The concept of cyber warfare is not particularly new. However, numerous criminal organizations in foreign countries claim to work for, or obtain funding from, widely recognized government organizations. Cyber warfare is a multifaceted concept that is almost impossible to trace or predict.
The issue was recently brought to light after Google recently blocked unauthorized SSL certificates issues by the National Informatics Centre of India, a division of India’s Ministry of Communications and Information Technology. Google first recognized the unauthorized certificates on July 2, 2014. The Indian Controller of Certifying Authorizes revoked all of the intermediate certificates within 24 hours. Google reported that the certificates are “trusted by the vast majority” of programs on Windows, such as Chrome and Internet Explorer.
SLL certificates are one of the main elements of online security. However, there is no definitive proof that the certificates from the Indian Controller of Certifying Authorities were malicious. In December 2013, Google mistakenly revoked trust for digital certificates, which were mistakenly signed by a French intermediate certificate authority.
Cyber Warfare Concerns and Realities
The People’s Republic of China might not be behind the recent attacks from a group of Chinese hackers on the United States. Recently, a Chinese business man was arrested for hacking U.S. defense contractors, including Boeing. There is evidence that the group received underground funding from the government agency. However, the validity of the statement is almost impossible to prove. Hackers can easily find vulnerabilities in systems and emulate a variety of private and government agencies.
In a related example, gamers received fake emails from the domain blizzard.com, which had nothing to do with the MMO enterprise Blizzard. It is common for hackers to emulate .gov and .edu sites in hopes of gaining access to secure government information or appearing larger than life. Is a large government agency backing malicious attacks in hopes of acquiring secure information and wreaking havoc on infrastructure? No one can be sure.
Attacks Focused on U.S. Infrastructure
A primary concern among numerous security experts are vulnerabilities in United States infrastructure. Water systems, wastewater systems, electric grids, and internet service could be brought down virtually by North Korea or Iran. However, the scope of the damage is difficult to estimate. Wet utility providers typically cover a limited geographic area. People left without water could take refuge 30 miles away from their homes. To put things in perspective, similar occurrences happen yearly in the United States due to natural disasters.
Almost by accident, the infrastructure in the United States is largely disjointed. Power grids and wet utility lines are not connected throughout the country. The New York Power Outage of 2003 is proof that life can still go on after utility failure in a densely populated area. However, military bases and nuclear plants such as Y-12 would make more appealing targets for cyber warfare.
Numerous people might be surprised to learn that gaining sensitive information about utility lines and service lines in Buckley Air Force Base located in Aurora, CO is as simple as conducting a Google search. The City of Aurora also published recent information regarding infrastructure in the area that is easy to access on its website.
The Battle for Net Neutrality in the United States
Net neutrality in the United States might or might not solve pressing security issues, especially if vulnerabilities can be traced back to publishing sensitive information on Google. Net neutrality cannot reasonably combat arguably the greatest security vulnerability—user error.
Widespread education efforts about granting access and types of cybercrime are poorly understood by numerous government employees. Currently, a degree of net neutrality exists in the U.S. However, implementing a blanket policy would be a momentous undertaking, and security risks would still exist. Rather than increase internet regulation, national security can be improved by widespread education efforts. The human element cannot be taken out of the most sophisticated systems; the battle for net neutrality will have to be able to address pressing concerns regarding end users before a comprehensive solution can be implemented.
Are Foreign Governments the Only Concern for National Web Security?
Fifteen-year old Jonathan James was successfully able to hack numerous networks including Miami-Dade County, NASA, the U.S. Department of Defense, and Bell South. James was sentenced to prison due to the breach of web security. James downloaded $1,700,000 of assets and cost NASA three weeks of downtime and $41,000 while the agency investigated the security breach. Sadly, the bright teenager committed suicide in 2008 after being investigated for a number of other malicious web attacks.
One of the largest global engineering firms which routinely completes federal contract work for the U.S. Federal Government recently identified a vulnerability in its network. Temporary administrative access could be obtained for 45 minutes and subsequently renewed every 45 minutes after access expired. The vulnerability was identified by an employee who found instructions for how to gain temporary admin access in the firm’s extensive employee manual in order to fix a routine IT issue after the employee and re-entered the security code to see what would happen. The firm currently has major operations in the United States, China, and Russia. At least the information was published on the firm’s intranet site, which only tens of thousands of employees around the globe have ready access to.
Teenagers, Municipal Employees, Global Firms, and National Security Breaches
Security vulnerabilities are too often associated with rudimentary user error. Did the Indian Controller of Certifying Authorities sign the certificates as an oversight? Did the Chinese group of hackers actually have financial backing from the People’s Republic of China? It is difficult to tell. Web warfare is almost impossible to trace. Net neutrality might only be part of the solution, or net neutrality might be more of a hindrance than a security benefit. In the end, there is reason for concern due to web security threats from foreign countries, and appropriate measures should be taken to mitigate risk.
However, security measures cannot be completely embedded in code. End user education should be considered a primary defense tactic. After all, the last thing a United States Air Force base needs to learn after a malicious attack from a foreign group is, “Well, we just Googled it.”
Top image ©GL Stock Images
