Most (but not all) Western countries use some form of computer controlled system to manage their electricity grid, gas supply and water distribution. It’s highly likely in the future that a nation-state will exploit these command and control systems by using DDOS methods which would lead to serious power outages and could bring down the stock markets.

The US government is already aware that Russia and China has infiltrated the electrical grid and deployed logic bombs which will be used to sabotage or disrupt the grid. The US is one of a number of countries that actually has its’ electricity grid connected to the Internet, so it is conceivable that they could just disconnect it from the Internet in the event of an attack.

In July 2009, North Korea is claimed (by security experts) to have been behind a cyber attack that paralysed the websites of US and South Korean government agencies, banks and businesses. South Koreas National Intelligence Service (NIS) claimed at the time that the attack appeared to have been elaborately prepared and staged by a certain organisation or state. The NIS claimed that the cyber attacks were the work of North Korea. The cyber attack didn’t appear to sabotage South Korean or US networks but after investigation by South Korean and US authorities it became apparent that it was a DDOS attack.

South Korea has for some time warned of the dangers of cyber espionage by Chinese and North Korean hackers. The country’s Defence Security Command at the time logged 95,000 daily attempts to penetrate its military network. There is no evidence to suggest that the same level of daily cyber attacks was seen in July of this year (2010). AhnLabs the South Korean Internet Security vendor did tell me earlier this year that they were preparing for a cyber attack but I understand it never came.

Source of Information : Hakin9 November 2010

• 0 comments »

Sabotage can occur at many levels i.e. military, government, utility platforms (i.e. electricity, oil, banking, stock markets, transport etc) or corporate and all will use the same attack methods. Sabotage is one of the major threats to our everyday lives and could in essence take a nation-state into the dark ages. With ever increasing reliance on the Internet (remember we are running out of IP addresses – think IPv6), it’s no surprise that cyber sabotage is going to increase the risks to every nationstate on Earth.

Cyber sabotage can do many things i.e. reprogramme existing source code; control or change the way programmable logic controllers work (PLC) by embedding a rootkit in the code; edit/delete source code and or readable documents and command and control of a servers files and folders. These are just some ways attackers (or a nation-state) might exploit damage on another network/system.

One of the most destructive sabotage attack vectors seen to date has to be Stuxnet. Stuxnet (seen earlier in 2010) is a Windows-based computer worm that specifically attempts to sabotage and in some instances reprogram industrial software systems like SCADA which are used to control and monitor industrial processes across the globe The worm targeted the Siemens SCADA control systems (via USB flash drives)* and is believed to have been created in the West and used in a sabotage attack on a nuclear plant in Iran.

The worm’s impact on the plant will probably never be known. What is known is that it delayed the start-up of the plant for some weeks. The malware itself was unique in that the malware writers would have had to have had firsthand knowledge of industrial processes – what was equally strange was that the malware was coded in C and C++ (malware isn’t normally coded this way) and that the malware had two stolen digital certificates. One significant advancement on previous malware was its’ ability to update itself over peer to peer – so all in all this is probably the most sophisticated malware of its type to date.

Who wrote it? This was probably a Western sponsored cyber sabotage. The Stuxnet worm is very much the beginning of a new dawn in cyber weaponry and leaves leading security researchers in no doubt that we will now see the evolution of the Stuxnet family.

Source of Information : Hakin9 November 2010

• 0 comments »

Espionage isn’t something new, and neither is cyber espionage. Some of the most sophisticated cyber espionage networks reside in Russia and China. Cyber espionage normally involves stealing secret (and or classified) documents from other nation-state governments, individuals, military establishments, rivals, enemies and businesses.

Cyber warrior units (that are run by nation-states) which are closely tied to private hacker groups are normally responsible for developing cracking techniques to develop sophisticated malware, Trojans, backdoor traps and logic bombs to gain unauthorised access to a foreign network and or server.

Recently, leading security researchers identified and tracked a sophisticated cyber espionage network based in China called Shadow. The Shadow worms systematically snoop through files (looking for secret; restricted or confidential classified documents) stored on the targeted computer. The Shadow worm would then send the harvested data through the web to core servers located in China. The attackers used social media platforms such as Twitter, Facebook, redundant cloud-based computing systems and Google Groups as the command-and-control infrastructure for the Shadow rollout.

This espionage network targeted computers in several foreign countries including systems belonging to the Indian government and military. The Shadow network (a similar espionage ring to GhostNet from 2009), was found to have compromised the UN, computers systems belonging to the Indian government and the Embassy of Pakistan in the US. Unfortunately, the targeted computers weren’t secure as the data had been moved from a secure environment.

Source of Information : Hakin9 November 2010

• 0 comments »

The cyber security threat areas again:
• Cyber warfare
• Cyber terrorism
• Cyber attacks (organised crime)

Cyber warfare
Cyber warfare can be defined as part of four other defence components – one being air, sea, land and space. It is in these areas that cyber warfare has emerged as the fifth domain of warfare. Cyber warfare involves one nation-state attacking another by using digital attack code to bring about a nation-state infrastructure collapse. The collapse will target the energy system i.e. gas, electricity and oil for example as well as the financial hubs. This can be achieved by using DDOS, Trojans, malware or the use of logic bombs and trap doors in source code for example.


Cyber terrorism
Cyber terrorism uses Internet based attacks which are related to terrorist activities – this might include DDOS attacks on government networks and or looking to steal individual personal information to commit fraud (this is used to raise funds for the terrorists to commit their terrorist acts).


Cyber attacks
Cyber attacks usually involve an organised criminal gang who target individual and networked computers to extract personal and business information to commit financial fraud.

Source of Information : Hakin9 November 2010

• 0 comments »