The kill chain: Australia's drone war

abc.net.au | Jun 8th 2012 9:18 PM

A senior Australian Defence Force officer has revealed details of how the Royal Australian Air Force deploys Israeli-owned drones for battlefield surveillance and to target anti-government Islamic fighters in Afghanistan.

Wing Commander Jonathan McMullan says Australia is "just buying hours" on the Heron drones from a Canadian company that in turn "leases them from IAI" (Israel Aerospace Industries), which is wholly owned by the Israeli government.

While enthusiastically endorsing the Heron's capabilities, Wing Commander McMullan was highly critical of the quality of training provided by Israeli and Canadian instructors to Australian drone crews.

The unarmed Israeli Herons first entered RAAF service in Afghanistan in December 2009.

They are the centrepiece of the ADF's rapidly expanding drone warfare capability that has so far cost an estimated $550 million.

Australian Defence Force chief General David Hurley told a Senate estimates hearing in Canberra late last month: "I wouldn't discount the fact that we might have armed UAVs thinking through our force structure review into the future."

In this report, Foreign Correspondent's Mark Corcoran goes behind the scenes of Australia's drone war.

'Saving Australian lives'

The Royal Pines Golf Resort on the Gold Coast is a long way from Afghanistan.

But it was there recently, at the Heli and UV Pacific aviation convention, that Australia's top military drone commanders launched an extraordinary public relations offensive.

In one sense they were preaching to the converted; this gathering of aviation industry insiders was fascinated by the technology but displayed no interest in discussing the political or ethical considerations of this rapidly expanding form of warfare.

Beyond the gleaming display helicopters parked on manicured lawns, and inside a packed auditorium, Wing Commander Jonathan McMullan took to the stage.

He'd returned just days earlier from deployment to Kandahar in Afghanistan and was exuberant about the drone force he commanded, the Royal Australian Air Force's 5 Flight. This technology, he proclaimed, was saving Australian lives and was now enthusiastically embraced by the troops on the ground.

"The capability? It's like crack cocaine, a drug, for our guys involved - just can't get enough of it," Wing Commander McMullan said.

So far none of the unmanned aerial vehicles (UAVs) employed by Australian forces carry weaponry, unlike the Reaper and Predator hunter-killer drones deployed by the United States.

However, military sources have told Foreign Correspondent that armed US drones have conducted strike missions at the direction of Australian special forces troops.

Australian Defence Force chief General David Hurley told a Senate Estimates hearing in Canberra late last month that: "I wouldn't discount the fact that we might have armed UAVs thinking through our force structure review into the future."

Flight of the Heron

The RAAF Heron drones are based at the sprawling Kandahar military complex in southern Afghanistan. The base's single runway is the busiest in the world, with a take-off or landing every 90 seconds. So when a RAAF Heron slowly rolls out for take-off every morning at 3am, Wing Commander McMullan says it is "a massive pain in everyone's arse".

But once airborne the ungainly Heron, weighing 1.1 tonnes with a 16.6-metre wing span, comes into its own.

The Heron carries no weapons, holding instead a sophisticated payload of sensors and cameras. It can stay airborne for up to 24 hours, soaring to a height of 27,000 feet.

RAAF Herons range far and wide across Afghanistan, supporting not just Australian troops, but all Coalition forces.

"We go from one customer to another until we run out of fuel," Wing Commander McMullan said.

Since first being deployed to Afghanistan in December 2009, RAAF Herons have flown 10,000 hours. Wing Commander McMullan claims the Heron's automatic take-off and landing system makes it much safer than American Predators and Reapers, which he says have notoriously difficult manual controls and suffer a high crash rate.

"The majority of Predators and Reapers are lost on landing. They lost three during my last time there," he revealed.

But the Heron isn't always graceful. Wing Commander McMullan conceded there had been "some crashes". In 2010, Sydney's Daily Telegraph reported that Defence had covered up two Heron accidents.

Military aviators never use the "drone" word. The RAAF prefers remotely piloted aircraft system, or RPA.

"People want to hear the word 'pilot' in there," Wing Commander McMullan insisted.

No military UAV presentation is complete without a sample of what's nicknamed "Kill TV" by the Australians, or "Predator porn" by Americans.

Conference delegates watched a brief video clip of what appeared to be an Afghan villager riding a bike down a dirt road - and falling off. Laughter in auditorium. Video ends.

This was the PG version. There were no excerpts of the lightning-fast missile strikes, the dramatic bursts of light, the chaos and carnage that gives "Kill TV" and "Predator porn" its apt names.

Operators spend hundreds of hours watching banks of TV monitors, as drone cameras record ordinary Afghans struggling to get on with their daily lives in appalling circumstances.

"We may spend five or 10 days over a village 24/7 so our war fighters can decide the best time to visit the village. Observing 'pattern of life' is about 50 per cent of our work." Wing Commander McMullan said.

Drones at sea

The Royal Australian Navy is also planning for drone warfare. Lieutenant Commander Bob Ferry, who runs the Navy's UAV development unit, told the Gold Coast conference the Navy will soon start 300 hours of trials with small ex-Army Scan Eagle drones.

In June 2013 the Navy will also test fly a sophisticated Austrian Schiebel helicopter drone.

UAV analyst Peter La Franchi says this is just the start.

"Four Navy frigates have already been converted to support Scan Eagle launch and recovery operations. Eventually all Australian warships will have a UAV capability," he noted.

High on the Heron target list are insurgent spotters, who observe Australian troop movements and coordinate ambushes and the laying of roadside bombs.

"Afghanistan's mobile phone system is crap. I've never had a call longer than one minute before it dropping out. This forces insurgents to use hand-held digital radios," Wing Commander McMullan said.

Telltale digital signals from their radio chatter put the spotters firmly in the crosshairs of prowling Herons.

"Insurgents push out (communicate) from mountain top to mountain top. We exploit that. Our mission is to locate these people so they can be removed," Wing Commander McMullan said.

"The Heron is very good at removing these spotters."

Once located, a decision is taken to "kill or capture". Military officers say special forces troops can be sent in to detain the spotter, or the insurgent can be marked with the Heron's laser and seconds later obliterated by a laser-guided bomb lobbed from a distant aircraft, or killed by a precision artillery shell fired from up to 30 kilometres away.

Australia has so far spent $230 million operating 19 Herons.

'The kill chain'

Australia's Herons may be unarmed, but they are a key link in a targeting process privately called "the kill chain".

The Australian Defence Force refuses to divulge how many individuals have been targeted by Herons, nor will the ADF disclose how high up the chain of command a decision is made to proceed with a "high-end precision targeting" strike.

Military sources have told Foreign Correspondent that senior officers, including the Dubai-based two-star general charged with commanding Australian forces in the Middle East, have been directly involved in the targeting process.

They may be unmanned aircraft, but each RAAF Heron still requires a team of 10 people to fly it in combat. In the Kandahar control room are a pilot, a pay load operator and an electronic warfare section comprising intelligence officers, technicians and locally hired "cultural advisers" and linguists.

Wing Commander McMullan says the last two categories are hard to fill. The linguists from his last deployment had moved to Canada and the United States, and he was urgently seeking replacements.

"I can't get enough [electronic warfare] people, so if you are a top secret-cleared, Pashtun-speaking individual, I have a job for you."

Wing Commander McMullan says every target on every mission is subjected to a rigorous review process. The priority is saving Australian lives.

He revealed that the RAAF has orders that if Australian troops are under attack, Herons are to stay overhead in support at all costs, even if that means running out of fuel and crashing.

The Israeli connection

The RAAF doesn't actually own the Heron drones it flies to war in Afghanistan. It hires them.

Unidentified flying drone

It appears the Defence Force is not alone in flying high-performance drones across Australian skies.

Lieutenant Commander Bob Ferry says that in November 2011 a civilian Learjet operated by Pelair was engaging in target-towing duties for a naval gunnery exercise in a restricted zone off the southern NSW coast.

He said the Learjet encountered an unidentified high-performance drone flying 65 nautical miles east of Jervis Bay at a height of 3,000 feet.

The mystery drone did not belong to either the Australian or US military nor licensed civilian drone operators. The Navy says investigations are continuing.

Wing Commander Jonathan McMullan says "we are just buying hours" from a Canada-based company called MacDonald, Dettwiler and Associates (MDA). MDA in turn leases them from another corporation, Israel Aerospace Industries (IAI), which is wholly owned by the government of Israel.

Israeli-owned drones, leased by Canadians, flown by Australians, fighting a war against Islamist insurgents in Afghanistan.

The first RAAF drone teams were trained in Israel and Canada. Now instruction takes place at Amberley in Queensland, with hands-on training at the Woomera military reserve in South Australia, where trainees spend 10 hours a day flying drones over a purpose-built mock Afghan village, under the guidance of civilian MDA instructors. Australian Army and Navy pilots have also joined the Heron teams.

But Wing Commander McMullan is critical of the training program. He says elite RAAF fighter pilots working with Canadians and Israeli civilians "has not been the best mix".

"My biggest bugbear is civilians with low experience (all on UAVs) teaching very experienced military guys," he said.

"Teaching at Woomera at the moment, there wouldn't be a day we don't get a whinge from a fighter pilot."

Obama's global drone war

There has been no public or political debate in Australia over the country's recently enhanced drone capability. This is in stark contrast to the drone war controversy now engulfing Washington.

As America's ground wars in Iraq and Afghanistan have wound down, the Obama administration has dramatically escalated the drone campaign. This highly controversial yet largely covert conflict is being waged across the skies of Afghanistan, Pakistan, Somalia and Yemen, from a growing network of bases.

Reapers and Predators armed with missiles and operated by the US military and the CIA roam far beyond the battlefield to engage in targeted killings. The New York Times reports that President Obama has personally approved drone strikes against individuals on a secret "kill list".

Mr Obama's top counter-terrorism adviser, John O Brennan, publicly defended the use of drone strikes, telling the Washington Post that their precision limited civilian casualties and lowered risks for US military personnel.

The decision to fire a missile from a drone, he said, was taken with "extraordinary care and thoughtfulness".

A growing legion of critics argue that drone strikes are not only illegal but frequently miss the targets, killing innocent bystanders and destroying any semblance of a "hearts and minds" mission.

"Every time the American attacks increase, they increase the rage of the Yemeni people, especially in Al Qaeda-controlled areas," Mohammed al-Ahmadi, legal coordinator for human rights group Karama told the Washington Post. "The drones are killing Al Qaeda leaders, but they are also turning them into heroes."

So what is the difference between an American missile-armed Reaper and an unarmed Australian Heron that is capable of calling in an airstrike or artillery?

Andrew Davies from the Canberra-based Australian Strategic Policy Institute (ASPI) says "there is a semantic difference between direct and indirect fire support".

"The Americans are sending their drones out on strike missions," Dr Davies said. "I don't think our aircraft are being sent over the border into Pakistan. I'd be very surprised if that was the case."

US military drones also routinely support CIA-ordered airstrikes, but Dr Davies doesn't see Australia's overseas spy agency ASIS calling in RAAF or Army drones to launch targeted assassinations.

"That side of ASIS operational capability was stripped away in the 80s and 90s," he said.

"ASIS agents in Afghanistan are now permitted to carry weapons, but they are not allowed to be involved in this kind of complex paramilitary activity."

He says the Australian "kill chain" is tightly controlled, with "lawyers literally looking over the shoulder of the operators".

"I'm not aware of any legal cases against Australia as a result of our drone operations," he noted.

Moving through the Gold Coast convention crowd of service personnel and salesmen was Peter La Franchi, aviation journalist and consultant to the rapidly expanding civilian UAV market.

He estimates the Australian Government has already spent $548 million on military drones, most of it in the past three years. He says Defence's approach had been ad-hoc.

"Defence is still to sort out what role it intends to play in the development of Australia's unmanned systems industry despite years of experimentation and trials."

He says the RAAF could have bought a fleet of UAVs for the same amount it had already paid to lease Israeli Herons.

Mr La Franchi, who in the 1990s was an advisor to then-defence minister Robert Ray, is puzzled by the absence of public debate over drone expenditure and strategy.

Like Dr Davies, he doubts Australia is participating beyond Afghanistan in Washington's escalating drone war.

"It is unlikely that RAAF Herons would be used in cross-border operations as the US acts as a solo operator in missions over Pakistan and it is unlikely Australia would give assent to such operations."

But he does see legal problems ahead for Australian drone missions within Afghanistan.

"The US has experienced lawsuits as a result of Predator strikes in Pakistan ... sooner or later we are going to face a near identical situation here in Australia," he said.

An official Defence spokesman told Foreign Correspondent "the Heron RPAs are confined to Afghanistan" but declined to elaborate on their exact role.

'Flying binoculars'

While the Air Force demands that expensive, highly trained pilots fly RAAF drones, the Army wants young soldiers of the "PlayStation Generation". No previous aviation experience necessary.

"If you want to have a look at it simplistically, this is a flying set of binoculars," said Lieutenant Colonel Nathan Loynes, commanding officer of the Army's 20th Surveillance and Target Acquisition Regiment.

Lt Col Loynes was in the exhibition hall of the Gold Coast convention. In the middle of this aviation bazaar, he proudly posed for photographs next to his latest acquisition, the Shadow 200 UAV.

In the best trade-show tradition, his young soldiers hand out souvenir pens containing tiny Shadow drone replicas. Tilt the pen and the drone dives towards an imaginary target.

"It's a great news story," Lt Col Loynes said. "We can fly higher, we can now see further and with an accuracy that we simply haven't been able to do before in Uruzgun province."

He says Australia's Shadow missions range from "humanitarian to high-end precision targeting".

Since launching Shadow operations in Afghanistan in March this year the Army has logged 1,000 flight hours. While the RAAF ranges across Afghanistan, the Army's Shadow, which is about one-third the size of the Heron, flies out of the Tarin Kowt base, keeping watch over the Australian contingent.

Previously, the Army operated the much smaller, toy-like Skylark and Scan Eagle drones in Afghanistan, Iraq and East Timor. The $169.5 million invested in 18 Shadow UAVs represents a massive increase in the Army's drone capability.

Lt Col Loynes says "the guys on the ground have got a real thirst for it. When you provide it, you know then real-time information with what's over the hill or what's in the next valley, or they can see an area that they're going to be going tomorrow.

"You can accurately map out, you know, what doorway and what is the best ... window for them to enter into a compound. That information is incredible so, you know, they want more and more."

"There's actually quite a small proportion which is actually that direct target acquisition function."

US Marines also operate the unarmed Shadow in Afghanistan. They're not so effusive. According to FlightGlobal.com: "On a recent deployment by a single unit, the Marines counted 94 'high-value targets' that escaped even though they were spotted."

Frustrated, US Marines are now arming their Shadows, an upgrade the Australian Army is watching closely.

"We have no plans to arm them, nothing in the pipeline like that, but I'm led to believe there are some other programs through ... American Aircraft Industries to look at that feasibility," Lt Col Loynes said.

Mark Corcoran has been a senior reporter/producer with Foreign Correspondent for 15 years. Since 2001 he has extensively covered political, military and social aspects of the US-declared 'war on terror' from Afghanistan, Pakistan, Iran, Iraq, Yemen, Somalia, Syria, France, Greece, Norway and the United States.

Credits

• Reporter: Mark Corcoran
• Foreign Correspondent executive producer: Steve Taylor
• News Online executive producer: Matthew Liddy

Topics: defence-and-national-security, defence-forces, defence-industry, australia

First posted June 08, 2012 13:56:09

Original Page: http://www.abc.net.au/news/2012-06-08/australias-drone-war-in-afghanistan/4058058

Shared from Read It Later

 אל

Google starts warning users of state-sponsored computer attacks

by Dan Goodin, arstechnica.com
June 5th 2012 4:06 PM

Google unveiled a service that automatically displays a warning to users who may be the target of state-sponsored phishing or malware attacks.

Company representatives aren't saying precisely what criteria is used to determine when a particular attack is sponsored by a government actor, because that information could be used to evade detection. They went on to say very generally that the company relies on "detailed analysis" and victim reports that "strongly suggest the involvement of states or groups that are state-sponsored."

The warning comes in the form of a red banner just above the Google search bar that reads: "Warning: we believe state-sponsored attackers may be attempting to compromise your account or computer." It includes a link to information users can use to help lock down their computers, smartphones and Google accounts.

The warnings are being rolled out after Google users have been hit by several high-profile attacks that show evidence of being sponsored by governments in China and Iran. In early 2010, for instance, the Web giant said it was the victim of a "highly sophisticated and targeted attack" that originated in China and stole information about human rights activists who used the company's Gmail service. Last June, Google said it detected a targeted campaign to collect hundreds of personal Gmail passwords belonging to senior US government officials. And in August, a fraudulent secure sockets layer certificate for the Google domain was discovered. Later analysis revealed that it was used to spy on more than 300,000 users, most of whom were located in Iran.

"We believe it is our duty to be proactive in notifying users about attacks or potential attacks so that they can take action to protect their information," Google Vice President of Security Engineering Eric Grosse wrote in a blog post published Tuesday. "And we will continue to update these notifications based on the latest information."

The new advisories augment warnings the site already provides users when their accounts show unusual activity, such as logins from foreign countries.

Original Page: http://arstechnica.com/security/2012/06/google-state-sponsored-attack-warnings/

Shared from Read It Later

 אל

Flame malware network based on shadowy domains, fake names - CNET

Flame malware network based on shadowy domains, fake names

by Elinor Mills, m.cnet.com
June 4th 2012

The mysterious Flame malware used domain names registered with fake names to communicate with infected computers in the Middle East for at least four years, researchers said today.

Someone began creating the 86 domains and more than 24 IP addresses that host the command-and-control (C&C) servers as early as 2008, using fake identities and addresses in Austria and Germany to register them with GoDaddy and others, Roel Schouwenberg, senior researcher at Kaspersky Lab, said in a Web conference with reporters this morning. He speculated that stolen credit cards were used for the transactions.

The IP addresses point to hotels, doctor's offices and other non-existent businesses, while the C&C servers are located in Germany, the Netherlands, U.K., Switzerland, Hong Kong, Turkey, Poland and Malaysia, according to Kaspersky.

"We definitely can't be sure" who is behind the attack, said Dan Hubbard, chief technology officer at OpenDNS, which has been working with Kaspersky on the research into the C&C infrastructure. "This has been very well planned and it's been well executed."

Believed to be a cyberespionage toolkit, Flame leaves a backdoor on computers and has at least 20 known modules that can be mixed and matched to steal documents, sniff network traffic, record audio communications and take screenshots, among other things. The 20MB of code can be instructed to propagate through a network and has infected an estimated 1,000 computers, mostly in the Middle East.

Details about Flame are coming out as researchers analyze the code. For instance, some Flame components spoofed a Microsoft security certificate for Terminal Server to trick computers into accepting the software as legitimate. Microsoft is releasing a security patch to plug the hole in Terminal Server, which is used for remote desktop connections.

To create a sinkhole for research purposes, GoDaddy took 30 of the domains offline and put up researcher-controlled servers to receive communications from infected computers. About 50 percent of the connections to the researchers' sinkhole are from Windows 7 machines, 45 percent are Windows XP and just fewer than five percent are running Windows Vista, Schouwenberg said.

The computers use a password of "LifeStyle2" when communicating with the C&C servers. Data is uploaded in small 8-kilobyte chunks, probably to accommodate slow Internet speeds in the Mideast, according to Schouwenberg.

"What we can say is that Flame is indeed a sophisticated operation. The domains were clearly registered by people and not through a domain name generation algorithm," Hubbard wrote in a blog post today. "And not only was the malware designed to send data in small packets, but the domains are disguised as regular Internet traffic. The most obvious reason is to go under the radar."

The domains were shut down about an hour or so after Kaspersky and others went public with their findings on Flame last Monday. However, the malware on several of the infected machines has been updated since then to a newer version that could have additional functions, Schouwenberg said. "There is possibly some unknown backup system in place," he said.

On Saturday, some domains started pointing to new IP address in Germany, Schouwenberg said, adding that it was unclear if this was due to activity on the part of Flame creators or researchers. The IP addresses went offline the following day, he said.

The Flame creators are interested in receiving PDF files, Microsoft Office documents and AutoCAD files, which are typically used to design things, "anything from turbines in the industrial field to designing buildings," according to Schouwenberg. This is circumstantial evidence that Flame was an operation run in parallel with the cyber espionage malware dubbed "Duqu." Duqu is believed to have been created by the same team that developed Stuxnet, which experts widely believe the U.S. created to sabotage Iran's nuclear program. A New York Times report from last week backs up that theory.

Kaspersky's network has registered 184 infected computers in Iran, 95 in Israel and Palestine, 32 in Sudan, 29 in Syria and 18 in Lebanon, according to statistics published in a blog post today.

Original Page: http://m.cnet.com/news/flame-malware-network-based-on-shadowy-domains-fake-names/57446652

Shared from Read It Later

 אל

Flame virus spread through rogue Microsoft security certificates - CNET Mob

Flame malware: So big, so overlooked

by Michael Lee, news.cnet.com
November 30th -0001

The most "complex malware ever found" -- Flame -- has taken the information security world by surprise. Given that it is said to have been around for years, how did everyone miss it?

Several security research firms, including Symantec, Kaspersky, and McAfee, have been hard at work analyzing a specific piece of malware in the past few days after the Iranian Computer Emergency Response Team posted an alert about malicious code designed to steal and exfiltrate information from infected computers back to a network of at least 10 command and control servers.

However, as Budapest University's Laboratory of Cryptography and System Security (Crysys) reported in its analysis of the malware, it "may have been active for as long as five to eight years." Crysys also reported that the malware's footprint is massive -- some 20MB -- in stark contrast to traditional malware, which attempts to keep as low a profile as possible to avoid detection. Furthermore, the malware also appears to regularly send out information to command and control servers, which should have raised the concerns of a discerning network administrator.

But despite these apparent red flags, the Flame war didn't heat up until just recently.

Read more of "How did everyone miss Flame?" at ZDNet Australia.

Original Page: http://news.cnet.com/8301-1009_3-57442675-83/flame-malware-so-big-so-overlooked/

Shared from Read It Later

 אל

Flame virus spread through rogue Microsoft security certificates - CNET

Flame: A glimpse into the future of war

by Elinor Mills, m.cnet.com
June 3rd 2012

If you roll your eyes at the term "Digital Pearl Harbor," you have my sympathy. We've been warned about the specter of an enemy attack via bits and bytes for several decades, with no real evidence that this is a realistic possibility and not mere hype.

Still, a new worm that's been spying on infected computers in the Middle East has been called a "cyberweapon," and while we're not talking outright combat, it's clear that malware is increasingly playing a part in geopolitical diplomacy and conflict.

This week brought news of not the first, nor the second, but the third known piece of advanced malware that appears to be government or nation-state sponsored. We have Stuxnet, its simpler cousin Duqu, and now we have "Flame." These three pieces of malware are hard evidence of cyberspying and, in the case of Stuxnet, sabotage of Iran's nuclear program with malware to preempt a military strike, according to a New York Times article based on reporter David Sanger's new book.

The article, which relies on information from unnamed U.S. government sources, confirms long-held speculation that Stuxnet (and likely Duqu) was developed by the U.S., probably in collaboration with Israel. (Israel has denied involvement in both Stuxnet and Flame, while the U.S. has not outright distanced itself from either. Meanwhile, the U.S. Cyber Emergency Response Team says there's no evidence that Flame is related to Stuxnet or Duqu or that it targets industrial control systems. (PDF) And the Department of Homeland Security declined to answer questions about Flame beyond providing this statement: "DHS was notified of the malware and has been working with our federal partners to determine and analyze its potential impact on the U.S.")

How ironic but not at all surprising that Americans have been the ones most vocal in raising the alarms about cyberwar and yet the U.S. may have launched the first cyberstrikes. The U.S. may be a leader in cyber-geopolitical affairs, but it's also a huge target. The U.S. government and private companies have been under attack in the form of electronic espionage, primarily from China, experts and victims say. Source code and other sensitive data has been pilfered in stealth cybermaneuvers conducted against Google, RSA, defense contractors, critical infrastructure operators, and others based on company statements, research in recent government reports, and info from security firms like Symantec and McAfee.

It will take months if not years for researchers to fully dissect Flame, which has been called "the most sophisticated cyberweapon yet unleashed." Infections have been concentrated in Iran and other Middle Eastern countries, and it seems designed mostly for spying. It leaves a backdoor on computers and can be instructed to spread itself via USB thumb drive, network shares, or a shared printer spool vulnerability. It uses various methods of encryption and data compression and has at least 20 different components that are used to command it to do things like sniff network traffic, take screenshots, record audio conversations, log keystrokes, and gather information from nearby Bluetooth devices. Experts believe more modules are in the wild. There are more than 80 command-and-control servers being used to send instructions to infected computers.

The malware isn't an entirely new beast really, and the individual functions aren't uncommon. But the size of the program, the fact that it has so many different functions, and its modularity make it fairly unique. An attacker can mix and match components at will. Flame may have remained hidden for as long as five years. And it could be only the tip of the iceberg; there's no reason to think there haven't been other pieces of malware that have thus far escaped detection, or that have been detected but kept under wraps. Flame's emergence isn't game changing necessarily, but it does give an indication of how far geopolitically motivated malware has come and who might be ahead in that "arms race," as well as give a glimpse of what the future holds.

"Everybody has known for 10 years in government circles that cyberespionage is profitable and that it is happening at an enormous pace. This is confirmation for the public that very sophisticated attacks are prevalent," said Stewart Baker, former assistant secretary of policy at the Department of Homeland Security and now a partner practicing cyberlaw in the Washington, D.C., office of Steptoe & Johnson.

"For most intelligence agencies and governments what is interesting is the specifics of the techniques that are being used. I'm sure there are agencies that are learning a lot from them," Baker warned. "This is bad for sophisticated countries that have secrets to protect, like the U.S. and Western Europe, and for the Chinese and Russians too. And it's probably good for countries like North Korea and Iran that are going to go to school with this tool."

"Stuxnet, Conficker, and Duqu and now with Flame added to that, it suggests we're in a new era here," agreed Scott Borg, director of the nonprofit research institute U.S. Cyber Consequences Unit. "I'm not at all surprised by Flame."

Borg has been following this stuff for a long time. Even before Stuxnet hit the news two years ago, Borg made prescient remarks to the effect that Israel's weapon of choice would be malware that would give the country the ability to interfere with Iran's nuclear program without launching a massive military strike, he identified the uranium enrichment centrifuges as the most likely target and suggested that a contaminated USB stick would be a likely vehicle for sneaking the program into a building, among other predictions that came true with Stuxnet.

According to the New York Times article, the Bush administration turned to malware as an alternative to launching a military strike against Iran and the Obama administration continued with the operation, which was code-named Olympic Games. However, while malware might save lives in the short term, it doesn't mean it's necessarily the safer and smarter choice in the long run, Borg and other experts say.

"Cyber can be a much better alternative," Borg said, noting that the Russian cybercampaign against Georgia in 2008 targeted communication and media sites with Distributed Denial of Service attacks and spared them from air strikes. "That's an example where a cyberstrike was less destructive and a more humane way to carry out a mission," he said.

But there's nothing to stop an aggressor from using both online and offline attacks. "If you are planning drone strikes, what better intelligence could you ask for than a tool that will turn on a camera and microphone of a machine in your enemy's possession to let you know who is there and what is going on?" Borg said.

One big problem with Flame is that the malware authors didn't use code obfuscation, which means it can easily be dissected and re-used by any organization with some advanced programming skills and experience, which would include a large number of nation-states and terrorist groups, according to Borg. Stuxnet can be (and likely has been) reverse engineered, but its limited functions make it less of a danger. "That's a terrible mistake" on the part of the creators, Borg said. "This is a general purpose tool. It has a lot of modules that will do a lot of things... This is not a good thing to have released into the world in a form that is decipherable."

Even though Flame doesn't initially appear to be designed for sabotage, there may be components in the wild that would give it that function. "If it's that sophisticated, it can probably have physical manifestations as well," said Greg Garcia, principal of the Garcia Cyber Partners consulting firm and a former assistant secretary of cybersecurity at the Department of Homeland Security. "It could have consequences that are even broader and potentially more deadly than a drone strike if you think about infiltrating and corrupting control systems that are managing critical operations, whether it's electrical grids, water purification, or transportation systems."

Garcia speculated that Flame could have been meant to send a message, a sort of muscle flexing exercise. "It might be probes for the purpose of reducing confidence in the information systems of certain networks," he said. "We're watching you and you're not safe." But Borg doesn't buy the psychological ops theory. "It doesn't fit the way it was deployed, the thoroughness of the way it was erased (from machines to cover its tracks), the limited number of machines" it infected, he said.

Borg declined to speculate which country is behind Flame but said he suspects it was created by "friendly forces.""The countries capable of writing these kinds of tools, the short list is: China, Russia, U.S., Britain, Germany, Israel, and probably Taiwan," he said. The code, which at 20 megabytes is huge compared with Stuxnet and other malware, most likely required hundreds of people to be working on it for many months, he said.

The very elements that make cyberattacks launched by groups like Anonymous and other hackers problematic as forms of political protest -- the inability to prove who did it and for anyone to take credit for it -- make these cyberactions by governments problematic too. These stealth cyberattacks not only may result in unintended consequences and victims but they also may fail to serve as a deterrent or as bargaining sticks.

"Do the same rules (of war) apply in cyberspace?" Columbia University computer science professor Steven Bellovin wonders in a blog post. "One crucial difference is the difficulty of attribution: It's very hard to tell who launched a particular effort. That in turn means that deterrence doesn't work every well."

Each new cyberthreat or incident launched by a purported government or nation-state will set the course for this debate. The Internet is redefining our lives and actions in unexpected ways -- e-commerce has put storefronts out of business, e-mail has made fax machines obsolete, smartphones have changed the face of photography and personal communications, and Facebook has evolved the notion of a "friend." New digital capabilities can also help people do more harm to each other in times of conflict or avoid physical suffering.

"We have been talking in the government and the Department of Defense about what constitutes cyberoffense in the 21st century and what are the boundaries," said Garcia of Garcia Cyber Partners. "I think those boundaries are going to be slowly defined by default and in practice, and maybe this is going to be one of those indicators."

Don't expect the Stuxnet-Duqu-Flame triumvirate to scare anyone straight though. The perception of threat or possibility for danger in cybersecurity hasn't been enough in the past to merit much action on the part of responsible parties, be they electricity providers or the untold corporate networks that are hacked daily. "There is no shortage of information that says we have a problem," said Herb Lin, chief scientist at the Computer Science and Telecom Board at The National Academies. "People like me have been complaining about the fact that Stuxnet was possible for 20 years and nobody listened. Is this enough of a wakeup call? Maybe. But there have been a lot of other wakeup calls and people just put the snooze button back on."

No doubt, more theories about Flame will be coming out in the future as additional technical information is unveiled. Kaspersky Labs has scheduled an online news conference for 6 a.m. PT on Monday to reveal new forensics it has done on the malware's command-and-control infrastructure used for communication between the attackers and the infected computers. Stay tuned.

Original Page: http://m.cnet.com/news/flame-a-glimpse-into-the-future-of-war/57445975

Shared from Read It Later

 אל