Cyber cold war threatens us all
Date: December 31, 2007Source: Wimmera.Yourguide.com.au
By:
First the mobile fails. Intermittent black spots are nothing new but you haven't had so much as an SMS from motormouth Michael in hours or anything from Jen who always calls with arrangements for Tuesday's movie by now.
You resign yourself to catching up on email and the frustrations mount with each minute on an unresponsive computer. Has the whole world stopped?
You resist the urge to slam the door as you head to the nearest ATM and the walk does you good ... until you key in your pin number. The machine is so sluggish it seems to take forever but eventually the screen responds. The news is worse than you thought. Your balance is: $0. It's as worrying as it is wrong. No mobile, no mail, no money.
You want to throw your hands in the air - and surrender is a more appropriate response than you suspect. You've lost a war you didn't even know was being waged.
The war of the future, according to an international look into cyber crime, could well be waged online. And the dangers are magnifying as governments and organised groups hone their abilities to spy on each other and attack critical pieces of public infrastructure with an arsenal of e-weapons.
The report, issued by the software security company McAfee, says government computer systems in Australia, New Zealand, the United States, Germany, India and Estonia have been attacked in the past 12 months and it predicts growth in virtual espionage will be among the main online threats in 2008.
An estimated 120 countries engage in online espionage and the report fingers China as a key perpetrator. Government sources in the United States and Germany have made similar accusations in the past.
The study gathered information from law enforcement and cyber crime experts in Australia, England, Israel, Canada, the United States and across Europe to reach its unsettling conclusions.
"There is now a growing threat to national security as web espionage becomes increasingly advanced, moving from curiosity probes to well-funded and well-organised operations out for not only financial but also political or technical gain," the Virtual Criminology Report 2007 warns. Potentially at risk, it says, are air traffic control systems, financial markets, government computer networks, telecommunications, electricity services and beyond.
Moreover, the danger of an attack extends beyond infrastructure, according to McAfee's local director of Technical Services, Michael Sentonas.
"A sustained cyber attack, for example, on a bank could damage public trust," he says.
The report says Australia was among the victims of online espionage earlier this year when Chinese hackers allegedly tried to break into classified government computer networks "as part of a broader international operation to glean military secrets from Western nations".
Canberra has refused to confirm the cyber attack on Australia's networks, and Chinese authorities have issued denials. Regardless of whether that attack was rumoured or real, the Federal Government is spending $70 million to improve the security of its electronic systems.
"[Cyber espionage] is potentially a threat, but if you look at most governments across the world, including Australia, we're all taking precautions to reduce our vulnerability," says James McCormack, director of the Australian High Tech Crime Centre.
Those measures include testing Australia's defences with realistic scenarios. As evidence of the nation's proactive approach, he cites a conference held last month in which law enforcement authorities assessed threats that could await us in 2020. "We looked at those challenges and sat down and worked out a range of strategies how we could prepare ourselves to actually counter them when they arrive on our doorstep."
Cyber security experts quoted in the McAfee report believe 99 per cent of attacks on government systems go unnoticed. But one attack this year that could not be overlooked was launched against the Baltic nation of Estonia, and that incident serves as a warning for other nations. The report calls the Estonia attack in April 2007 "the first real example of nation states flexing their cyber-warfare capabilities".
Estonian computers for government, banks and news organisations were hit with what is known as a distributed denial of service attack - that is, they were bombarded with so many requests they couldn't function.
What was suspicious was that the attack came during a heated dispute between Estonia and Russia over the removal of a Soviet statue in Tallinn, Estonia's capital. The attacks harnessed 20,000 networks of compromised computers in the United States, Canada, Vietnam, Brazil and elsewhere.
The director of Estonia's Department of Communication and Information Technology, Mikhel Tammet, was indignant at the time, saying: "It was a political campaign induced by the Russians, a political campaign designed to destroy our security and our society."
After several weeks, the attacks on Estonia's networks suddenly ceased. Russia vigorously denied any involvement and none can be proved, but the warning stands regardless of who was behind it.
Gary Gill, a partner in KPMG's forensic area, says corporate espionage is also on the rise. "We see and hear of a lot more attacks via the internet, phishing emails, people hacking into systems. One can only imagine that kind of stuff will get worse," he says.
He does, however, praise the work being done by Australian companies to thwart these activities.
"When you look at how the banks in particular deal with phishing emails and that kind of stuff, I would have to say they are probably up there among the best in the world."
Australian businesses have been quick to respond when attacks occur and have been clever in anticipating attacks that can then be shut down in advance, he says.
Sentonas agrees. The dangers here, while real, are not insurmountable - "Australia is well aware of internet-based and cyber crime, and organisations are quite mature in dealing with a lot of these threats" - but he stresses the responsibility rests not just with governments and big businesses.
The Estonian experience of harnessing thousands of unprotected PCs as "zombies" or "bots" reinforces the importance of individuals protecting their home computers from being used for such purposes. With even a $1500 home computer now able to send out 1 gigabtye of traffic a second, the dangers quickly become apparent, Sentonas says.
"If you multiply that across 100,000 machines, you've got a sizeable denial of service account that nearly every network on the internet would struggle to deal with," he says.
As an absolute minimum, he says, home PCs should be protected by anti-virus software, anti-spyware and a firewall.
David Vaile, the executive director of the Cyberspace Law and Police Centre at the University of NSW, was a contributor to the Virtual Criminology report. He believes it may be premature to blame China for the exploratory online attacks around the world, if only because the attacks are so difficult to pinpoint, but he agrees the problem is real.
"If you look at espionage generally, you can be quite sure various governments all around the world are developing both offensive and defensive capabilities in this area," he says.
As for Australia's efforts, little is publicly known. In part this is because such information is kept close to the chest and the more sophisticated the attack, the harder it is to investigate.
Vaile warns, however, that the proliferation of tools for hacking may prove a great equaliser as nations and political groups attack each other electronically.
"Many of the smaller and less-resourced intelligence services around the world would be in a position where instead of having to develop these sorts of skills themselves, they may well be able to buy them off the back of a truck, so to speak."
"A sustained cyber attack, for example, on a bank could damage public trust," he says.
The report says Australia was among the victims of online espionage earlier this year when Chinese hackers allegedly tried to break into classified government computer networks "as part of a broader international operation to glean military secrets from Western nations".
Canberra has refused to confirm the cyber attack on Australia's networks, and Chinese authorities have issued denials. Regardless of whether that attack was rumoured or real, the Federal Government is spending $70 million to improve the security of its electronic systems.
"[Cyber espionage] is potentially a threat, but if you look at most governments across the world, including Australia, we're all taking precautions to reduce our vulnerability," says James McCormack, director of the Australian High Tech Crime Centre.
Those measures include testing Australia's defences with realistic scenarios. As evidence of the nation's proactive approach, he cites a conference held last month in which law enforcement authorities assessed threats that could await us in 2020. "We looked at those challenges and sat down and worked out a range of strategies how we could prepare ourselves to actually counter them when they arrive on our doorstep."
Cyber security experts quoted in the McAfee report believe 99 per cent of attacks on government systems go unnoticed. But one attack this year that could not be overlooked was launched against the Baltic nation of Estonia, and that incident serves as a warning for other nations....
Next
Add comment
Email to a Friend
