1 Discussion , 1 Case Study and weekly summary
Shrikaa
cyberwarfare_ppt08_l04.pdf
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cyberwarfare: Information
Operations in a Connected World
Lesson 4
Weaponizing Cyberspace, and Nonstate
Actors in Cyberwar
Page 2Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective(s)
▪ Describe cyberwarfare attackers and the
evolution of cyberwarfare techniques.
Page 3Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Key Concepts
▪ How malicious code outbreaks contributed to the
evolution of cyberwarfare
▪ The types of nonstate actors who participate in
cyberwarfare
▪ Nonstate actors and nongovernmental
organizations in cyberwarfare
▪ The role of organized crime, terrorists,
corporations, individuals, and the media in
cyberwarfare
Page 4Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: CONCEPTS
Page 5Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Early Attacks: The 1990s
Solar Sunrise
Moonlight Maze
Honker Union
Page 6Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The 2000s: The Worm Turns
▪ Code Red
▪ SQL Slammer
▪ Titan Rain
▪ Stakkato
▪ Poison Ivy
▪ Senior Suter
Page 7Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Code Red
▪ Log entries
▪ When worm infected a vulnerable Web server, Code
Red changed contents of Web site to:
HELLO ! Welcome to http://www.worm.com!
Hacked By Chinese!
Page 8Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Stuxnet
▪ Attacked and destroyed uranium enrichment
centrifuges at Iranian nuclear facility in Natanz,
Iran
▪ Targeted the Siemens Step 7 programmable
logic controllers used to control the centrifuges
at Natanz facility
▪ Software rapidly accelerated and decelerated
centrifuges, causing them to destroy
themselves
Page 9Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: OBJECTIVES
Page 10Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cyberattacks from 2010–2011
▪ Operation Aurora
• In January 2010, attacked Google corporate
infrastructure
• 20 major organizations targeted by China-based
attackers
▪ Duqu
• Detected in 2011
• Written by same individuals who wrote Stuxnet
or by individuals who had access to Stuxnet
source code
• Purpose of worm is to gather intelligence
Page 11Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Duqu Bridge System
Page 12Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cyberattacks from 2012–2014
▪ Flame
• Targeted Microsoft Windows systems
• Source code similar to some of Stuxnet code
• Targeted the Iranian oil ministry
▪ FOXACID
• Allegedly run by National Security Agency to
leverage secret Internet servers for hacking into
systems of selected targets; eavesdropping
Page 13Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cyberattacks from 2012–2014
(Cont.)
▪ Careto (Spanish for “mask”)
• APT
• Gains total control to monitor system
• Controls infrastructure elements on target
network
• Covers its tracks
• Steals massive amounts of information
Page 14Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: CONTEXT
Page 15Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Understanding Nonstate Actors
▪ An entity other than a nation-state or extremely
well-organized and funded group
▪ Can engage in cyberwar actions with computing
equipment already at his or her disposal
▪ May become involved in cyberwarfare for a
variety of reasons, typically related to the
reason the nonstate group was organized in the
first place
Page 16Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Understanding Nonstate Actors
Nongovernmental organizations
Organized crime
Corporations
Terrorists/activists
Individuals
The media
Page 17Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The Roles of Nonstate Actors in
Cyberwar
▪ Targets
• Nonstate actors attacked by nation-states or by
other nonstate actors
▪ Participants
• Aggressors initiating acts of cyberwarfare
against nation-states or other nonstate actors
▪ Critics
• Vocal critics of cyberwarfare activities
Page 18Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Nongovernmental Organizations
in Cyberwar
Aid groups
Diplomatic organizations
Religious organizations
Page 19Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: TECHNOLOGY
Page 20Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Corporations
Are entangled in affairs of nations
Are transnational in nature
Often pressure governments around the world to make policy decisions favorable to their business interests
Page 21Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Corporations (Cont.)
• May engage in espionage activities against each other to advance their own competitive business interests
Industrial espionage
• May participate in cyberwarfare activities through cooperation with intelligence agencies
• Example: PRISM
Cooperation with intelligence
agencies
Page 22Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Organized Crime
▪ Cyber activities include:
• Individual extortion attempts
• Identity theft rings
• Using organized hacking groups to infiltrate
computer systems
▪ Use of ransomware
• Malicious computer software that takes over a
system, encrypting files with a secret key
rendering them inaccessible to the legitimate
user until he or she pays a ransom
Page 23Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Ransomware Payment Demand
Page 24Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Terrorists and Activists
Estonia
Syrian Electronic Army (SEA)
Anonymous
Page 25Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Estonia
▪ In April 2007, Estonian government moved a
war memorial erected by former Soviet
Union
▪ Outraged Russians protested the relocation
of the memorial, rioting occurred in Estonia
▪ Accompanied by a series of cyberattacks
that appeared to originate from Russia
▪ Distributed denial of service (DDoS) attacks
flooded servers with traffic, attempting to
disrupt legitimate use of the servers
Page 26Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Syrian Electronic Army (SEA)
▪ An activist organization composed of
hackers who support the Syrian
government
▪ Well known for a series of attacks
against:
• Popular media outlets where it defaced Web
sites
• Replacing content with anti-American and/or
pro-Syrian items
Page 27Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Anonymous
▪ Loosely organized group of activist hackers
who orchestrate DDoS attacks against targets
they select based upon ideological concerns
▪ Targets have included:
• The Church of Scientology
• PayPal
• Visa
• Sony
• Government agencies
• Child pornography sites
• Copyright protection agencies
Page 28Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: UNDERSTANDING
Page 29Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Individuals and the Media
Individuals
Wield power against larger forces
Media
Bring attention to individuals/ causes
Page 30Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Individuals and the Media
▪ Individual motivations
• Greed, technical challenge, ego, ideology
▪ Hackers
• White-hat, black-hat, gray-hat hackers
• Kevin Mitnick was black-hat, is now white-hat
▪ Leakers and whistleblowers
• Come forward to call attention to questionable
government actions
• Examples: Julian Assange, Chelsea Manning,
Edward Snowden
Page 31Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
▪ How malicious code outbreaks contributed to the
evolution of cyberwarfare
▪ The types of nonstate actors who participate in
cyberwarfare
▪ Nonstate actors and nongovernmental
organizations in cyberwarfare
▪ The role of organized crime, terrorists,
corporations, individuals, and the media in
cyberwarfare
