Pierluigi Paganini: Fear Iran and escalation of cyber attacks

 

 - OPEN SOURCE

IranianCyberWar/LinkedIN; US/1; ATTN: IS/[redacted], HD/23; HST/2; Mil.COM/2; US/17     Member CONTRIBUTION

by paganinip on April 30th, 2012

Last week I reported the virus attack to the Iranian oil industry, a cyber attack that seems has caused few damages but that raised again the theme of cyber warfare. Oil industry is the primary economic business of Iranian Government and an attack to the sector appears to the experts as a cyber war acts. In the past Iran was already victim of cyber attack to its nuclear plants, we all remember the case of the Stuxnet Virus, for this reason the Iranian intelligence is convinced that also this time the nation is facing with a new cyber attack. Iran has in great consideration the theme of cyber warfare and it government is making big investments to strengthen the technological structure of the country and to promote effective cyber strategy.

Immediate reaction to the incident, on Saturday Iranian oil ministry’s cyber team has identified the targets of the attack and also the responsibles. Despite the Iranian officials haven’t revealed the identity of the responsibles they have provided more information regarding the attack and the real damages, they have in fact confirmed a virus has hit the structures of Kharg Island plant destroing minor data and some user’s hard disks. For all the data infected the experts have a copy of backup that has been restored without problems.

“The nature of the attack and the identity of the attackers have been discovered, but we cannot publicize it since we are still working on the case,”

Deputy Oil Minister Hamdollah Mohammadnejad told FNA.

“the attack was carried out by virus penetration and was aimed at stealing and destroying data and information.”

The spokesman’s words are eloquent, the attack hasn’t had the sole intent to destroy data, but it is part of a complex strategy that aims to infiltrate the Iranian networks gathering sensible information.

“those who design and develop such viruses are pursuing specific goals”.

Obviously there is the announcement in tones of propaganda immediate resumption of operations at the site attacked, senior Iranian oil ministry officials announced earlier this week said their computer systems resumed normal operation on Wednesday.

Iranian Oil Ministry’s Spokesman Alireza Nikzad-Rahbar declared that main services of the ministry’s computer systems, including the Administrative Automation System were up again on Tuesday evening, and that all the Iranian government experts have adopted all precautions to minimize the impact of a cyber attack ensuring the business continuity.

Iranian government is aware of the destructive capabilities of cyber weapons and the importance of appropriate cyber strategy, rather it is believed that in this area, the Western enemy may be more vulnerable. On March 2012 the leader of the Islamic Revolution Ayatollah Seyyed Ali Khamenei has tasked Iranian President Mahmoud Ahmadinejad with the duty of establishing a Supreme Council of Cyberspace which is charged with protecting the Iranian cyberspace

The registered attack is not the only one against Iranian infrastructures, Iranian Sharg newspaperhas reported that hackers have attacked the computers of Iran’s ministry of science, of course also this time there aren’t damage. Iranian expert also in this occasion have noted that the hackers haven’t the only purpose to destroy data but they were more interested to steal information.

An analysis of activities in cyber space clear the escalation of cyber conflict in the Middle East with Israel as the main protagonists, and the emerging Iran and Lebanon. The detailed Middle East Cyber War Timeline is available on the web site of the collegue Paolo Passeri, following a brief list of the events.

The intensification of the attacks provides an indicator of the level of tension in the area, and portends a military intervention to date avoided only by the veto of countries like China and Russia backing the government in Tehran. The intense activity also impacts on the policies of leading western nations, U.S. in the lead. 

The Iran issue is beginning to worry the American government, and not only, that through a media campaign is trying to rally support for military intervention in the area. Attempts of diplomacy did not match the expected results allowing the government in Tehran to organize an alarming strategy. Recall that world experts believe that Iran can have its own nuclear arsenal within two years, this time the West will have to decide how to act and precede.

Very significant is the report “The Iranian Cyber Threat to the U.S. Homeland” Statement before the U.S. House of Representatives Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies and Subcommittee on Counterterrorism and Intelligence. In the document are analyzed the growing Iranian capabilities, the country expanding exploitation of cyberspace can be attributed to two principal geopolitical drivers:

1. The first are the Iranian regime’s efforts to counter Western influence and prevent the emergence of a “soft revolution” within its borders. That digital barrier has grown exponentially over the past three years, as Iran’s leadership has sought to domestic dissent and curtail the ability of its opponents to organize.
2. The second geopolitical driver of Iran’s interest in cyberspace relates to the expanding conflict with the West over its nuclear ambitions.

The report clarify the position of Teheran that is considering itself engaged in a cyber war with West, due this reason the Iranian regime is mobilizing in response launching an ambitious $1 billion governmental program to boost national cyber capabilities, acquiring new technologies, investing in cyber defense, and creating of a new army of cyber experts.

Where does the United States stand with regard to a response? The Obama administration has made cybersecurity a major area of policy focus since taking office in 2009, and the past year in particular has seen a dramatic expansion of governmental awareness of cyberspace as a new domain of conflict.

The U.S. government, in other words, has not yet even begun to get ready for cyberwar with Iran, and according the report it’s time to start it. The risk of attacks against infrastuctures located in US homeland is high and it will increase in coming months due a range of scenarios, from a renewed diplomatic impasse to a further strengthening of economic sanctions to the use of military force against Iranian nuclear facilities.

Never let the guard down!

Pierluigi Paganini

http://securityaffairs.co/wordpress/4799/intelligence/fear-iran-and-escalation-of-cyber-attacks.html?goback=.gde_37658_member_111511700

[Information contained in BKNT E-mail is considered Attorney-Client and Attorney Work Product privileged, copyrighted and confidential. Views that may be expressed are those of the author(s) and do not necessarily reflect those of any government, agency, or news organization.]

PIERLUIGI PAGANINI: Iran, and her Oil Industry under cyber-attack, are we close to a military strike?

-LIMITED DISSEMINATION – I/Cy-WAR—SWG(A) -[Lifted]

IranianCyberWarfare/LinkedIN.com; US/1; ATTN: US/17…Order the Pizza …?

[ed.note: New BlackNET Intelligence Channel “IRAN/’Cy’-WAR—Special Working Group (Augmented)” is hereby instituted, without objection?

 BKNT Designator: As above - I/Cy-WAR—SWG(A)

Outside of  the obvious Members, additional BKNT-Volunteers are SOUGHT.

CONTACT: US/1@BKNT-HQ at the sender’s address above.

(Inside of the obvious is…obvious…?)

And Please welcome aboard the BlackNET ship-of-lollipops, our newest ADOPTEE, err.. Member, the below author, Pierluigi Paganini (no doubt a confirmed ‘foreign’ national—but that would depend on one’s perspective...]

SECURITY AFFAIRS.co; VIA:IranianCyberWarfare

by paganinip on April 24th, 2012

A new cyber-attack against Iran, in particular this time the Oil Industry was the target of a Malware Attack. The news was widespread by Officials in the Iranian oil ministry, they say that their network and the country’s main oil export terminal were infected with a malware; due this event the government has taken temporarily systems offline. An instance of the virus used for the attacks was found in the control systems of Kharg Island, the place provides a sea port for the export of oil and extends Iranian territorial sea claims into the Persian Gulf. The operations inside the terminal continued, no recording interruption due to the attack. According Iranian officials only one server was compromised, it was used to provide public information.

We all remember that the nation in 2010 was victims of another cyber attack, when the Stuxnet worm infected control systems inside nuclear plant in Iran. worldwide experts recognized in Stuxnet agents a powerful cyber weapon used to stop the nuclear program of the Iranian government. Immediately, experts have thought of that episode was related to the discovery made in recent months of a platform for the creation of similar cyber weapons, the “Tilded Platform“, assuming that the new virus was created by the same team.  The first news reported in security sector say that the malware used in the attack is not related to Stuxnet, so meanwhile the Stuxnet was developed by foreign governments to attack the Iran, at the moment it’s impossible to make hypothesis on the source of the malware. According the declaration of an Iranian oil ministry spokesperson the virus attacks has infected public servers that were immediately isolated, no particular damage were reported.

The Mehr News Agency revealed the National Iranian Oil Company and other businesses were under attack on Sunday 22th April, no information has been exposed and the attacks were successfully mitigated. It’s clear that behind the attacks there is a defined strategy to mine the main sector of the country, and Oil sector is the most important. The Government of Teharan is involved in a cyber war with the United States and Israel, periodically it reports cyber-attacks to its nuclear and industrial sectors, always declaring that minor damage were caused. Earlier this year, head of Iran’s civil defense agency Gholam Reza Jalali said the energy sector of the country has been a main target of cyber-attacks over last years.

As usual in similar case are circulating news not confirmed by the official sources. Many expert are convinced it is early to hazard hypothesis of connection with Stuxnet and Duqu. The first news related to the incident indicates that only the website of the oil ministry that was hit during the attacks and that not control systems was infected. If confirmed of course we can resize the impact of incident reformulating new hypotheses on its origin.

John Bumgarner, a security specialist with the think tank U.S. Cyber Consequences Unit, declared to the Reuters Press that the purpose of similar malware is to attack the production processes erasing data and shutting down operations.

“The reason you would put a virus inside this network to erase data is because that causes those facilities to have to shut down” and to rebuild servers, he told Reuters.
“So during that time the production and refinery operations for Iran could be impacted. And depending on how the virus was written, it could be longer term.”

In the last months the Iran has been banned from the purchase of antivirus systems, a technological embargo with clear implications for the Stuxnet virus attacks and the need for the country to prevent further infections to industrial control systems for critical infrastructures. It was announced an international sanctions to stop the Government of Teheran from obtaining commercial anti-virus software, according to a senior Iranian intelligence official. The reply of Teharan was immediate, the announcement was been made public by FARS news agency, and Iranian Deputy National Security Minister for technical issues Ahangaran said the country is being forced to design its own anti-virus software due to the sanctions. Ahangaran said that Iran is unable update antivirus programs and combat Internet viruses because of the imposed ban.

To respond to the cyber-attacks and with the intent to be more active in the cyber warfare Iran has recently announced a series of cyber defense measures spearheaded by the Revolutionary Guards, the unit which already runs every key military program in Iran and many industries.  All the strategic servers of the government moved inside the country and for them special protection measures have taken, the Revolutionary Guard in March also set up an hack-proof communications network for its high-level officials.

   These are just last measures in order of times, we must consider that an emerging expertize in cyber warfare. Under Cyber warfare perspective we must consider Iranian expertise. During the protests after the disputed election in 2009 Iran has demonstrated to have the complete control of its cyberspace thanks the collaboration of western companies and to strategic alliance with technologic countries like China. The country is investing in cyber training program and in recruiting of young nationalist building a parallel covert cyber army already engaged to suppress domestic protest that could be easily employed like a cyber weapon against external enemies.

The Iranian Revolutionary Guards Corps, IRGC, seems to have built one of the largest forces of hackers on the planet. “Emperor”, “Iran Hackers Sabotage” these are the names of the main group of hackers that during the last year have conducted several operation like destroy a government database or hack into two candidates’ websites. during the 2005 presidential election. If in terms of cyber offense Iran has a considerable force not so it can be said of cyber defense strategy.

Obviously not all hacking groups in Iran are under government control, emblematic is the case of a group that managed to carry out a fraud to the detriment of some banks in the country for several million dollars.

In May 2010, Ebrahim Jabbari, a provincial Revolutionary Guards commander, declared that the IRGC had the world’s second-largest cyber army at its disposal, the US intelligence is convinced of the potential of groups to the point of recognizing them as among the major cyber threats to the country.

In addition to cyber warriors and mercenaries, the Iran regime also has the control of the private IT firm Ashiyane Security Group, which has coordinated several cyber-attacks from Iran. Its illustrious victims are Mossad, Defence minister Ehud Barak, NASA and several websites in the Arab world. It is clear in my opinion that the cyber strategy aimed against Iran by Western governments are continuing to undermine the nuclear weapons ambitions of Teheran.

The embargo, in addition to reinforcing the belief that the dangerous virus was indeed developed by Israeli agents and / or the U.S., suggests that these countries are focusing their efforts in prelude to a conventional military offensive against Iran.
Are we also close to a military attacks against Iran?

Certainly events like this might make us think that the event is close, but I believe that its strategy against the Iranian government does not provide urgently the option of a military attack. The situation is very complex and there are interests too high that involve nations like Russia and China…

[…and ISRAEL, AZERBAIJAN, and GEORGIA;  and eventually, even IRAQ and TURKEY. (US/1)]

A possible U.S. or Israeli military attack could trigger a dangerous political situation with unpredictable consequences.

Pierluigi Paganini

http://securityaffairs.co/wordpress/4654/intelligence/iranoil-industry-under-cyber-attackare-we-close-to-a-military-strike.html?goback=.gmp_1271127.gde_1271127_member_110065323

[Information contained in BKNT E-mail is considered Attorney-Client and Attorney Work Product privileged, copyrighted and confidential. Views that may be expressed are those of the author(s) and do not necessarily reflect those of any government, agency, or news organization.]

CyBER-BlackSEC--EPIC v. NSA; VC/JCS v. DepSECDEF--OS

VS/2; US/1; ATTN: US/12; JAG/1; HST/2; JAG/5

EPIC v. NSA: Agency Can "Neither Confirm Nor Deny" Google Ties

A federal judge has issued an opinion in EPIC v. NSA, and accepted the NSA's claim that it can "neither confirm nor deny" that it had entered into a relationship with Google following the China hacking incident in January 2010. EPIC had sought documents under the FOIA because such an agreement could reveal that the NSA is developing technical standards that would enable greater surveillance of Internet users.

The "Glomar response," to neither confirm nor deny, is a controversial legal doctrine that allows agencies to conceal the existence of records that might otherwise be subject to public disclosure. EPIC plans to appeal this decision. EPIC is also litigating to obtain the National Security Presidential Directive that sets out the NSA's cyber security authority. And EPIC is seeking from the NSA information about Internet vulnerability assessments, the Director's classified views on how the NSA's practices impact Internet privacy, and the NSA's "Perfect Citizen" program. 

Tags: Google NSA NSPD54 Privacy

http://epic.org/2011/07/epic-v-nsa-agency-can-neither.html

- OPEN SOURCE

-------------------------------------------------------|

CBS News Exclusive on US Cyber-WAR Center:

http://www.washingtonpost.com/national/national-security/us-defense-secrets-stolen-in-cyber-attacks/2011/07/14/gIQAgjV2EI_video.html

U.S. cyber approach ‘too predictable’ for one top general

By Ellen Nakashima, Published: July 14, 2011

The nation’s second-ranking military official said Thursday that the U.S. approach to protecting its computer systems was “too predictable” and failed to penalize attackers, comments that preceded the release of a Pentagon cyber strategy that emphasized defense over retaliation.

“We’re on a path that is too predictable, way too predictable,” Gen. James Cartwright, vice chairman of the Joint Chiefs of Staff, told defense reporters Thursday. “It’s purely defensive. There is no penalty for attacking us now. We have to figure out a way to change that.” 

Hours later, Deputy Defense Secretary William J. Lynn III presented a strategy whose thrust, he said, is defensive and focused on “denying the benefit of an attack.”

To illustrate the growing threat, Lynn disclosed that in March, the Defense Department discovered that a foreign intelligence service had hacked into a defense contractor’s system and stolen 24,000 computer files related to a weapons system under development, one of the largest known cyberattacks targeting the U.S. military.

Lynn did not name the contractor or the government behind the intrusion but said the Pentagon was reviewing whether the weapons system needed to be redesigned.

The Defense Department’s newly unveiled strategy relies on deploying sensors, software and special signatures, or lines of code, that detect and stop intrusions before they affect operations.

“If an attack will not have its intended effect, those who wish us harm will have less reason to target us through cyberspace in the first place,” Lynn said.

Defining an act of CyBER-WAR, VC/JCS Gen. James Cartwright said during a recent press conference on the subject: “it’s in the eye of the beholder.”

Cartwright, in his remarks to defense reporters, suggested that stronger deterrents would be needed. “We are supposed to be offshore convincing people if they attack, it won’t be free,” he said, adding that adversaries should know that the United States has “the capability and capacity to do something about it.”

Cartwright, who appeared with Lynn at a news conference after the strategy rollout, described the cyber plan as a first step. “This starts us down the path of building out both our defenses and our awareness skills,” he said. Eventually, he added, more aggressive cyber tactics, as well as legal and diplomatic measures, would be needed to “raise the price” of attacking. 

Over the past year, President Obama had asked Cartwright several times whether he would be willing to become chairman of the Joint Chiefs of Staff, The Washington Post reported in May, but Obama later turned to another candidate. Cartwright is leaving office this summer.

Stewart A. Baker, a former National Security Agency general counsel, in a blog post likened the Pentagon’s new cyber plan to a nuclear deterrent strategy of building more fallout shelters. “This is at best a partial strategy,” he wrote. “The plan as described fails to engage on the hard issues, such as offense and attribution and, well, winning.”

Rep. Jim Langevin (D-R.I.), co-founder of the Congressional Cybersecurity Caucus, said that the plan was a good start but that key areas were missing. “What are acceptable red lines for actions in cyberspace? . . . Does data theft or disruption rise to the level of warfare, or do we have to see a physical event, such as an attack on our power grid, before we respond militarily?”

Lynn said that the United States has not yet been hit by an act of cyber war and that there was deterrent value in remaining ambiguous about what would constitute one. But ultimately, he said, it is the president and Congress that would decide that the human or economic damage is severe enough to consider a cyber event an act of war. He said the Pentagon would take the lead only if, in the “judgment of the leadership of the country, it required a military response.”

Cartwright, at the news conference, said the disabling of computerized patient records at a hospital such that the patients cannot be treated would be a violation of the law of armed conflict. “Then you have proportional responses” that can be undertaken, he said, without specifying which or by whom.

But when it comes to an act of war, he said, “it’s in the eye of the beholder.”

Staff writer Jason Ukman contributed to this report.

© The Washington Post Company

 CONTINUE Reading FULL STORY HERE...

FP: Why Missiles Won’t Scare Cyber-Terrorists--OS

- OPEN SOURCE  US/1; ATTN:

US/121; US/12; VADM/2

Why Missiles Won’t Scare Cyber-Terrorists

 Pentagon planners are dusting off the Cold War deterrence playbook to plan for cyberattacks, but Iraq and Afghanistan would be better models.

BY ROBERT HADDICK | JUNE 3, 2011 

The Pentagon's cyberwarfare doctrine begins to emerge

 

This week, the Wall Street Journal revealed that Pentagon strategists are completing a document that outlines the government's cyberwarfare strategy. The Pentagon is expected to publish an unclassified version next month. According to the Journal, Pentagon strategists are prepared to declare that a sufficiently damaging cyberattack against the United States could be viewed as an "act of war," warranting equivalent retaliation. 

And that retaliation would not necessarily be a U.S. cyber-counterstrike. As one official put it, "If you shut down our power grid, maybe we will put a missile down one of your smokestacks." It is good that the government is finally establishing a doctrine for dealing with cyberwarfare. But strategists still must grapple with a challenging form of warfare that combines elements of Cold War-era deterrence theory and modern counterinsurgency doctrine.

According to the Washington Post, the Pentagon has developed a list of cyberweapons, including various worms and viruses, for use either in support of an existing military campaign or for use, with presidential approval, at the strategic level. According to the emerging doctrine, U.S. military commanders in existing war zones would have the authority to use cyberweapons to collect intelligence from adversary networks and support tactical operations in a broader military campaign. At the strategic level, presidential approval would be required for attacks against an adversary's industrial infrastructure like the Stuxnet worm against Iran's nuclear complex. 

It is not so simple to find a neat divide between strategic cyberattacks requiring presidential approval and tactical attacks delegated to field commanders. The doctrine appears to reserve to the president the decision to attack portions of an adversary's civilian infrastructure. But in an ongoing military campaign, adversary military forces will use portions of the civilian infrastructure -- for example, the telecommunications system -- for tactical military purposes. This will certainly be true if the adversary is a nonstate actor. A local commander's tactical use of cyberweapons could have wider strategic effects. As with all doctrine, the emerging cyberwarfare doctrine will undergo many changes after decision-makers encounter practical experience. 

The Journal article highlighted the threat to use traditional military power in retaliation for a cyberattack that cripples U.S. infrastructure. Reserving the right to expand the boundaries of retaliation should not come as a surprise. Earlier this year, Gregory Schulte, deputy assistant secretary of defense for space policy, discussed a similar retaliatory policy when he rolled out the National Security Space Strategy. As I discussed in a column at that time, that strategy seeks to use diplomacy and soft power to protect U.S. assets and interests in space. But if it became necessary, Schulte asserted a broad retaliatory policy to deter attacks on U.S. space interests. The emerging cyberwarfare doctrine appears to follow the same principle. 

Announcing such a policy is one thing. Implementing it in a crisis won't be easy, as Cold War policymakers discovered to their discomfort. Recently, anonymous hackers attempted to penetrate Lockheed Martin's networks and apparently did succeed in cracking into Google's Gmail service. Having caused no deaths or widespread economic calamity, such attacks wouldn't seem to rise to the level requiring the kind of punitive retaliation discussed in the Wall Street Journal piece. 

But these incidents expose some of the dilemmas cyberwarfare strategists will face. Who exactly were the attackers? The problem of attribution remains unsolved, at least to the degree necessary to convince world opinion that punitive and deadly U.S. retaliation would be legally and morally justified. The emerging U.S. cyberwarfare doctrine will presumably seek to hold governments responsible for the cyberattacks that originate from their territory. Such a policy is designed to elicit cooperative behavior from governments. But it creates opportunities for mischief by nonstate actors and will set up an agonizing test of the U.S. government's retaliatory credibility. 

Policymakers are tempted to view cyber warfare through the lens of deterrence theory. But as long as the attackers remain anonymous, cyberwarfare more closely resembles counterinsurgency -- a form of warfare where the U.S. government is still struggling to crack the code…

Robert Haddick is managing editor of Small Wars Journal.

CONTINUE FULL Story at:

http://www.foreignpolicy.com/articles/2011/06/03/this_week_at_war_coincom

[Information contained in BKNT E-mail is considered Attorney-Client and Attorney Work Product privileged, copyrighted and confidential. Views that may be expressed are those of the author(s) and do not necessarily reflect those of any government, agency, or news organization.]