Recensioni
Tracers in the Dark: The Global Hunt for the Crime… di Andy Greenberg
It can’t have escaped Greenberg’s attention that his stories of cybercrime and law enforcement predates the golden age of large language models, also known as but not confined to generative AI.
Law enforcement and the criminals will undoubtedly use AI in new attempts to foul and/or secure privacy of crypto transactions.
This book is further proof to me that the fall of the Putin and N. Korean regimes cannot come fast enough, as they are harbouring and in too many cases hosting cybercrime crime on a massive scale.
1 
Castinet | 5 altre recensioni | Dec 10, 2022 |
Castinet | 5 altre recensioni | Dec 10, 2022 | Attacks like that go beyond the simple inconvenience people may face from time to time with brief electrical losses. Taking out the entire grid for a substantial period of time means that nothing works. Computers, phones, banking, ATM's, transportation, lights, refrigeration, manufacturing, etc. --- all gone. If done during a period of military conflict, even military capabilities would be disrupted. It's also very dangerous, even if done in the absence of military conflict, since the physical, financial, and communications damage could be severe enough to compel a nation to respond against the attacker militarily.
Greenberg's focus for cyberwar logically is on Russia. It's was identified in the October, 2020 Homeland Security Threat Assessment issued by the U.S. Department of Homeland Security as possessing some of the most sophisticated cyber capabilities in the world— capabilities which can disrupt or damage U.S. critical infrastructure networks via cyber-attacks. In addition to having the cyber capabilities to compromise or disrupt critical infrastructure in the U.S., the report goes on to state that cyber threats to the Homeland from other nation-states and non-state actors will remain acute – and will likely grow as well.
So the book "Sandworm" is a real eye-opener as to what has already occurred, and what may well occur in the future. It certainly makes me think of how future conflicts between nations may be like nothing experienced in past conflicts. Military planners tend to prepare to fight future wars based in a large part on how past wars were fought. After the First World War, battleships were thought to be the be-all and end-all, but aircraft carriers proved more effective in the WW II; trench warfare was the norm in WWI, and the French built the Maginot Line to be the be-all and end-all to defend against Germany prior to WWII. But the Germans blitzkrieg quickly went around that defensive line in WW II, and occupied Paris within a month, etc. And in the Second World War, or the War in Vietnam, many a raid was made by brave soldiers, fliers or Navy Seals to sabotage key infrastructure like power plants, railroads, or dams. But as Greenberg points out in this book, air attacks or special forces are no longer the only way to destroy key infrastructure of enemies - they now can easily be destroyed by hackers in a cyberwar, and he explains exactly how easily that can (and has) been done.
Greenberg's warnings are serious and well respected. He has recently won the Gerald Loeb Award for International Report journalism for his story "The Untold Story of NotPetya, the Most Devastating Cyberattack in History", in Wired Magazine. In it, he describes how a single piece of computer code crashed systems across the globe, leading to crippled seaports, paralyzed corporations, frozen government agencies, etc. This book, "Sandworm" provides those details and more. It focuses on the most dangerous hackers in Russia, who have demonstrated their abilities several times to interfere in elections in Estonia, Georgia, and Ukraine, and to disrupt the electrical grids there, causing massive power failures throughout those Countries. Additionally, Greenberg points out that Russian hackers have already been identified as interfering in the U.S. elections of 2016, and Russian hackers already have been identified as having hacked into the U.S. electrical grid. Luckily, they haven't flipped any switches at this point in time, but they've clearly demonstrated having the ability to do so.
Warnings of the capabilities of cyber attacks won't come as a surprise to too many readers of this book, as most will probably remember the 2014 North Korean hack into Sony Pictures, stealing movies, scripts, personal information, and causing millions of dollars of losses. Most should also remember the Stuxnet computer worm which infected Iranian controls for high-speed centrifuges used to enrich uranium for use nuclear weapons.
So "Sandworm" is pretty scary, reading about how cyberattacks can impact us all. Imagine having no water, oil and gas, no refrigeration, no access to money, traffic lights not working, air traffic stalled, etc. Looking at the ability of foreign nations to conduct cyberwar is gripping, captivating, and engrossing. It should be must-reading for IT security staff at all U.S. electrical, oil, gas, communication, and water utilities.
One bit of possibble good news I noted while reading this book is that the U.S. House of Representatives unanimously passed four bills at the end of September, 2020 aimed at securing the power grid and other energy infrastructure against cyberattacks. These bills (HR 5760, the Grid Security Research and Development Act; HR 359, Enhancing Grid Security through Public-Private Partnerships Act; HR 360, the Cyber Sense Act of 2019; and HR 362, the Energy Emergency Leadership Act) make a lot of sence and are welcomed by the electric utilities, so I imagine that means that the Senate will delay in taking them up and they'll never get enaced until something terrible occurs.
Having read several articles and books on Stuxnet, the successful destruction of Iranian nuclear centrifuges by the U.S. and Israel, I was anxious to read Greenberg's book. "Zero Day" security flaws are software holes that have never been used before so their vulnerability has yet to be discovered or fixed. Knowledge of these is precious to those wishing to penetrate systems. The Sandworm group (the name came from a Frank Herbert novel, Dune) has access to several and used them to great effect. The group went to great lengths to disguise themselves and hide. To Greenberg's credit he is able to explain how experts deciphered what group was responsible and he does it in language free of technical jargon.
Just a few months ago, a Netherlands researcher wanted to come to the U.S. to present a paper on the vulnerability of the industrial control system. There are almost 30,000 of these devices (programmable logic controllers) that control everything from wastewater plants to the electrical grid. The researcher, thanks to America's arcane and silly visa system, was not admitted and so unable to present these important findings. Fortunately he was able to post them to his blog. Whether that resulted in a wider dissemination of the information than had he delivered his talk is academic, perhaps. **
Researcher Wojciech, used standard OSINT techniques (the CIA has identified five main OSINT fields: Internet, media, geolocation, conferences, and online pictures) to analyze the exposed ICS devices. Many of these are used in critical infrastructure that would include dams, electrical grid, reactors, health treatment facilities, etc. Critical infrastructure developed by OSINT can be used not just by espionage agencies, but also criminal elements who may seek to gain monetary advantage by holding these devices hostage. OSINT techniques are passive, in that the target remains completely unaware it is being surveilled. Access may be gained by open ports, IP addresses, knowledge of details of the specific devices and how they work -- all freely available online and elsewhere -- and even responses from the device itself.
Here's an example of device information that's available that even includes the phone number:
There are several programs that permit searching the internet for active ICS devices (https://www.shodan.io for example.) The author lays out precisely how to go about searching. Many of these devices have open management ports that are convenient for technicians to access the devices remotely for maintenance. That, however, makes them extremely vulnerable to malicious actors. General contractors with government contracts are particularly vulnerable as they have a history of being more open and thus more vulnerable.
That hackers can cause innumerable problems has already been shown in Ukraine, Estonia, and Georgia where the Russians devastated each country's infrastructure. Andy Greenberg in Sandworm documents what happened in several cases. In Ukraine access to the banking system was eliminated.
It took forty-five seconds to bring down the network of a large Ukrainian bank. A portion of one major Ukrainian transit hub…was fully infected in sixteen seconds. Ukrenergo, the energy company…had also been struck yet again…the effect was like a vandal who first puts a library’s card catalog through a shredder, then moves on to methodically pulp its books, stack by stack.
Ukraine became a testing ground for Russian hacking. Disinformation to spread distrust in the election and tampering with the infrastructure were simply test runs for their successful attacks on United States electoral trust in 2016 and 2020. Ukraine had taken the brunt of Russian abuse for centuries and Greenberg's short history of those onslaughts was suitably horrifying. (See also Anne Applebaum's Red Famine: Stalin's War on Ukraine to understand why Ukraine at first welcomed the Nazis.)
US officials, typically heads in the sand, refused to admit something similar could happen in the U.S. yet we now know that Russian hackers infiltrated the U.S. election system and may well have manipulated the outcome in a variety of unorthodox ways. In 2016, Iranian hackers attacked several US banks causing millions in damages and shut down a dam presumably in retaliation for the Stuxnet attack. The attacks themselves were quite unsophisticated, mostly DDoS attacks that even the most unsophisticated hacker can pull off.
There is software (malware, really) that has been designed for specific purposes; Stuxnet is but one example. Another, discovered by the security firm Dragos, was CrashOverride***, only the fourth example of malware designed to attack and manipulate the controllers in electrical grids. "The functionality in the CRASHOVERRIDE framework serves no espionage purpose and the only real feature of the malware is for attacks which would lead to electric outages."
Greenberg shows that a variety of software is available, even for sale, that permits relatively easy access for anyone, but can also be used to hide the origin of the attacker. To make matters worse, Greenberg wrote in Wired (https://www.wired.com/story/plundervolt-intel-chips-sgx-hack/) of researchers who had managed to access and control Intel processors (a vulnerability that has since been fixed) by manipulating the internal voltage of the processor. You can induce faults by lowering or changing the voltage and once you can do that you can change the output by manipulating the faults. The technique, called Plundervolt, was discovered concurrently by a researcher in Beijing. (Take from that what you will.)
In his book, Greenberg focuses on Sandworm, a group of hackers and software named after the malicious creature in Dune (cyberanalysts had discovered that preference while doing research on the code - don't ask me how.) They determined there was evidence that Sandworm had been infiltrating critical infrastructure—some of it in the United States—since 2011 and had already developed a weapon that could knock it out. When it was used against Ukraine, it had evolved even further.
The hackers had, in other words, created an automated cyberweapon that performed the same task they’d carried out the year before, but now with inhuman speed. Instead of manually clicking through circuit breakers with phantom hands, they’d created a piece of malware that carried out that attack with cruel, machine-quick efficiency.
PowerPoint users need take note that the program has become so large and now includes so many useless features that it has almost become its own programming language. The Sandworm group utilized the ability to place objects and run programs within slides to place malware within the users computer that would download or run other programs unbeknownst to the user.
They managed to fix the system in about an hour, but the point was made. Another group calling themselves ShadowBrokers made off with a whole set of penetration tools developed by the NSA and turned them loose in the wild where virtually anyone with a modicum of knowledge can make use of them. Shadow Brokers caused immense harm when they released EternalBlue, malware that spread faster than anything anyone had seen before. Within minutes it had disabled pharmaceutical companies, and Maersk, the huge shipping company was brought to its knees.
“ 'For days to come, one of the world’s most complex and interconnected distributed machines, underpinning the circulatory system of the global economy itself, would remain broken,” Greenberg writes of the attack on Maersk, calling it “a clusterfuck of clusterfucks.” The company was only able to get its ships and ports back in operation after nearly two weeks and hundreds of millions of dollars in losses, when an office in Ghana was found to have the single computer that hadn’t been connected to the Internet at the time of the attack.' " ****
I've been reading a lot of books and articles on the potential for cyberwarfare. The potential is there for even non-state actors to operate in the shadows and do tremendous harm. Then again shutting down most of our industry might solve the global warming worst case scenarios. One apocalypse preventing another.
**https://www.icscybersecurityconference.com/intelligence-gathering-on-u-s-critical-infrastructure/
***For a review of CrashOverride designed to attack electricity grids, see https://dragos.com/wp-content/uploads/CrashOverride-01.pdf
****https://www.i-cio.com/management/insight/item/maersk-springing-back-from-a-catastrophic-cyber-attack Note that this source places the lone saved Domain Controller in Nigeria rather than the more accepted Ghana.
1 octal | 12 altre recensioni | Jan 1, 2021 |
octal | 12 altre recensioni | Jan 1, 2021 | Interested in cyber security? Read this.
Not interested in cyber security? Read this.
No idea what cyber security is? Read this.
It's really good. Seriously.
1 bhiggs | 12 altre recensioni | Apr 11, 2020 |
bhiggs | 12 altre recensioni | Apr 11, 2020 | Why does Russia do it? Russia is a relatively small country with a GDP comparable to Canada, yet it feels embattled and surrounded by powerful countries. It uses tactics similar to terrorism in an asymmetrical manner. By destabilizing and keeping its powerful enemies off-balance and guessing it can slow or halt perceived attempts to usurp those currently in power in Russia. Thus the cyber attacks are only one part of a larger strategy to sow chaos in the West. Unfortunately Russia has set the stage for other countries to follow who fear being left behind, there are now at least a dozen countries working along similar lines, beyond the usual suspects like China, North Korea and Iran. This does not include the terrorism of scammers calling our homes and elderly parents, or sending spam emails. We live in an increasingly dangerous world, but that is what terrorism seeks to achieve, to erode trust in governments. Greenberg ends with a story of a high-level security expert who doesn't own a smart-phone, TV or radio - he seeks to reduce his exposure to technology as a means of protection, and resilience.
> The next morning, the election commission was hit with a third and final attack, this time a punishing wave of junk traffic designed to keep its servers off-line and prevent them from confirming the legitimate results. … By the time I visited Kiev in early 2017, practically every strata of Ukrainian society was being hit in successive waves of coordinated hacker sabotage: media, energy, transportation, finance, government, and military. … the same group that had just snuffed out the lights for nearly a quarter of a million Ukrainians had only a year before infected the computers of American electric utilities with the very same malware.
> NATO members were unwilling to remotely consider an Article 5 response to the Russian provocations [to Estonia]. This was, after all, a mere attack on the internet, not a life-threatening act of physical warfare. Ilves says he asked his diplomats to instead inquire about Article 4, which merely convenes NATO leaders for a "consultation" when a member's security is threatened. The liaisons quickly brought back an answer: Even that milder step proved a nonstarter.
> Russia's gains from its brief war with Georgia, however, were tangible. It had consolidated pro-Russian separatist control of Abkhazia and South Ossetia, granting Russia a permanent foothold on roughly 20 percent of Georgia's territory. Just as in Ukraine in 2014, Russia hadn't sought to conquer or occupy its smaller neighbor, but instead to lock it into a "frozen conflict," a permanent state of low-level war on its own soil. … No country had ever before so openly combined hacker disruption tactics with traditional warfare. The Russians had sought to dominate their enemy in every domain of war: land, sea, air, and now the internet. Georgia was the first crude experiment in a new flavor of hybrid warfare that bridged the digital and the physical.
> No one in the security community could remember seeing a piece of malware that used four zero days in a single attack. Stuxnet, as Microsoft eventually dubbed the malware based on file names in its code, was easily the most sophisticated cyberattack ever seen in the wild. … Stuxnet's only flaw was that it was too effective. … When the NSA chose to let its Tailored Access Operations hackers abuse those software flaws, it prioritized military offense over civilian defense.
> No U.S. agency even named Russia as the offender, despite the numerous clues available to any researcher who looked. The Obama administration was virtually silent. America and the world had lost a once-in-history chance, Lee argues, to definitively establish a set of norms to protect civilians in a new age of cyberwar. "It was a missed opportunity," he says. "If you say you won't allow something and then it happens and there's crickets, you're effectively condoning it."
> But the code was also highly modular. The protocols could just as easily be swapped out for others—including those used in the United States. "I salute the author of this malware, because it will work anywhere," as Krotofil would later put it. "The beauty of this is that you can launch it in any country, in any substation." The notion that Sandworm was using Ukraine to test out techniques that it might someday repeat in western Europe or the United States was now more than an abstract theory: It had been borne out in the actual mechanics of the tool the researchers had uncovered.
> Instead of an abstract fear that U.S. cyberweapons would inspire adversaries to develop their own, America's hacking arsenal had fallen, suddenly and directly, into enemy hands. … Maersk's desperate administrators finally found one lone surviving domain controller in a remote office—in Ghana. At some point before NotPetya struck, a blackout had knocked the Ghanaian machine off-line, and the computer remained disconnected from the network. It thus contained the singular known copy of the company's domain controller data left untouched by the malware … In total, the result was more than $10 billion in damages, according to a White House assessment
> The result of all these combined myopias was the closest thing the earth has yet seen to the long-predicted, infrastructure-crippling cyberwar doomsday. To an extent never seen before or—as of this writing—since, a single surprise cyberattack took a chunk out of the foundation of civilization, from pharmaceuticals to shipping to food. Distributed across the world, and in a far more concentrated sense for Ukraine itself, NotPetya was the "electronic Pearl Harbor" that John Hamre had first warned of in 1997. … The "perfc" file that Amit Serper had identified as NotPetya's vaccine appeared on computers that hadn’t actually been affected by the worm, close to 10 percent of machines in some cases. The victim companies' administrators told him that they hadn't installed the vaccine. But those computers had, nonetheless, been spared from encryption. Yasinsky believed that the "vaccine" had, in fact, served a different purpose in the hands of the hackers: It was designed to preserve their access.
> American utility operators, more than Ukrainians, have learned to manage the generation and flow of power primarily through their computers and automated systems. Without those modern tools, they're blinded. Ukrainian operators, by contrast, are far more accustomed to those tools' failures, and thus ready to fall back on an analog option.
Questo sito utilizza i cookies per fornire i nostri servizi, per migliorare le prestazioni, per analisi, e (per gli utenti che accedono senza fare login) per la pubblicità. Usando LibraryThing confermi di aver letto e capito le nostre condizioni di servizio e la politica sulla privacy. Il tuo uso del sito e dei servizi è soggetto a tali politiche e condizioni.