US Cyber Bombs On ISIS Change The Nature Cyber War

US military’s Cyber Command will now run its own aggressive operations as part of the War on Terror, and even augment regular, lethal military strikes with cyber capabilities.

Since its creation in 2009, US Cyber Command has focused its efforts mostly on sophisticated cyber-actors on the world stage, states like Iran, Russia, and North Korea. 

It acts mostly in the new realm of cyber-conflict, in which states can take digital shots at one another without getting too worried about starting a real shooting war. 

But now, the American war on ISIS is blurring the lines between digital and kinetic conflict, opening a new cyber-front in the physical world: For the first time in its short history, the US military’s Cyber Command will now run its own aggressive operations as part of the War on Terror, and even augment regular, lethal military strikes with cyber capabilities.

The announcement came as President Obama prepared to discuss the war on ISIS in Hanover, Germany earlier this week, where he met with world leaders and laid out this new cyber initiative, among others. Deputy Secretary of Defense Robert O. Work has the key quote encapsulating the effort: “We are dropping cyber bombs… We have never done that before.”

Indeed, until now the cyber war on ISIS has been mostly confined to disruption of communications. While ISIS has always been vulnerable to attack online, if only thanks to the youth and modernity of its members, messing with their Twitter accounts simply cannot do the job on its own. If it could, Anonymous would be the most beloved group in the world by now. What we’re talking about here is functionally very different; from diverting ISIS’ troop payment transfers to sending its fighters fake military coordinates, this is cyber as a technical use of military force.

According to Brigham Young professor of law Eric Jensen, there have been basically three major, publicly known cyber-attacks that probably constitute a use of force under international law: Stuxnet, a devastating 2012 attack on the Saudi Aramco oil company, and a recent, rather terrifying attack on Swedish air traffic control. It is possible that this particular cyber-campaign won’t affect that total number of attacks, since ISIS is not a legitimate state. Still, if “cyber bombs” do prove useful against ISIS, we can expect the strategy to continue against real states, as the US rolls out these capabilities to complement attacks in other theaters.

For instance, we don’t currently know if the US attack on Osama Bin Laden’s compound in Pakistan had a cyber component, perhaps taking down the local aircraft tracking systems. If the US launches a similar mission in a few years’ time, the use of cyber weapons to complement real ones will likely be totally routine. Cyber-attacking national infrastructure to support attacks with lethal consequences could change the severity of an otherwise isolated incident, a serious concern with nations already threatening to take cyber incursions as provocative acts of war.

Now, you might wonder what good a “cyber bomb” could do in this case, used against a reasonably modern nation like Iran, sure, but a band of medieval thugs like ISIS? At this point, though, it’s almost impossible to insulate yourself from the effectiveness of cyber war. Al-Qaeda chose to train and sometimes live in literal caves, and yet they still had to use potentially hackable, jam able technology to communicate and coordinate, especially if they were under active attack at the time. Not even the parallel universe of ISIS territory can keep out the modern world to the extent that cyber war becomes ineffective.

ISIS is trying to run a literal war, as opposed to Al-Qaeda’s figurative one, and that means they must hold territory, collect taxes, buy or manufacture supplies, provide (meager) services, and more. There are more than enough points of attack for any cyber warfare outfit, and many of those weaknesses could be debilitating if hit hard enough.

We’ve already seen the effectiveness of blowing up their physical cash shipments with bombs, and now, Cyber Command is messing with their books. ISIS commanders have reportedly become aware that sophisticated hacking is altering their records, we don’t know the details, but this presumably means that the Western attackers are changing the books, rather than deleting them, which would make financial organization all but impossible. Fighters are reportedly deserting the terrorist organization due to low pay, so we should expect some good returns if Cyber Command can make it impossible to get the right amount of pay to the right people, on a regular basis.

Cyber Command will also basically weaponised forum trolling. They’ve already infiltrated some of ISIS’ communications networks with fake identities, hiding or posing as real commanders so they could learn the group’s habits. Now, they hope to exploit this access to distribute false information, like changing the coordinates of a meeting so terrorist leaders drive into a nice open area within easy striking distance of a nearby American drone. At the least, Cyber Command could introduce an element of doubt into every order, or bog ISIS down with unwieldy authentication routines.

The options are virtually endless. They could help shut down a bank to keep it from offloading data right before a missile strike. They could turn off some vital cooling system in a facility so it destroys itself and becomes useless. They could make easy pickings of an ISIS officer by hacking his newer-model car and driving it into a wall. The future of war is going to be very different than the past, and today, the US took a big step toward making that future a reality.
Ein News: http://bit.ly/1SNaqvP

« Disrupting ISIS Online In Africa
Cybersecurity Training For US Undergraduates Is Dismal »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Kaspersky Lab

Kaspersky Lab

Kaspersky Lab is one of the world’s largest privately held vendors of endpoint cybersecurity solutions.

Black Duck Software

Black Duck Software

Black Duck Hub allows organizations to manage open source code security as well as license compliance risks.

Odix

Odix

Odix security software neutralizes file embedded targeted cyber attacks before they enter your organization’s network.

ENEA Qosmos Division

ENEA Qosmos Division

Qosmos, a division of Enea, leads the market for IP traffic classification and network intelligence technology used in physical, SDN and NFV architectures.

Secure Decisions

Secure Decisions

Secure Decisions focus on research and product development related to national security including information assurance, computer network defense, cyber security education, and application security.

Office of the Government Chief Information Officer (OGCIO) - Hong Kong

Office of the Government Chief Information Officer (OGCIO) - Hong Kong

OGCIO supports the development of community-wide information technology infrastructure and setting of technical and professional standards to strengthen Hong Kong’s position as a world digital city.

Infosequre

Infosequre

Infosequre builds up your security awareness culture and turns your employees into the first line of defense against cyber risks.

3wSecurity

3wSecurity

3wSecurity provides visibility to your company’s internet facing systems throughout the security life cycle, allowing for a more thorough approach to vulnerability management.

DeepSeas

DeepSeas

DeepSeas is the result of a merger between Security On-Demand (SOD) and the commercial Managed Threat Services (MTS) business of Booz Allen Hamilton.

Stanley Reid & Company (SRC)

Stanley Reid & Company (SRC)

Stanley Reid & Co is an Executive and Technical Search Firm serving the commercial market and the US Intelligence & Defense community. Our areas of expertise include Cybersecurity.

Virtue Security

Virtue Security

Virtue Security are specialists in web application penetration testing.

MalwareFox

MalwareFox

MalwareFox is an advanced, yet simple-to-use anti-malware solution for Windows computers. We provide aggressive detection capabilities and an effective malware removal tool to keep your systems safe.

CY4GATE

CY4GATE

CY4GATE was conceived to design, develop and produce technologies and products that are able to meet the most stringent and modern requirements of Cyber Intelligence & Cyber Security.

Exceed Cybersecurity & I.T. Services

Exceed Cybersecurity & I.T. Services

Exceed Cybersecurity & I.T. Services is a premier Managed Internet Technology (I.T.) company with a focus in cybersecurity risk management and CMMC compliance management.

Data Protection Commission (DPC)

Data Protection Commission (DPC)

The Data Protection Commission (DPC) is the national independent authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected.

AgilePQ

AgilePQ

AgilePQ visibly secures IoT devices worldwide to protect the privacy, safety, and well-being of all people.