Ukraine Crisis Fits Cyber War Narrative

Looks like there is a  a direct connection between the geopolitical climate and the increase in cybercriminal activity.

When Kenneth Geers (pictured), an expert ambassador of the NATO Cyber Centre, first suggested two years ago that there might be a connection between spikes in cybercriminal activity and spikes in geopolitical conflict, there was skepticism. Since then, NATO has declared cyberspace a domain for war and regions of geopolitical strife have also seen their fair share of cyberespionage and cybercrime. What's been learned and has the skepticism waned or grown?  

Geers, who has been living in Ukraine for the past two years, will discuss this in an forthcomingcoming session at Black Hat USA, "Cyber War in Perspective: Analysis from the Crisis in Ukraine." The talk will cover some of the work published by 20 prestigious researchers on behalf of the NATO Cooperative Cyber Defence Center of Excellence (CCDCOE), investigating the cyber activity in the region between 2013 and 2015.

Two years ago, Vladimir Putin signed a bill incorporating the Crimean peninsula into the Russian Federation, and Russian military forces massed along the Ukrainian border. Geers was a global threat analyst for FireEye at the time, and noticed a spike in malware traffic traced back to Ukraine and Russia at the height of the conflict between the two nations.

Geers tentatively suggested at the time that there could be a connection between the geopolitical climate and the increase in cybercriminal activity, and that this connection could be used for threat intelligence. He received some pushback, at the time, even among colleagues within FireEye.

Since then, however, Ukrainian targets have been hit with more cyberattacks that directly or indirectly impact the country's autonomy.   

Ukrainian presidential elections in 2014 were “completely, utterly, thoroughly hacked,” says Geers. Three days before the election was to be held, a pro-Moscow hacking group attacked the election commission. As a Wall Street Journal feature described:

Its stated goal: To cripple the online system for distributing results and voter turnout throughout election day. Software was destroyed. Hard drives were fried. Router settings were undone. Even the main backup was ruined.

A valiant effort by the election commission's IT staff rebuilt the voting system in time for the election, starting from an offline backup. However, attackers were able to post false election results that appeared to be hosted by the Commission's website -- media outlets reported these false results briefly before they were debunked.

Cyber war skeptics would argue that these attacks didn’t actually change the results of the election, so the impact was minimal, says Geers, who maintains “it degrades the integrity of the government” and the systems on which it relies.

In addition to these moves against elections, there have been cyberattacks on Ukraine's banks, railroads, mining industry, and of course the highly publicized one in December that took down a significant portion of the Ukrainian power grid. 

Skeptics of the very existence or possibility of "cyber war" could point to attacks like these and dismiss them by saying they did not cause death or widespread destruction. They therefore challenge terms like "Cyber Pearl Harbor."  

"People don’t like it," says Geers, "but we talk about ['Cyber Pearl Harbor'] a lot at Cyber Command.”

The term, says Geers, is in reference to the tactical advantage the Japanese forces gained in World War II by the attacks on Pearl Harbor. "It wasn’t meant to win the war. It was meant to create some breathing space.”

Similarly, he says, cyberattacks can be used “to give you a bit of time. An edge.”

Disrupting satellite communications, causing mass blackouts, derailing trains, or stirring up some public unrest, might not be the ultimate goal, but it could be a strategic maneuver in a war. It's something to divert leaders' attention and resources away from something of greater importance. 

Perhaps more sinister, is the possibility of cyberattacks being used to change data. “So the ship goes left, not right. So the agent meets at 2, not 12. Those things could get people killed," and that, says Geers, is not hyperbole. A cyberattack, he says “is not an artillery barrage, but you could lead troops into an artillery barrage” with a cyberattack.

The changes could be smaller, he says, to less critical systems, and maybe socks get sent to the base that needs more bullets and bullets get sent to the base that needs more socks. Regardless, it's a matter of diminished integrity, says Geers -- diminished integrity of data, of systems, and of people.

Once citizens' trust in their own nation is compromised, they could be open to other kinds of manipulation, like "psyops," (psychological operations), the process of changing people's minds -- something Geers says Russian intelligence is particularly good at. 

Regardless of what skeptics believe, NATO officially declared cyberspace a domain for war in June, which would mean that an act of war in cyberspace would initiate a collective response by NATO allies. (Neither Russia nor Ukraine are NATO member countries.)

Geers says that governments will spend “ungodly” amounts to prepare the battle space for the military, and that he's sure they are investing heavily in ways to compromise military vehicles.

"They're floating, driving, and flying computers at this point," he says. What has become clear to Geers and his co-authors of the NATO CCDOE book is that as geopolitical tension rises, not only does the amount of malware traffic rise -- as Geers reported in 2014 -- but so does the number of sophisticated cyberattacks. Which one is driving the other?

To this point, says Geers, geopolitics has been driving the cyber activity -- with both intelligence agents and opportunistic financially driven attackers upping their game when the action gets hot. However, he says, “the ubiquity of computers will mean they’ll begin to play a lead role.”

Kenneth Geers is the author of “Strategic Cyber Security”, Editor of “The Virtual Battlefield: Perspectives on Cyber Warfare”, Technical Expert for the “Tallinn Manual on the International Law Applicable to Cyber Warfare”, and author of more than twenty articles and chapters on cyber conflict. Follow him on Twitter @KennethGeers.

DarkReading

 

« Healthcare CISOs Find Security Vendors Overpromising
Retail Banks Will be Dead Within A Decade »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Conference-Service.com

Conference-Service.com

Conference-Service.com provides a categorised calendar of conferences and events which includes Information Security.

Software Engineering Institute (SEI)

Software Engineering Institute (SEI)

At the CERT Division of SEI we study and solve cybersecurity problems, research security vulnerabilities in software, and develop information and training to help improve cybersecurity.

Snyk

Snyk

Snyk is the leader in developer security. We empower the world’s developers to build secure applications and equip security teams to meet the demands of the digital world.

Bounga Informatics

Bounga Informatics

Bounga Informatics provides Digital Forensics, E-Discovery, and Endpoint Security software, hardware, and training in Singapore and other countries in Asia Pacific.

Appvisory

Appvisory

Appvisory by MediaTest Digital is the leading Mobile Application Management-Software in Europe and enables enterprises to work secure on smartphones and tablets.

Office of the National Security Council (UVNS) - Croatia

Office of the National Security Council (UVNS) - Croatia

UVNS coordinates, harmonizes the adoption and controls the implementation of information security measures and standards in the Republic of Croatia.

AXELOS

AXELOS

AXELOS develops best practice frameworks and methodologies used globally by professionals working primarily in IT management and cyber resilience.

Transmit Security

Transmit Security

The Transmit Security Platform provides a solution for managing identity across applications while maintaining security and usability.

Quantinuum

Quantinuum

Quantinuum is the combination of Cambridge Quantum with Honeywell Quantum Solutions, structured to drive the future of quantum computing.

Pyxsoft PowerWAF

Pyxsoft PowerWAF

Pyxsoft PowerWAF responds to the problem of business cybersecurity. We protect our clients' websites and data against attacks and exploitation of all kinds of vulnerabilities.

SignalSEC

SignalSEC

SignalSEC provides vulnerability intelligence, malware analysis, penetration testing and associated training services.

Gridware

Gridware

Gridware is a specialised cybersecurity consultancy firm and an emerging global player in the cybersecurity intelligence and advisory field.

QAlified

QAlified

QAlified offer independent testing and quality assurance services for software projects including security testing.

Lansafe

Lansafe

Lansafe stands as a leading managed service provider in the UK, seamlessly integrating IT, Telecoms, Security, Electrical and Cyber Security solutions.

Cyber Guards

Cyber Guards

Cyber Guards provide comprehensive, turn-key cyber security programs for small and mid-size business for about the cost of one full-time cybersecurity hire.

BlackSignal Technologies

BlackSignal Technologies

BlackSignal Technologies provides cybersecurity, digital signal processing and electronic warfare products to help DOD and IC agency customers counter near-peer threats and security challenges.