US needs digital warfare force

[Litotes]

Double tap..

 

[Litotes]

I have just found this interesting story:

BBC story

It's a good idea but the thought of an army of geeks (think about mating R Signals with REME... on second thoughts, don't go there...) fills me with horror.

Should we follow suit?

Litotes

 

[bobthedog]

Its not such a bad idea, having recent experience in the ISP/Tier1 internet market, DoS (Denial of Service) attacks are now commonplace, and if directed against banks etc can be devastating to a country's economy. At the moment there is little co-ordination to track, trace and identify culprits. Even more diffucult with the technical capabilities built into trojans and worms.

 

[in_the_cheapseats]

Litotes, I know you're good but quoting yourself is going to far

I think it certainly a necessity in some form but I'm not sure about the military setting. The expertise in this field will always remain within the civilian work force - to think otherwise is just silly. I do agree that it should be a government function but do we not have this within GCHQ (perhaps not to the level that will be needed in the future) anyway?

 

[Caradoc]

Something worth a read here is The Cuckoos Egg. Issues the writter has are pretty much true even in today's world with the lack of co-op he gets. Sure, things have changed - but that for him becomes a personal crusade. It's truely the only way to get someone hacking.

When working for a carrier, some script kiddies fired of a script like clock work from an ISP DNS server they'd compromised. They did it right in the at the most annoying part of the day for the 4 people managing the service. Because of that they did get tracked and had their front doors caved in by FBI in the states and our police here. Aged 17-21 they generally had a bad day out. Why? They ruined my friday after work pint.

Having geeks being able to run assault courses doesn't really inspire the generic type, but something does need to be done. The internet is a wild west, it doesn't need a police force thou - what it really needs are a few sheriff's to be able to fight back. Its a poachers/game keeper model where they both use the same tools to hunt and track each other.

 

[leveller]

Litotes, I know you're good but quoting yourself is going to far

I think it certainly a necessity in some form but I'm not sure about the military setting. The expertise in this field will always remain within the civilian work force - to think otherwise is just silly. I do agree that it should be a government function but do we not have this within GCHQ (perhaps not to the level that will be needed in the future) anyway?

Just wait till you meet the staff, its known as the funny farm round here! Geek central, though you wouldnt be typing on here without them

Still a bunch of weirdos though.

 

[ABrighter2006]

Just wait till you meet the staff, its known as the funny farm round here! Geek central, though you wouldnt be typing on here without them

Still a bunch of weirdos though.

Although it could be argued that they wouldn't be there, without us typing on here.

 

[leveller]

Just wait till you meet the staff, its known as the funny farm round here! Geek central, though you wouldnt be typing on here without them

Still a bunch of weirdos though.

Although it could be argued that they wouldn't be there, without us typing on here.

Like to borrow my tinfoil hat?

 

[ABrighter2006]

Like to borrow my tinfoil hat?

Worth reading Fredrick Thomas Martin's book "Top Secret Intranet" - detail the history of Intelink, and makes several references to the risks and means to deal with them.

Ultimately the need for dedicated resources that can act quickly is a reasonable request. Strangely, the last nine months of turmoil in the major economies has given several institutions their closest simulation of what a substantial "cyber-attack" could do to their current sy / business models.

We crack wise on here everytime data goes walk-about, and the usual responses of investigation / lessons learned / changes in process / dismissal of fall-guy improve matters incrementally - moreoften due to the media pressure to be seen to be doing something.

I predict, that at some stage in the next couple of years a major financial / global organisation will discover that is has been targetted and hit for a severe financial loss. Anyone analysing trends in card fraud will know the true costs and yet the same security models are employd to secure sums and trading systems far larger. Given the average bank's ability to calculate risk is becoming more difficult than ever before, you really would have to wonder if all of them would be able to spot a co-ordinated attack, until after the event.

Which would lead to the next question - If a bank did get "taken apart" (and the bank discovered what was going on) - would they make that information public?

- screw the tinfoil hat - expose me to that radiation baby.

 

[Gravelbelly]

Which would lead to the next question - If a bank did get "taken apart" (and the bank discovered what was going on) - would they make that information public?

The thing is that banks have been concerned about computer crime since loooonnnnngggg before the internet turned up. After all, criminals follow the money - bank security types have been security minded since the first time that someone tried salami-slicing, way back in the 1960s or 70s.

They worry about such things all the time. Large corporations have invested lots of money in being able to offer computer security products; you can even get qualifications in penetration testing.

If HM Armed Forces want an aggressive cyber-warfare capability, I suspect that the answer would be a sponsored reserve from GCHQ or KPMG...

 

[petergriffen]

Even the Germans have recently set up a "cyber warfare" unit, if they see a need, there might be something in it.

 

[BV_Technician]

At the moment there is little co-ordination to track, trace and identify culprits. Even more diffucult with the technical capabilities built into trojans and worms.

The bigger difficulty is the simple fact that the Internet is global, Law is not.
Good luck in taking any kind of legal action against an unknown attacker bouncing out of DPRK IP space, or a large botnet where the control channel is sourced in Armenia, for example.

As in_the_cheapseats said, the Military is just not the right place to source this kind of resource, they simply don't have the experience outside of a very restricted [sic] environment, either in terms of technology or threat models.

 

[bobthedog]

BV Technician, yes the internet is global, but the US has been very successful at extraditing hackers from foreign countries, who have tried to attack banks and defence systems.

Currently response to cyber attacks is sporadic, and relies on the commercial enterprises who operate the internet backbone to try to defend against these attacks. Competition between these enterprises does not necessarily enhance the response to DoS attacks, and it takes time to a) stop the attack b) identify the perpetrator.

I think generally the use of systems to attack or deny service to servers in other countries is seen as breaking the law somewhere, and when identified perpetrators are usually caught and prosecuted. The telecommunications acts have various provisions for misuse within them in this country for example. However this becomes more difficult when the attacker is seen to be a foreign government who are intent on disrupting the telecommunications of another state.

 

[ottar]

As in_the_cheapseats said, the Military is just not the right place to source this kind of resource, they simply don't have the experience outside of a very restricted [sic] environment, either in terms of technology or threat models.

Which is why LIAG is TA. If the MoD/Government/Land decide we need an offensive equivalent to complement LIAG it would make sense for that to be TA as well.

 

[BV_Technician]

BV Technician, yes the internet is global, but the US has been very successful at extraditing hackers from foreign countries, who have tried to attack banks and defence systems.

They have ? That is being hidden well then as they are still trying to extradite Gary McKinnon for alleged crimes dating from 2001, Ehud Tenenbaum surrendered to US Marshals and so on. I am not disagreeing in that legal action can sometimes be taken against attackers, it's just the reality that there are countries in this world were you cannot take any action at all, if the attack is sourced from there.

 

[bobthedog]

I agree that the process is slow and labourious to extradite individuals. When it comes to state sponsored attacks there are some pretty quick and simple remedies. DPRK and Armenia (if they have open internet) will still require physical interconnect connections at some point, even in our vastly routed internet backbone it still requires physical interconnectivity to function. Closing off these connections, or restricting them to certain traffic types would soon reduce the ability for that state to attack other states. That is the method by which we today protect from the threat of an individual conducting such an attack.

The difficulty comes with botnets and trojan/worm attack where the attack can come from a number of different entry points, this is where a co-ordinated approach would be required, as potentially the attack could originate in friendly territory.

 

[BV_Technician]

The other problem is that in some cases the ISP's themselves don't know what they are doing. A classic case was Pakistan Telecom blocking all access to YouTube simply because they didn't understand how a basic routing protocol (BGP) worked, something you would expect an ISP to understand.

That's like a professional car mechanic putting diesel in a petrol car.

 

[broadsword69]

Which is why LIAG is TA. If the MoD/Government/Land decide we need an offensive equivalent to complement LIAG it would make sense for that to be TA as well.

Don't LIAG come under 2(NC) Brigade? Wonder what their future is given the current squeeze...

 

[In-Limbo]

No doubt some forward thinking individuals are gauging the need for some degree of pro-activity to things like this:

http://www.telegraph.co.uk/news/wor...9157/Georgia-Russia-conducting-cyber-war.html

As far as I recall this is the first publicly observed case of a significant cyber attack coordinated with a land invasion. Conducted effectively it does constitute as a significant force multiplier.

Disrupting lines of communication, establishing fearsome reputation, deception, and skull ***** your opponents to kingdom come with targeted psyops all trace their military sources waaaay back to the times of yore. The strategies remain fundamentally the same but the medium (and thus the defence) evolves out with.

Advancements in the long overlooked science behind Network Theory illustrate how the seemingly invulnerability of the 'Tinternet can actually be used against it, effectively isolate and shut down countries, perhaps even groups of countries.

Of course it wouldn't have be simple case of phones are dead, better reboot and run the virus scanner. If recent patterns of attacks are anything to go by, it takes months and costs millions to clean up relatively mild mannered peace-time attacks.

So while global recession, collapsed financial markets and frozen international and nation trade might be symptoms of other phenomenon, I bet there are some industrious fellows out there who could draw upon that, model it at a smaller scale and fire if off whenever called to do so.

It takes very few points of attack, and very few individuals to make it a real bad time for quite a few million. It's the fact that some have achieved it without really knowing how that defies all logic.

 

[BV_Technician]

Advancements in the long overlooked science behind Network Theory illustrate how the seemingly invulnerability of the 'Tinternet can actually be used against it, effectively isolate and shut down countries, perhaps even groups of countries.

Teh Intartoobs are anything but invulnerable, or even close to it, as had been repeatedly shown.
One of the better papers I have seen on unrestricted/asymmetric warfare was actually a Chinese one from 10 years ago... (PDF and HTML versions).