Cyber War, Intelligence, Malware & Espionage

Uploaded on 2023-07-24 in INTELLIGENCE--International, Education & Research

Cyber War, Intelligence Malware & Espionage

Student Report: This article is exclusive to premium subscribers For unrestricted website access please Subscribe: £5 monthly / £50 annual.

Digital disruption is sweeping through the world’s second-oldest profession, Spying, and it is altering all aspects of intelligence collection and action. Many forms of cyber attacks are now common, including zero-day exploits, malware, phishing, man-in-the-middle attacks, and denial of service attacks.

Intelligent agents known as malware are rapidly becoming the tool of choice for nations, criminals, and terrorists in finding the high ground of the 21st Century’s cyber battlefields.

Malware

Malware is making information control the capital of peace and the currency of cyber war. There is a realisation that the hero’s and jobs for action spy agents are becoming redundant. Cyberspace can now be used to monitor and spy on the seas, skies, streets and individuals.

Drones can be used to assassinate, machines can spy on systems, people and even on a leader’s mobile conversations, texts and emails.

AI can be used to monitor the intelligence services information and their correspondence open sources and classified information. All can be collected and analysed by machines.

The reputed second oldest profession will soon have far fewer jobs than in the past as HUMINT transforms to AIMINT.

Background

The UK is now repurposing its intelligence services with a £1.5bn annual top-up for Intelligence and Security and as the Former Head of MI6, Alex Younger, has said, comments, “..the digital world is a very interesting combination of an existential threat and a golden opportunity”.

Espionage techniques have evolved beyond the old methods of bugging rooms or tapping phone lines; today’s Watergate wouldn’t come from breaking into a hotel room, it would come from cracking an email server or a corporate network.

Already, we’re seeing these threats escalate in the political world, from the Democratic National Convention (DNC) email hack, to a spear-phishing campaign targeting US officials, to last year’s surge of sophisticated cyber-attacks against the State Department.

Tip Of A Cyber Iceberg

Cyber attacks have made it increasingly possible for foreign governments, international and local hackers to even alter election results. So where previous US election polls were concerned Hillary Clinton had apparently maintained a marginal lead over Trump, Hillary on 45% against Trump on 41%. There is also definitely something in the air in the US where the mass of ordinary people are rebelling against the ruling establishment elite who have had an increasing grip on power through institutions and the media for at least the past 40 years.

Hundreds of millions of dollars are being spent conducting opinion polls across the States, many if not most of which tend to have in built bias's that ensures their primary function is in terms of perpetuating a propaganda message in the interests of those commissioning the polls. This is the lesser known Malware message.

Internet protocols are now nearly 30 years old, and the Web has grown dramatically in scale; and it has acquired hundreds of additional protocols and extensions, making it increasingly complex to manage.

Around 65% of the world population now has an Internet connection. In 1995, it was less than 0.5%.

In 10 years ...

People will be so connected via the Internet that it has been suggested they will be able to create new digital "nations" with other people who share their interests. In the next decade, the number of people using the Internet will grow from 5.2 billion to 7/8 billion. Global connectivity has arrived in the past 25 years.

This is significant because like previous industrial geo-political and macro-economic revolutions this one reminds us that the age of connectivity is in its infancy, and most of the changes have yet to come. By the end of this year, there will be around 4.2 billion connected things, everything from smart cars, smoke detectors, door locks, industrial robots, streetlights, heart monitors, trains, wind turbines, even tennis racquets and toasters.

As digital technology continues to spread to the poorest parts of the world criminal and extremist groups operating here and there will also increasingly be given access to the new technology.

On the brighter side, digital technology should make it easier to track down and uncover illegal syndicates and bring them to justice, unless they are run by governments who have their own agenda.

This Has Been So For A Long Time

In Ancient Rome, major political players had their own surveillance networks, which provided them with information about the schemes of those in power. Politician and orator Cicero frequently lamented that his letters were being intercepted. "I cannot find a faithful message-bearer," he wrote to his friend, the scholar Atticus. "How few are they who are able to carry a rather weighty letter without lightening it by reading."

In the Middle Ages, the Roman Catholic Church was more powerful than most governments, and it had a powerful surveillance network to match. Religious confessions and the confession boxes were used to monitor and spy on local communities. The court of Elizabeth I was fertile ground for scheming and spies, and Francis Walsingham's job was to keep the monarch one step ahead of her adversaries. In May 1582, Walsingham intercepted letters written by Spanish ambassador to England, regarding a conspiracy to invade England and install Mary, Queen of Scots to the throne.

Walsingham came up with a way to prove she was a threat to the queen. He had most of her mail opened, but led her to believe that she had a secret means of correspondence through letters hidden in a beer keg. Walsingham gathered and added evidence of Mary's involvement in rebellious plots. She was put on trial for treason and beheaded.

Today Malware in its simplest form is similar to the way in which phone systems were originally used to listened to phone calls or to copy them.

Malware is any software used to disrupt computer operations, gather sensitive information, gain access to private computer systems and can engage in many other options including displaying unofficial counter-advertising. Malware is defined by its malicious intent, acting against the requirements of the computer user, and does not include software that causes unintentional harm due to some deficiency.

Spyware is a type malware sometimes found embedded in programs supplied officially by companies, e.g., downloadable from websites, that appear useful or attractive, but may have, for example, additional hidden tracking functionality that gathers marketing statistics. For example, Yahoo was recently found to have been secretly scanning millions of its users' email accounts on behalf of the US government. Reuters news agency says the firm built special software to comply with a classified request.

Today’s Types Of Malware

Malware: An umbrella term used to refer to a variety of forms of hostile or intrusive software, including computer viruses, worms, Trojan Horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other types of spy software.

Some categories of Malware include:

Virus: Software that can replicate itself and spread to other computers or are programmed to damage a computer by deleting files, reformatting the hard disk, or using up computer memory.

Adware: Software that is financially supported (or financially supports another program) by displaying ads when you're connected to the Internet.

Spyware: Software that surreptitiously gathers information and transmits it to interested parties. Types of information that is gathered includes the Websites visited, browser and system information, and your computer IP address. Spyware is software that aims to gather information about a person or organisation without their knowledge and that may send such information to another entity without the consumer's consent, or that asserts control over a computer without the consumer's knowledge.

Spyware can collect almost any type of data, including personal information like internet surfing habits, user logins, and bank or credit account information. Spyware can also interfere with user control of a computer by installing additional software or redirecting web browsers. Some spyware can change computer settings, which can result in slow Internet connection speeds, un-authorised changes in browser settings, or changes to software settings.

Browser hijacking software: Advertising software that modifies your browser settings (e.g., default home page, search bars, toolbars), creates desktop shortcuts, and displays intermittent advertising pop-ups.

Once a browser is hijacked, the software may also redirect links to other sites that advertise, or sites that collect Web usage information.

Today malware and spyware are used in many different environments, technologies and military equipment, including maritime vessels.

HMS Defender Is A Cyber Operational Warship

HMS Defender is the fifth of the Type 45 or Daring-class air defence destroyers built for the Royal Navy. She is the eighth ship to bear the name. Construction of Defender began in 2006, and she was launched in 2009. The ship completed her first sea trials in October–November 2011, and was commissioned during March 2013.

Its weapon system includes a directed-energy weapon (DEW) emits highly focused energy, transferring that energy to a target to damage it. Potential applications of this technology include anti-personnel weapon systems, potential missile defense system, and the disabling of lightly armored vehicles such as cars, drones, watercraft, and electronic devices such as mobile-phones.

Defender’s systems allow the ship to be made invisible to radar and satellite monitoring and it can also hide the aircraft carrier that often accompanies it on trips. By using its own radar, it can monitor a countries Internet and communications from hundreds of miles off from the coast. Her weapons system is able to track more than 2,000 targets and simultaneously control and co-ordinate multiple missiles in the air at once, allowing a large number of tracks to be intercepted and destroyed at any given time.

The US Pentagon is now begin to up-grade the potential of such vessels and is researching technologies like directed-energy weapon and railguns to counter maturing threats posed by missile and hypersonic glide vehicles. These systems of missile defense are expected to come online in the mid to late-2020s.

In 2016, US Attorney General Eric Holder announced that the United States was charging members of the Chinese military with economic espionage. Stealing trade secrets from American companies, he said, enabled China to “illegally sabotage” foreign competitors and propel its own companies to “success in the international marketplace.” The United States should know - that’s how they got a start as a manufacturing power, too.

Espionage Background

Throughout the late eighteenth and early nineteenth centuries, American industrial spies roamed the British Isles, seeking not just new machines but skilled workers who could run and maintain those machines. One of these artisans was Samuel Slater, often called “the father of the American industrial revolution.” He emigrated to America in 1789, posing as a farmhand and bringing with him an intimate knowledge of the Arkwright spinning frames that had transformed textile production in England, and he set up the first water-powered textile mill in the US.

Two decades later, the American businessman Francis Cabot Lowell talked his way into a number of British mills, and memorized the plans to the Cartwright power loom. When he returned home, he built his own version of the loom, and became the most successful industrialist of his time.

Britain had strict laws against the export of machines, and banned skilled workers from emigrating. Artisans who flouted the ban could lose their property and be convicted of treason. The efforts of Thomas Digges, America’s most effective industrial spy, got him repeatedly jailed by the Brits, and praised by George Washington for his “activity and zeal.”

Not that the British didn’t have a long history of commercial theft themselves. In 1719, in Derby, Thomas Lombe set up what’s sometimes called the first factory in the United Kingdom, after his half-brother made illicit diagrams of an Italian silk mill. Lombe was later knighted. In the nineteenth century Britain’s East India Company, in one of the most successful acts of industrial espionage, sent a botanist to China, where he stole both the technique for processing tea leaves (which is surprisingly complex) and a vast collection of tea plants. That allowed the British to grow tea in India, breaking China’s stranglehold on the market.

These days, of course, things have changed. The United States is the world’s biggest advocate for enforcing stringent intellectual-property rules, which it insists are necessary for economic growth. However, a current example might be Samsung, for instance, is known for being a “fast follower” in its consumer business, which really means that it’s adept at copying other companies’ good ideas. That’s not the same as theft, but evidence from its recent patent trials with Apple shows that Samsung’s response to the iPhone was, in large part, simply to do it “like the iPhone.”

Covert Malware Delivery

Malware writers are very experienced in using tricks to get users to download their malware. Software that comes bundled with "other software" is often called a "Trojan Horse." For example, an instant messenger software could be bundled with a program such as WildTangent, a known spyware offender.

Peer-to-peer file sharing software bundle various types of malware that are categorised as spyware or adware. Software that promises to speed up your Internet connection or assist with downloads will often contain adware.

Another common way to infect a computer is through email containing a seemingly benign link or email attachment.

Recently revelation that intelligence agencies have been gathering user data directly from nine of the largest Internet companies, including Google and Facebook, shocked and partially surprised many Americans and Europeans. Decades before intelligence agencies were collecting massive amounts of phone and Internet records, it was collecting telegraph records in an operation that raises similar legal issues and worries about lack of oversight.

For instance, in August of 1945, US Army representatives met in secret with the country’s three major telegraph companies, ITT World International, RCA Global, and Western Union. They explained that the Army Signal Security Agency wanted copies of all telegrams sent to and from the United States. World War II was coming to a close and the top secret, multinational Manhattan project had proven the power of foreign intelligence. Executives from the three companies agreed to comply, provided they were assured by then, Attorney General Tom Clark that it was not illegal for them to do so. There is no record any such assurance was officially given, but the operation went ahead anyway.

The telegraph operation, codenamed SHAMROCK, was a massive undertaking in the time before digital data storage:

Once a day, beginning in late 1945, the Army sent couriers to telegraph offices in New York; Washington, DC; San Francisco; and San Antonio to pick up all their international telegrams, which were stored at first on hole-punched paper and later on reels of magnetic tape. Analysts then sifted through the communiques, looking for encrypted intelligence and evidence of Soviet spying.

For the next two decades the program continued in secret, often even from the top staff of the NSA. This was impart, the model for PRISM, which Snowden exposed.

Cyber War

Edward Snowden has made the public aware of what’s now known as Cyber Warfare that involves the actions by a nation-state or international organisation to attack and attempt to damage another nation's computers or information networks through, for example, computer viruses or denial-of-service attacks.

Cyber war remakes old assumptions about national security and military engagement. Old metrics such as troop numbers or missile inventories become outdated. Cyber-warriors aren’t as easy to track as nuclear weapons or naval warships. Unlike in the Cold War, when the US and the Soviet Union were the only powers capable of exacting serious damage, cyberwar is inexpensive. Any nation might emerge as a threat, and the identities of the true combatants are never quite clear.

The new era of cyber war became public knowledge in 2012, when US intelligence officials leaked details of the malware Stuxnet, which took place a few years before the leak, was a piece of malicious software that American and Israeli forces developed to sabotage Iran’s nuclear weapons development. The virus infected some 300,000 computers, but it became active only in a fraction of them. Unlike the assassinations of Iranian scientists, which Israeli forces, probably its intelligence agency, the Mossad, performed, Stuxnet’s effect was invisible.

Stuxnet marked a new chapter in the annals of international confrontation: the first known instance of a computer attack that aimed for results in the physical world, rather than stealing data or clogging online traffic. Reflecting the importance of cyberwar, the Pentagon said it would ramp up its hacking capabilities.

Chinese hackers favor “spear-phishing attacks.” An email that appears to come from someone the recipient knows arrives in the morning, when the target might not be alert enough to notice that a familiar name accompanies an unfamiliar email address.

Or it arrives just before a long weekend, when the victim is hurrying to get out of the office. When the user opens an attachment or clicks on a link, the virus takes control of the computer. As the malware spreads, it gains access to more and more files.

Paying a hacker to steal secrets can be a cheap way to gain valuable business intelligence. Consider Su Bin, a Chinese hacker living in Canada. He was indicted in 2014 for stealing US military secrets. He targeted several military planes, amassing a stockpile of hundreds of thousands of documents, including drawings, wing measurements and flight-test data for the C-17 flight transport aircraft. While US taxpayers invested $3.4 billion to develop the C-17, Su Bin’s project to steal 630,000 related documents cost a mere $450,000.

After years of the US suffering losses valued in the billions of dollars due to economically-motivated cyber espionage from China, there are some signs that China has begun to reduce its intrusions into US private sector firms' computer networks.

This unexpected change in Chinese behavio may possibly because of the high-profile agreement signed by President Barack Obama and Chinese President Xi Jinping.

If China did reduce its economically-motivated cyber espionage, there are a number of possible explanations for why it did so. Some observers have argued that China actually started cutting back several months before last fall's summit agreement, perhaps taking steps to exert greater control over the community of military hackers. Other observers suspect that Chinese hackers may have simply redirected their efforts to other, more valuable or more vulnerable targets in other countries.

Many observers suspect that China's apparent compliance with the cyber agreement represents little more than a shift in tactics that is probably temporary.

Coming Soon Online

Social Media - particularly Twitter - has been used as a propaganda tool. The 2012 Gaza conflict was “the first Twitter war” – spokesmen for Israel and Hamas each posted up to 90 times a day. Hamas posted photos of people who were killed and buildings that air strikes had destroyed. Israel used Twitter to demonstrate its Army’s restraint and worked with volunteers to respond to anti-Israel Facebook messages. For both sides, “much of the social media played to the base, appealing to supporters and doing little to convince the other side or to sway neutral or uncommitted observers.”

Voting Systems are another problem for democracies is the electronic voting system. More often than not, electronic voting systems are nothing but bare-bone, decade old computer systems that lack even rudimentary endpoint security. Despite the recurring discussion on electronic voting vulnerabilities that occurs every four years, only limited attention is given to the systemic problem undermining American democracy.

To hack an election, the adversary does not need to exploit a national network of election technology.

By focusing on the machines in swing regions of swing states, an election can be hacked without drawing considerable notice. Voter machines, technically, are so riddled with vulnerabilities that hacking an election is easy. The electronic voting systems popularised in the United States in the early 2000s have been repeatedly proven vulnerable and susceptible to attacks that are so unsophisticated, a high school student could compromise a crucial county election in a pivotal swing state. This could be done with equipment purchased for less than $100, potentially altering the distribution of the state’s electoral votes and thereby influencing the results of the Presidential election.

The United States e-voting system is so vulnerable that a small group of one or a few dedicated individuals could target a linchpin district of a swing state and sway the entire Presidential election. Previous close elections similar to the one this November are for instance, in 1960, John F. Kennedy only had 112,727 more votes than Richard Nixon. The 2000 election between George W. Bush and Al Gore was similarly contentious and it may have depended on as few as a few hundred votes.

A single unsophisticated attacker who spoofs a few hundred votes or who disrupts voting operations at a few key locations could have a similar impact on a future election, if they have not done so already.

If the attacker has access to the administrative card or if they can infect a machine with malware that will spread onto the administrative card, then they can spread malware onto multiple machines and increase their sway over an election.

The world first went global with international trade shipping and was soon corrupted by some clever criminal technologies who created effective pirate ships used to attack trading vessels. Governments over the years began to realise that pirates could be used for their national attack and ‘defence’ tactics. Privateers were created which are of course now similar to government hacking teams. They like pirates are apparently ‘independent of government’ and can be used to carry out government/military attacks.

Although privateers were considered a type of pirate, they were more like navy soldiers as most of their actions were legal. They were authorised mostly during the wars by the government of a country or by some group, like a trading company. Besides some specific tasks, their orders were to capture or destroy vessels of enemy nations and seize their valuables. The proof of authorisation was letters of marque and reprisal. Both, the nation and privateers, benefited from those deals. Many sailors got plenty of opportunities for an easy-profiting and exciting job. They could attack ships and ports without the fear of potential punishment.

On the other side the privateers were drastically increasing the size of the nation's navy. Whatsoever, the government didn't have to pay the crew, to arm or supply them. Instead, they even gained great wealth as privateers were giving percent of sold plunder to their backers in exchange for their immunity.

Privateers History

In 1243 King Henry III of England granted the first Letter of Reprisal. The Privateers were the most active between the 16th and 18th century, in a period when many European nations fought each other for dominance in the New World. Famous commanders like Sir Francis Drake built names and became heroes of their nations as privateers. They lasted until 1856 and the Declaration of Paris.

Since that year, the practice of privateering has been illegal in international law, however, a new form of privateer, the nation-state hacker, has emerged.

Since Russia’s sponsored cyber attacks on Estonia US spies and security researchers say Russia is particularly skilled at developing hacking tools. Some malicious software linked to Russia by security researchers has a feature meant to help it target computers on classified government networks usually not connected to the Internet. The malware does this by being loaded onto USB thumb drives connected to targeted computers, in the hopes that the user, such as US military personnel, will then plug that USB drive into a computer on the classified network.

Hacking the Internet of Things

Cyberwar’s victims usually reside in cyberspace: Hackers cripple a website, spread misinformation or steal secrets, but they don’t wreak physical damage.

That could change. Consider cars. Software increasingly operates control systems as crucial as the brakes and the gas pedal. Since software systems are vulnerable, hackers can affect cars through several access points, like keyless entry, navigation or emergency systems. Former NSA hacker Charlie Miller posted videos of himself remotely taking control of a Ford Escape and a Jeep.

The Internet of Things creates new levels of complexity for those enforcing cybersecurity and creates new opportunities for cyber-spies. By one estimate, some 75 billion devices, everything from kitchen appliances to office equipment to manufacturing systems, will be linked to the Internet by 2025.

This new world order might also allow far greater surveillance of individuals by governments. A UCLA engineer notes that ever-cheaper data storage could allow public officials to record and catalog everything that happens online.

A newly discovered piece of malicious code dubbed Duqu is closely related to the notorious Stuxnet worm that damaged Iran’s nuclear-enrichment centrifuges. Although it has no known target or author, it sets the stage for more industrial and cyberwar attacks. The code can monitor messages and processes, and look for information including the design of so-called SCADA systems (for “supervisory control and data acquisition”). These are computer systems that are used at industrial plants and power plants to control things like pumps, valves, and other machinery.

Like Stuxnet, which infected thousands of computers in 155 countries last year, Duqu got aboard victim computers by means of a stolen digital certificate, a cryptographic code that authenticates a piece of software on a target machine.

From power smart grids to the Internet of Things, the potential targets of cyber warriors are now multiple and the possible consequences catastrophic.

Premeditated, politically or socially motivated attacks against a computer-dependent society could be orchestrated by foreign powers and affect nations at any level: from the availability of utilities, to denied access to important financial and medical information, to causing a significant impact on national GDPs.

Some people have asked can digital attacks really have such tangible effects? Yes.

An oil pipeline in Turkey was cyber attacked and exploded in 2008. The pipeline was super-pressurised and alarms were shut off. By hacking security cameras, attackers were able to hide the blast from the control room that, unaware, was unable to respond promptly.

Another attack to a German steel company demonstrated how, by simply infiltrating the information systems running the plant, hackers could cause major damage.

What makes a cyber warfare attack appealing? Mainly the fact that it can come at little or no cost for the perpetrator. An attacker with great technical capabilities can create disruption by using a single computer wherever he or she is located.

While the use of conventional weapons requires expensive manufacturing and physical travel to target locations, cyber attacks can be conducted from anywhere.

Accountability is hard to prove when cyber weapons are used. By using several proxies or infecting computers indirectly, it is difficult to trace back to a particular malicious hacker or organisation on any form of attacks. And even if a culprit is found, it is hard to accuse a nation of a deliberate act of war, especially due to lack of a legal framework.

Lacking a real global response to cyber warfare, many countries and organisations are creating structures and task forces to prepare against cyber threats. According to intelligence studies, more than 140 countries have funded cyber weapon development programs.

Conclusion

Some of the numerous larger-scale cyber-attacks can be intuitively considered acts of cyber war. With many countries large and small investing in cyber warfare, it is impossible not to think of the use of “information warfare” as a new form of terrorism.

Information warfare goes beyond simply attacking computers and communications networks, as a computer-literate terrorist can wreak havoc causing physical destruction and harm to populations.

The Internet can be turned into a weapon used against targets by terrorists hidden in cyberspace to carry out cyber violence and disruption, while being physically located elsewhere. Computer-related crimes, as an extension of terrorist attacks, have the potential of bringing catastrophic side effects.

Right now, we are clearly in a cyber arms race, and what is most frightening is that far more development is going into offensive than defensive tools. Yet, several experts believe the malware, which was initially described as not particularly sophisticated, could now determine the future of warfare as well as global electronic connectivity.

So, how do we counteract such attacks? If cyber warfare is considered war, then anti-terrorism defenses must be deployed. First, though, a legal basis for responses to attacks must be defined. A legal definition of cyber war and cyber weapon, a definition agreed upon globally, is necessary to define the perimeters within which nations can operate in cyberspace. It is important to define what to consider cyber espionage, cyber war or an act of simple hacking.

Thpotentialal for new AI platforms to generate at least partially intelligent malware it seems likely and that it can evolve to a more advanced offering and the idea of AI-powered malware package is already taking form

Some observers think that will be used for future hostile acts and that the power to destroy connected and disconnected computers, with the potential for uncontrolled AI-generated attacks against humans. Others say that the interconnected global society will bring about a positive social revolution.

Thomas Paine’s pamphlet Common Sense, a bestseller in the 13 American colonies when it was published in January 1776, marking a revolution, which was not identical with the revolutionary war against Britain that began later that year. The reach of Common Sense is immeasurable, because it was not just sold but was also read aloud at churches and meetings. The idea that hereditary monarchs were somehow spiritually superior to the rest of us was decisively rejected.

The 1848 uprisings around Europe were substantially a protest against voting laws that limited voting to only a minority of men: property holders or aristocrats. Women’s suffrage followed soon after. In the 20th and 21st centuries, we have seen civil rights extended to racial and sexual minorities, but more needs to be done using the electronic revolution. All of the past “justice revolutions” have stemmed from improved communications. Oppression thrives on distance, on not actually meeting or seeing the oppressed.

The next revolution will not abolish the consequences of place of birth, but the privileges of nationhood will be tempered. While the rise in anti-immigrant sentiment around the world seems to point in the opposite directiosn, the sense of injustice will be amplified as communications continue to grow. Ultimately, recognition of wrong will wreak big changes.

This next revolution will likely to occur in the 21st century, it will challenge the economic foundtaions of the nation state. It may well focus on the injustice that follows from the fact that, by chance, some are born in poor countries and others in rich countries.

As more people become connected by technology and get to know more people from other countries, our sense of justice is being woken and engaged and the ability of nations to Spy on us will improve.

References:

NY Times NBC: Wired:

BBC: degruyter vmware

statista Image: Gernot Riepen

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.