Information warfare!

[esteem]

INFORMATION WARFARE: Attack or Human Error?

courtesy: http://www.strategypage.com/fyeo/how...arget=HTIW.HTM

January 19, 2002; Something to keep in mind is that a lot of hacked systems may have may not noticed as such immediately because of the large number problems that are quickly traced back to human error. Most of the problems with computer systems have always been human errors (either in the design or maintenance of hardware or software.) Indeed, there have been so many human error problems, compared to obvious hacks of systems, that it is very difficult to find a good hack among all the problems cause by people's ineptitude.



January 18, 2002; Cyberwar takes a number of forms. Here are some of the principal targets known to be vulnerable to attacks over the internet or other networks.

- Electrical systems are shut down, momentarily or for days. While there is no standardization in the electrical generation or distributions system, it is common to control systems remotely via the net or a telephone connection. Security also varies, but an ambitious hacker could penetrate several systems, figure out how they worked, and do considerable damage. The military usefulness of this is obvious. U.S. military hackers are thought to see this particular kind of attack as very useful, at least in nations advanced enough to have remote access in their electric power industry.

- Criminal groups draining bank accounts. This is something that is an ongoing problem. But a highly organized and massive attack of this type could make a terrorist organization even more formidable. Rogue states like North Korea and Iraq have long used illegal scams to provide cash flow for their dictators. Kim Sung Il, the dictator of North Korea is known to be a PC enthusiast, so an attack of this sort may already be in the work from North Korea. Or attacks may have already been made, for the ideal hack of this sort would involve draining accounts in such a way that it looked like an internal flaw in the banks computer system. One military use of such access would be to cause enough disruption (by destroying or altering records) to cripple banks, and the banking system. This could disrupt segments of the economy that have the most military impact. Or you could just try to disrupt as many major segments of the economy as possible and inflict a lower capability on the entire nation.

- Some lower tech nations, like Iraq or North Korea, might find it advantageous to bring down the entire internet. Since the larger nations (like the United States ) are much more dependent on the net, this would be an overall advantage to a nation like Iraq or North Korea (or even China.)

- Assassination via tampering with hospital records. Most state of the art hospitals now have computerized systems that keep track of what drugs are to be administered to patients, when and in what quantities. These records also record what the patient is allergic to. You can figure this one out yourself. While a really big shot would have medical personnel manually double checking medication and such, you could still knock off a lot of mid level people (military, espionage or diplomatic types, or just someone who was getting in your way.) Again, the ideal way to do it is subtly, so the fact that it was a cyberattack was not revealed. That way, you can do it again. Maybe someone's already doing it that way.

- The military uses a lot of computers to take care of mundane tasks like logistics, transportation, assignments, training schedules and so on. These computers do not get the industrial strength security (which is expensive and requires more specialized people to maintain) that more important stuff (war plans, communications with combat units, nuclear weapons, research and so on). Thus it's easier to get into these systems and enough damage can be done to have an impact on military operations. This can be done two ways. At the beginning of a war or military operation in a massive way to disrupt enemy operations as much as possible. The other approach is to do as much undetected mayhem as you can get away with.

- Another target that can hurt military operations would be the mass deletion of government records. This would make government operations more difficult, and in wartime, the government provides many vital operations for the military. In particular, the government hires contractors, and makes deals to arrange transportation and housing for troops. If you can disrupt things like government payrolls or contracts, you make that government's troops much less effective.

- Another target is police departments and intelligence agencies. The intel outfits usually have high grade security on their main headquarters. But there are lots of "branch offices" that have lowered security. Intelligence agencies often work with local police departments, and the electronic records here are even easier to get at. This sort of thing is also of great interest to criminal organizations, and some hacking has apparently already taken place in this area.

- Another area with some military impact, and a lot of benefit for terrorists, is hacking and disrupting the court and prison computer systems. This sort of thing is already of great interest to criminal gangs, who will often sell their access to anyone with enough cash. Playing with the court and prison system computers makes it possible to get your low and mid level people out of jail (and out of the country before they can be rearrested.)

- Immigration and customs computer systems. Cracking these can enable you to get saboteurs and spies into (or out of) the enemy country more easily. Mucking about with customs service computers lets you smuggle things in (bombs) and out (stolen technology) of the country.

- Air defense systems have long been tied together by computers. The U.S. did it first in the 1950s (leading to the design and manufacture of the first modems.) Hacking these systems can do all sorts of things, from crashing the system, to just putting false reports on enemy radar screens.

- The air traffic control systems are linked by a network. Ironically, the best defense this system has are the ancient computers that run it. This makes it more difficult (but not impossible) for cyberwarriors or terrorists to get in there and commit some mass murder (or just subtly interfere with air operations so as to hinder the war effort.) Military air traffic control systems are better protected, but still vulnerable.

- Industrial facilities (nuclear and conventional power plants, chemical plants, refineries, or other industrial facilities) are vulnerable to tampering via net connections. This could cause thousands of civilians to be injured or killed, not to mention damage to, or destruction of, the facilities.



January 17, 2002; Once the world appeared to have survived the Y2K scare relatively unscathed, attention turned to other potential computer disasters. Indeed, one of the bonuses coming out of the massive audits and reprogramming the Y2K project (to make sure programs did not crash because the year date was stored as two numbers and computers did not read "00" as 1900 instead of 2000) entailed was a massive number of flaws in communications programs. The Y2K project required that a lot of software be scrutinized in a way that would have never happened had there not been the danger of Y2K mishaps. Before that, the common attitude towards software was, "if it ain't broke, don't fix it." But a lot of software that appeared to be working fine, did have problems that had nothing to do with Y2K. In most cases, they really weren't serious problems, or at least they were things that were more economically fixed when, and only when, the problem somehow got triggered and had to be fixed. But buried in a lot of communications programs were flaws that, in a world where everyone was honest, would not be problems. But as the world finding out, there were a lot of malicious creeps on the internet who loved to exploit communications software flaws to go where they weren't supposed to go and do what wasn't supposed to be done. Governments and military organizations were most concerned about these attacks being used pretty much like a military weapon. Some nations, particularly the United States, had already spent a lot of money on cyber war. It was dawning on people that this was a threat right up there with nuclear weapons, chemical warfare and the use of biological weapons. As the year went on, a list of the likely types of attacks grew. Most of these had to do with the penetration of computer systems via the internet (or any other network that allowed access via the telephone system.) As the internet population grew, along with the number of people probing the net for vulnerabilities, the number of opportunities grew enormously. The quantity of software to be hacked did not grow nearly as much, which explains why this stuff got combed over so thoroughly. For example. In 2000, 1,090 flaws in Internet software were found, of which four percent of them could be used for serious hacking. But in 2001, 2,437 flaws were found, of which 13 percent could be exploited by hackers. So the age of cyberwar was on, fueled by growing quantities of flawed software and malicious hackers.



December 17, 2001; The Curse of Cable News- The proliferation of cable channels was initially seen as a good thing. More choices allowed people to see what they wanted, not just what was available. When cable news channels began to multiply, this was also seen as a good thing. Part of this proliferation was the worldwide availability of news networks from many different nations. This enabled immigrants to the United States to see news in a language they understood. But the War on Terror brought on an unanticipated downside. The September 11 attacks were covered by Arabic news stations very differently than in America. The Arab take included things like Israel being behind the attacks on the World Trade Center and the War on Terrorism actually being an excuse for a war on Islam. For many Arab Americans, these foreign newscasts were all they saw, or the bulk of the newscasts they were exposed to. This put many Arab-Americans in this situation at odds with their non-Arab neighbors. We tend to believe a lot of what we see in the news, and if two groups of people are seeing radically different interpretations of the same story, there will some unease and suspicion on both sides. But most Arab-Americans caught in this situation quickly expanded their list of news sources and at least came to understand where their neighbors were coming from. At the same time, many people take advantage of all those newly available foreign news channels to actively look for different takes on the news. You don’t even have to understand other languages to do this. Some foreign news channels broadcast a block of their news in English, giving English speakers a synopsis of the day’s news as seen in their country. Many American’s are picking up on this, or at least the news junkies are, and providing a wider assortment of interpretations of the news.


November 17, 2001; The US was seen to be losing the propaganda war by some nervous allies are starting to believe the reports of massive civilian casualties. This resulted in new efforts to get the American version of civilian casualties out and that reduced the nervousness somewhat.--Stephen V Cole

November 15, 2001; Cyber attacks on Defense Department computer networks had been level at 22,500 per year for some time, dipped considerably after 11 Sept, but are now on a steady rise, reaching an annual rate of 40,000 by the end of this year. The attacks are increasing in complexity and destructiveness. While some are no doubt hackers who just happen to oppose US military operations, some appear to be part of a concerted attack pattern, indicating that al Qaeda or other Islamic fundamentalist groups may have at least a minimal capability in this regard. American cyber war attacks are such new technology that every operation has to be approved at very high levels. As the US attack methods become known, counters will be developed, and the US doesn't want to "waste" this new technology against a nation with no real computer networks to attack. --Stephen V Cole