On their own they can't hurt you. But when the bits and bytes are put into the right form and context, they can be lethal. It's no coincidence the Department of Defense has called cyberspace the "Fifth Domain" of modern warfare.
What many consider a scenario from the movies is now quite real.
In 2012, I was interviewed by CNN Entertainment about the James Bond film "Skyfall". I was asked "Would it be possible for a bad guy to hack into MI6 - or any infrastructure - to target it for destruction?"
I replied that "many critical infrastructures are connected to Supervisory Control and Data Acquisition systems, controlling our electricity grid, water, and sewers, and are therefore are a huge soft target for terrorism."
Last month the UK's National Cyber Security Centre (NCSC) warned that Britain will be hit by a life-threatening "Category 1" attack in the near future. According to the NCSC, a Category 1 incident is "an attack which causes 'sustained disruption' of essential services or affects national security, leading to severe economic or social consequences, or to loss of life."
We now have a major nation highlighting the consequences of a cyberattack with the same language normally reserved for a terrorist attack.
How did we get here?
Russia has already launched the first successful BlackEnergy attack. BlackEnergy was originally developed in 2007 as a distributed denial-of-service tool (DDoS). It evolved in 2014 to a full package that targeted Industrial Control Systems (ICS) and embedded espionage modules, with the ability to attack multiple types of operating systems and employ KillDisk, which erases files and destroys the ability to boot up computers.
We've done it too. As far back as 1982, the CIA tricked the then-Soviet Union to steal software that had been programmed with a logic bomb. The Soviets used the stolen software to operate their gas pipelines in Siberia. A logic bomb has a set of instructions secreted inside the computer code that - when the conditions or timing is right - executes a preprogrammed routine.
The CIA's logic bomb "was programmed to reset pump speeds and valve settings to produce pressures far beyond those acceptable to pipeline joints and welds." The result was the "largest non-nuclear explosion and fire ever seen from space." No fatalities were recorded, but the initial impact reportedly raised fears that a small nuclear device had exploded.
In the case of the Flame and Stuxnet attacks against Iran's centrifuges in 2009 and 2010, the code targeted a certain model of PLCs - programmable logic controllers - that controlled the interaction between Iran's computers and their uranium centrifuges. Stuxnet altered the PLC programming and caused the centrifuges to spin too quickly for too long a time. Simultaneously, it told the controlling computer everything was fine. The result was massive damage to delicate systems and instruments.
The Iranian uranium enrichment systems were air-gapped, meaning there was no physical connection to the Internet. An Iranian spying for Israel is reported to have introduced Stuxnet through a USB drive, which gave access to the rest of the computer network. The first attacks were launched in June and July of 2009.
1
